SSH & Remote Administration

Stop hunting for the right jump host with SSH config matches

🧩 The Challenge

Managing a dozen different VPCs or data centers is a nightmare when you have to keep track of which bastion host guards which private subnet. You end up wasting ten minutes just checking docs to see which server you need to tunnel through first.

💡 The Fix

Use the Match block in your local ssh_config to chain your jump hosts automatically based on the target IP range. It makes connecting to deep internal infrastructure feel like you’re just SSHing to localhost.

Host 10.50.*.*
ProxyJump bastion-internal.company.com
User yourname

Host 10.60.*.*
ProxyJump jumpbox-secondary.provider.net
User yourname

⚙️ Why It Works

SSH looks at your config top to bottom and applies the first block that matches the host string, which means your specific tunnel rules take precedence over global defaults. It saves you from manual proxy command chains and keeps your .ssh/config from becoming a mess.

🚀 Pro-Tip: Add the -v flag if you ever get stuck; it shows you exactly which jump host it’s trying to talk to.

Linux Tips & Tricks | © ngelinux.com | 10/11/2026