I'm having troubles understanding the definition or the idea behind screened host / bastion host that you often find in the internet or books: enter image description here

Is the bastion host in this context, the firewall itself? (e.g. just a machine on which iptables (or another software) is running that is controlling the traffic? Or is it some kind of host that is accessible from the internet?

  • In your diagram, it clearly shows that the firewall is separate. I'm not sure what your question is.
    – schroeder
    Dec 31, 2016 at 20:09
  • 1
    Well I'm not that sure because of the gray block that also has the title "Firewall". But we assume that the firewall is separate, what is the purpose of the bastion host? In that case it just looks like any other host within the intranet to me.
    – user66875
    Dec 31, 2016 at 20:24

1 Answer 1


Bastion hosts are from old, and flawed, firewall design concepts. The idea was basically an unprotected DMZ of sorts with a hardened computer (the bastion host) in that area. The reason it even came into existence is simply due to the fact that firewalls when they first came out were extremely expensive and rarely had more than two interfaces on them. This was also long before IPTables/IPChains was an option.

A second concept going on in this drawing is referring to multiple systems as part of the firewall. For a while when we were using things like proxy servers for firewalling specific protocols, not unlike using a Web-Application Firewall (WAF) or SPAM firewall in addition to your network firewall today, we considered the combined set of devices to be one firewall. That notion has mostly gone away and we simply call each device by its own name now.

You may find the historical reference to Marcus J Ranum useful on the related Wikipedia page: https://en.wikipedia.org/wiki/Bastion_host

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .