> For the complete documentation index, see [llms.txt](https://docs.gotempest.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gotempest.app/connect-to-servers/ssh-jump-host-bastion-chaining.md).

# SSH Jump Host & Bastion Chaining

Connect to private servers behind one or many SSH bastions with Tempest's recursive jump-host chaining — like OpenSSH ProxyJump, with a GUI.

Tempest's **Jump Host** feature is a GUI equivalent of OpenSSH's `ProxyJump` — connect to a private server through one or many SSH bastions, with each hop authenticated independently and tunneled over a `direct-tcpip` channel (no cleartext exposure on the bastion).

Use it whenever your target server isn't directly reachable: production hosts behind a corporate bastion, lab machines behind a VPN gateway, IoT devices behind a remote development box.

## Single jump host

1. Add the **bastion** as a normal SSH connection in Tempest. Save it.
2. Add the **target** server.
3. In the target's edit form, set **Jump Host** to your bastion.
4. Save and connect.

Tempest authenticates to the bastion first, opens an SSH `direct-tcpip` tunnel from the bastion to your target, and runs the SSH handshake with your target through that tunnel — exactly like `ssh -J bastion target`.

## Recursive chains (jump → jump → target)

Set the bastion's **own** Jump Host to a higher-level bastion. Tempest walks the chain:

```
Tempest → bastion-1 → bastion-2 → target
```

Each hop:

* Has its own credentials (password, key, cert, agent — independently configured).
* Verifies its own host key fingerprint with you the first time.
* Reports per-hop status messages in the SSH terminal as the connection builds.

There's no built-in chain length limit. Common patterns: 2 hops (corporate edge → app cluster), 3 hops (corporate edge → cluster bastion → namespace pod).

## RDP through a jump host

A Windows host behind a bastion is reached the same way:

1. Add the **bastion** as an SSH connection and save it.
2. Add the **RDP** host.
3. In the RDP host's edit form, set **Jump Host** to your bastion.
4. Save and connect.

Tempest connects to the bastion first and tunnels the RDP session through it. The remote desktop still authenticates against the address you typed, so NLA and certificate checks behave exactly as they would on a direct connection.

The bastion's own credentials are requested when you connect, and its host key is confirmed the same way an SSH session's is. If the bastion cannot be reached, the connection fails and tells you why rather than falling back to a direct attempt.

## How it differs from OpenSSH `ProxyJump`

| Feature                         | OpenSSH `-J` / `ProxyJump` | Tempest Jump Host                |
| ------------------------------- | -------------------------- | -------------------------------- |
| Tunneling                       | `direct-tcpip` channel     | Same                             |
| Per-hop auth method             | Reads your `~/.ssh/config` | First-class form fields per host |
| Per-hop credentials in keychain | Manual                     | Tempest Keychain                 |
| Recursive chains                | Yes (with config)          | Yes (UI-driven)                  |
| GUI host-key verification       | No                         | Yes — fingerprint dialog per hop |

## OpenSSH `ProxyJump` quick reference (`-J` and `~/.ssh/config`)

If you're on the command line instead, the equivalent OpenSSH setup is:

```bash
# One-off: jump through a bastion with -J
ssh -J bastion.example.com deploy@10.0.0.12

# Multiple hops: comma-separate the chain
ssh -J edge.example.com,bastion.internal deploy@10.0.0.12
```

Or persist it in `~/.ssh/config` so `ssh prod-db` just works:

```
Host prod-db
  HostName 10.0.0.12
  User deploy
  ProxyJump bastion.example.com
```

`ProxyJump` (OpenSSH 7.3+) supersedes the older `ProxyCommand ssh -W %h:%p bastion` idiom. Tempest's Jump Host field is the GUI version of exactly this — same `direct-tcpip` tunneling, without hand-maintaining the config file on every machine.

## Pro feature

Jump host chaining is part of **Tempest Pro**, for SSH and RDP hosts alike.

## Combine with proxy commands

A jump host's *own* connection can also use a Proxy Command (e.g., `cloudflared access ssh`, `aws ssm start-session`). This lets you compose, for example:

```
Tempest → cloudflared tunnel → corporate-bastion → prod-target
```

The first hop reaches the bastion through Cloudflare Access; the second hop tunnels to the target via standard SSH `direct-tcpip`.

See [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale.md) for proxy-command setup.

## Troubleshooting

* **"Connection refused" to the target**: the bastion might not have a route to the target. SSH into the bastion first and verify with `nc -zv target 22`.
* **Host-key fingerprint dialog appears every connect**: make sure you accept the fingerprint, not just dismiss the dialog. Tempest stores it in the host's `fingerprint_v2` field.
* **First hop authenticates, second hop hangs**: check if the bastion sshd allows `direct-tcpip` (`AllowTcpForwarding yes`).

## See also

* [SSH Port Forwarding](/connect-to-servers/ssh-port-forwarding.md) — local / remote / dynamic forwards through your jump chain
* [SSH Client for Teleport, Cloudflare Access, AWS SSM, GCP IAP & Tailscale](/connect-to-servers/ssh-client-for-teleport-cloudflare-access-aws-ssm-gcp-iap-and-tailscale.md)
* [SSH tunneling & bastions](https://gotempest.app/ssh-tunneling) — the product page for this feature