Jump hosts and port forwards

Jump hosts

A jump host is a machine Conn signs in to first, and reaches the machine you want from there. Use one when the machine isn't reachable from where you are, but is from another machine you can reach: a bastion in front of an office network, or a home server that can reach the rest of your lab.

Setting one up

1. Add the jump host itself to Conn as an ordinary host, with its own sign in, and connect to it once so Conn knows its SSH key.
2. Open the machine behind it, choose Edit, and under Jump host set Reach It Through to the jump host. Nothing, connect directly is the default.
3. Connect as usual. Conn goes through the jump host for you.

• Chains: a jump host can have a jump host of its own. Edit Host lists the chain from this machine's own jump host outward, for example Chain: Gateway, then Bastion. Conn reaches Bastion first.
• Hosts that would lead back to the same machine aren't offered, so a chain can't go round in a circle.
• From an SSH config: pasting a config whose Host has a one-machine ProxyJump sets that host's jump host, matching the jump host by its alias or address, in the paste first, then among your hosts. If neither has it, the jump host is left empty: add that machine and set Reach It Through. A ProxyJump with more than one machine, or a ProxyCommand, can't be imported.

What goes through it

A host with a jump host connects through it, as ssh -J does:

• Terminal, opening and reconnecting;
• Files, and New Session's folder browser;
• Screen, when it goes over SSH, and a file dropped onto a screen;
• port forwards, group runs, and Conn's own checks of your tmux sessions;
• Wake, when the machine is on another network, signs in straight to the machine's own jump host (the one in Reach It Through) and sends its packet from there.

Signing in and server keys

• Each machine signs in with its own saved password or key. The jump host never sees the machine's password or your key: Conn signs in to each one end to end, through the one before.
• One Face ID or Touch ID check covers the whole chain.
• Each machine's SSH key is checked and kept separately, under its own address. If the machine's own key changes, Conn stops and asks, as it always does. If a jump host's key changes, or is new to Conn where it would ask, Conn stops and names the jump host: open the jump host on its own to answer the question.
• Connections Conn makes on its own, such as reconnecting, group runs and Sessions checks, never answer a key question. Open a terminal on the host once (or on the jump host, for its key) to answer it.
• If a machine on the way can't be used, Conn says which, for example Conn could not get through Bastion on the way to Home Lab 101.

Port forwards

A port forward lets an app on your device reach a service that only listens on the server, such as a web dashboard, a database or an admin page. Conn listens on your device at 127.0.0.1, and carries what arrives over SSH to the machine and port you name.

Saving a forward

1. Open the host, choose Edit, and go to Port forwards.
2. Under New Forward, set Host and Port, then Add Forward.
   • Leave Host empty (it means 127.0.0.1) for a service on the machine itself.
   • Or name another machine the server can reach, such as db.internal, to go on from there.

Saved forwards stay with the host: they sync with iCloud sync on, and travel in a .conn file. Change or remove them in Edit Host.

Starting and stopping

The host's page has a Port Forwards card listing each forward as To its machine and port on the host.

• Start connects and shows Listening at 127.0.0.1: and a port: the service's own port when it's free on your device, or else one the system picks.
• Copy copies that address, to paste into a browser, a database app or anything else on your device.
• Open appears for the usual web ports (80, 443, 3000, 5000, 8000, 8080, 8081, 8123, 8443, 8888, 9000, 9090 and 9443; 443, 8443 and 9443 open as https). On iPhone and iPad the page opens inside Conn, so Conn stays open and the forward keeps running. On a Mac it opens in your browser.
• Stop closes it.

All the forwards of one host share one SSH connection, through its jump hosts if it has any, and it closes when you stop the last one. Conn checks it every ten seconds, and if it goes, the card says so (The forward stopped.) and you can start it again.

Good to know

• A forward listens on this device only. Nothing else on your network can use it.
• It's not a VPN. Conn doesn't change how your device reaches anything else; only connections to the forward's address go through it.
• A forward can't answer a host key question. Where Conn would ask (a changed key, or a known machine at a new address), the forward stops: open a terminal on the host once, answer the question, then start the forward again.
• Forwards start when you press Start, not automatically.

Not in this version

• SOCKS (dynamic, ssh -D) forwards.
• Remote (ssh -R) forwards.
• Agent forwarding.
• Importing a ProxyJump chain of more than one machine (set the chain up in Edit Host instead), or a ProxyCommand.
• Wake through a chain: Wake signs in straight to the machine's own jump host, not through the jump hosts before it.