# How to use jump/gateway hosts **URL:** \ **Category:** Ansible Project\ **Created:** [October 3, 2013, 3:31pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603 "2013-10-03T15:31:04Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Baron\_Schwartz](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Baron\_Schwartz](https://forum.ansible.com/u/Baron_Schwartz)\ **Post date:** [October 3, 2013, 3:31pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/1 "2013-10-03T15:31:04Z")
Hi! I cannot find anywhere in the documentation how to use a gateway host (jump host, bastion host, etc). All of our hosts are inside an unreachable network with only one host reachable. We SSH to that host and then on to others. I searched this mailing list, but I mostly found people talking about using ~/.ssh/config. That’s obviously not the Right Way To Do It – we should be sharing our configuration in the configuration management repository, not setting it in user-specific files. In some places people said they were using ansible’s SSH options to set a ProxyCommand or other way to accomplish a hop-through. but that also smells, because that’s a global setting as far as I can see. If you have more than one isolated network you’re going to use different gateway hosts. This is a really common requirement – surely I’m missing something? - Baron ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [October 3, 2013, 7:56pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/2 "2013-10-03T19:56:04Z")
It’s fine to edit ~/.ssh/config and most people who need jumphosts are ok with that. However it’s probably better to just log into your bastion host and run SSH from there. ---
**Author:** ![Mark\_Maas](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@Mark\_Maas](https://forum.ansible.com/u/Mark_Maas)\ **Post date:** [October 4, 2013, 8:37am UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/3 "2013-10-04T08:37:01Z")
Is it not possible to put the configuration in /etc/ssh/ ? (Just for the one domain) > ssh/config > Host \* > ControlMaster auto > #ControlPersist yes > Host [domain.net](http://domain.net) > ProxyCommand none > Host \*.domain.net > ProxyCommand ssh [domain.net](http://domain.net) -W %h:%p Thanks, Mark ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [October 4, 2013, 11:50am UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/4 "2013-10-04T11:50:26Z")
this is what /etc/ssh/ssh\_config file is for. As for specific domains: Host \*.[particulardomain.com](http://particulardomain.com) ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [October 4, 2013, 1:16pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/5 "2013-10-04T13:16:57Z")
Yep, it’s totally possible in Ansible. If you were asking Baron, yep 🙂 ---
**Author:** ![Baron\_Schwartz](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Baron\_Schwartz](https://forum.ansible.com/u/Baron_Schwartz)\ **Post date:** [October 4, 2013, 1:49pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/6 "2013-10-04T13:49:58Z")
Hi! Thanks for responding, everyone. And now that I’ve done some more searching, I’ve found [this topic](https://groups.google.com/d/topic/ansible-project/Heo2f7wBflw/discussion) that already discusses the same thing, in the context of a pull request that was rejected. With respect, I disagree with the Ansible project’s stance on this topic. Based on previous discussions such as the one I linked, I don’t expect this to change anything, but just to state my position succinctly and then let it be: 1. The fact that machines must be accessed through a gateway is a vital part of the system’s configuration. 2. Configuration should be contained entirely within the configuration management repository. 3. The use case is demonstrated by broad existence of this functionality in a convenient form in other tools. 4. It’s fine to say “there’s no true solution but here’s a workaround.” But if the response invalidates/rejects the use case, that’s discouraging. Regards, Baron ---
**Author:** ![Javier\_Candeira](https://avatars.discourse-cdn.com/v4/letter/j/c6cbf5/32.png) [@Javier\_Candeira](https://forum.ansible.com/u/Javier_Candeira)\ **Post date:** [October 4, 2013, 2:05pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/7 "2013-10-04T14:05:52Z")
You can use ansible to configure ~/.ssh/config in the localhost machine, that is, in the machine that's doing the management of the nodes. By doing it that way, maybe via lineinfile, you can ensure that the configuration is contained entirely within the configuration management repo as per your point 2. J ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [October 4, 2013, 2:12pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/8 "2013-10-04T14:12:20Z")
Thanks for helping me understand. I don’t think “in a convient form in other tools” really applies. The reason here is that none of these tools are decentralized, and this behavior in those tools _also_ has to be configured. In our case, the most _flexible_ place to configure that if you wanted to is currently the SSH configuration file. Now, that all being said, you wish to keep your configuration in version control. That’s fine. Now in most of those other tools, it’s usual to say, keep the configuration file for the tool itself along with the project. However, in this case, yes, it’s decentralized. Should you choose to keep this in your configuration file, easily solve this problem. A) set a “-f” in your ansible\_ssh\_options to point to the configuration file B) check this file in alongside your playbooks as ansible.cfg This will result in that SSH config being used every time. I don’t believe we have ever invalidated the idea that it should be possible, and each time we’ve suggested how it can be done. The crux of it is as follows – it doesn’t make sense to expose in Ansible an option for every option in OpenSSH. This bloats the system unneccessarily where it’s meant to be a minimal system – let OpenSSH do what it does best and support feeding arbitrary options to it. Now, all being said, I recognize that it may not _always_ be strategic to do this even by jump hosts. If running inside EC2, it is much nicer to run _ansible_ inside of EC2, rather than funneling everything through the jump host. It is for this reason that Ansible and/or AWX may likely support multiple workers at some point in the future, as we initially did way back when creating Func. But right now, most people will run their EC2 playbooks from a management node inside EC2, etc. ---
**Author:** ![Baron\_Schwartz](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Baron\_Schwartz](https://forum.ansible.com/u/Baron_Schwartz)\ **Post date:** [October 4, 2013, 3:49pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/9 "2013-10-04T15:49:52Z")
Michael, Thanks for your response. Just a couple of things to add to previous points: ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [October 4, 2013, 3:52pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/10 "2013-10-04T15:52:25Z")
in my devops repo i have an ansible.cfg which points to the dir in same repot inventory. I just run my ansible commands from that repo and it picks up the config and inventory. ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [October 4, 2013, 4:34pm UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/11 "2013-10-04T16:34:50Z")
" Ideally, Ansible would look for a local config file in the current working directory, and if that doesn’t exist, go up to parent directories, and if all else fails look system-wide" Actually it does something very much like this already ansible.cfg is looked for alongside your playbook, then ~/.ansible.cfg, then /etc/ansible/ansible.cfg I’m about to push out a docs update today that gives the config file it’s own chapter. ---
**Author:** ![Baron\_Schwartz](https://avatars.discourse-cdn.com/v4/letter/b/e95f7d/32.png) [@Baron\_Schwartz](https://forum.ansible.com/u/Baron_Schwartz)\ **Post date:** [October 5, 2013, 12:11am UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/12 "2013-10-05T00:11:49Z")
Perfect, thanks. I did not realize that. What about the host inventory file? I was under the impression that had to be in /etc/ansible/hosts, or mentioned explicitly in an env var or config setting. If that's discovered in the CWD and parents too, then that's great. Thanks, Baron ---
**Author:** ![Michael\_DeHaan](https://avatars.discourse-cdn.com/v4/letter/m/c4cdca/32.png) [@Michael\_DeHaan](https://forum.ansible.com/u/Michael_DeHaan)\ **Post date:** [October 5, 2013, 12:20am UTC](https://forum.ansible.com/t/how-to-use-jump-gateway-hosts/13603/13 "2013-10-05T00:20:21Z")
You can specify it with -i or change the default inventory path in your config file.