Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Imagine the following situation:

I do not have direct SSH access to Server-A due to IP filtering restrictions. To access the server (from windows using putty), I first connect to Server-B, which has a white listed IP address, and from there SSH into Server-C, and then SSH from there to Server-A (I know that sounds insane, but unfortunately I do not have rights to change the IP filtering restrictions). Is there a way using putty/winscp/anything else to download a file from Server-A to my local PC?

share|improve this question
up vote 3 down vote accepted

Use port forwarding. WinSCP, for example, has an option to create a connection through a ssh tunnel and it uses port forwarding. Still, since you need to tunnel through two hops, you cannot use it.

I would propably first create a ssh connection to server-B which has a tunnel to server-C. You could use plink.exe for this (part of putty):

plink.exe -l username_on_server_B -L 8888:server-C:22 server-B

Now you can create a second tunnel, using a ssh connection to server-B, which leads to server-A (in a second cmd.exe shell):

plink.exe -l username_on_server_C -L 8889:server-A:22 -P 8888 localhost

After this, you should be able to connect to server-A using WinSCP. Instead of server-A, you connect to localhost port 8889, which will be tunneled to server-A.

This is untested but it should work I think.

share|improve this answer

The easiest way without chains:

  1. download file from Server-A to Server-C using scp
  2. download file from Server-C to Server-B using scp
  3. download file from Server-B to local PC using WinSCP
share|improve this answer

WinSCP has support for SSH tunneling. To enable it:

  • Click on "Advanced options" check box.
  • in the configuration tree click on "Connection/Tunnel" and here add the intermediate hop server.
  • in the configuration tree click on "Session" and configure the destination server. Save the session for later user by clicking "Save..."

You can chain the rest of connections using ssh tunneling. See the option -L for openssh: ssh -L 1234:remote_host:22 user@intermediate_hop. Then you can connect on remote_host ssh by using localhost:1234 on the intermediate_hop.

share|improve this answer
He has two intermediate hops. Does WinSCP really provide this? – Moritz Both Jun 28 '11 at 13:26
No, WinSCP can use only one tunnel. But he can use another tunnel besides one provided by WinSCP. – Mircea Vutcovici Jun 28 '11 at 13:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.