Netcat tunnel
If your sshd config disallows listening to remote ports, you can accomplish about the same thing using nc and ssh.
Typical error message when remote listening is disallowed: <geshi lang="bash"> $ ssh -R 18080:thirdhost:8080 remotehost cat - Warning: remote port forwarding failed for listen port 18080 </geshi>
To work around this, you can use netcat and mkfifo to create a tunnel.
<geshi lang="bash"> mkfifo x while true; do ssh remotehost nc -l -p 8081 -c <x | nc -c thirdhost 8081 >x; done </geshi>
Then on the remote host, you can access the third host via the local tunnel.
Unfortunately, this approach is limited to a single connection at a time, and also, there is a slight delay after each socket is closed. Another issue is that it's easy to leave orphan processes on the remote host.