Tunnel from work to home, and make a tunnel that allows you to connect from home..
A is at work, B is at home. You want to connect from B to A, but firewall blocks it.
Instead, connect from A to B creating a tunnel back in to the server. This assumes you have an ssh server running at home and have opened port 22 on your router. If your home machine is Mac or Linux you probably have it running; if windows, install cygwin and set up sshd (link).
At work, put this in your .ssh/config file:
hostname B # replace with your FQDN or IP
user homeuser # user at home
LocalForward 2222 localhost:22
Now, when you run 'ssh home', port 2222 will be a tunnel in to your local machine's ssh server. I find if you just leave this sitting at a prompt in some window, the connection may become hung occasionally, or the filewall may close it after a while. I prefer to use a command like
while true; do ssh -n home sleep 600; sleep 3000; done &
This will start a tunnel that lasts ten minutes, closes, then start another the next hour. If there are tunneled connections, when the sleep is finished the ssh command waits for them to finish.
(sleep 3000 is not necessary; you can keep it open all the time, it's just some enterprises don't like seeing frequent or long lived persistent connections to outside machines)
Now, on the home side, put this in your .ssh/config file:
Save it, and then when the tunnel is up on your home machine you can just type
and you're in.
The UserKnownHostsFile line is not necessary, but it prevents warnings when you use
multiple tunnels with different ports for different hosts, so the localhost entry in the default known_hosts file won't match all those hosts.
You can add multiple LocalForward lines to the config file on A; e.g.
LocalForward 2223 server2:22 # another server with ssh
LocalForward 5900 qa:5900 # vnc
LocalForward 3389 exchange:3389 # remote desktop
LocalForward 3128 internalProxy:3128 # for surfing internal hosts
(For tunneling X connections, use 'ssh -X', not LocalForward.)
No changing of ssh server port numbers is required here.
Note this kind of remote access may be against your company's policies. Some places scan or audit these kind of connections, and may give you a warning about this. You can run the tunnel command for five minutes, sleep for 55; or have a script on the home machine that exits immediately when you don't need the tunnel. Logmein is another free solution that works nicely to allow remote access to (windows, mac) desktops behind firewalls