SSH Reverse Tunneling

Remote host that listens on localhost:2211:

nohup $(which sshd) -D -f /dev/null -o HostKey=~/.ssh/host_ed25519 -o Port=2211 -o PermitRootLogin=no -o PubkeyAuthentication=yes -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no -o ClientAliveInterval=60 -o ClientAliveCountMax=3 > /dev/null 2>&1 & disown
~/.ssh/config
Host *
  ServerAliveInterval 60
  ServerAliveCountMax 3
ssh -fN -R 2222:localhost:2211 -p 2345 middle_user@example.com

Middle-man that listens on example.com:2345:

/etc/ssh/sshd_config
GatewayPorts yes
ClientAliveInterval 60
ClientAliveCountMax 3

Client that can access the middle-man through LAN:

ssh -p 2222 remote_user@192.168.0.111