Forward mDns from one subnet to another

As you mentioned, the environment variables are removed by sudo, for security reasons.

But fortunately sudo is quite configurable: you can tell it precisely which environment variables you want to keep thanks to the env_keep configuration option in /etc/sudoers.

For agent forwarding, you need to keep the SSH_AUTH_SOCK environment variable. To do so, simply edit your /etc/sudoers configuration file (always using visudo) and set the env_keep option to the appropriate users. If you want this option to be set for all users, use the Defaults line like this:

Defaults    env_keep+=SSH_AUTH_SOCK

man sudoers for more details.

You should now be able to do something like this (provided user1's public key is present in ~/.ssh/authorized_keys in user1@serverA and user2@serverB, and serverA's /etc/sudoers file is setup as indicated above):

user1@mymachine> eval `ssh-agent`  # starts ssh-agent
user1@mymachine> ssh-add           # add user1's key to agent (requires pwd)
user1@mymachine> ssh -A serverA    # no pwd required + agent forwarding activated
user1@serverA> sudo su - user2     # sudo keeps agent forwarding active :-)
user2@serverA> ssh serverB         # goto user2@serverB w/o typing pwd again...
user2@serverB>                     # ...because forwarding still works

Although you can do “wide-area Bonjour” (that is, Bonjour over an ordinary DNS domain with dynamic registration enabled, rather than Bonjour over multicast DNS), most built-in Mac OS X stuff isn’t designed for using it — principally because wide-area Bonjour is designed for advertising services over something more diverse than just a couple of subnets.

Theoretically, though, you could configure a router to pass packets bound for the multicast group 224.0.0.251 between your two subnets, which should do the right thing — assuming you don’t have NAT involved. Whether and how you can do this depends on the type of router you have sitting between the wireless and wired networks.