My situation :

Me(localhost) -> Server A(ip: =>(server B(ip:,server....)

i'm able to SSH into server since it has a true ip if i then want to connect to server b, i would ssh server b with it's ip(


from my pc:

ssh [email protected]

then in,

ssh [email protected]

this would get me to server B with ssh

what if i want to connect to server b directly? how can i do that?


from my oc:

[email protected]

i have tried the following:

ssh -L 22:localhost:22 [email protected]

without success

6 Answers 6


Your problem is in binding a listener to localhost:22; there's already an sshd listening on that. Tunnelling an ssh connection through an ssh connection is completely lawful, and I do it all the time, but you need to pick unused ports for your forwarding listeners.


me% ssh [email protected] -L 2201:


me% ssh localhost -p 2201

You should end up on server B (unless something's already bound to me:2201, in which case, pick another port).

  • thanks for the quick reply! it does work, however, how i can forward all connections instead of only ssh(22)?
    – tom91136
    Dec 15, 2011 at 12:00
  • 1
    That's a full-blown VPN you're looking for, not just port-forwarding. There's a writeup on how to do vpn-over-ssh at bodhizazen.net/Tutorials/VPN-Over-SSH , but it requires remote root access via ssh on A. Or you could look into OpenVPN or other VPN solutions, but again, you'll need privilege on A to make these work.
    – MadHatter
    Dec 15, 2011 at 12:06
  • thanks a lot, one last thing, what if i only want to connect to A?
    – tom91136
    Dec 15, 2011 at 12:12
  • me% ssh [email protected] ; didn't we already cover that? or do you mean "what if I want a full-blown VPN to A?", in which case my answer stands.
    – MadHatter
    Dec 15, 2011 at 12:19
  • 1
    For people who want VPN over SSH, don't have root access on the server but it does have Python, try sshuttle. Dec 15, 2011 at 15:50

You don't have to use ssh port forwarding to ssh into an internal computer through a proxy. You can use the ssh feature of executing a command on the first server you connect to in order to ssh into a 3rd computer.

ssh -t [email protected] ssh [email protected]

The -t option forces ssh to allocate a pseudo-tty so you can run an interactive command.

This can work with ssh keys as well. If you have your private and public key on machine A and your public key in the authorized keys files on machines B and C, then you can use the -A option to forward the authentication agent connection.

  • 3
    Use -A with caution and only if the jump host is fully trusted. A safer and simpler alternative is to use ssh -J jumphost destination if the -J option is available.
    – coldfix
    Aug 10, 2020 at 16:01

As of OpenSSH 7.3 (late 2016) the easiest way is the ProxyJump setting. In your ~/.ssh/config:

Host B
  ProxyJump A

Or on the command line, -J B.


I used a different solution. I used a ProxyCommand option (here in ~/.ssh/config):

Host myinsidehost1 myinsidehost2 myinsidehost3
ProxyCommand ssh externalhost ssh %h sshd -i

This doesn't set up any port-to-port tunnel, instead tunnels ssh by using standard stdin/out. This method has a drawback that there are actually three ssh connections to authenticate. But to connect to the internal host you just type:

ssh myinsidehost2

...so you do not need to care about choosing any IP for that tunnel.

  • 1
    This is the only kind of SSH stacking that I find working. I've been tried corkscrew or nc (netcat) but none work as seamlessly as this. Sep 16, 2014 at 16:38

according to the ssh man page, ProxyCommand is the correct method

the syntax being:

ProxyCommand ssh -W %h:%p user@jumphost 2> /dev/null
  • I am not sure the -W option existed when this question was answered. But with newer versions of the ssh client, I agree that the combination of ProxyCommand and -W is the preferred method. Maybe add some context showing both how it can be used on the command line as well as an example of a section for .ssh/config.
    – kasperd
    Jul 21, 2015 at 8:18
  • Any idea where to find the changelogs/version info that tells us which versions of SSH have the -W command and which don't? A bit of googling did not yield answers quickly for me...
    – dmh
    Aug 1, 2017 at 13:01
  • -W got introduced with OpenSSH 5.4, released in 2010. So the answer is yes @kasperd Mar 27, 2018 at 19:59

While ProxyJump has already been mentioned, it's most useful for static hosts you keep connecting to. If the machines keep changing, it's much easier to use -J (jump host) command line argument:

Once you know what it's doing, the syntax is pretty straightforward:

ssh -J [email protected] [email protected]

The above command establishes a connection to as user1, then from there "jumps" to as user2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .