Trouble setting up a simple SSH VPN to bypass a firewall

I have a small test network composed of two LANs connected via a firewall, with Linux hosts(containers). This firewall is set up to block certain websites from being accesed from within the B LAN, and as such I want to check out ways of bypassing said firewall.

For this, I know that both A and B are SSH servers (which allow root login, tunneling etc. for testing purposes), and moreover that A has set up a NAT server so that it can look up websites and such for other hosts.

So far, I have set up B as a VPN client, and A as a VPN server, with the following command, which sets up both the tunnel and the tun interfaces on each side, with addresses A_tun0_address and B_tun0_address:

root@B:/# ssh -w 0:0 root@A \
       -o "PermitLocalCommand=yes" \
       -o "LocalCommand= ip addr add B_tun0_address/24 dev tun0 && \
       ip link set tun0 up" \
       -o "RemoteCommand=ip addr add A_tun0_address/24 dev tun0 && \
       ip link set tun0 up"```

Now, let's say that I want to access a blocked website from B1, for this I would want to use the tunnel set up on B...but how? Should I redirect traffic to B_tun0_address somehow? I do not know what should be the steps from here.

Note:

This should be the equivalent of doing dynamic port forwarding, such as ssh -4NT -D <B’s IP>:<B’s port X> <user id>@<A’s IP> from B and then using B as a socks5 proxy, but the point would be doing this only with a VPN.

Edit 1:

As per @tsc_chazz comment's, I have set up the following iptables rules on B to do a dNAT:

    iptables -t nat -A PREROUTING -s 192.168.20.0/24 ! -d 192.168.20.0/24 -j DNAT --to-destination B_run0_address
    iptables -t nat -A POSTROUTING -j MASQUERADE

Also, on A, I made it masquerade traffic too:

    iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0

And then, on B1, I set up B as the default gateway for simplicity:

    ip route del default
    route add default gw 192.168.20.99

Now, I have noticed in Wireshark that, misteriously, after setting the default route for B1, the traffic just hops from that host to the destination directly, whatever the destination. I suspect that VirtualBox may be doing funky stuff so I'm not sure if that's correct.

Example, showing a Wireshark trace for a traceroute:

There would seem to be two pieces to this. The first is that B needs to be set up to forward incoming network traffic from 192.168.20.0/24, destined for anywhere outside 192.168.20.0/24, to B_tun0_address which should then result in it being forwarded to A, and from there to the Internet. With that done, all you should need to do is set a static route in B1 that sends traffic to 192.168.20.99, if it's destined either for the specific website, or for everywhere - in which case you'd set 192.168.20.99 as the default gateway.

If B is already your default gateway for the 192,168.20.0/24 network, you will have to implement filtering rules in your firewall - you do have a firewall in B, no? - to prevent any machine except B1 from seeing anything outside the 10.8.0.0/24 network.