TechKnowSurge
VideoSecurityFree

Bastion Host

A bastion host is a hardened, minimally configured server positioned at the network perimeter to absorb and deflect attacks before they can reach internal systems. It acts as the first point of contact for incoming traffic, protecting the servers behind it.

Complete this video to capture a CTF flag worth 1 point.

About this video

A bastion host is a deliberately stripped-down, heavily hardened server deployed at the network perimeter to intercept and withstand attacks before they reach internal infrastructure. By running only the services essential to its role, it minimizes exploitable vulnerabilities while concentrating defensive resources where they matter most. Any external actor attempting to compromise the internal network must first contend with the bastion host, making it the critical chokepoint in a layered security architecture. In practice, a bastion host often performs a functional network role in addition to its defensive one. It may operate as a reverse proxy, handling requests on behalf of backend servers, or as a load balancer that distributes traffic across multiple internal systems. In either configuration, the bastion host provides both operational value and a hardened outer boundary, ensuring that backend servers remain isolated from direct external contact. This dual-purpose design makes the bastion host a foundational component in securing exposed network services.

What you'll learn

What's covered

Bastion Host

Key terms

Bastion Host
A hardened server placed on the network perimeter that serves as a gateway to protect internal servers from external threats.
Hardening
The process of securing a system by reducing its attack surface — disabling unnecessary services, applying configuration best practices, removing default credentials, and keeping software patched. Hardened systems offer fewer opportunities for exploitation.
Proxy Server
An intermediary server that handles requests between clients and other servers, providing anonymity and content filtering.
Load Balancer
A device or software that distributes incoming network traffic across multiple servers to ensure availability and performance.
Attack Surface
The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Network Segmentation
The practice of dividing a network into smaller segments to improve performance and limit the spread of security threats.

Topics

Bastion Host Network Security Network Perimeter Server Hardening Network Architecture Cybersecurity

Transcript

Another thing that we could have out front protecting the rest of our network is called a bastion host.

From castle towers to bastions

At one point in time, we built castles, and these castles would protect us from the enemies down below. These castles would have these towers to them, and these towers would help protect the castle, because you could be up above and shoot down arrows on your enemy and make sure that they couldn't attack the castles.

Now, that was good until gunpowder came out. And then these castle walls, or specifically these towers, were a lot more susceptible now to like cannon fire. The cannon fire would hit these and they would crumble because they were hollow on the inside. So these were not as powerful with the invention of gunpowder.

So sometime later, when gunpowder became much more prevalent, they started creating bastions. Bastions are these areas that are sticking out right here. Notice that they're a lot shorter and they're a lot more reinforced, as in this is solid. These are not just skimpy little walls, but this is actually earth there, that you couldn't blow a cannonball through that because it's really thick. So bastions are these protruding areas, and generally they took this shape, but there are these protruding areas around your fort to help protect the fort. So it's the first thing you encounter: you don't encounter the wall first over here, you encounter the bastions right here.

The bastion host

Well, that's the same concept when it comes to a bastion host. When it comes to our networks and securing our services, we have a server out front. This is a hardened server. This is a server that doesn't have a lot of services running on it. It's very stripped down and very basic, but what is on it is a lot of reinforcements. So it's a hardened machine that's protecting all of your servers on the back end. So we call that a bastion host.

One example where we might have a bastion host is maybe this is a reverse proxy. Now, we'll get more into reverse proxy here in a little bit, but that's just one example. Or maybe it's a load balancer, and it's load balancing between these devices. So it serves two purposes here when it's a load balancer: it's a load balancer that's balancing between these devices, but also this is a hardened machine out front that, if somebody were to attack it, they would have to get to that bastion host first.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →