There are a lot of options available, including using .internal URIs.
Check this page out -
I am not 100% sure the best path for you, but I would imagine if you have Postgres and your Airbyte instance on fly, you should be able to use the default internal networking features without needing a SSH tunnel.
If the Bastion is a passthrough, and Airbyte is hosted somewhere else, I am not 100% sure the best way.
I played with self hosting Airbyte last week, and its so massive (like 7 GBs on disk).
I really liked this product over Airbyte. Though it has less connections, it seems like a better architecture. I would consider looking at it honestly, because it has a step in the middle that gives you more resilience and access to modify/transform the data after the fact.