July 21, 2026

Using a SSH bastion, but only when I'm touching grass

I’m a few years into my homelab. (might go into a bit more detail about that at some point!), and I often need to ssh into one of my servers.

At home, I can just do this by using a domain name like:

ssh ahoy.m.example.ca
ssh bread.m.example.ca

I have set up Split-Horizon DNS at home using DNSMasq, so these domains resolve but only at home.

When I’m outside, I use a a ‘bastion’ server that I can ssh into and hop to another server. It’s on a ‘secret’ port.

To automatically tell SSH to go via the bastion server, I have this in my ~/.ssh/config:

Host *.m.example.ca
    ForwardAgent yes
    User evert
    ProxyCommand ssh -q -W %h:%p -l evert bastion.example.ca -p 6767

bastion.example.ca does resolve to a real IP (my home IP). The annoyance with this is that if I use one of the above commands, I always go through the bastion whether I’m home or not.

I recently found about about the Match and ProxyJump command, and cludged together this:

Match host *.m.example.ca exec "! getent hosts %h >/dev/null"
    ForwardAgent yes
    User evert
    ProxyJump evert@bastion.example.ca:6767

This works the same as before, except this rule only kicks in if the command command getent hosts %h fails.

The ProxyJump is a slightly simpler command from ProxyCommand. I think this has been around for a bit, but I’ve just been copy-pasting ProxyCommand from previous configs for a decade+.

You might not have a DNS setup like this, and might be using .local domains to access local servers, if this also work, HOWEVER:

Match host *.local exec "! getent hosts %h >/dev/null"
    HostName %h
    ForwardAgent yes
    User evert
    ProxyJump bastion.example.ca:6767

Every time you do this, you computer likely first broadcasts on your local network it’s looking for that machine. .local / MDNS also tends to be a bit slower when you’re local, and given that you’re paying that cost. ForwardAgent agent can also make this extremely dangerous because someone might impersonate target.local and get access to your entire SSH keychain. So maybe for that case it’s not the worst thing to just always go through a bastion server. If so, this config is for you:

Host *.local
    HostName %h
    ForwardAgent yes
    User evert
    ProxyJump bastion.example.ca:6767

This always go through the bastion for every SSH connection to a .local host.