My favorite trick (in .ssh/config): Host *.internal.workdomain.com ProxyCommand ssh gateway.workdomain.com nc %h 22 ForwardAgent yes User <username> T

My favorite trick (in .ssh/config): Host *.internal.workdomain.com ProxyCommand ssh gateway.workdomain.com nc %h 22 ForwardAgent yes User <username> Then you can type ssh bender.internal.workdomain.com and ssh will automatically connect through the gateway to the (normally inaccessible) internal node. ForwardAgent will pass the credentials through. (If you copy this blindly, note that this requires netcat). This configuration lets you pretend (to tools like scp, rsync-over-ssh, etc) that you have direct access to the machine in question, even when it goes through a gateway machine: scp config bender.internal.workdomain.com: scp bender.internal.workdomain.com:logfile .