[JENKINS-56485] RFE: Add Support for VPN Proxy for Starting Agents

Our network configuration requires that our Master, in one DMZ, start an agent in another DMZ that are separated by firewalls, proxies, and a VPN bridge with separate credentials from the agent machine.

This is a request to add the following to SSH Slaves:

1. Host IP/name of the VPN proxy.


2. A field to specify the command to launch a VPN proxy. Sample: `openconnect --protocol=gp --server-key=... --user=something --key-password=something`


3. A credential specification to be used for the VPN proxy.


4. Launching the VPN proxy command.


5. Continue with SSH startup of the agent JVM but from an SSH session initiated on the VPN proxy instead of initiated from the master.

There are actually three distinct sets of credentials involved here:

• Controller to VPN proxy SSH keys


• VPN proxy to VPN server keys (whichever they use, probably user/password)


• Controller to Agent SSH keys once the VPN connection is established.

The original thought was to use or even take over the now defunked openconnect plugin, but that seems to have disappeared. There are many different possible VPN solutions, with openconnect being one of them. This enhancement would remove the need to establish a static VPN connection available to all users and Jenkins instances on the Controller.

---
Originally reported by rsbeckerca, imported from: RFE: Add Support for VPN Proxy for Starting Agents

• assignee: ifernandezcalvo
  
• status: Open
  
• priority: Major
  
• component(s): ssh-slaves-plugin
  
• label(s): configuration, security, slave
  
• resolution: Unresolved
  
• votes: 1
  
• watchers: 2
  
• imported: 20251212-090250
  

Our network configuration requires that our Master, in one DMZ, start an agent in another DMZ that are separated by firewalls, proxies, and a VPN bridge with separate credentials from the agent machine.


This is a request to add the following to SSH Slaves:



	
Host IP/name of the VPN proxy.

	
A field to specify the command to launch a VPN proxy. Sample: `openconnect --protocol=gp --server-key=... --user=something --key-password=something`

	
A credential specification to be used for the VPN proxy.

	
Launching the VPN proxy command.

	
Continue with SSH startup of the agent JVM but from an SSH session initiated on the VPN proxy instead of initiated from the master.



There are actually three distinct sets of credentials involved here:



	
Controller to VPN proxy SSH keys

	
VPN proxy to VPN server keys (whichever they use, probably user/password)

	
Controller to Agent SSH keys once the VPN connection is established.



The original thought was to use or even take over the now defunked openconnect plugin, but that seems to have disappeared. There are many different possible VPN solutions, with openconnect being one of them. This enhancement would remove the need to establish a static VPN connection available to all users and Jenkins instances on the Controller.

• environment: Any

Review the ssh-slaves-plugin's existing SSH agent startup and credential configuration paths first; the issue names no files or tests. Define how the VPN proxy host, launch command, and separate credentials fit the connection flow, then verify that an agent can start through the proxy while preserving the three credential boundaries.

Written by the indexing model from the issue text.