OpenVPN on the bastion host, and ssh over the VPN. If you don't control the bastion, then you need something that 'phones out' (could use a reverse ssh session

OpenVPN on the bastion host, and ssh over the VPN. If you don't control the bastion, then you need something that 'phones out' (could use a reverse ssh session for small scale stuff)