I have an entry in ~/.ssh/config on my computer at home that look like this:

host foo bar
    ProxyCommand ssh -x -a -q gateway.example.com nc %h 22

where gateway.example.com is a server at work that is connected to both the public Internet and an internal network. The gateway box resolves foo and bar using entries in /etc/hosts.

My problem is that I need to reach a box that is on the other side of foo. Let's call it "baz". The "baz" host is on another private network that foo is connected to, but not the one that "gateway" is connected to.

I've tried using this:

host baz
    ProxyCommand ssh -x -a -q gateway/example.com ssh foo nc %h 22

But that doesn't work, and I'm a little out of my depth. How do I do this?

I don't think it should matter, but I'm doing this in Ubuntu 10.



Assume the following network setup:

example network setup

You should be able to use a ~/.ssh/config file that looks something like this:

host foo bar
    ProxyCommand ssh -x -a -q gateway.example.com nc %h 22

host baz
    ProxyCommand ssh -x -a -q foo nc %h 22

The idea here is that your SSH does know how to get to "foo", so an SSH there will succeed. And from there, you can "nc" to baz. And if there are other hosts on the internal private network alongside "baz", you can just add them to the "host baz" line.

This basically treats the host "foo" as the gateway to "baz", just as "gateway" is the gateway to "foo".


| improve this answer | |

Regarding ghoti's answer: instead of using netcat ("ssh ... nc %h 22"), starting with OpenSSH 5.4, you can do this directly with: "ssh -W %h:22 ...". This way, you don't have to worry about whether netcat is installed in the right place.

| improve this answer | |
  • 1
    Great point, thanks. This is an old question, but I might as well clarify that while I was running Ubuntu on my workstation, the server "gateway" was an old Busybox Linux with OpenSSH 5.3, and the servers "foo" and "baz" were FreeBSD (OpenSSH 5.4). So I would have needed at least one netcat anyway. – Graham Oct 6 '15 at 20:56
  • @Graham No. It's only the client which need to be 5.4 or greater for -W to work. It relies on port forwarding code on the server side, which is much older. – kasperd May 1 '16 at 17:43

Using private keys stored on your local computer, enter this command with the private keypaths, shell usernames, and hostnames/IP addresses changed to your local->gateway->destination ssh needs.

Note that ProxyCommand is preferred over Agent Forwarding to mitigate the risk of compromising private key authentication (using the gateway and local ssh agent connection to compromise further hosts as if the hijacker had the private key) when a gateway/jumperbox is root-hijacked.

Single Command To Proxy SSH to a Server (keep both private keys on local computer):

sudo ssh -i dest_private_key.pem -o "ProxyCommand ssh -W %h:%p -i gate_private_key.pem gate_user@gate_IP" dest_user@dest_IP 
| improve this answer | |

This is what I do to hop out of protected network to Internet.

I'm using my laptop to work with code at build. Since build is restricted from Internet-access, to clone a repo from github.com, I first need to jump into toolbox, which doesn't have Internet-access either. But it can access gw, which has Internet.

Like this:

SSH jumping schematic

My .ssh/config on build:

Host gw
  ProxyCommand ssh -A -W %h:%p toolbox

Host github.com
  ProxyCommand ssh -A -W %h:%p gw


  1. The point-of-view is from build. There are no configurations on other servers.
  2. First, I declare, that to get to gw you need to do that via toolbox.
  3. Second, I declare, that to get to github.com, you need to do that via gw. Internally SSH uses the previous rule.
  4. Ultimately, git clone git@github.com:aRepo/There just works!


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.