SSH now has a -W netcat mode, so your ssh config can be simplified to: ProxyCommand ssh -W %h:%p <bastion> this also means that netcat, or even a shell

SSH now has a -W netcat mode, so your ssh config can be simplified to: ProxyCommand ssh -W %h:%p <bastion> this also means that netcat, or even a shell/ability to execute commands is not required on the remote bastion host.