IPv6 Tunnel
It's fairly easy to set up an IPv6 tunnel on a WLAN-connected notebook 2 hops away from the DSL line, see http://tunnelbroker.net for details.
But this will also bypass the router's firewall leading to public access for example to local ssh and apache on the IPv6 address.
So I stopped the tunnel and will now set up a VM appliance for further tests before the router is capable of IPv6 tunneling.
SSH Tunnel in the Background
If you want to put a backdoor^H^H^H^H^H^H^H^Hssh tunnel in the background, just use the option f for background usage and N for no commands, just port forwarding.
ssh -f -N -R XXXX:localhost:22 REMOTE_HOST
Now you can use port XXXX on the REMOTE_HOST to connect to the system that executes the tunnel.
This is just my solution for using an open port on a 24/7 VPS REMOTE_HOST (Virtual Private Server) to connect to a system, connected by UMTS with NATted internet access.
No, the UMTS connection provides no possibility to configure port forwarding like you can do on your DSL router.
The usual key-based authentication will assure password-less setup of this tunnel.