SSH Through a Jump Host with -J (ProxyJump)
Connect to an internal server via a bastion host in one command using ssh -J, instead of logging in twice and hopping manually.
Run ssh -J user@gateway.example.com user@internal-server.local to reach the internal machine through the gateway in one step.
01Command
Command
$ ssh -J user@gateway.example.com:2222 user@internal-server.local02What it does
The -J option tells OpenSSH to first connect to the jump host and then tunnel a second SSH connection to the real target through it, handling forwarding automatically. Add :port after either host when it uses a non-default port, and give separate users like -J gateuser@gateway,workuser@target. If you reach the same target often, put ProxyJump in ~/.ssh/config under that host so plain ssh target does the hop for you.
03Risk
!Warning: Authentication happens twice — your local key must be accepted on both the jump host and the target, or use ssh-agent forwarding deliberately; the jump host sees the unencrypted connection setup metadata.
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- ssh(1) — Linux manual page (-J / ProxyJump)Evidence: Documents -J [user@]host[:port] as shorthand for ProxyJump, which connects to the target host via an intermediate jump host.
- ssh_config(5) — ProxyJumpEvidence: Describes the ProxyJump option and how OpenSSH forwards a TCP connection through the specified jump host.
Last verified: 2026-09-18 · Category: Network