Additional details: You have to log into jumpbox (presumably still running on port 22) in order to log into the device who's SSH listening port has been forwar

Additional details: You have to log into jumpbox (presumably still running on port 22) in order to log into the device who's SSH listening port has been forwarded from port 22 on the device itself across the encrypted tunnel to port 22001 on the localhost of the jumpbox. If instead you prefer to expose the 22001 to the entire world (so you don't need to log into the jumpbox first), try this: device$ ssh jumpbox -R 22001:*:22 Then, to log into the device, you can just laptop$ ssh jumpbox -p 22001 which will pass your encrypted packets securely through from your laptop to the end device (and the jumpbox can NOT see them.) Keep in mind that, with this method, any potential attacker can now directly try to break into the device itself through the jumpbox rather than have to break into the jumpbox first, so make sure that you harden both the jumpbox and the end device (which is always a good idea anyway - don't deploy an IOT device that isn't hardened!)