I love using zerotier (free version for me atm) to create my own private networks. I use it to traverse NAT and configuration is done on the webUI. It works like a virtual private network (closest tool I know is hamachi) and it is also possible to create virtual public networks.
It can create virtual Ethernet networks of almost unlimited size.
You run zt as a client and your system will have a virtual network "zt" interface. Then you create your own network environment and authorize the 'clients' in the webui (for private networks). Every client will then get it's own IP address (or multiple, according to your config) connected on the virtual 'zt' interface.
It works by creating a virtual
zt network interface for every joined network (
zt0, zt1, etc with the IPs you assign it to (multiple IPs are possible per interface). Networks can be private or public.
edit: This is indeed not a direct answer to the question about jumphosts, but it's an alternative solution by eliminating the need to forward ports.
Instead of forwarding each vnc instance to it's own port range, with zt you can just assign a individual IP to each vm instance in your own private network, running on a default port.