Use of SSH ProxyJump and LocalForward to access lab devices

[a-v-popov]

It is not an idea for a feature, but for documentation probably. Not sure in which category it should go.
Looking at https://netlab.tools/example/external/#connecting-to-lab-devices somehow I do not see option to use a built-in SSH functionality to access lab devices. For example one can use the following ansible playbook and jinja template to generate ssh config file:

# cat ssh_config.yml
---
- name: Generate SSH config 
  hosts: localhost
  gather_facts: no

  tasks:
  - name: Get my public IP
    community.general.ipify_facts:

  - name: Render a config template
    template:
      src: ssh_config.j2
      dest: ./ssh_config

# cat ssh_config.j2 
# --- start of netlab config ---

Host netlab
    Hostname {{ ipify_public_ip }}
{% for host in groups['fortios'] %}
{%   set hv = hostvars[host] %}
{%   if hv.get('provider') != 'clab' %}
    LocalForward {{ 8000 + hv.id }} {{ hv.ansible_host }}:443
{%   endif %}
{% endfor %}

{% for host in groups['all'] %}
{%   set hv = hostvars[host] %}
Host {{ host }}
{%   if hv.get('provider') == 'clab' %}
    Hostname netlab
    RequestTTY yes
    RemoteCommand docker exec -it {{ hv.ansible_host }} sh -il
{%   else %}
    Hostname {{ hv.ansible_host }}
    User {{ hv.ansible_user }}
    ProxyJump netlab
{%   endif %}

{% endfor %}


# --- end of netlab config ---

[ipspace]

Thank you, definitely an interesting topic ;) The https://netlab.tools/example/external/#connecting-to-lab-devices section was concerned more with having direct access to the lab devices, what you seem to be proposing here is the lab server acting as a sort of a bastion host, right?

Anyway, we could do the same thing as a netlab report, but then of course you'd have to save it (or append it) to ssh_config file yourself.

[a-v-popov]

I guess it would depend on the definition of a bastion host and a direct access.
The generated config allows me to use scp to lab devices directly from my laptop, thanks to ProxyJump.
With LocalForward I can open Fortinet web interface in my browser on my laptop using https://localhost:80xx as URL.
All connections are encrypted inside SSH tunnel, no need to expose anything externally.
I also have a WireGuard tunnel, but practically have no use for it.