open up two terminal tabs. in the first tab:
run the following to view the system log. this is a good rule of thumb when trying to troubleshoot.
sudo tail -f /var/log/syslog
in the second tab:
try to connect to your ssh server using your command and configure your browser to use a SOCKS5 proxy at 127.0.0.1:9999. you should see from the syslog that the traffic is getting dropped.
the firewall rules in TAILS are built using ferm, and the policy is defined in /etc/ferm/ferm.conf. to punch a hole in the firewall for your desired port, run this:
sudo sed -i 's/(9050 9061 9062 9150)/(9050 9061 9062 9150 9999)/g' /etc/ferm/ferm.conf
essentially we're allowing traffic at port 9999. now, reload ferm with:
sudo /usr/sbin/ferm /etc/ferm/ferm.conf
re-connect to your ssh server and you should see that your traffic no longer gets dropped.
i also recommend you add the following options to your ssh command:
-o ExitOnForwardFailure=yes ServerAliveInterval=120
these essentially do what they look like.
also, the changes to the firewall are temporary, and will be lost on reboot. however, it would be prudent to close the port once you've ended your ssh session. to do this, execute:
sudo sed -i 's/(9050 9061 9062 9150 9999)/(9050 9061 9062 9150)/g' /etc/ferm/ferm.conf
writing a shell script to automate this will make it less tedious. if you go this route, you should code the firewall reset commands using an exit trap:
tails relevant linkies: