SSH tunnels work. But you still need to control access to the bastion server / outside host system.