I am trying to give some one on internet access to one specific IP on my machine which is on LAN behind a Bastion host and the authentication should not be twice only one time.
So I am trying to have some thing that runs on my bastion host or you can call it as a gateway and it redirects the incoming SSH to a machine on LAN but it should not be a two times authentication only once.
The user should not know that they first logged in to bastion host and then they are redirected to some other IP on LAN.This using a web interface so that if they are behind some proxy or firewall they do not need to bother at least they always have http access.My gateway has public IP but only port 22 is opened by ISP .Is there any software or mechanism to do so I came across one
http://www.webos-internals.org/wiki/Ajaxterm
but it is pretty slow.

You can set up a tunnel on the computer inside the firewall. I just added to the "TIPS" section of my tunnel article how to set it up for a single authentication. See http://www.wikihow.com/Tunnel-Through-a-Firewall