Can a previously define Host be used as a Hostname in .ssh/config file for a tunnel configuration using LocalForward?

Question

So, I have a bunch of servers that are only accessible thru a bastion host.

My bastion host, however has a dynamic IP which change randomly.

For ssh'ing into the various server, I simply have a .ssh/config with a ProxyJump referencing the host of my bastion server so that I only need to change the IP at one place. i.e :

Host preprod_jumphost
    Hostname 123.123.123.123
    Port 22
Host target_host1
    Hostname 201.201.201.201
    ProxyJump preprod_jumphost
Host target_host2
    Hostname 201.201.201.202
    ProxyJump preprod_jumphost

By changing the ip of 123.123.123.123 to whatever is the new one all my other host are correctly updated.

However, I have some service which I need to connect to using local forward (db mainly) that I can't SSH into the server.

I tried using the Host alias in the Hostname like:

Host db_preprod
        Hostname  preprod_jumphost
        LocalForward  5432 201.201.201.111:5432

however, when I run ssh db_preprod I get:

ssh: Could not resolve hostname preprod_jumphost: Name or service not known

If I replace the Hostname by the dynamic ip as in:

Host db_preprod
        Hostname  123.123.123.123
        LocalForward  5432 201.201.201.111:5432

it works. I can ssh db_preprod and the psql -UYYY -d XXX -p 54332 -h localhost works.

Since I have a lot of db and other service that I need access to is there a way to reference preprod_jumphost define in another Host for my various LocalForward definition. That way I don't have a bunch of Host config to update when the ip of the bastion host is changed?

While I know I could have multiple LocalForward defined directly in my Host preprod_jump host as

Host preprod_jumphost
    User ubuntu
    Hostname 123.123.123.123
    Port 22
    LocalForward  5432 201.201.201.111:5432
    LocalForward  5433 201.201.201.122:5432
    LocalForward  5434 201.201.201.133:5432
    LocalForward  5435 201.201.201.144:5432

I don't want to have all the port continuously forward the moment I ssh somewhere (Especially for my prod env). I want to explicitly start a ssh session when I need it.

Answer 1

You might be trying to make this too complicated. Just add the forwards to the target host config. Don't worry about the ProxyJump when it comes to fowarding. The way ProxyJump works means you can ignore it for this purpose, since the forward that will happen will be across the ssh connection that is established from your machine to the far target.

So using the below just make an ssh connection to db_preprod, which will do the ProxyJump, and make the forwards.

Host preprod_jumphost
    Hostname 123.123.123.123
    Port 22
Host db_preprod
    ProxyJump preprod_jumphost
    Hostname 201.201.201.111
    LocalForward  5432 201.201.201.111:5432

Since I have a lot of db and other service that I need access

You could just make a single SOCKS forward, and do everything via SOCKS. The dynamic nature of the socks proxy basically means you can tunnel ANY tcp protocol via the ssh connection without lots of configured forwards, assuming you have a client software capable of using SOCKS.

Host preprod_jumphost
    Hostname 123.123.123.123
    Port 22
    DynamicForward 8888