# jump through two bastion hosts?

**URL:** <https://forum.ansible.com/t/jump-through-two-bastion-hosts/32276>\
**Category:** Ansible Project\
**Created:** [February 19, 2020, 8:06pm UTC](https://forum.ansible.com/t/jump-through-two-bastion-hosts/32276 "2020-02-19T20:06:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![erichymowitz](https://avatars.discourse-cdn.com/v4/letter/e/9d8465/32.png) [@erichymowitz](https://forum.ansible.com/u/erichymowitz)\
**Post date:** [February 19, 2020, 8:06pm UTC](https://forum.ansible.com/t/jump-through-two-bastion-hosts/32276/1 "2020-02-19T20:06:21Z")

</div>

So I’ve got a host that I need to jump through two bastion hosts to get to:

Ansible -----\> bastion\_1 -----\> bastion\_2 -----\> target

I can use ansible to get to bastion\_2 by setting up a hostvar:

ansible\_ssh\_common\_args: -o “ProxyCommand=ssh -q -W %h:%p {{local\_user\_account}}@bastion\_1”

…and that works correctly.

I tried setting up a similar hostvar for target:

ansible\_ssh\_common\_args: -o “ProxyCommand=ssh -q -W %h:%p {{local\_user\_account}}@bastion\_2”

…but that doesn’t work, because ansible is trying to ssh directly to bastion\_2 and not caring about the hostvar set up to access bastion\_2.

I have a workaround. I can set up an entry in my ~/.ssh/config file

Host bastion\_2  
ProxyCommand ssh -q -W %h:%p bastion\_1

… and then ansible works, because ansible tells ssh to go through bastion\_2, and ssh figures its own way there.

But is there a way to do this just within ansible, without using .ssh/config ?

–EbH

PS – my ssh is too old for the -J / ProxyJump option, which I think would solve my problem.

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [February 21, 2020, 11:31pm UTC](https://forum.ansible.com/t/jump-through-two-bastion-hosts/32276/2 "2020-02-21T23:31:53Z")

</div>

There is nothing stopping you from adding -o ProxyCommand in the ssh inside  
the ProxyCommand.

So something like this might work

ansible\_ssh\_common\_args: -o "ProxyCommand=ssh -o 'ProxyCommand=ssh -q -W %h:%p user@bastion\_1' -q -W %h:%p user@bastion\_2"

You may need to play around with the single and double quotes and escaping some of them.