You can set up ssh to forward via a visible host behind the firewall. The following example illustrates (“remote” being my home machine, and cslin189 the one on my desk in ECS, which can't be seen from off campus):

[logon@remote ~]$ ssh -f remoteusername@cslin-gps.leeds.ac.uk -L 9999:cslin189:22 sleep +1d
[logon@remote ~]$ ssh remoteusername@localhost -p 9999
Last login: Thu Dec 11 12:03:04 2008
[logon@cslin189 ~]$

The first command effectively says “when I try to connect to port 9999 on my local machine, forward everything to cslin189 port 22 via cslin-gps”. So replace “cslin189” with whichever host you like. The “sleep +1d” will keep the forwarding connection open for a day. You can adjust to suit. 'scp' is done like this:

[logon@remote ~]$ scp -P 9999 remoteusername@localhost:file file