diff --git a/server/routers/siteResource/createSiteResource.ts b/server/routers/siteResource/createSiteResource.ts
index e189d73e7..a15b10555 100644
--- a/server/routers/siteResource/createSiteResource.ts
+++ b/server/routers/siteResource/createSiteResource.ts
@@ -49,7 +49,6 @@ const createSiteResourceSchema = z
         scheme: z.enum(["http", "https"]).optional(),
         siteIds: z.array(z.int()).optional(),
         siteId: z.number().int().positive().optional(), // DEPRECATED: for backward compatibility, we will convert this to siteIds array if provided
-        // proxyPort: z.int().positive().optional(),
         destinationPort: z.int().positive().optional(),
         destination: z.string().min(1).optional(),
         enabled: z.boolean().default(true),
@@ -248,7 +247,6 @@ export async function createSiteResource(
             siteId,
             mode,
             scheme,
-            // proxyPort,
             destinationPort,
             destination,
             enabled,
diff --git a/server/routers/siteResource/updateSiteResource.ts b/server/routers/siteResource/updateSiteResource.ts
index 50b942cb6..a52d15d6a 100644
--- a/server/routers/siteResource/updateSiteResource.ts
+++ b/server/routers/siteResource/updateSiteResource.ts
@@ -59,7 +59,6 @@ const updateSiteResourceSchema = z
         mode: z.enum(["host", "cidr", "http", "ssh"]).optional(),
         ssl: z.boolean().optional(),
         scheme: z.enum(["http", "https"]).nullish(),
-        // proxyPort: z.int().positive().nullish(),
         destinationPort: z.int().positive().nullish(),
         destination: z.string().min(1).optional(),
         enabled: z.boolean().optional(),
@@ -632,6 +631,15 @@ export async function updateSiteResource(
                               })
                           }
                         : {};
+                let tcpPortRangeStringAdjusted = tcpPortRangeString;
+                if (mode === "http") {
+                    tcpPortRangeStringAdjusted = "443,80";
+                } else if (mode === "ssh") {
+                    tcpPortRangeStringAdjusted = destinationPort
+                        ? destinationPort.toString()
+                        : "22";
+                }
+
                 [updatedSiteResource] = await trx
                     .update(siteResources)
                     .set({
@@ -644,9 +652,14 @@ export async function updateSiteResource(
                         destinationPort: destinationPort,
                         enabled: enabled,
                         alias: alias ? alias.trim() : null,
-                        tcpPortRangeString: tcpPortRangeString,
-                        udpPortRangeString: udpPortRangeString,
-                        disableIcmp: disableIcmp,
+                        tcpPortRangeString: tcpPortRangeStringAdjusted,
+                        udpPortRangeString:
+                            mode == "http" || mode == "ssh"
+                                ? ""
+                                : udpPortRangeString,
+                        disableIcmp:
+                            disableIcmp ||
+                            (mode == "http" || mode == "ssh" ? true : false),
                         domainId,
                         subdomain: finalSubdomain,
                         fullDomain,
diff --git a/src/app/[orgId]/settings/resources/public/[niceId]/ssh/page.tsx b/src/app/[orgId]/settings/resources/public/[niceId]/ssh/page.tsx
index cc733d6ab..de207b872 100644
--- a/src/app/[orgId]/settings/resources/public/[niceId]/ssh/page.tsx
+++ b/src/app/[orgId]/settings/resources/public/[niceId]/ssh/page.tsx
@@ -480,7 +480,8 @@ function SshServerForm({
                                     />
                                 </PopoverContent>
                             </Popover>
-                        ) : standardDaemonLocation !== "site" ? (
+                        ) : standardDaemonLocation !== "site" ||
+                          pamMode === "passthrough" ? (
                             <BrowserGatewayTargetForm
                                 orgId={orgId}
                                 multiSite={true}
diff --git a/src/app/[orgId]/settings/resources/public/create/page.tsx b/src/app/[orgId]/settings/resources/public/create/page.tsx
index a28303669..93a2d6d72 100644
--- a/src/app/[orgId]/settings/resources/public/create/page.tsx
+++ b/src/app/[orgId]/settings/resources/public/create/page.tsx
@@ -27,7 +27,6 @@ import {
     StrategySelect,
     type StrategyOption
 } from "@app/components/StrategySelect";
-import { ResourceTargetAddressItem } from "@app/components/resource-target-address-item";
 import { BrowserGatewayTargetForm } from "@app/components/BrowserGatewayTargetForm";
 import {
     SitesSelector,
@@ -896,26 +895,23 @@ export default function Page() {
                                                 />
                                             </div>
 
-                                            {/* Auth Method (standard only) */}
