Jump Chains

Reach a host that only exists inside another network — a database server behind a bastion, or a machine on a private subnet. This is SSH's ProxyJump (ssh -J), saved on the host.

Why the address can look wrong

A jumped host's address is resolved by the last hop, not by your machine. A name like db.internal that means nothing on your laptop is still correct here, because the hop before it is the one that looks it up.

That is the whole point of the feature, and the usual reason a host "looks misconfigured" when it isn't.

Set up a chain

1. Add the bastion as an ordinary host first, and connect to it once so its fingerprint is accepted.
2. Open the host you want to reach → Jump chain → Add hop.
3. Pick the bastion. Add more hops if you need them; they are dialled top to bottom.

The line under the list shows the route as it will actually be dialled — you → bastion → db.

Chains build on each other

A hop can declare hops of its own. If db goes via bastion-b, and bastion-b goes via bastion-a, then connecting to db dials bastion-a → bastion-b → db — you only ever describe one link at a time.

This is why the preview can list more machines than you added: it shows the expanded route.

One route, every tool

The chain is stored on the host, not on each thing that connects to it. Terminals, the SFTP browser and every port-forwarding rule that rides that host all follow the same route automatically.

Each hop is verified separately

Every hop is a full SSH session running inside the previous one, so an intermediate bastion only ever relays encrypted traffic — it cannot read your session. Each hop therefore has its own host key, and you confirm each fingerprint the first time you use it.

Connect to the hosts in chain order the first time, so each fingerprint is accepted before something further down needs it.

When it doesn't work

Failures name the hop they happened at — Hop 2 of 3 (bastion-b): … — so start there rather than at the host you were opening.

• "could not reach … " — that hop cannot see the next machine. Check the next hop's address from that hop, not from your laptop.
• "has not been accepted yet" — open a terminal to that hop once and confirm its fingerprint. Port forwards never prompt for a key.
• "loops back on itself" — two hosts jump through each other. Edit one and remove the hop.
• A host in the chain is missing — a jump host was deleted or moved to another vault. Edit the host's jump chain to fix the route.

Tips

• Moving a host between vaults brings its jump hosts along; you are asked what to do with each one.
• Editing a host's route stops any port-forward tunnel that was running through it, so it can be restarted on the new route.