# Using Ansible via a bastion host

**URL:** <https://forum.ansible.com/t/using-ansible-via-a-bastion-host/29427>\
**Category:** Ansible Project\
**Created:** [January 11, 2019, 6:58pm UTC](https://forum.ansible.com/t/using-ansible-via-a-bastion-host/29427 "2019-01-11T18:58:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tim\_Coote](https://avatars.discourse-cdn.com/v4/letter/t/439d5e/32.png) [@Tim\_Coote](https://forum.ansible.com/u/Tim_Coote)\
**Post date:** [January 11, 2019, 6:58pm UTC](https://forum.ansible.com/t/using-ansible-via-a-bastion-host/29427/1 "2019-01-11T18:58:47Z")

</div>

I’ve encountered a couple of modules where target hosts that are accessed an intermediate host don’t seem to work in a naive way. I’m wondering if this is a known issue and whether there are any workarounds. The latest version concerns the `apt` module. Here’s a snippet from my inventory file:

`target_host ansible_host=localhost:4321 ansible_user=user host_key_checking=false`

A simple stanza is:

```auto

- name: Remove CA certificate bundle

tags:

- oneoff

apt:

name: ca-certificates

state: absent

```

When I run this playbook, I get this error:

```auto

TASK [upgrade : Remove CA certificate bundle] ***********************************************************************************************************************************

**fatal: [target_host]: UNREACHABLE! => {"changed": false, "msg": "SSH Error: data could not be sent to remote host \"localhost:4321\". Make sure this host can be reached over ssh", "unreachable": true}**

```

The module `rsync` has similar issues. Any thoughts on how to work around this, other than just using `shell`?

tc

---

<div class="post-metadata">

**Author:** ![Tim\_Coote](https://avatars.discourse-cdn.com/v4/letter/t/439d5e/32.png) [@Tim\_Coote](https://forum.ansible.com/u/Tim_Coote)\
**Post date:** [January 11, 2019, 7:15pm UTC](https://forum.ansible.com/t/using-ansible-via-a-bastion-host/29427/2 "2019-01-11T19:15:46Z")

</div>

ignore the `apt` example. Running it to remove ca-certificates from Raspian ripped out the packages that sustained the tunnel!

however, the error does still occur with the `rsync` module.

---

<div class="post-metadata">

**Author:** ![cassell](https://avatars.discourse-cdn.com/v4/letter/c/ecae2f/32.png) [@cassell](https://forum.ansible.com/u/cassell)\
**Post date:** [January 11, 2019, 7:21pm UTC](https://forum.ansible.com/t/using-ansible-via-a-bastion-host/29427/3 "2019-01-11T19:21:28Z")

</div>

> ignore the `apt` example. Running it to remove ca-certificates from Raspian  
> ripped out the packages that sustained the tunnel!
> 
> however, the error does still occur with the `rsync` module.

The synchronize module does not work with complicated connection setups, from my experience.

V/r,  
James Cassell