The SSH protocol has the ability to forward arbitrary network connections over your encrypted SSH connection. WinSCP can use the ability to allow you to connect to a server (Server B) that cannot be reached directly from your working station, but can be accessed indirectly from another station (Server A) that can be reached. It does that by first opening SSH connection to the Server A, asking it to open forwarded connection to Server B.

Forwarded connection is supported for SFTP and SCP protocols only. It is not supported for FTP yet.

WinSCP also opens local listening port on your working station, that works as a tunnel to Server B via Server A. It can be used by any other TCP/IP application to reach Server B.

To configure connection to be tunneled, use Tunnel tab of Login dialog.