Running an SSH bastion host: ProxyJump on the client, and restricting what the jump host may forward

Goal

Let users reach internal hosts through a single SSH jump host without giving that jump host's SSH server a blank cheque to forward traffic anywhere.

Prerequisites

A bastion host reachable from the client's network, with SSH access to internal hosts from the bastion; administrative access to both the client's ssh_config and the bastion's sshd_config.

Steps

1. On the client (or its ~/.ssh/config), configure the hop with ProxyJump: a Host block for the internal target with ProxyJump bastion-user@bastion-host and its real HostName. The option specifies one or more jump proxies, and multiple proxies separated by commas are visited sequentially, so a chain of bastions is also possible.
2. On the bastion's sshd_config, do not leave forwarding at its default: AllowTcpForwarding specifies whether TCP forwarding is permitted (default yes, local and remote). ProxyJump asks the bastion to open a TCP connection to the target (ssh -W), which sshd treats as local forwarding, so AllowTcpForwarding no breaks it. Keep no as the global default for administrators' own logins and grant jump users local only (step 4), so remote (-R) forwarding stays off; set X11Forwarding no and AllowAgentForwarding no as well.
3. Limit where jumps may go with PermitOpen, which specifies the destinations to which TCP port forwarding is permitted as host:port pairs, for example PermitOpen 10.0.1.10:22 10.0.1.11:22. It applies to ProxyJump too, and destinations are compared as the client names them, so use the same names or addresses as the clients' HostName.
4. Put the exception in a Match block at the end of the file, for example Match Group jump-users followed by indented AllowTcpForwarding local, PermitOpen ..., PermitTTY no and ForceCommand /usr/sbin/nologin (jump connections open no shell, so this only denies interactive logins). A Match block introduces a conditional block whose keywords override the global section's settings until the next Match line or end of file.
5. Log what passes through: LogLevel VERBOSE records the key fingerprint of each login; forwarding requests refused by PermitOpen are logged at the default level, while permitted destinations appear only at DEBUG levels.
6. Validate with sshd -t, keep an existing root session open, then reload (systemctl reload ssh on Debian and Ubuntu, sshd on RHEL; existing sessions stay up) and confirm from a second terminal that the ProxyJump path still works and that an unlisted destination is refused.

Expected result

A jump user reaches only the listed internal hosts via ProxyJump and gets no shell on the bastion; forwarding to an unlisted destination, or from an account without the Match exception, fails and is logged with user and target.

Limits and test basis

Restricting forwarding on the bastion does not restrict what the internal target hosts themselves allow — apply the same review there. sshd_config(5) notes that disabling forwarding does not improve security while users keep shell access, since they can run their own forwarders. Match blocks are evaluated in file order and, for most keywords, the first obtained value wins; test after every change with a non-privileged account, not only as an administrator.