Connect through a jump host (bastion) on your Mac

Many servers aren’t reachable directly — you have to go through a bastion (a jump host) first. Bifrost handles this for you: set a jump host on the target connection and it tunnels through automatically, the same idea as OpenSSH’s ProxyJump, but without editing ~/.ssh/config.

How it works

You define the bastion once as its own connection, then tell the target connection to reach it through that bastion. When you open the target, Bifrost first connects to the jump host, then opens the real session to the target from there — the target only ever sees traffic from the bastion, exactly as your security team expects.

1. Add the bastion as a connection

Create a normal SSH connection for the bastion itself (host, username, key or password). Test that it opens on its own first — if the bastion doesn’t connect, nothing behind it will.

2. Point the target at the jump host

On the connection for the private server, set its jump host to the bastion connection you just made. Fill in the target’s own host and credentials as usual — using the address the bastion can resolve (often a private IP or internal hostname).

Open the target: Bifrost connects to the bastion, then hops to the server behind it.

Multiple hops

Need to go through two bastions? Chain them: the first bastion is the jump host of the second, and the second is the jump host of the target. Bifrost walks the chain in order.

Works beyond the terminal

A jump host set on a connection also applies when you open it as SFTP — file transfers ride the same hop, so you can browse files on a server that’s only reachable through the bastion.


Troubleshooting

The bastion connects, but the target times out. The target’s address must be resolvable from the bastion, not from your Mac. Use the private IP or internal hostname the bastion can reach, and make sure the bastion can actually SSH to it.

Authentication fails only on the target. The bastion and the target can need different credentials. Check that the target connection has its own correct username and key/password, separate from the bastion’s.

Still stuck? Get in touch — include the exact error text Bifrost shows.

← All guides