In your current configuration, you'd be attempting to stack SOCKS5 over SOCKS5 which would be very difficult to use.
Since 192.168.2.2 will be able to reach and resolve correctly the webserver, that's the one which should keep the DynamicForward (
-D) option. You can use a classic LocalForward (
-L) to reach it.
This should work, but wouldn't be the best with regard to security: a 3rd party having access to 192.168.1.2 could then use your SOCKS5 entry point too. Don't use it:
ssh -tt -L 10100:localhost:10101 firstname.lastname@example.org ssh -D 10101 email@example.com
Since there's no need to leave the DynamicForward tunnel entry point on 192.168.1.2, better have the LocalForward tunnel be used to reach the 2nd host's ssh port, from the initial client. This will allow the intended DynamicForward configuration to be moved to the local client.
ssh -L 2222:192.168.2.2:22 firstname.lastname@example.org
term2 (still on the initial client):
ssh -D 10100 -p 2222 user1@localhost
Actually this can be simplified using ProxyJump (
-J), if available. This will handle under the hood the first port forward to 192.168.2.2's ssh server, removing the need of LocalForward at all:
ssh -D 10100 -J email@example.com firstname.lastname@example.org