Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an entry in ~/.ssh/config on my computer at home that look like this:

host foo bar
    ProxyCommand ssh -x -a -q gateway.example.com nc %h 22

where gateway.example.com is a server at work that is connected to both the public Internet and an internal network. The gateway box resolves foo and bar using entries in /etc/hosts.

My problem is that I need to reach a box that is on the other side of foo. Let's call it "baz". The "baz" host is on another private network that foo is connected to, but not the one that "gateway" is connected to.

I've tried using this:

host baz
    ProxyCommand ssh -x -a -q gateway/example.com ssh foo nc %h 22

But that doesn't work, and I'm a little out of my depth. How do I do this?

I don't think it should matter, but I'm doing this in Ubuntu 10.

share|improve this question

migrated from stackoverflow.com Mar 10 '12 at 9:26

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 6 down vote accepted


Assume the following network setup:

example network setup

You should be able to use a ~/.ssh/config file that looks something like this:

host foo bar
    ProxyCommand ssh -x -a -q gateway.example.com nc %h 22

host baz
    ProxyCommand ssh -x -a -q foo nc %h 22

The idea here is that your SSH does know how to get to "foo", so an SSH there will succeed. And from there, you can "nc" to baz. And if there are other hosts on the internal private network alongside "baz", you can just add them to the "host baz" line.

This basically treats the host "foo" as the gateway to "baz", just as "gateway" is the gateway to "foo".


share|improve this answer
So simple! Thanks ghoti! –  Graham Mar 9 '12 at 14:28

Regarding ghoti's answer: instead of using netcat ("ssh ... nc %h 22"), starting with OpenSSH 5.4, you can do this directly with: "ssh -W %h:22 ...". This way, you don't have to worry about whether netcat is installed in the right place.

[Note: there appears to be no way for me to comment on ghoti's answer, merely post another of my own? That's confusing. Am I missing something?]

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.