often I have to download a file that isn't directly accessable via the first SSH connection. For example I'm on a Windows machine and I want to access another machine that is only accessable from lan. That means that I must first connect to a intermediate machine and SSH to the next one.It would be easy to use pscp to get the file, if it were available for the first machine. Could SSH port forwarding be used in this scenario?
Common multiple SSH connections file handling issue
ssh;ssh tunneling
Yes, SSH port forwarding can be used in this case, but you can also get warnings about invalid or incorrect host keys when attempting this.  Some SSH clients like OpenSSH track SSH host keys by domain or IP only and don't include the port number with it.  PuTTY appears to record the port number with the host key and should not suffer from this problem as long as your consistent with which port numbers you use for each host.  I'd recommend adding the port forwardings to a saved session in PuTTY.  You can then also save the additional sessions for the various remote hosts as saved sessions and use that with pscp/psftp.  You can start with any high number port for the forwarding such as 2220 and go up by one from there for each host you need to forward through an intermediate host.  Add to the saved session for intermediate local port forwards like port 2220 and destination remote1:22 and port 2221 with destination remote2:22 for remote hosts remote1 and remote2  Then create sessions for remote1 with destination localhost and SSH port 2220 and a session for remote2 with destination localhost and SSH port 2221.  To use sessions with pcsp/psftp use @session-name for the host.The problem occurs when either you have somehow associated a SSH host key with localhost and you attempt to connect to a local port that's being forwarded to a different computer.  With OpenSSH, I fixed this problem by using HostKeyAlias.  I added entries to my ~/.ssh/config like this:Host intermediateHostName intermediate.example.orgLocalForward 2220 remote1.example.org:22LocalForward 2222 remote2.example.org:22Host remote1HostName localhostPort 2220HostKeyAlias remote1.example.orgHost remote2HostName localhostPort 2221HostKeyAlias remote2.example.orgMy preferred fix, though, was when I deployed IPv6 on my home and work network and I no longer had to worry about connecting to an intermediate server first to get to my final destination.