SSH now has a -W netcat mode, so your ssh config can be simplified to:

       ProxyCommand ssh -W %h:%p <bastion>

this also means that netcat, or even a shell/ability to execute commands is not required on the remote bastion host.