SSH Jump Host (Bastion) with ProxyJump: The Clean, Modern Way

A jump host (also called a bastion host) is an SSH-accessible machine that sits in between your laptop and a private/internal server. You SSH into the jump host first, then “hop” into the internal machine without exposing the internal machine to the internet.

ProxyJump is the modern OpenSSH feature that makes this setup simple, readable, and maintainable.

The Goal

You have:

• Gatekeeper (Jump Host / Bastion) on the public internet (WAN IP, custom port 422)
• Workstation (Internal Server) reachable only from inside your network (local IP)

You want to connect like this:

Your Laptop → Gatekeeper (WAN) → Workstation (LAN)

With an SSH config like:

Host gatekeeper
    HostName <wanip>
    User soulevil
    Port 422

Host workstation
    HostName <localip>
    User soulevil
    ProxyJump gatekeeper

Then you can simply run:

ssh workstation

…and OpenSSH automatically routes through gatekeeper.

Why Use a Jump Host?

1) Keep internal servers private

Your internal workstation stays on LAN (or private subnet/VPN), not exposed to the internet.

2) Single hard target

You harden one public entry point (gatekeeper) instead of hardening every internal server.

3) Auditing and control

You can log/monitor SSH access at the gatekeeper, rate-limit, and enforce policies.