Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

SSH tunneling is very confusing to me. I am wondering if I can do this in Linux.

I have 3 machines..

A. My local machine at home.
B. Machine at work that I can SSH into (middle man).
C. My desktop at work that I can only SSH into from machine B.

So I can SSH from A -> B and from B -> C, but not from A -> C.

Is there a way to setup an SSH tunnel from A through B, so when I run other SSH commands it they just work from my local machine A? I am basically trying to clone a git repo from work to home (and I cannot install git on machine B).

Also, once setup.. How would I unset it as well?

share|improve this question

migrated from stackoverflow.com Feb 11 '10 at 19:36

This question came from our site for professional and enthusiast programmers.

i believe there's a duplicate question around somewhere but my search-fu is weak today. –  quack quixote Feb 11 '10 at 21:53
that would be mine: superuser.com/questions/96489/ssh-tunnel-via-multiple-hops –  Mala May 3 '12 at 7:23

4 Answers 4

Place this in your .ssh/config file on hostA (see man 5 ssh_config for details):

# .ssh/config on hostA:
Host hostC
ProxyCommand ssh hostB -W %h:%p
hostA:~$ ssh hostC  # this will automatically tunnel through ssh hostB

You may like to add options like -oCiphers=arcfour -oClearAllForwardings=yes to speed things up, since wrapping ssh inside ssh is computationally more expensive and the extra effort and the wrapper doesn't need to be as secure when it's tunneling already-encrypted traffic.

If you are using OpenSSH earlier than 5.3, the -W option is not available. In this case you can implement the above using netcat (nc):

ProxyCommand ssh hostB nc %h %p  # or netcat or whatever you have on hostB
share|improve this answer
This is brilliant! Thank you. This solves a problem that has been eating me for the past 2 days: hostC sits behind a firewall and has data I want to access from hostA, a laptop that can be anywhere in the world. hostB is also behind the same firewall with hostC, but it has an SSH port open to the world. Thus I can ssh from hostC -> hostB. I setup a reverse SSH tunnel between hostC & hostB, so I can also ssh from hostB -> hostC (forwarded through localhost). With your trick I can go from hostA -> hostC! It works seamlessly with SCP & Fugu on OSX! Thank you! –  AndyL Mar 7 '10 at 4:45
The -W option should be used instead of the nc option. –  vy32 yesterday

Edit: This is the wrong approach. See ephemient's answer instead. This answer will work, but is potentially less secure and definitely less awesome.

It sounds like you want a solution like the following:

ssh -L localhost:22:machinec:22 machineb

This will get you a shell on machineb. Leave this alone; minimize the terminal window.

Now, whenever you make an ssh connection to localhost, you will actually be connected to machinec through machineb. When you're done with the tunnel, just close the terminal in which you ran the above command.

Note that you'll need superuser privileges to run the command.

share|improve this answer
+1 Thanks Wesley. This is the real ssh tunneling answer. Here's an article about it: securityfocus.com/infocus/1816 –  Larry K Feb 11 '10 at 4:18
On the whole, this is quite evil... but I've had to do this with ancient versions of OpenSSH, or other ssh clients. You could pick some high port like 8022: this way it doesn't interfere with any ssh service on localhost, and doesn't require running as root. Just add -p 8022 to your ssh commands. And it's braindead easy with git: use the URI ssh://localhost:8022/path/to/repo.git. –  ephemient Feb 11 '10 at 4:43

Sounds like you want a shell alias on A that causes ssh to occur on C

  1. I assume that on A, you can type ssh me@b "ssh me@c hostname" and get back "C"
  2. Make an alias sshc which expands sshc foo into ssh me@b "ssh me@c foo"
  3. For exact syntax of creating the alias, consult superuser.com
share|improve this answer
You may have to add -t to the outer ssh's options if you want an interactive shell, since ssh assumes -T if it's given a command. –  ephemient Feb 11 '10 at 4:12

If your employer provides a VPN, I'd recommend using that instead.

That way, you won't have to configure any applications specially (even ssh), and you can see any machine behind the firewall. Additionally, all of your traffic will be encrypted by the VPN software, which will add security to any inadvertently or deliberately unencrypted traffic.

share|improve this answer
Sometimes its the VPN that is the reason we need these tricks... –  Louis Dec 6 '12 at 4:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.