If you don’t have firewall access to a specific server on a subnet, you can use ssh tunnelling to forward requests from an existing host.
Find a server you do have access to and create the ssh tunnel as below, where destinationhost is the server you ultimately want to access and jumphost is the server you have access to:
destinationhost# ssh -L22033:localhost:22033 -R22033:10.220.112.173:670 -N jumphost
jumphost# ssh -p22033 userid@localhost
You may need to add a hostfile entry for jumphost