Jump Hosts & Bastions

Overview

A jump host (bastion) is an SSH server you connect through to reach devices you can't reach directly, like OpenSSH's ProxyJump. NetStacks logs in to the jump host, opens a forwarded channel to the target, and runs a second SSH login to the target over that channel. The jump and the target each use their own credentials.

A jump can be either:

• a Jump Host record (Settings → Jump Hosts), or
• another saved session, so a bastion you already have as a session doesn't need to be entered twice.

Add a Jump Host

1. Create a credential profile for the bastion login if you don't have one (Settings → Profiles).
2. Open Settings → Jump Hosts.
3. Enter a Name (for example “Production Bastion”), choose the Profile, and enter the Host and Port.
4. Click Add Jump Host.

Deleting a jump host clears it from any sessions that used it.

Use a Jump

For one session

In the session's settings, on the SSH tab, set Jump under Jump (Bastion). Options are Inherit from profile, any saved session (under Sessions) or any jump host (under Jump Hosts).

For every session using a profile

In the credential profile's Connection tab, set Default Jump. Sessions and tunnels that use the profile go through it unless they choose their own jump.

For a tunnel

Standalone tunnels have a Jump (optional) field (see SSH Tunnels).

Connected tabs show a via <jump name> badge. When editing a session that other items use as their jump, the dialog shows Used as jump by: with the counts.

Which Jump Is Used

1. The jump set on the session (or tunnel).
2. Otherwise the credential profile's Default Jump.
3. Otherwise a direct connection.

What Goes Through the Jump

Troubleshooting