# SSH Jump Hosts

**Jump hosts** (bastion hosts) allow you to access servers on private networks by chaining through an intermediate public-facing host. SSH can do this transparently.

Single jump:

```bash
$ ssh -J jumphost user@finalhost
```

SSH connects to `jumphost`, then from there connects to `finalhost`. You only type one password (unless both require auth).

Multiple hops:

```bash
$ ssh -J host1,host2,host3 user@final
```

Chained connection: local → host1 → host2 → host3 → final.

Configure in `~/.ssh/config`:

```
Host final
    HostName 10.0.0.50
    User alice
    ProxyJump jumphost

Host jumphost
    HostName jump.example.com
    User bob
```

Then `ssh final` automatically routes through `jumphost`.

Multiple hops in config:

```
Host final
    ProxyJump host1,host2,host3
```

Requirements:

- Jumphost must be reachable from your machine
- Jumphost must have SSH access to final host
- Final host's firewall only needs to allow connections from jumphost (not from your public IP)

`ProxyJump` is the modern way (OpenSSH 7.3+). Older systems use `ProxyCommand` with netcat:

```
Host final
    ProxyCommand ssh jumphost nc -X connect %h %p
```

Copy files through a jump host:

```bash
$ scp -J jumphost file user@final:/path
```

Jump hosts are essential for accessing servers on internal networks without exposing them directly to the internet.