To reach a private SSH server through two or more bastions, use OpenSSH’s ProxyJump option: run ssh -J bastion1,bastion2 user@target for a one-off connection, or save the route in ~/.ssh/config for reuse. On Mac, use Terminal and OpenSSH. On iPhone or iPad, use an SSH client that explicitly supports ordered jump-host chains.
What a multi-hop SSH connection does
With a jump chain, your SSH client connects to each server in sequence. Each bastion forwards the TCP connection toward the next hop, and your client establishes the final SSH session with the destination. You authenticate separately to the servers along the route. This is not the same as logging into one bastion and manually running another ssh command from its shell.
As an Amazon Associate I earn from qualifying purchases.
OpenSSH’s -J option is shorthand for ProxyJump. The OpenBSD manual says multiple jump hosts are visited sequentially when separated by commas. See the OpenBSD ssh_config(5) documentation and the Debian trixie ssh(1) manual.
Connect through multiple hosts with OpenSSH
Use a one-off command
For a quick connection, pass the bastions in order with -J. This example uses separate login names for the first two hops, and connects to the target on port 2222:
#1 Best Overall
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
ssh -J [email protected],[email protected]
-p 2222 [email protected]The order matters: OpenSSH connects through bastion1.example.net, then bastion2.internal, before reaching db.internal.example. Use names and ports that are valid in your own network; internal names may only resolve in the expected network context.
Save per-hop settings in SSH config
For a route you use repeatedly, define a block for each host in ~/.ssh/config. Give every hop its own username and identity where needed, and define the target’s port and login separately:
Rank #2
- BUILT FOR COLLEGE. AND BEYOND — MacBook Air with the M5 chip packs blazing speed and powerful AI capabilities into an incredibly portable design. And with up to 18 hours of battery life,* this thin and light powerhouse is ready to take on almost any major, just about anywhere.
- TEAR THROUGH TOUGH ASSIGNMENTS — With its faster CPU and unified memory, the M5 chip delivers even more performance and fluidity across apps, making multitasking and creative workflows smooth and responsive. A powerful Neural Engine and next-generation GPU with Neural Accelerators give you a powerful platform for AI.
- MAKE QUICK WORK OF YOUR TO-DO LIST — Apple Intelligence helps you write, express yourself, and get things done effortlessly — whether it’s for school or everyday life. With groundbreaking privacy protections, it gives you peace of mind that no one else can access your data — not even Apple.*
- UP TO 18 HOURS OF BATTERY LIFE — MacBook Air delivers incredible battery life with amazing performance, so you can power through a full day of classes without worrying about plugging in.
- A BRILLIANT 13.6-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Air supports 1 billion colors, making photos and videos pop with rich contrast and sharp detail, and text appears supercrisp. So everything — from class presentations to movies to games — looks truly stunning.
Host edge
HostName bastion1.example.net
User alice
IdentityFile ~/.ssh/id_ed25519_edge
IdentitiesOnly yes
Host corp-bastion
HostName bastion2.internal
User bob
IdentityFile ~/.ssh/id_ed25519_corp
IdentitiesOnly yes
ProxyJump edge
Host private-db
HostName db.internal.example
Port 2222
User deploy
IdentityFile ~/.ssh/id_ed25519_db
IdentitiesOnly yes
ProxyJump edge,corp-bastionThen connect using the target alias:
ssh private-dbOpenSSH generally does not apply the destination’s configuration options to jump hosts. That is why the intermediate servers have their own Host blocks. IdentitiesOnly yes can also prevent the client from offering every identity available through an agent. See the OpenBSD manual’s ProxyJump and configuration guidance and its IdentitiesOnly entry.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Choose ProxyJump or ProxyCommand
Use ProxyJump for a normal chain of SSH bastions. ProxyCommand is intended for custom transport or helper flows, such as a required proxy program; the correct command depends on your installed software and network policy. Avoid setting both options for the same route without understanding precedence: OpenSSH documents that the first encountered of ProxyJump and ProxyCommand prevents later instances of the other from taking effect. See the ProxyCommand entry and ProxyJump entry.
Rank #3
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Use the right workflow for each device
Mac: Terminal and OpenSSH
On a Mac, open Terminal and use either the one-off ssh -J command or the reusable configuration above. Apple documents connecting to remote servers over SSH from Terminal, but its support guide does not explain multi-hop configuration. For the jump-chain options themselves, follow the OpenSSH documentation. See Apple’s Terminal guide to connecting to a server.
iPhone and iPad: choose an app with chain support
iOS and iPadOS do not provide the same built-in Terminal workflow as macOS. Choose an SSH terminal app whose documentation or current listing explicitly describes jump routing or host chains. Blink documents commands using -J, ProxyCommand for special cases, and host-specific SSH configuration. Its guidance is available in Blink’s advanced SSH documentation and Blink’s host configuration documentation.
