Probably the -i works because when you boot up your system and rc.local will be executed, I think it will be done as root, and that is not where the keys are stored, so the "-i" Lars proposed do add some weight.
The ssh commands after each other will not be run nested, but in sequence. The "&" will spawn the process to the background so that you don't have to wait for it to return ... which it shouldn't since the tunnel should be up as long as your computer is up ... What you could do for troubleshooting purposes you can add temporarily add debug info to your ssh connections like
That should redirect all normal output (which is verbose thanks to the -v) to the file /tmp/normal.out and all errors to ... error.out
ssh -v -i keys -L 8000:net1:8001 user2@net2 > /tmp/normal.out 2> /tmp/error.out &
That should provide clues about ssh actually being started and what it is doing while you don't have any sight on it.