-                                            {!isNative && (
-                                                <div className="space-y-3">
-                                                    <p className="text-sm font-semibold">
-                                                        {t(
-                                                            "sshAuthenticationMethod"
-                                                        )}
-                                                    </p>
-                                                    <StrategySelect<
-                                                        "passthrough" | "push"
-                                                    >
-                                                        value={pamMode}
-                                                        options={
-                                                            authMethodOptions
-                                                        }
-                                                        onChange={setPamMode}
-                                                        cols={2}
-                                                    />
-                                                </div>
-                                            )}
+                                            <div className="space-y-3">
+                                                <p className="text-sm font-semibold">
+                                                    {t(
+                                                        "sshAuthenticationMethod"
+                                                    )}
+                                                </p>
+                                                <StrategySelect<
+                                                    "passthrough" | "push"
+                                                >
+                                                    value={pamMode}
+                                                    options={
+                                                        authMethodOptions
+                                                    }
+                                                    onChange={setPamMode}
+                                                    cols={2}
+                                                />
+                                            </div>
 
                                             {/* Daemon Location (standard + push) */}
                                             {showDaemonLocation && (
@@ -1046,7 +1042,9 @@ export default function Page() {
                                                         </PopoverContent>
                                                     </Popover>
                                                 ) : standardDaemonLocation !==
-                                                  "site" ? (
+                                                      "site" ||
+                                                  pamMode ===
+                                                      "passthrough" ? (
                                                     <BrowserGatewayTargetForm
                                                         orgId={orgId as string}
                                                         multiSite={true}
diff --git a/src/components/CreatePrivateResourceDialog.tsx b/src/components/CreatePrivateResourceDialog.tsx
index effbe9d84..4bfb478ba 100644
--- a/src/components/CreatePrivateResourceDialog.tsx
+++ b/src/components/CreatePrivateResourceDialog.tsx
@@ -103,6 +103,7 @@ export default function CreatePrivateResourceDialog({
                             data.alias.trim()
                                 ? data.alias
                                 : undefined,
+                        destinationPort: data.destinationPort ?? undefined,
                         pamMode: data.pamMode ?? undefined,
                         ...(data.authDaemonMode != null && {
                             authDaemonMode: data.authDaemonMode
@@ -112,13 +113,14 @@ export default function CreatePrivateResourceDialog({
                                 authDaemonPort: data.authDaemonPort
                             })
                     }),
-                    ...((data.mode === "host" ||
-                        data.mode === "ssh" ||
-                        data.mode === "cidr") && {
+                    ...((data.mode === "host" || data.mode === "cidr") && {
                         tcpPortRangeString: data.tcpPortRangeString,
                         udpPortRangeString: data.udpPortRangeString,
                         disableIcmp: data.disableIcmp ?? false
                     }),
+                    ...(data.mode === "ssh" && {
+                        disableIcmp: data.disableIcmp ?? false
+                    }),
                     roleIds: data.roles
                         ? data.roles.map((r) => parseInt(r.id))
                         : [],
diff --git a/src/components/EditPrivateResourceDialog.tsx b/src/components/EditPrivateResourceDialog.tsx
