I have a similar (even more complex) case recently and managed to solve the problem.
The short answer: use
ProxyCommand instead of agent forwarding.
The long story:
In my case four hosts are involved:
- Linux desktop in my office
- Linux VPN server somewhere on the Internet
- Linux home server in my apartment
- Linux laptop in my apartment
The router in my apartment gets no public address from the ISP, so home laptop and home servers are both behind double-NAT, no way I can do port forwarding or something because I cannot control ISP devices. For some reason, the home server is always connected to a VPN server with public address. This way I can
ssh -A into the VPN server, and
ssh -A into home server and finally
ssh into my home laptop.
But sometimes I need to transfer files. I do not want to
scp multiple times hop by hop.
ProxyCommand comes to rescue. Put these in the
# Host A is a VPN gateway with public address.
# Host B is a home server / gateway with no public address.
# It's connected to host A via VPN.
ProxyCommand ssh -W %h:%p a.example.org
# Host C is my home laptop.
ProxyCommand ssh -W %h:%p b.example.org
# vim: ft=sshconfig:
This could be indefinitely chained. You can keep chaining host D, host E, etc as long as your hosts have fast connections. There is no need to do
ssh -L or
ssh -D hop by hop manually and connect through non-standard ports. I can now do
ssh c.example.org directly from anywhere as long as I can connect to
a.example.org. Of course other SSH-based protocols like Rsync, SCP, SFTP, etc are automatically supported.