iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A jump server gives authorized users a controlled route to machines on a private network without exposing those machines’ management ports directly to the internet. To set one up, choose between operating an OpenSSH bastion yourself and using a managed access service; then scope who can connect, which destinations they can reach, and how sessions will be audited.
What a jump server does
A jump server—also called a bastion host or jump box—is an intermediary between an external network and private resources. AWS defines a bastion host as “a server that provides a single point of access from an external network to the resources located in a private network.” AWS Prescriptive Guidance
With an SSH jump host, your SSH client connects to the gateway and asks it to forward a TCP connection to the private target. The target can remain on a private address and need not accept public SSH connections. The gateway becomes a privileged access boundary, however—not a security guarantee by itself.
Recommended Free Tools
Choose the access pattern before deploying
The right design depends on your infrastructure, identity controls, connection method, and audit requirements. These options are not interchangeable: a self-managed host gives you direct control but requires operation, while managed services shift some gateway functions to the cloud provider and impose their own prerequisites.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
| Option | Gateway or host to operate | Exposure and target address | Identity and access | Logging and prerequisites |
|---|---|---|---|---|
| OpenSSH ProxyJump | You operate and secure a bastion VM. | The bastion must be reachable by SSH from authorized clients; the target can stay private. | You manage SSH keys, host access, and which destinations are reachable. | Logging and audit capture are your responsibility. Uses an SSH client that supports ProxyJump. |
| AWS Systems Manager SSH | For supported managed nodes, AWS documents SSH through Session Manager without maintaining a bastion. | Can avoid inbound port exposure; the managed node must be reachable through Systems Manager. | IAM policies can allow or deny users, groups, or roles. | Session Manager does not log SSH session contents because SSH encrypts them. The managed node needs SSM Agent 2.3.672.0 or later; the client needs Session Manager plugin 1.1.23.0 or later. AWS prerequisites and configuration |
| Azure Bastion | Azure Bastion is the managed gateway. | Portal or native-client access to VMs without a public IP on the target; supported connection modes depend on SKU and settings. | Available authentication methods depend on connection method and include Microsoft Entra ID, username/password, and SSH keys. | The target must allow SSH on port 22 or a custom port reachable from Bastion. Native-client SSH and IP-based connections require Standard and relevant features; portal-based access is listed at Basic or higher. Azure Bastion overview Azure SSH connection guide |
If you already manage Linux hosts with SSH and want control over the gateway, ProxyJump is a straightforward fit. If you want cloud identity controls and fewer inbound openings, evaluate the provider-managed approach—but check its specific connection and logging limitations before adopting it.
Set up a self-managed OpenSSH jump host
This route assumes you have a bastion reachable by authorized administrators and a private target reachable from that bastion. The example uses placeholder hostnames; replace them with your actual DNS names or IP addresses.
1. Restrict the network path
- Allow inbound SSH to the bastion only from approved administrator networks or other tightly controlled sources.
- Allow the bastion to reach only the private targets and ports required for administration. Do not make it a general-purpose route into the network.
- Keep the target’s management interface private and permit SSH from the bastion’s network path, not from arbitrary internet sources.
- Apply your operating system’s security updates and use strong authentication and narrowly scoped accounts.
Exact firewall and routing rules depend on your network and hosting environment. The goal is to limit both who can reach the gateway and what the gateway can reach.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
2. Connect with ProxyJump
OpenSSH’s -J option (ProxyJump) connects through the jump host to the final destination. For example:
ssh -J admin@bastion.example.net ops@10.20.1.15The client authenticates to bastion.example.net as admin, then reaches the private host at 10.20.1.15 as ops. The private target must be resolvable or reachable from the jump host. OpenSSH documents ProxyJump and support for multiple jump hosts in its ssh(1) manual.
