Allow a connection to be made without forwarding ports

[yang (Yang.Y)]

Actually you do not have to create tunnel for the bastion host, just set "Proxy Jump" option and everything is done:

Jump Hosts -- Passing Through a Gateway or Two

It is possible to connect to another host via one or more intermediaries so that the client can act as if the connection were direct. The main method is to use an SSH connection to forward the SSH protocol through one or more jump hosts, using the ProxyJump directive, to an SSH server running on the target destination host. This is the most secure method because encryption is end-to-end. In addition to whatever other encryption goes on, the end points of the chain encrypt and decrypt each oth…