Configuring MobaXterm: Proxy Settings for Jump Host SSH Connections

To configure MobaXterm for SSH connections through a jump host, you must set up a Proxy entry in the Session settings that defines the intermediate server. This allows your client to tunnel traffic securely from your local machine to the final destination via the gateway. Proper configuration ensures seamless authentication and network routing without manual command-line flags.

Creating the Jump Host Proxy Entry

The foundation of this setup is creating a specific session type designated as a proxy. Open MobaXterm and click on Session in the toolbar. In the dialog box that appears, select the SSH radio button. Crucially, check the box labeled Proxy. This action changes the interface options, allowing you to define the connection details for the intermediate server rather than the final target. Enter the hostname or IP address of your jump host in the Remote host field. Specify the correct port, which is typically 22 unless customized. Click OK to save this proxy session. You should now see this new session listed in your sidebar. It acts as the bridge, but it does not yet know where to send the data once connected.

Configuring the Target Server Session

Next, create the session for the actual server you wish to access. Again, go to Session > SSH. Enter the hostname or IP address of the final destination server. Ensure the Proxy checkbox remains unchecked for this session, as this is the endpoint, not the bridge. Save this session with a distinct name to avoid confusion. Once both sessions are created, you need to link them. Right-click the target server session (the one without the proxy check) and select Edit. Navigate to the Advanced SSH settings tab. Look for the Proxy dropdown menu. Select the name of the proxy session you created in the previous step. This tells MobaXterm to route all SSH traffic for this target through the specified jump host.

Authentication and Credential Management

Handling credentials across multiple hops can be complex. If your jump host and target server use different usernames or passwords, MobaXterm handles this automatically if configured correctly. In the Advanced SSH settings of the target session, you can specify a different Username for the final destination. The username for the jump host is defined within the proxy session itself. For enhanced security, consider using private key authentication. Generate an SSH key pair if you do not have one. Load the private key into MobaXterm’s SSH agent by navigating to Settings > Configuration > SSH tab. Add your private key file. When connecting, ensure the key is associated with the correct user. This method reduces the risk of password exposure during transit. If you encounter issues with keyboard-interactive authentication, verify that the jump host supports it. Some strict firewalls or configurations may block certain authentication methods. Using public key authentication is generally more reliable for jump hosts because it avoids interactive prompts that might hang the connection attempt.

Troubleshooting Common Connection Issues

Even with correct settings, connections may fail due to network restrictions or misconfigurations. Check the MobaTerm window at the bottom of the interface for error messages. A common error is "Connection refused," which usually indicates the jump host is unreachable or the SSH service is down on the intermediate server. Another frequent issue is timeout errors. This often happens when the jump host requires additional latency handling. Increase the timeout value in Settings > Configuration > SSH tab. Set the Timeout to a higher value, such as 30 seconds, to allow for slower handshakes through the proxy. Verify that your firewall rules permit SSH traffic on port 22 from your local machine to the jump host, and from the jump host to the target server. Network Address Translation (NAT) issues can also cause failures. Ensure the jump host has proper routing rules to forward packets to the target subnet. For deeper diagnostics, enable verbose logging. Right-click the session, select Edit, and check Verbose mode in the advanced settings. This provides detailed output in the terminal window, helping identify exactly where the handshake fails. Compare these logs against known working configurations. Related articles like How to Use SSH Jump Host(-J) Directive to Tunnel Command Line Options provide alternative methods for command-line users, while Importing Server Information from WinScp to Mobaxterm helps manage large inventories of servers efficiently.

Frequently Asked Questions

Can I use the same session for both the jump host and the target?

No, you must create two separate sessions. One is configured as a proxy for the jump host, and the other is the target session that references the proxy. Combining them into one session prevents MobaXterm from establishing the necessary two-hop connection chain.

What if my jump host uses a non-standard port?

You can easily accommodate non-standard ports by editing the proxy session. In the proxy session settings, simply change the port number from 22 to your specific port. The target session will automatically route traffic through this custom port without needing additional adjustments.

Does MobaXterm support SOCKS proxies for SSH jumps?

MobaXterm primarily supports SSH-based proxy chains for jump hosts. While it has general proxy settings, the SSH jump functionality relies on SSH tunneling. For SOCKS proxies, you may need to use external tools or configure your system’s network settings separately before launching MobaXterm.

Why does my connection time out after entering the password?

This often occurs if the target server rejects the forwarded authentication or if there is a network delay. Verify that the username and password for the target server are correct in the target session settings. Also, check if the jump host requires a second factor authentication that might be blocking the tunnel establishment.

How do I remove a proxy from an existing session?

Right-click the target session and select Edit. Go to the Advanced SSH settings tab. Clear the selection in the Proxy dropdown menu. Save the session. The next connection attempt will go directly to the target server without passing through any intermediate hop.