Eu encontrei a resposta
SOCKS proxy via an Intermediate Host
If you want to open a SOCKS proxy via an intermediate host, it is possible:
$ ssh -L 8001:localhost:8002 [email protected] -t ssh -D 8002 [email protected]
The client will see a SOCKS proxy on port 8001 on the local host, which is actually a connection to machine1 and traffic will ultimately enter and leave the net through machine2. Port 8001 on the local host connects to port 8002 on machine1 which is a SOCKS proxy to machine2. The port numbers can be chosen to be whatever you needed, but forwarding privileged ports still requires root privileges.
Então, no meu caso, usei:
ssh -L 6000:localhost:6001 -p 9000 admin@ip
ssh -D 6001 -p 6666 localhost -l username -N