The previous answers mention how to use the ProxyJump directive (added in OpenSSH 7.3) to connect through an intermediate server (usually referred to as the bastion host), but mention it just as a command line argument.
Unless it is a machine you won't be connecting in the future, the best thing is that you configure it on
I would put a file like:
If you are using an earlier version of OpenSSH which doesn't support ProxyJump, you would replace it with the equivalent:
ProxyCommand ssh -W %h:%p bastion-machine
and if your local ssh version was a really ancient one that didn't support
ssh bastion-machine nc %h %p
although this last one requires that the bastion machine has
The beauty of ssh is that you can configure each destination on the file, and they will stack very nicely. Thus you end up working with
office-machine as the hostname on all the tools (ssh, scp, sftp...) as they were direct connects, and they will figure out how to connect based in the ssh_config. You could also have wildcards like
Host *.internal.company.local to make all hosts ending like that going through a specific bastion, and it will apply to all of them. Once configured correctly, the only difference between doing one hop connections or twenty would be the slower connection times.