For work I sometimes have to connect to our enterprise VPN.

When inside of the VPN, I can reach host remote per SSH, so the following TRAMP incantation works:

C-x C-f /ssh:remote:/path/filename RET

Whereby remote's user and full hostname are specified in my .ssh config so TRAMP magically handles that.

When outside of the VPN, I can still reach host remote provided I hop through entry. So the following would work:

C-x C-f /ssh:entry|ssh:remote:/path/filename RET

My question is:

Can I have TRAMP automatically convert "ssh:remote" to "ssh:entry|ssh:remote" only when I'm not connected to the VPN? Ultimately I'd like existing connections to files to also be updated upon TRAMP cleanup connections. Currently disconnecting from the VPN is a real pain but I can't be connected all the time because the VPN lease resets every now and then.

1 Answer 1


The answer to any engineering question that starts with “Can I have…” is almost always yes. The real question is how much work it will take, and whether it is worth it.

You haven’t said what operating system you are using, which is absolutely vital information; everything else depends on it. So I will just assume that you made the most sane choice, and are using Linux.

NetworkManager knows whether you are connected and how, so you should be querying it for the status of the VPN. I can’t give you complete details about it, but if you just wanted to know if you are connected at all, you could use this function:

(defun nm-is-connected()
  (equal 70 (dbus-get-property :system

You can read the NetworkManager documentation for all the details about the dbus API it provides.

Emacs has a number of features that you can use in combination with Tramp so that you can type something short and Tramp will open a much longer filename. They are all briefly documented in the Tramp FAQ. Look for the question titled “How to shorten long file names when typing in TRAMP?”; it has no anchor so I cannot link to it directly.

So, pick a method for shortening your long and complex file name, and then combine it with the state of your VPN. Choose wisely: some of these methods are more amenable to this type of complex customization that others. For example, some of these methods only allow you to replace one string with another, while other methods may allow you to specify a function that will be called to generate the replacement. You will need to research each of these methods until you find the one which is most appropriate.

But the question remains; it may not be a good idea to do all of this work. If you can reach your jump host even while connected to the VPN, then it may just be easier to always use the jump host even when it isn’t necessary. It won’t be any less secure, and it will simplify your life.

In particular, this makes method #3 much more attractive. If you specify the ProxyJump configuration option in your ssh config file, then it will always be used for all ssh connections to the remote host:

Host remote
    Hostname remote.example.com
    ProxyJump entry.example.com

Then you can always just use the shorter form to connect using Tramp:

C-x C-f /ssh:remote:/path/filename RET
  • Thank you, @db48x. This is a very educational answer. ProxyJump works like a charm and according to this server fault thread has no downsides (provided the proxy is safe and stable) even when it isn't necessary. The only issue I have left when dealing with remote work is that some org babel packages don't support multi-hopping for reasons at this time unknown to me (emacs-jupyter, for example). ProxyJump doesn't seem to resolve that either.
    – Daniel
    Commented Jul 8, 2021 at 15:02
  • I think this may be off-topic for this question, so I'll just note that ProxyJump in your SSH config can be made smarter if you use the Match directive rather than Host. See en.wikibooks.org/wiki/OpenSSH/Cookbook/… Commented Jul 13, 2021 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.