Can you expand on why? OpenVPN has long been an example of solid development (and crypto) practices. As far as the bastion host, you need an actual VPN to do m

Can you expand on why? OpenVPN has long been an example of solid development (and crypto) practices. As far as the bastion host, you need an actual VPN to do more than forward SSH connections. For instance, connectivity to your LDAP server, internal web services, etc. Port forwarding gets you part of the way there, but it's inconvenient to use with SSL, requires using weird local port numbers when connecting to services, etc. SSH does have VPN support via tun/tap, but it's not nearly as functionally complete as OpenVPN, and you still have the entire SSH authentication path exposed to the world.