Don't proxy to bastion itself.
Use ssh -W.