If you consider &quot;ssh jump host&quot; and &quot;vpn&quot; somewhat similar implementations of the same general strategy (forcing users to jump through something secure) we have a similar recommendation.