Multi-Hop SSH

A jump chain routes a connection through one or more intermediate SSH servers (bastions) to a target that is not reachable directly. Configure it in a server’s settings under Advanced › Jump Host. It is the in-app equivalent of OpenSSH’s ProxyJump.

You -> bastion -> internal gateway -> target

Each hop is one of your saved SSH servers, so a chain needs at least two saved servers: the hop and the target. The Free plan keeps one server active, and a server locked by the Free limit is refused as a hop, so working jump chains require PocketCmd Pro.

Set up a jump chain

1. Save the bastion as a server of its own, with its host, user and credentials. Test it once on its own.
2. Open the target server’s settings and expand Advanced.
3. Under Jump Host, tap Add Jump Host and pick the bastion from Select Jump Host.
4. For a longer chain, tap Add Another Hop and pick the next server. Hops run in the order you add them.
5. Tap Test Connection to check the whole path, then save.

The editor shows the path as a row of chips, from You through each hop to the target’s host. Tap the × on a hop’s chip to remove it. To change the order, remove hops and add them again in the order you want.

The picker lists your saved servers, except the one you are editing. A hop must accept SSH on the port saved for it. If a hop server is deleted later, its chip reads [Deleted] and the connection fails rather than falling back to a direct connection.

Authentication on each hop

Every hop signs in with the credentials saved on its own server entry. When a hop has both a key and a stored password, the key is tried first and the password is the fallback. Because hops reference the saved server, fixing a hop’s key or password in one place applies to every chain that uses it.

A bastion that accepts only keys works as a hop. You do not need to enable password logins on it.

Inherit a chain from a group

A Jump Host set on a server group applies to every server in that group. A member server with no chain of its own shows the group’s chain, marked as inherited. Editing the chain on the member creates a local override that applies to that server only. Agent forwarding can be inherited from a group in the same way. See Server Organization.

Free plan and locked servers

On Free, or after a Pro subscription ends, servers beyond the one you keep active are locked. A locked server carries no connection, including as a hop:

• In the hop picker, locked servers are listed last and grayed out. Tapping one explains the lock instead of adding it.
• A hop already in a chain that becomes locked is grayed out in the editor.
• Connecting to a server whose chain includes a locked hop shows “Its jump host is paused” and does not connect. Test Connection does the same.

Compared with an SSH config

This chain in PocketCmd:

You -> jump1 -> jump2 -> target-server

corresponds to this ~/.ssh/config:

Host target-server
    HostName 10.0.0.50
    User deploy
    ProxyJump jump1,jump2

SSH config import brings in Host, HostName, User, Port and IdentityFile. It does not read ProxyJump, so recreate the chain in the target’s settings after importing.

Behavior of a chained connection

• The terminal, SFTP and commands all run on the target. The hops only relay the connection.
• On a Mosh or Eternal Terminal server, only the SSH bootstrap goes through the chain. The Mosh UDP session and the ET connection (port 2022 by default) go straight from your device to the target, so the target must be reachable on those ports without the bastion. If it is not, use SSH for that server.
• If any hop drops, the session to the target drops with it. Reconnecting builds the chain again from the first hop.
• Port forwards apply to the target. A local forward to localhost:5432 reaches port 5432 on the target, not on a hop.