A jump host is a server you connect through to reach another one, like OpenSSH's ProxyJump. MorphGate opens the connection to the jump host first and reaches the target from there.
Set a jump host
- Save the jump host itself as a host, with its own user and sign-in method.
- Open the target host's editor.
- Under Connect via, pick Jump host: and the host to go through.
- Save.
A group can set Connect via for all its hosts. A host that leaves the field on Direct connection then uses the group's jump host.
Chains
A jump host can have its own jump host, so you can chain hops. MorphGate follows the chain from the first hop to the target, up to eight hops, and refuses loops.
Every hop is a separate SSH connection with its own sign-in. Each hop's host key is checked against the key pinned for it before the next hop opens. A first-time hop asks you to trust its key, like any host. See SSH keys and host keys.
Jump hosts and VPNs
A VPN carries the first hop. When a host uses a jump host, its own VPN setting is replaced by the jump host's: the editor shows From the jump host: and that VPN. The target is then reached through the jump host, not through a VPN of its own.
Seeing the route
- The sidebar shows via and the jump host's label under a host's address.
- The host editor's Connection path lists this device, the VPN, each jump host and the target.
- Above a session, the route bar shows the same chain while you work. See Terminal sessions.
Limits
- A jump host must be in the same vault as the host that uses it.
- Tunnels and SFTP to a host use its whole route, jump hosts and VPN included.