index 2c390dedb..077c85ee0 100644
--- a/src/components/EditPrivateResourceDialog.tsx
+++ b/src/components/EditPrivateResourceDialog.tsx
@@ -104,6 +104,7 @@ export default function EditPrivateResourceDialog({
                         data.alias.trim()
                             ? data.alias
                             : null,
+                    destinationPort: data.destinationPort ?? null,
                     pamMode: data.pamMode ?? undefined,
                     ...(data.authDaemonMode != null && {
                         authDaemonMode: data.authDaemonMode
@@ -112,13 +113,14 @@ export default function EditPrivateResourceDialog({
                         authDaemonPort: data.authDaemonPort || null
                     })
                 }),
-                ...((data.mode === "host" ||
-                    data.mode === "ssh" ||
-                    data.mode === "cidr") && {
+                ...((data.mode === "host" || data.mode === "cidr") && {
                     tcpPortRangeString: data.tcpPortRangeString,
                     udpPortRangeString: data.udpPortRangeString,
                     disableIcmp: data.disableIcmp ?? false
                 }),
+                ...(data.mode === "ssh" && {
+                    disableIcmp: data.disableIcmp ?? false
+                }),
                 roleIds: (data.roles || []).map((r) => parseInt(r.id)),
                 userIds: (data.users || []).map((u) => u.id),
                 clientIds: (data.clients || []).map((c) => parseInt(c.id))
diff --git a/src/components/PrivateResourceForm.tsx b/src/components/PrivateResourceForm.tsx
index 1557c89f5..adbbc5f22 100644
--- a/src/components/PrivateResourceForm.tsx
+++ b/src/components/PrivateResourceForm.tsx
@@ -365,6 +365,19 @@ export function PrivateResourceForm({
                     path: ["destination"]
                 });
             }
+            if (data.mode === "ssh" && !isNativeSsh) {
+                if (
+                    data.destinationPort == null ||
+                    !Number.isFinite(data.destinationPort) ||
+                    data.destinationPort < 1
+                ) {
+                    ctx.addIssue({
+                        code: z.ZodIssueCode.custom,
+                        message: t("internalResourceHttpPortRequired"),
+                        path: ["destinationPort"]
+                    });
+                }
+            }
             if (data.mode !== "http") return;
             if (!data.scheme) {
                 ctx.addIssue({
@@ -548,7 +561,7 @@ export function PrivateResourceForm({
                   mode: "host",
                   destination: "",
                   alias: null,
-                  destinationPort: null,
+                  destinationPort: 22,
                   scheme: "http",
                   ssl: true,
                   httpConfigSubdomain: null,
@@ -735,6 +748,7 @@ export function PrivateResourceForm({
                 onSubmit={form.handleSubmit((values) => {
                     const siteIds = values.siteIds;
                     const trimmedDestination = values.destination?.trim();
+                    const isSshMode = values.mode === "ssh";
                     onSubmit({
                         ...values,
                         siteIds,
@@ -742,6 +756,12 @@ export function PrivateResourceForm({
                             trimmedDestination && trimmedDestination.length > 0
                                 ? trimmedDestination
                                 : null,
+                        tcpPortRangeString: isSshMode
+                            ? undefined
+                            : values.tcpPortRangeString,
+                        udpPortRangeString: isSshMode
+                            ? undefined
+                            : values.udpPortRangeString,
                         clients: (values.clients ?? []).map((c) => ({
                             id: c.clientId.toString(),
                             text: c.name
@@ -826,8 +846,11 @@ export function PrivateResourceForm({
                                                         {t("sites")}
                                                     </FormLabel>
                                                     {mode === "ssh" &&
-                                                    sshServerMode ===
-                                                        "native" ? (
+                                                    (sshServerMode ===
+                                                        "native" ||
+                                                        (pamMode === "push" &&
+                                                            authDaemonMode ===
+                                                                "site")) ? (
                                                         <Popover>
                                                             <PopoverTrigger
                                                                 asChild