How to ssh to a server via bastion(proxy) with key from the bastion(proxy) NOT origin

So I'm essentially trying to do this:

ssh [email protected] -t ssh bob2@test-vm

the above works fine if I just put it into the terminal, however I am having a hard time trying to replicate it via the .ssh config file.

Here's what I have inside the config file:

Host bastion
     HostName 35.192.152.35
     User bob2

Host test-vm
     User bob2
     FOrwardAgent yes
     ProxyCommand ssh bastion nc %h %p 2> /dev/null

However it comes up with an error saying "permission denied", invalid public key file? I came up with the above from this post: https://unix.stackexchange.com/questions/124078/how-to-ssh-to-a-server-using-another-server-with-key-from-the-second-server

Somehow it worked for the guy, but doesn't seem to work for me. I also tried allowing agent forwarding and TCP forwarding in the sshd_chroot config as well on all parties (origin, bastion, and server), but that didn't make a difference.

if I force specify the identity paths:

Host bastion
     HostName 35.192.152.35
     User bob2
     IdentityFile /Users/bob/.ssh/id_rsa

Host test-vm
     User bob2
     FOrwardAgent yes
     ProxyCommand ssh bastion nc %h %p 2> /dev/null
     IdentityFile /home/bob2/.ssh/id_ed25519

Then it comes up with the same error, in addition to saying that it couldn't find the directory "/home/bob2/.ssh/id_ed25519"

Anyone got any ideas?

Below works for me ... Almost same as yours except I do specify the IP address of final destination (maybe not relevant in your case) and I HAD TO COPY the key from the bastion to my local host as my ssh_config is finding key files here not on the bastion midway :

==== added to .ssh/config ====
Host mybastion
    HostName 133.35.41.9
    User bastuser
    IdentityFile /Users/bchapman/.ssh/bast_priv.key

Host mytarget
    HostName 109.0.1.38
    ProxyCommand ssh -q -W %h:%p mybastion
    User targuser
    IdentityFile /Users/bchapman/.ssh/targ_priv.key
==============

After that I can ssh mytarget, scp localfile mytarget:, etc just fine

It seems that you want your config let test-vm look for key in bastion. So I suggest:

1. Copy key file to bob2’s .ssh folder in bastion.
2. add ProxyCommand with ssh-add in your config.