I apologize for the weird wording of the question title, I was hitting the character count.

I am taking a network security course in college and the textbook we use, Network Security Essentials: Applications and Standards 6th Edition by William Stallings, dives into firewalls in chapter 12. The book defines 6 firewall deployment architectures: host-resident, screening router, single bastion inline, single bastion T, double bastion inline, double bastion T, and distributed firewall.

I am doing a bit of research for a project and the only places I've been able to find the terms single/double bastion inline/T are on websites referring to the book or places that define the terms and don't give anything other than a definition. I've had trouble finding any more information about these architectures. I've found terms like screening host, multi-homed host, and others but I'm having trouble connecting them to the things discussed in the book.

Are there other terms used to describe these firewall layouts? If not, what terms are used and how do they relate to the ones discussed in the textbook?

I've included a picture that does a decent job of showing what the book describes below.

Firewall deployment architectures discussed in my textbook

1 Answer 1


There are many textbooks that invent their own terminology; as long as you can understand the terms used in the context of the book, that's OK. For example, your "single bastion inline" is called "Internet screening firewall" elsewhere, and your "Single bastion T" could be called "Internet Firewall with a Single DMZ"

(When I use a word, it means just what I choose it to mean—neither more nor less.")

That being said, there are a number of standard terms.

A host-based or host resident firewall is most of the times a bit of packet filtering by the OS. At best unreliable: we've had examples where a server's "host-based firewall" was completely opened by the upgrade of a software package.

A screening router is a router that filters the IP traffic. Rules should be kept simple. In general (but not always) it is stateless filtering. (https://dullaart.website/acl/index.html for some more info on that).

A screening host is a host that screens/filters the network traffic. You could say that a firewall is a screening host. Some will also say that a proxy is a screening host (though at a higher level of the OSI-stack).

A bastion host is a host through which all traffic must go. Many describe firewalls as bastion hosts, though some use the bastion host only for a host like a web server or proxy. A bastion host is always at least dual-homed: it has an input and an output. Although that may be virtual too.

A multi homed host is a host that has a network adapter in different networks. Like, for example, your bastion hosts.

The T in the architectures is for the optical likeness, but you may have guessed that. When I learned about firewalls (long ago), your "double bastion in line" was called "Dual firewall with a T-DMZ" Inline is also a term that describes how hosts are connected.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .