My favorite trick (in .ssh/config):

  Host *.internal.workdomain.com
  ProxyCommand ssh gateway.workdomain.com nc %h 22
  ForwardAgent yes
  User <username>

Then you can type

  ssh bender.internal.workdomain.com

and ssh will automatically connect through the gateway to the (normally inaccessible) internal node. ForwardAgent will pass the credentials through. (If you copy this blindly, note that this requires netcat). This configuration lets you pretend (to tools like scp, rsync-over-ssh, etc) that you have direct access to the machine in question, even when it goes through a gateway machine:

  scp config bender.internal.workdomain.com:
  scp bender.internal.workdomain.com:logfile .