Is this setup possible:
isp -> tunnel-1 -> tunnel-2 -> destination
tunnel-2 will be exit IP, but in the "tunnel-1" containter. So ISP should only see traffic from tunnel-1. The programs used should be putty and chrome.
yes it is possible. it seems reasonable to connect a tunnel from the customer premises to the tunnel1 source interface, in which case the isp couldn't see anything at all except a single encrypted tunnel with data passing across it. they can probably tell alot from signal timeing, size, etc, but they couldn't see any data in the tunnel packet.