ssh tunnelling chain

In OpenSSH, I use this setup when I need tunnels. This allows me to directly type sftp server3 without having to worry about manually starting the server2 and server1 tunnels first.

# ~/.ssh/config# to connect to server2, tunnel through server1Host server2ProxyCommand ssh server1 nc %h %p# to connect to server3, tunnel through server2Host server3ProxyCommand ssh server2 nc %h %p

To be more complete, I usually use ssh -oCiphers=arcfour128,arcfour256,arcfour,blowfish-cbc -oControlMaster=no -oForwardX11=no -oForwardAgent=no -oPermitLocalCommand=no -oClearAllForwardings=yes server1 nc %h %p as the ProxyCommand.

• The ssh connection being tunneled is already encrypted, so there's no point in using the heavier aes/3des for the outer layer; arcfour and blowfish are faster.
• The rest of the -o**** settings are out of paranoia, so that nothing breaks even if a Host server1 stanza with really odd settings is added to ssh_config.

Similarly, you can configure PuTTY to use the proxy command plink -P %proxyport -pw %pass %user@%proxyhost nc %host %port, and set the proxy hostname/port/user/password in the Connection/Proxy configuration pane accordingly. plink and the rest of the PuTTY suite (pscp, psftp, etc.) load anything saved in PuTTY's graphical configuration; hopefully WinSCP does too. (I don't use it, so I'm not too familiar with its features.)

The first solution that leaps to mind is to tunnel one local port to each of your servers. Since SSH uses port 22, we'll use each SSH connection to tunnel a local port to the next server's port 22.

When you open PuTTY, you're met with the PuTTY Configuration dialog. The two categories you'll need to edit are "Session" and "Connection→SSH→Tunnels".

1. Open a copy of PuTTY. Use these settings:

   • Connect to host

     • Host name: server1
     • Port: 22

   • Tunnel a port

     • Local mode
     • Source port: 15500

     • Destination: server2:22 (the secure shell port)

       

   Now, every time you connect to port 15500 on your local machine, your connection is being tunneled to port 22 on server2.

2. Open a copy of PuTTY. Use these settings:

   • Connect to host
     • Host name: localhost
     • Port: 15500
   • Tunnel a port
     • Local mode
     • Source port: 15501
     • Destination: server3:22 (the secure shell port)

3. Open a copy of PuTTY. Use these settings:

   • Connect to host
     • Host name: localhost
     • Port: 15501
   • Tunnel a port
     • Local mode
     • Source port: 15502
     • Destination: server3:22 (the secure shell port)

4. Use WinSCP to connect to localhost on port 15502. Your connection will be tunneled as if you're connecting to server3 directly.

Let me know in the comments whether this works for you. Good luck!

This method is similar to the way you can use proxycommand in the open ssh config file.

A prerequisites for this method is that Pageant must be used with public key authentication by all intermediate (proxy) hosts otherwise you will end up with a flashing cursor and nothing else. To learn more about Pageant, PuTTYgen and public keys see:
http://the.earth.li/~sgtatham/putty/0.62/htmldoc/Chapter8.html#pubkey
http://the.earth.li/~sgtatham/putty/0.62/htmldoc/Chapter9.html#pageant

We have four machines accessible in this order
PuttyPC -> server01 -> server02 -> server03

For server01 we have a Putty saved session as:
Main Window: user1@server01 // port 22 // SSH
Save this session as server01

For server02 we have a Putty saved session as:
Main Window: user2@server02 // port 22 // SSH
Proxy config window: type local // proxy command plink -load server01 -nc %host:%port
Save this session as server02

For server03 we have a Putty saved session as:
Main window: user3@pc3 // port 22 // SSH
Proxy config panel: type local // proxy command plink -load server02 -nc %host:%port
Save this session as server03

This means that the saved session for server03 will call the saved session for server02 and server02 saved session will call the server01 session.