SSH port forward NAT rules

[frwlnb]

Do I have to create a port forward NAT rule for every server that I want to access via SSH from behind pfSense - including those I indirectly access?

What I mean is - I prefer to ssh to one server that's NAT'd to the puplic IP address and then ssh to the others from that.

Because I'm a noob I have a NAT port forward rule for ssh for each server I access, which is probably 'wrong' and insecure.

Is this unnecessary? Can I just port forward ssh on the first server then ssh to the others without forwarding their ports too?

[danswartz]

Not only can you, the extra forwards are useless.  If you are ssh'ing to server X, and then once you get to X you say 'ssh Y', that second ssh is invisible to pfsense, since the traffic is inside the first ssh tunnel.