How to set up SSH bastion access into a private subnet

Reach instances on a private subnet through a single hardened jump host, so the private instances never need a public address.

In this guide you will:

Create two security groups: one for the bastion, one for the private instances
Launch the bastion on the private network and give it the single floating IP this pattern needs
Launch private instances with no floating IP
Configure SSH ProxyJump on your workstation to reach the private instances through the bastion
Verify the connection and tear the pattern down

Prerequisites

ConsoleLogged in to the Quake AI console
CLIOpenStack CLI installed and authenticated (clouds.yaml or openrc sourced)

Windows: CLI examples use bash. Set up a Linux CLI environment on Windows before proceeding.

An SSH key pair uploaded to your account
A private network, subnet, and router already in place. Follow How to create a VM on a private network to build the network, subnet, and router used below (my-private-net, my-private-subnet, attached to PublicStatic)

Step 1. Create the security groups#

Create two security groups. The bastion group allows SSH only from your administrators' source addresses. The private group allows SSH only from the bastion group, so the private instances accept connections from the jump host and nothing else.

Replace YOUR_ADMIN_CIDR with the public address range your administrators connect from, for example 203.0.113.10/32 for a single static address.

Go to Network > Security Groups > Create Security Group.
Name the first group bastion-sg and select OK.
On the bastion-sg row, open the Settings gear icon dropdown and select Create Rule.
Select SSH for the protocol (TCP port 22). Set Source to CIDR and enter your administrators' range in CIDR (for example 203.0.113.10/32). Select OK.
Select Create Security Group again, name the second group private-sg, and select OK.
On the private-sg row, open the Settings gear icon dropdown and select Create Rule.
Select SSH for the protocol (TCP port 22). Set Source to Security Group and select bastion-sg in the Security selector that appears. Select OK.

Step 2. Launch the bastion and assign one floating IP#

Launch a small instance on the private network with the bastion-sg security group, then associate the single floating IP. A shared flavor such as s1a.small is enough: the bastion forwards connections, it does not run application load.

Go to Compute > Instances > Create Instance.
On Base Config (Step 1), name the instance bastion, select us-east-1a, and choose a small flavor such as s1a.small (under the Shared Resources tab).
Select Ubuntu-22.04 as the image, set disk to 10 GiB, and check Deleted with the instance.
Select Next: Network Config and choose my-private-net.
For subnets, select Automatically Assigned Address.
Select the default and bastion-sg security groups. Clear any group that allows broad inbound SSH.
Select Next: System Config, choose Keypair, and select your key.
Select Next: Confirm Config and confirm.
On the Instances list, open the bastion row's Networking icon menu and select Associate Floating IP.
Select the bastion's private IP address, allocate one new floating IP from PublicStatic, and select OK.

Step 3. Launch the private instances#

Launch each application instance on the same private network with the private-sg security group and no floating IP. With no floating IP and a security group that only admits the bastion, these instances are reachable from the bastion and not from the public internet.

Go to Compute > Instances > Create Instance.
On Base Config (Step 1), name the instance app-1, select us-east-1a, and choose a flavor for your workload.
Select an image, set the disk size, and check Deleted with the instance.
Select Next: Network Config and choose my-private-net.
For subnets, select Automatically Assigned Address.
Select the default and private-sg security groups.
Select Next: System Config, choose Keypair, and select your key.
Select Next: Confirm Config and confirm.
Do not associate a floating IP with this instance.

Step 4. Configure SSH ProxyJump on your workstation#

ProxyJump tells your SSH client to open a connection to the bastion first, then tunnel through it to the private instance in a single command. Your private key stays on your workstation: the bastion forwards an encrypted channel and never sees the key material.

Add a block to your ~/.ssh/config, replacing the floating IP and private address with the values from Steps 2 and 3:

Host bastion
    HostName FLOATING_IP_ADDRESS
    User ubuntu
    IdentityFile ~/.ssh/my-keypair

Host app-1
    HostName 192.168.200.0
    User ubuntu
    IdentityFile ~/.ssh/my-keypair
    ProxyJump bastion

Set HostName for app-1 to the private address that openstack server show app-1 reported. With this config, one command reaches the private instance through the bastion:

bash

ssh app-1

To connect without editing ~/.ssh/config, pass the jump host inline with -J:

bash

ssh -J ubuntu@FLOATING_IP_ADDRESS [email protected]

Verify the connection#

Connect to the private instance through the bastion:

bash

ssh app-1

On first connection your SSH client prompts you to accept the host key for both the bastion and the private instance. Type yes for each. Your prompt changes to ubuntu@app-1, which confirms the session terminated on the private instance after transiting the bastion.

Confirm the private instance is not reachable directly. A connection straight to its private address from your workstation, without the jump, times out because no floating IP and no public route exist:

bash

ssh -o ConnectTimeout=5 [email protected]

Type logout to end the session.

Harden the bastion#

The bastion is the one host in this pattern exposed to the internet, so treat it as a security boundary. Beyond the full security hardening checklist, apply these bastion-specific controls:

Keep bastion-sg scoped to your administrators' source range. Do not widen port 22 to 0.0.0.0/0.
Disable password authentication and root login in /etc/ssh/sshd_config (PasswordAuthentication no, PermitRootLogin no), then reload sshd.
Restrict who can log in with AllowUsers or AllowGroups so only operator accounts reach the bastion.
Apply operating system security updates on a schedule. A jump host that lags on patches becomes the weakest link.
Run nothing else on the bastion. A single-purpose host has a smaller attack surface than one that also serves an application.

Tear down#

Remove the pattern in reverse order. The single floating IP is released in the second step.

Delete each private instance (app-1 and any others) under Compute > Instances.
On the bastion row, open the Networking icon menu and select Disassociate Floating IP, then release it under Network > Floating IPs > Release.
Delete the bastion instance.
Delete the private-sg and bastion-sg security groups under Network > Security Groups.

Leave the private network, subnet, and router in place if other workloads use them. To remove them as well, follow the teardown steps in How to create a VM on a private network.

How to set up SSH bastion access into a private subnet

How to set up SSH bastion access into a private subnet

Step 1. Create the security groups#

Step 2. Launch the bastion and assign one floating IP#

Step 3. Launch the private instances#

Step 4. Configure SSH ProxyJump on your workstation#

Verify the connection#

Harden the bastion#

Tear down#

See also#

Usage Guidelines

See Also