I have three Computers.

PC1 and PC2 is on a private LAN, where PC1 is known to PC2 as

PC2 and PC3 is on a another LAN, where PC2 is known to PC3 as

How can I connect to PC1 from PC3 with SSH.

Is there something like:

ssh user@ -via user@
ssh -o 'ProxyCommand ssh -W %h:%p user@'

Then you can simply run ssh PC1.

Best used through an alias in ~/.ssh/config:

Host PC1
User user
ProxyCommand ssh -W %h:%p user@

For older versions of OpenSSH that don't have the -W option (I think this means ≤5.4), make sure that netcat is available on PC2 and use

Host PC1
User user
ProxyCommand ssh user@ nc %h %p

Using SSH there is a clear solution:

  1. on your local machine set up your ~/.ssh/config such that it has the following:

    host WhatYouWillCallTheConnection
        hostname the.gateway.server.address.com
        user YourUsernameOnTheGateway
  2. On both the gateway and the end server you'd like to connect to, make sure that you have your local client's public keys located in the ~/.ssh/authorized_keys

  3. On the gateway machine you need to alter the ~/.ssh/authorized_keys such that at the beginning of the line that specifies your client's public key, add the forced command as follows:

    command="ssh -A user_name@ServerTheGatewaySees.ButTheClientCant.net" ...yourPublicKey....

The -A is to forward the agent if you don't like to send passwords all the time...

This way, anytime you do something like ssh WhatYouWillCallTheConnection it will run straight through the gateway and connect you to the server on the other side transparently.

  • 2
    Don't use ssh -A if you don't trust the administrator of the gateway machine. He can't get your private key, but as long as you're connected to the gateway with ssh -A, he can use the forwarded agent to connect to other machines as you. – Jander Oct 15 '11 at 6:44

Port Forwarding might come in handy.
From PC1:

~# ssh -fN -L 22:PC3:7777 -l <user> PC2  

7777 can be just any port (provided it is not already being used). I just like that number, plus any "ordering up" I can manage by +1 's (7778, 7779, etc, etc).

This being done, you will have a 'transparent' tunnel from PC1's local port 7777 to PC3's port 22. Just issue:

~# ssh -l <user> -p 7777 localhost  

And you should be on PC3.
You can also use -D to dynamically forward a port if you want a SOCKS proxy established.

~# ssh -D <someport> -fN -L 22:PC3:7777 -l <user> PC2  



The 2017+(since v7.3)-answer to this is ProxyJump:

ssh -J user@jumphost user@destination

, which is short for:

ssh -o "ProxyJump user@jumphost" user@destination

This can be shortened to ssh dest with a ~/.ssh/config snippet as such:

Host jump
    User MyJumpHostUser
    Hostname Jump.host.tld

Host dest
    ProxyJump jump
    User MyDestUser
    Hostname des.tin.ati.on

The only solution I know for this is ssh scripting with Belier:

Belier allows opening a shell or executing a command on a remote computer through a SSH connection. The main feature of Belier is its ability to cross several intermediate computers before realizing the job.

A while ago I found this README.sshhop on the MIT Lincoln Laboratory Homepage, but I wasn't able to find any further information about that. Does somebody know more?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.