so my network layou is something like this

(I don't have enough reputation to post images so here's the link)

http://i.imgur.com/OaD4i.png

now Alice has access to SSH gateway (just gateway from now on) with:

ssh [email protected]

and the authorized keys file on the gateway looks like this

#/home/Alice/.ssh/authorized_keys
command="ssh -t alice@web" ssh-rsa ABCD...E== alice@somehost

so when Alice trys to connect to the Gateway with her private key, she actually gets connected to the Web server (the gateway pc can make a connection to the web server with a passwordless private key, so that stays transparent).

The question

1) How can I set this up so that Alice will be able to scp things to web server too?

2) I know this makes a separete connection, but is there any way for this to work as a normal ssh so that even something like -R12345:localhost:22 would work?