We use a reverse SSH tunnel:

nated-host$ ssh -R 2222:localhost:22 anyuser@public-host
anyuser@public-host$

This command opens 2222 port on public-host, forwarding it to local 22 port on nated-host.

Finally, from public-host we connect to 2222 local port with SSH, to end on nated-host:

public-host$ ssh -p2222 localhost
nated-host$

References:

• man ssh
• http://articles.techrepublic.com.com/5100-10878_11-5779944.html?tag=nl.e011
• http://www.howtoforge.com/reverse-ssh-tunneling