How to Reach Remote Sites Safely With an SSH Jump Host

Step by step

1. Build the jump host

   Install a minimal Linux, apply updates, create one account per engineer with their public key, and disable password logins.

2. Allow SSH only to the jump host

   On the gateway firewall, allow TCP 22 from your office or VPN range to the jump host only. Block SSH from the Internet to every other device.

3. Allow the jump host to the devices

   Inside, allow SSH and HTTPS from the jump host to switches, gateways and edge servers on the management VLAN.

4. Connect through it

   OpenSSH's ProxyJump makes the hop transparent. Your key is used end to end; nothing is stored on the jump host.

   ssh -J alice@bastion.example.com admin@10.1.99.12
   

5. Save it in your SSH config

   Add host aliases so every engineer uses the same safe path.

   # ~/.ssh/config
   Host bastion
     HostName bastion.example.com
     User alice
   Host site1-*
     ProxyJump bastion
     User admin
   Host site1-core
     HostName 10.1.99.2
   

6. Log and limit

   Send the jump host's auth log to your syslog server and add fail2ban or rate limits on port 22.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.