I am currently setting up my Linux system to make some daily tasks easier. I'd like to configure my SSH to be able to jump hosts using the terminal. I read about LocalForward as well as ProxyJump. The goal is to connect to the first server, tunnel the connection over it and then connect to the second server (as the second server is in a zone I can only reach from the first server).

Now what I did was the following snippet inside my ~/.ssh/config file:

Host tunnel
    HostName <firstServer>
    IdentityFile ~/.ssh/example.key
    LocalForward 9906 <secondServer>:22
    User helloWorld

If I now connect to the server using "ssh tunnel" I can successfully connect to the first server. If I now use telnet to check on the second server using "telnet secondServer 9906" I can see that SSH is running on it. If I now try to SSH into the second server using "ssh localhost:9906" I get the information that the hostname couldn't be resolved (same thing for

Afterwards I read about the option "ProxyJump" and tried the following:

Host tunnel
    HostName <firstServer>
    ProxyJump <secondServer>:22
    User helloWorld

However, the connection never goes through. It gets stuck on "connection to ".

Am I missing something obvious here? Maybe I misunderstand the basic concept of the whole SSH forwarding thing? I am used to using Putty but I recently made the jump to Linux and would like to set everything up appropriately.

2 Answers 2


This ~/.ssh/config will ProxyJump through jump to the target, and bind a port all the way to target:

Host jump
  HostName      <server-ip>
  User          user-name
  IdentityFile  ~/.ssh/key.pem
  LocalForward  8888 localhost:8888
Host target
  HostName      <server-ip>
  User          user-name
  IdentityFile  ~/.ssh/key.pem
  ProxyJump     jump
  LocalForward  8888 localhost:8888


  • ssh target
  • ssh -v target # see verbose debugging
  • 0

    We use this oneliner in our teams:

    $ ssh zone_user@zone_host -o ProxyCommand="ssh -W %h:%p proxy_user@proxy_host"


    1. Make sure both proxy_user@proxy_host and zone_user@zone_host have your private key in ~/.ssh/authorized_keys.
    2. You don't have to allocate and "tunnel" extra ports to forward SSH over SSH.
    3. I'd not recommend to fiddle too much with ~/.ssh/config, it's error-prone and not documentation-friendly. Better share oneliners just like the one above.


    • 2
      3) more error prone than the command line? its a simple enough format Jan 16, 2018 at 19:31

    You must log in to answer this question.

    Not the answer you're looking for? Browse other questions tagged .