Using a SSH bastion, but only when I'm touching grass

subscribe

July 21, 2026

Using a SSH bastion, but only when I'm touching grass

I’m a few years into my homelab. (might go into a bit more detail about that<br>at some point!), and I often need to ssh into one of my servers.

At home, I can just do this by using a domain name like:

ssh ahoy.m.example.ca<br>ssh bread.m.example.ca

I have set up Split-Horizon DNS at home using DNSMasq, so these domains resolve but<br>only at home.

When I’m outside, I use a a ‘bastion’ server that I can ssh into and hop<br>to another server. It’s on a ‘secret’ port.

To automatically tell SSH to go via the bastion server, I have this in my ~/.ssh/config:

Host *.m.example.ca<br>ForwardAgent yes<br>User evert<br>ProxyCommand ssh -q -W %h:%p -l evert bastion.example.ca -p 6767

bastion.example.ca does resolve to a real IP (my home IP). The annoyance with<br>this is that if I use one of the above commands, I always go through the bastion<br>whether I’m home or not.

I recently found about about the Match and ProxyJump command, and cludged<br>together this:

Match host *.m.example.ca exec "! getent hosts %h >/dev/null"<br>ForwardAgent yes<br>User evert<br>ProxyJump evert@bastion.example.ca:6767

This works the same as before, except this rule only kicks in if the command<br>command getent hosts %h fails.

The ProxyJump is a slightly simpler command from ProxyCommand. I think this<br>has been around for a bit, but I’ve just been copy-pasting ProxyCommand from<br>previous configs for a decade+.

You might not have a DNS setup like this, and might be using .local domains<br>to access local servers, if this also work, HOWEVER:

Match host *.local exec "! getent hosts %h >/dev/null"<br>HostName %h<br>ForwardAgent yes<br>User evert<br>ProxyJump bastion.example.ca:6767

Every time you do this, you computer likely first<br>broadcasts on your local network it’s looking for that machine. .local / MDNS<br>also tends to be a bit slower when you’re local, and given that you’re paying<br>that cost. ForwardAgent agent can also make this extremely dangerous because<br>someone might impersonate target.local and get access to your entire SSH keychain.<br>So maybe for that case it’s not the worst thing to just always go<br>through a bastion server. If so, this config is for you:

Host *.local<br>HostName %h<br>ForwardAgent yes<br>User evert<br>ProxyJump bastion.example.ca:6767

This always go through the bastion for every SSH connection to a .local host.

Looking for a CTO or senior developer for your next project? I'm looking for contracts or full-time gigs!<br>Check out my resume or drop me a line!

-->

Bad Gateway is Toronto-based team of software engineers. We build good APIs and websites.

Email us

-->

Web mentions