Short note: Firewall types, bastion host

Types of firewall

A firewall is a system that controls traffic between a trusted network and an untrusted network (the Internet) according to security rules.

1. Packet-filtering firewall: checks each packet's header (IP, port, protocol) against ACLs. Fast, but stateless and cannot see application data.
2. Stateful inspection firewall: tracks connection state (TCP handshake, sessions) and permits only packets that belong to a valid, established connection.
3. Application-level gateway (proxy firewall): works at layer 7; a proxy for each application (HTTP, FTP, SMTP) examines content and hides internal hosts. Slower but most secure.
4. Circuit-level gateway: relays TCP connections after checking the handshake (e.g. SOCKS), without inspecting data.
5. Next-generation / UTM firewall: adds deep packet inspection, IPS, antivirus and application awareness.

Architectures: screened host, dual-homed host, and screened subnet (DMZ).

Roles of a bastion host

A bastion host is a hardened computer placed at the edge of the network (often in the DMZ), exposed to the Internet and expected to be attacked.

• Acts as the main contact point and gateway/proxy for traffic between the inside and the outside.
• Runs only essential services; unnecessary software, accounts and ports are removed (hardened).
• Hosts public services such as web, mail relay, DNS and FTP, so internal servers are not exposed.
• Performs authentication, logging and auditing of all access.
• Hides the internal network (address translation, proxying) and enforces policy at a single choke point.

 Internet --[Ext router]--[Bastion host]--[Int router]-- LAN
                           (DMZ)

If the bastion is compromised, the inner router or firewall still protects the internal network.