Jump hosts (bastion hosts) allow you to access servers on private networks by chaining through an intermediate public-facing host. SSH can do this transparently.

Single jump:

$ ssh -J jumphost user@finalhost

SSH connects to jumphost, then from there connects to finalhost. You only type one password (unless both require auth).

Multiple hops:

$ ssh -J host1,host2,host3 user@final

Chained connection: local → host1 → host2 → host3 → final.

Configure in ~/.ssh/config:

Host final
    HostName 10.0.0.50
    User alice
    ProxyJump jumphost

Host jumphost
    HostName jump.example.com
    User bob

Then ssh final automatically routes through jumphost.

Multiple hops in config:

Host final
    ProxyJump host1,host2,host3

Requirements:

• Jumphost must be reachable from your machine
• Jumphost must have SSH access to final host
• Final host's firewall only needs to allow connections from jumphost (not from your public IP)

ProxyJump is the modern way (OpenSSH 7.3+). Older systems use ProxyCommand with netcat:

Host final
    ProxyCommand ssh jumphost nc -X connect %h %p

Copy files through a jump host:

$ scp -J jumphost file user@final:/path

Jump hosts are essential for accessing servers on internal networks without exposing them directly to the internet.