Jump hosts

A host behind a bastion is reached the way OpenSSH reaches it, with ProxyJump. The terminal, the host's files, its monitor and its tunnels all go through the jump host on one connection, so you log in once.

A host you add in Wayfinder

Add the jump host itself with File › New Host… (⌘N) and check that it connects.
Add the host behind it. Its address is the one the jump host uses to reach it, such as 10.0.4.31.
In Jump host, pick the bastion from the list, or type it as user@bastion.example.com:2222.

For more than one jump, list them in order, separated by commas: ops@bastion.example.com,10.0.4.1. The host is saved with a ProxyJump line, so ssh in any terminal can use it too once you choose Use These Hosts in Every Terminal in Settings › Connections.

A host in your own ssh_config

Write ProxyJump there as usual. Wayfinder reads the file as it is, so there is nothing to set in the app:

Host app-behind
  HostName 10.0.4.31
  User deploy
  ProxyJump ops@bastion.example.com

Since Wayfinder runs the Mac's own OpenSSH, an older ProxyCommand line works too.

When it does not connect

Connect to the jump host alone first. If that fails, so will every host behind it.
The jump host resolves the name. The address of the host behind it has to be one the bastion can reach, not one your Mac can.
"administratively prohibited" means the bastion does not allow forwarding. Its administrator turns on AllowTcpForwarding in its sshd_config.
Try it in Terminal. Copy ssh Command in the host's menu gives the command; add -v to see each step.

Next: Keys and SSH agents