Summary: Bastion hosts differ from firewalls and VPNs, offering more control over assets. Read our article and see if your business needs one.
In a world of data breaches and cyber threats, data protection and business health are two sides of the same coin.
Bastion hosts are one of the most common security solutions, protecting data at the network edge. But these digital fortifications are widely seen as outdated by security experts. Are they still viable options for modern companies?
This blog will dive into the issue and come up with some answers. We will learn how bastion hosts work and why some companies use them, but we will also assess their security pros and cons.
You may prefer cutting-edge alternatives instead of traditional bastion hosts. Let’s find out more to help you decide.
A bastion host is a highly-secured server. Bastions reside on the network perimeter to control or manage traffic between trusted and untrusted network zones.
What is a bastion host?
A bastion host is a highly secured server placed at the network edge to protect against cyber attacks. It creates a bridge-like structure between the public internet and local devices. Traffic entering the network must cross this bridge, where tools can allow or deny entry.
Bastion hosts are hardened to withstand cyber attacks. They enhance network security by controlling what enters or leaves the network. In remote work contexts, bastion hosts act as SSH proxies, enabling secure SSH connections.
Historically, bastions were parts of fortresses or castles that projected away from the main building. Bastions were forward defenses designed to repel attacks before enemies could breach the perimeter.
The same principles apply to network bastions. Bastion hosts act like gatekeepers at the network edge or on the edge of secure zones. This gatekeeper decides who enters the “castle” and who remains outside.
Businesses position bastions strategically to withstand cyber attacks. They protect data or devices from harm through a range of features:
Bastions provide a way to centralize network security via SSH connections. The bastion host checks the device and user credentials. If users are on approved access lists, the bastion approves the connection and allows entry.
This solution is efficient but generally insecure. Most companies prefer to strengthen their defenses via VPNs, firewalls, and access management systems.
Jump servers are secure gateways that allow administrators to manage software or devices within protected network zones. The bastion acts as a jump server by requesting authentication credentials and controlling access, keeping attack surfaces as small as possible.
For instance, bastions may allow a firewall administrator to change filtering settings while denying requests from all other users.
Companies often use bastions as jump servers to maintain distributed network assets. Networks may extend across the world. Bastion hosts allow a centrally-located IT department to access distant office networks securely.
As the outer fortification, bastions enforce access control policies. They request multiple authentication factors and check user credentials against secure directories.
Bastions also provide a secure proxy gateway for SSH (Secure Shell) connections. SSH creates secure connections between remote devices and internal services. The SSH protocol encrypts data passing through the bastion. SSH agent forwarding allows users to access multiple servers via the bastion gateway.
Finally, bastion hosts log user access and session activity. All users and data entering a private network must pass through the server. Logging tools track general information about user sessions. However, they do not track user activity in-depth, but these logs can be integrated with external security systems to create alerts about suspicious behavior.
In terms of network security, there are three main bastion host configurations: single, dual, and internal. Each version uses similar technologies. However, they operate differently, and security services differ as well.
Additionally, organizations can combine more than one configuration type. For example, you might use a single-bastion inline server for perimeter protection, alongside internal bastions to guard sensitive network zones.
Single-Bastion inline hosts place a single fortified server between the untrusted networks (like the public internet) and internal network assets.
This bastion server type acts like a gateway for network traffic, filtering traffic before it reaches network devices. This filtering function may complement firewalls, intrusion detection systems (IDS), or additional proxy servers.
A single-bastion host can enhance network security. However, the use of one server creates a single point of failure. Concentrated attacks can overwhelm security tools on a single server, raising security risks for critical assets.
Dual-bastion host setups place two fortified servers between an untrusted external network and internal network assets. The two servers exist in series, creating a chain of network defenses.
In a dual-bastion inline arrangement, the first host directly faces the public internet. This host executes basic security tasks, including packet inspection and firewall filtering.
The second bastion faces internal network devices. This host adds extra layered security together with intrusion detection, deep packet inspection, or proxy server functions.
Layered bastion host setups are usually more secure than single host configurations. Attackers struggle to take down dual servers, and layered security neutralizes threats efficiently. This setup suits load balancing, where one bastion manages incoming traffic, and the other handles outbound connections. It also provides a backup if one server fails, ensuring continuous operations for critical data or sensitive applications.
On the negative side, dual-bastion host setups are more complex to configure. Dual bastions may increase network latency. Maintenance is also more complicated and resource-intensive.
Internal bastion hosts are fortified servers located within internal networks. These bastion servers operate behind network firewalls. They are not directly exposed to an external network.
Internal bastions are a preferred option when defending critically important servers or devices and sensitive internal resources. The internal bastion provides an extra line of defense and limits east-west traffic within the network. Security teams can use internal bastions to create secure zones and guard against insider threats.