3. Save a reusable client configuration
Add host entries to your local SSH client configuration, usually ~/.ssh/config:
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Host bastion-prod
HostName bastion.example.net
User admin
Host app-private
HostName 10.20.1.15
User ops
ProxyJump bastion-prodThen connect with ssh app-private. Keep private keys protected, and ensure each account and key has only the access it needs. OpenSSH also supports specifying multiple jump hosts when a network requires more than one intermediary.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute4. Decide how to handle agent forwarding
ProxyJump does not require agent forwarding for the usual connection pattern. OpenSSH warns that a user able to access a forwarded agent socket may perform authentication operations using identities loaded in that agent, even though the key material itself is not revealed. Avoid enabling forwarding by default; use it only when the access design requires it and the intermediate hosts are trusted.
5. Add operational controls
- Review gateway accounts and authorized keys regularly; remove access when roles change.
- Monitor successful and failed logins, administrative activity, and changes to SSH or network policy.
- Keep the bastion patched and limit installed software and services to what administration requires.
- Test access from an approved client and verify that an unapproved source cannot reach the bastion or that the bastion cannot reach unrelated private systems.
Use AWS Session Manager for SSH access
AWS documents SSH connections to managed nodes through Session Manager without maintaining a bastion host. The managed node needs SSH running and SSM Agent version 2.3.672.0 or later. The connecting client needs Session Manager plugin version 1.1.23.0 or later. Configure the SSH client to invoke aws ssm start-session through a ProxyCommand, following the current AWS setup guide. IAM policies can control which users, groups, or roles may connect.
Rank #4
- Runs UniFi Network for full-stack network management
- Manages 30+ UniFi Network devices and 300+ clients
- 1 Gbps routing with IDS/IPS
- Multi-WAN load balancing
- 0.96" LCM status display
There is an important audit trade-off: AWS states that Session Manager logging is unavailable for SSH or port-forwarding sessions because SSH encrypts the session data and Session Manager acts as a tunnel. If you need a record of commands or session content, design and validate a separate audit method rather than assuming Session Manager captures it.
A different AWS pattern uses a bastion in a private subnet with IAM-controlled access, Session Manager, and EC2 Instance Connect, with no inbound ports exposed to the public internet. It uses Systems Manager interface VPC endpoints and temporarily pushes a public key to the bastion; AWS says that key remains available for 60 seconds. AWS labels the example a proof of concept and says it assumes Amazon Linux 2, which its page describes as nearing end of support. Adapt the design and select a supported operating-system version before using it in production. AWS bastion pattern
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use Azure Bastion for VM access
Azure Bastion provides portal-based and native-client access to virtual machines without requiring a public IP on the target VM. The connection method and available features depend on the Bastion SKU: Microsoft lists browser-based portal access at Basic or higher, while native-client SSH and IP-based connections require Standard and the relevant features enabled. Authentication options vary by method and include Microsoft Entra ID, username/password, and SSH keys.
The Linux VM must allow SSH on port 22 or a custom port that Bastion can reach. Configure network security groups and segmentation for both the Bastion subnet and target VM subnet. Microsoft’s security guidance, dated August 10, 2026, recommends aligning deployment with network-segmentation principles; required traffic varies by deployment and connection mode, so use the current Azure Bastion security guidance rather than copying a generic port list.
Check the design before granting access
- Identity: Can access be tied to individual users or roles, and can permissions be revoked promptly?
- Reachability: Is the gateway reachable only from intended sources, and can it reach only approved destinations and ports?
- Target exposure: Can the target remain without a public management IP or inbound management rule?
- Credentials: Are SSH keys or other credentials protected, rotated or revoked when needed, and not broadly shared?
- Audit: Does the chosen method capture the information your policy requires? A connection log is not necessarily a record of commands or session content.
- Operations: Who patches the gateway or managed nodes, reviews access, and responds to suspicious activity?
A jump server is one control in an access design. Its value depends on the restrictions around identity and network reachability, plus the maintenance and monitoring applied to the gateway or managed service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
