A bastion host is a specially hardened intermediary server that provides controlled access to private networks through a demilitarized zone (DMZ). It acts as a bridge without exposing sensitive databases or internal APIs directly to the internet. section 9.2
Place databases and internal APIs in private subnets, then permit access through the bastion host when outside access is necessary. This reduces direct exposure and supports network segmentation, but the host itself remains a security-sensitive entry point. section 9.0 section 9.2
A practical bastion-host design typically includes:
- A position in the DMZ or another internet-connected network, bridging toward private systems. section 9.2
- Hardened configuration with inbound SSH restricted to port 22 and a small allowlist of trusted IP addresses. section 9.2
- Tunneled connections from an authorized local machine to private databases or internal APIs. section 9.2
Private database access
Keep a payment database in a private subnet rather than exposing it to the internet. An authorized operator connects through the bastion host, which tunnels the connection to the database. The same pattern can provide controlled access to internal or developmental APIs. section 9.2
Figure 9.11 A bastion server gives us access to an internal network. We use bastion servers to access internal or private APIs and databases. The bastion server sits in the DMZ and is hardened to allow traffic only from certain origins.
Use the network diagram to see the bastion host in the DMZ and the restricted path to internal APIs and databases. section 9.2
