Awesome. Here is another version to support chaining multiple gateways:

  Host *%*
    Proxycommand ssh $(echo %h | rev | cut -d%% -f2- | rev) nc $(echo %h | rev | cut -d%% -f1 | rev) %p

usage:

    ssh gateway1%gateway2%target

(Not very clean, improvements welcome.)

A shorter version of the same thing:

  Host *%*
    Proxycommand bash -c "h=%h; ssh \${h%%\\%%*} nc \${h##*%%} %p"

It would be shorter and cleaner if I knew a way to apply string operators on a constant string rather than defining the intermediate variable $h.

That syntax gave me flashbacks to good old bang paths...

Very cool! Is there any security risk in running nc on the gateway this way?

A more featureful version of that hack:

https://github.com/ryancdotorg/ssh-chain