Rank #4
- AN AMAZING MAC AT A SURPRISING PRICE — With an incredibly portable and durable aluminum design, up to 16 hours of battery life,* and the A18 Pro chip, MacBook Neo is ready to go wherever school takes you.
- FOUR STUNNING COLORS. ONE DURABLE DESIGN — Choose from four beautiful colors — Silver, Blush, Citrus, or Indigo — each with a color-coordinated keyboard. And MacBook Neo is made with a durable recycled aluminum enclosure that helps it reach 60 percent recycled content by weight — the most ever in any Apple product.*
- FLY THROUGH EVERYDAY ASSIGNMENTS — Whether you’re cramming for finals, using Apple Intelligence* to summarize class notes, creating presentations, or even playing the latest Apple Arcade game,* MacBook Neo delivers the performance and AI capabilities you need to get things done.
- UP TO 16 HOURS OF BATTERY LIFE — MacBook Neo delivers all day battery life, so you can power through from early morning classes to late night study sessions without worrying about plugging in.
- A VIBRANT 13-INCH DISPLAY* — The gorgeous Liquid Retina display on MacBook Neo supports 1 billion colors, so photos and videos pop and text is crisp for easy reading.
Termius’ App Store listing for iPhone and iPad describes proxy and jump-server features, as well as host chains. App features and plan requirements can change, so check the current listing and app version before relying on a particular capability. A Bluetooth keyboard can make command entry on an iPad more convenient, but it is optional. See the Termius App Store listing.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesProtect credentials and verify every hop
Keep agent forwarding off unless it is necessary
A typical ProxyJump route does not require SSH agent forwarding. OpenSSH warns that someone able to access a forwarded agent socket can ask the agent to authenticate using loaded identities, even though the private key material itself is not copied to the remote host. If forwarding is genuinely required, limit it to trusted hosts and consider a dedicated, limited-purpose key. Blink also documents this risk in its advanced SSH guidance.
Best Value
- FAST RUNS IN THE FAMILY — The 16-inch MacBook Pro with the M5 Pro or M5 Max chip brings next-generation speed and powerful on-device AI to personal, professional, and creative tasks. With all-day battery life, double the starting storage,* and a breathtaking Liquid Retina XDR display, it’s pro in every way.*
- BUCKLE UP — Along with a next-generation CPU, faster unified memory, and up to 2x faster SSD storage,* M5 Pro and M5 Max feature a more powerful GPU with a Neural Accelerator built into each core, delivering faster AI performance and on-device training capabilities. So you can blaze through demanding workloads at mind-bending speeds.
- BUILT FOR AI — Apple silicon, and every major component that powers it, is designed to run demanding on-device AI workloads like LLM inference and training. And Apple Intelligence helps you write, express yourself, and get things done effortlessly with groundbreaking privacy protections at every step.*
- ALL-DAY BATTERY LIFE — MacBook Pro delivers the same exceptional performance whether it’s running on battery or plugged in.*
- MACOS RUNS APPS FAST — All your go-to apps run lightning fast in macOS, including built-in apps like FaceTime and Messages. Plus, built-in virus protection and free software updates help keep your Mac running smoothly and securely.
Check host keys at every stage
Host-key verification applies to each SSH server in the chain. Do not automatically accept an unexpected changed key. OpenSSH’s StrictHostKeyChecking yes setting rejects changed keys; accept-new allows first-seen keys but rejects changed ones. If a key changes unexpectedly, confirm the fingerprint with an administrator or another trusted channel before proceeding. See the StrictHostKeyChecking documentation.
Troubleshoot the chain one connection at a time
When a multi-hop connection fails, identify which link in the route is failing rather than changing every setting at once.
- Test each bastion from the client. Confirm that you can reach and authenticate to each jump host individually.
- Check name resolution and network context. Verify that each hostname is resolvable from the context where the next connection is made; an internal hostname may not resolve from your Mac or mobile network.
- Verify each hop’s account, port, and key. Check the corresponding
User,Port, andIdentityFilesettings rather than assuming the target’s settings apply to the bastions. - Inspect verbose output. Retry with
ssh -v private-dborssh -vvv private-dbto see where connection setup or authentication stops. - Check the route against network policy. Confirm that each bastion is allowed to forward traffic to the next host and that any required proxy helper is installed and configured.
These checks follow from how the chain works; they do not imply that a particular device, app, or network has been tested.
Free tools Windows power users keep installed
One-click scans. No signup required.
Evaluate mobile SSH apps before relying on them
For a phone or tablet, verify that a client can handle the full route rather than only a single jump host. Check the details that affect both usability and security:
- Whether the app supports ordered multi-hop chains and, if needed, custom proxy commands.
- Whether each hop can have its own username, port, and key selection.
- How the app verifies host keys and handles changed keys.
- How keys are stored or synchronized, and whether agent forwarding is involved.
- Whether its terminal and keyboard controls work for your device and workflow.
Feature availability can vary by app version or plan. Confirm the details in the current app documentation or listing before setting up a route you depend on.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