Bastions create a perimeter around critical assets. Servers use authentication and IAM tools to allow secure access. They log activity and filter internal traffic while enabling legitimate access for network users.
Internal bastion hosts enhance security but may increase network complexity. Bastions can become traffic bottlenecks and can be compromised by some network attacks.
When they function correctly, bastion hosts enhance network security. However, compromised bastions can expose networks to security risks. Compromised hosts become secure gateways for attackers — defeating the initial purpose.
Attackers gaining control of a bastion host can use their position to access other network resources. They may extract sensitive data from traffic flowing across the host, and use this data to gain further access.
Compromised hosts aren't the only security issue to worry about. Other bastion host risks include:
Bastion hosts are labor-intensive and carry significant risks. Consider alternative measures to counter external threats. If not, take care when adding bastion protection to your private network.
If you opt for bastion host protection, it's important to do so safely. With that in mind, here are some best practices to follow when securing bastion hosts:
Now we know more about defending a bastion host, let's clear up some misconceptions about what they are (and what they do).
For instance, people often confuse bastions and firewalls. This is understandable as bastion hosts often include firewall capabilities. Firewall appliances inspect and filter traffic passing across the entire network perimeter. Sometimes, firewalls provide sufficient protection. However, firewalls on their own have limited access management capabilities.
Bastions also operate at the network edge. Unlike firewalls, bastions protect and manage access to specific locations or assets. Onboard firewalls and security tools create a demilitarized zone outside the network perimeter.
This DMZ adds an extra layer of protection beyond firewall filters. Fortified bastion hosts offer greater control over internal network access. They are also hardened to cope with cyber threats, while firewalls are not.
Another common point of confusion is between VPNs and bastion hosts. Again, this is understandable. Both technologies allow secure remote access and SSH connections. But they are very different.
VPNs create encrypted tunnels to transfer data. Users generally install a VPN client on their device. The client encrypts data and routes it via a VPN server, which assigns a new IP address and passes data to its destination.
Using a VPN solves some of the security problems we noted earlier. VPNs protect SSH keys beneath a layer of encryption. They shrink the attack surface by creating private connections without direct exposure to the public internet.
Bastion hosts are exposed to external networks, leaving security risks unaddressed. They also represent a single point of failure, which is less of a problem with VPNs.
On the other hand, administrators can harden bastions to minimize threats. Bastions also make it easier to prevent data extraction. VPN users can download data onto remote devices, and switching off the VPN can put this data at risk.
Hybrid VPN and bastion host setups are also possible. VPNs protect remote access connections in a user-friendly way, while bastions protect sensitive endpoints and create secure zones for high-value data.
Possibly, but probably not. Companies mainly use bastion hosts to lock down sensitive data. For instance, you may handle protected health information (PHI) or customer financial records. The bastion creates a DMZ around critical data only approved users can enter.
Bastion hosts are also useful for connecting different offices. Admins can safely manipulate software remotely, while the bastion excludes unauthorized users.
Some businesses use bastions in remote access systems. If you rely on SSH connections and are happy to risk a single point of failure, bastions provide robust protection for on-premises assets.
However, bastion server architecture is outdated and risky. Bastions are poorly suited to safeguarding cloud computing assets. Cloud-based firewall-as-a-service (FWaaS), remote access VPNs, Zero Trust Network Access (ZTNA) and access management tools provide a scalable and more secure alternative.
Maintaining bastion hosts is costly and complex, a problem for small and medium-sized enterprises that need to cut overheads. Larger businesses may find uses for bastion technology, but for many companies, the risks and costs are not worthwhile.
Bastion hosts are outdated and risky, but what is the best way to secure on-premises, remote, and cloud-hosted assets? NordLayer's Zero Trust solutions provide a streamlined alternative.
NordLayer's remote access VPN enables secure access to your private network and sensitive resources. Companies can create private gateways to replace bastion hosts, while site-to-site VPNs safely establish secure connections to hybrid networks.
Our Multiple Network Access Control (NAC) solutions let you control access to hybrid services at a granular leve. Threat prevention tools prevent access to malicious websites and unauthorized intrusion, and scan downloads for malware. Users do not need to configure bastion hosts. Flexible solutions plug every potential vulnerability.
Assess your network security needs and create a data protection strategy. When you do, go beyond bastions and outdated technology. Contact the NordLayer team to discuss next-generation remote access security.
Joanna Krysińska
Senior Copywriter
A writer, tech enthusiast, dog walker, and amateur pastry chef, Joanna grew up in a family of engineers and mathematicians, so a techy mind is in her genes. She loves making complex tech topics less complex and digestible. She also has a keen interest in the mechanics of cybercrime.
Subscribe to our blog updates for in-depth perspectives on cybersecurity.
