What prevents SSH port forwarding from the jump box (besides, possibly, policy)? That’s been my go to whenever indirect access is required and tools want to connect directly to hosts.