SSH Jump Hosts and Bastions on iPhone and iPad
Well-run infrastructure does not put every server on the public internet. There is one hardened, heavily-logged host that accepts connections, called the bastion or jump host, and everything else is reachable only from inside. This is good practice, and it makes connecting from a phone look impossible until you know the mechanism. You do not log into the bastion and then type ssh again; you tunnel through it, so the connection to the real server is end-to-end from your device.
Written by the GateShell team at Hefty Innovations
Step by step
- 1
Understand why you should not just SSH twice
The obvious approach, connecting to the bastion and then running ssh from there, works but is worse in ways that matter. Your session to the target is encrypted only between the bastion and the target; the bastion sees it in the clear. You also end up either putting a private key on the bastion, which defeats much of its purpose, or forwarding your agent to it, which lets anyone with root there use your key while you are connected. ProxyJump avoids all of this: the bastion forwards an encrypted stream it cannot read, and your keys never leave your device.
- 2
Add the bastion as its own server first
In GateShell, create a normal server entry for the bastion with its own credentials, and connect to it once. This confirms the credentials work and pins the bastion's host key, which means a later warning genuinely indicates something changed rather than being a first-connection prompt you click through.
- 3
Add the target and point it at the bastion
Create the server entry for the internal host, using the address as the bastion sees it, often a private 10.x or 192.168.x address or an internal DNS name. Then set its jump host to the bastion entry you just made. Each hop keeps its own username, port, and key, because they are frequently different: a shared bastion account and a per-service account on the target is a common pattern.
- 4
Connect to the target directly
Select the target server and connect. GateShell opens the connection to the bastion, then tunnels through it to the target, authenticating at each hop and verifying each host key separately. You land in a shell on the target. You never interacted with the bastion, and no credential for the target was ever present on it.
- 5
Bring your existing config across instead of retyping it
If your laptop's ~/.ssh/config already describes this topology, import it rather than re-entering it. GateShell imports hosts, usernames, ports, and single-alias ProxyJump relationships, and reports any jump references it could not resolve so you can fix them rather than discovering a broken entry later. Referenced IdentityFile paths are listed for you to map to saved keys manually, because a sandboxed iOS app cannot silently read arbitrary key files from disk.
- 6
Combine it with the rest of your setup
Jump hosts compose with everything else. Port-forward through the chain to reach a database that only the internal host can see. Enable Mosh on the target so the session survives a network change. Run an agent on the internal server. The hop is a property of how you connect, not a limitation on what you can do once connected.
Frequently asked questions
What is the difference between a jump host and a bastion?+
In practice, nothing. The terms are used interchangeably. 'Bastion' usually emphasises the security role of a hardened, audited entry point; 'jump host' emphasises the mechanism of hopping through it. ProxyJump is the SSH feature that implements it.
Can I chain more than one jump host?+
Yes. Each server entry names its own jump host, so pointing A at B and B at C produces a chain. GateShell resolves the chain, guards against cycles, and reports a missing host rather than failing obscurely at connect time. Depth is covered by its tests, though in practice more than two hops is rare outside large corporate networks.
Do my keys ever touch the bastion?+
No. Authentication for each hop happens on your device; the bastion only forwards an encrypted stream it cannot read. This is the main reason to prefer ProxyJump over connecting twice or forwarding your SSH agent. With agent forwarding, anyone with root on the bastion can use your key for as long as you are connected.
Does the target's host key still get verified?+
Yes, and this matters. Each hop is verified independently, so you get a real warning if the target's host key changes, even though you are reaching it through the bastion. Verification is not delegated to the intermediate host.
My ~/.ssh/config has a ProxyJump the import did not pick up. Why?+
Import covers single-alias ProxyJump relationships. Inline comma-separated chains, Match blocks, and Include directives are not parsed, and unresolved references are reported rather than silently dropped. Set those up manually with the jump-host picker. The underlying capability handles chains fine, it is only the config parsing that is narrower.
Try it in GateShell
GateShell is a zero-backend SSH client for iPhone, iPad, and Mac, with no vendor cloud, no accounts and no telemetry. Everything above works out of the box.
Guide reflects GateShell's shipped features as of September 2026. Steps assume basic familiarity with SSH and the command line; server-side commands may vary by distribution. All product names, logos, and brands are property of their respective owners.