Most production networks put a single gateway in front of everything. A bastion, a jump host, a jump box — one machine that accepts SSH from the outside world, with the servers you actually care about sitting on a private network behind it, no public address of their own. The question is how to get through that gateway to the box behind it without making a mess of your keys. The clean answer is ProxyJump.
The bastion pattern, briefly
The reason to have a bastion is containment: only one host is exposed to the internet, so only one host is worth hardening, monitoring, and worrying about. The internal servers can't be reached directly at all — you have to go through the gateway. That's the whole design, and it's a good one. It only breaks when the way people traverse the bastion quietly undoes the containment.
There are three common ways through. Two of them do exactly that.
The two wrong ways
