Do a double (two spans) SSH tunnel between two machines (with a third machine sitting in the middle)

It is sometimes necessary to connect to a final destination node via an intermedite node that serves as an SSH stepping stone (and is typically in the DMZ). To establish some terminology lets use the following:

A

your local node

B

the intermediate node (a.k.a jump host, firewall host, gateway)

C

the destination node

Once you have this chain of SSH accesses — even with an intermediary stepping stone — you can effectively access every port of the node C.

There's two ways to go about it:

• a single SSH invocation to bore both spans (using an embedded subsequent SSH command to execute)
• two separate SSH invocations, each boring a single span

In both cases it is a good idea to implement SSH public key authentication on node B (for node A) and on node C (for node B).

single SSH invocation that bores both tunnels

ssh username@ssh.esac.esa.int -L 18300:localhost:18302 ssh -N username@esavo00.esac.esa.int -L 18302:localhost:8300

NB: the above incantation uses the port 18302 on the middle (stepping stone) machine. Should this port by in use the boring will fail. In that case just try 18303, 18304, etc. until you find an open port. You will obviously have to replace the stepping stone machine's port in both places where it occurs. It is for this reason (the uncertainty over which ports will be discovered to be open in the middle machine) that I have not crystallized the above incantation as a script.

NB2: the above note applies to the next method, too.

NB3: an alternative, simpler way to bore a tunnel that may not be applicable in this scenario is given here.

two separate SSH invocations that bore one tunnel each

For a case similar to the above, use the following on machine A (mutatis mutandis):

ssh username@ssh.esac.esa.int -L 18300:localhost:18302

… and the following on machine B (mutatis mutandis):

ssh username@esavo00.esac.esa.int -L 18302:localhost:8300