I’m a few years into my homelab. (might go into a bit more detail about that
at some point!), and I often need to ssh into one of my servers.

At home, I can just do this by using a domain name like:

ssh ahoy.m.example.ca ssh bread.m.example.ca

I have set up Split-Horizon DNS at home using DNSMasq, so these domains resolve but
only at home.

When I’m outside, I use a a ‘bastion’ server that I can ssh into and hop
to another server. It’s on a ‘secret’ port.

To automatically tell SSH to go via the bastion server, I have this in my ~/.ssh/config:

Host *.m.example.ca ForwardAgent yes User evert ProxyCommand ssh -q -W %h:%p -l evert bastion.example.ca -p 6767

bastion.example.ca does resolve to a real IP (my home IP). The annoyance with
this is that if I use one of the above commands, I always go through the bastion
whether I’m home or not.

I recently found about about the Match and ProxyJump command, and cludged
together this:

Match host *.m.example.ca exec "! getent hosts %h >/dev/null" ForwardAgent yes User evert ProxyJump evert@bastion.example.ca:6767

This works the same as before, except this rule only kicks in if the command
command getent hosts %h fails.

The ProxyJump is a slightly simpler command from ProxyCommand. I think this
has been around for a bit, but I’ve just been copy-pasting ProxyCommand from
previous configs for a decade+.

You might not have a DNS setup like this, and might be using .local domains
to access local servers, if this also work, HOWEVER:

Match host *.local exec "! getent hosts %h >/dev/null" HostName %h ForwardAgent yes User evert ProxyJump bastion.example.ca:6767

Every time you do this, you computer likely first
broadcasts on your local network it’s looking for that machine. .local / MDNS
also tends to be a bit slower when you’re local, and given that you’re paying
that cost. ForwardAgent agent can also make this extremely dangerous because
someone might impersonate target.local and get access to your entire SSH keychain.
So maybe for that case it’s not the worst thing to just always go
through a bastion server. If so, this config is for you:

Host *.local HostName %h ForwardAgent yes User evert ProxyJump bastion.example.ca:6767

This always go through the bastion for every SSH connection to a .local host.