Set “GatewayPorts yes” in /etc/ssh/sshd_config on the server.
On client (behind NAT):
ssh -R 6333:localhost:22 server_user@server
Leave this connection open.
On server (public accessible):
ssh client_user@localhost -p 6333
Now the server is connected to the client.
On client type the following
ssh -f user@server -L 2000:server:25 -N
It will make it possible to connect to port 25 on the server via port 2000 on the client.
Removing '-f' will stop ssh from going to the background.