# chaining psrp through multiple bastion hosts

**URL:** <https://forum.ansible.com/t/chaining-psrp-through-multiple-bastion-hosts/33167>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [June 12, 2020, 7:19pm UTC](https://forum.ansible.com/t/chaining-psrp-through-multiple-bastion-hosts/33167 "2020-06-12T19:19:12Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Simon\_Tyler](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Simon\_Tyler](https://forum.ansible.com/u/Simon_Tyler)\
**Post date:** [June 12, 2020, 7:19pm UTC](https://forum.ansible.com/t/chaining-psrp-through-multiple-bastion-hosts/33167/1 "2020-06-12T19:19:12Z")

</div>

Hello Ansible Citizens,

I am able to connect to a windows machine through a linux bastion host. This is a central jump server that is connected to all of our client networks. Each client network has it’s own linux jump server.

To review the current configuration:

Example in the Ansible hosts file:

[dr\_win]  
DR-MGMT01-WIN

[dr\_win:vars]

ansible\_user=  
ansible\_password=  
ansible\_connection=psrp  
ansible\_port=5985  
ansible\_psrp\_protocol=http  
ansible\_psrp\_proxy=socks5h://10.x.x.x:1234  
ansible\_winrm\_server\_cert\_validation=ignore

The /etc/hosts file has an entry for DR-MGMT01-WIN.

So does the central jump server.

This works; I am able to win\_ping successfully.

Now I want to set up similar connectivity to another windows host in DR but there is an extra hop. I have connectivity from Ansible to DR MGMT subnet. I want to chain the jump servers together.  
I have done this successfully with linux machines and ssh, but now I need a way to do this for windows machines.

So right now it looks like:

Ansible → Central\_bastion:1234 (ssh listener) → DR-MGMT01-WIN:5985 (successful)

I want:

Ansible → Central\_bastion:1234 → DR-MGMT-LIN:22 → DR-SERVER-WIN:5985

How do I configure Ansible to be aware of this chain or how do I set this chain up? There must be a way but it is not clear.  
I understand that this is not fully secure; once connectivity is established and I understand the process I can add layers of security.

Regards,