---
title: "Short note: Firewall types, bastion host"
subject: "Internet and Intranet"
chapter: 5
key: "semester_8/internet_and_intranet:note-firewall-bastion-host"
source: https://www.bctengineer.com/q/semester_8/internet_and_intranet/note-firewall-bastion-host
site: BCT Engineering
---

# Short note: Firewall types, bastion host

Internet and Intranet · Chapter 5: Designing Internet Systems and Servers

- Asked in: 2070 Magh, 4 marks
- Video: [#6  WHAT IS A BASTION HOST? HOW TO USE BASTION HOSTS? Simplified and Visualized](https://www.youtube.com/watch?v=llMW5_cyFsI) — S3CloudHub
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/internet_and_intranet/note-firewall-bastion-host
- Whole chapter: https://www.bctengineer.com/md/semester_8/internet_and_intranet/chapter-5

## Question

Write a short note on Types of Firewall and Roles of Bastion Host.

## Short answer

Firewalls include packet-filtering, stateful inspection, application-level proxy, circuit-level gateway, and next-generation/UTM types. A bastion host is a hardened computer in the DMZ that acts as the main gateway/proxy, runs only essential services, performs authentication and logging, and hides internal hosts. If compromised, the inner router or firewall still protects the internal network.

## Answer

#### Types of firewall

A **firewall** is a system that controls traffic between a trusted network and an untrusted network (the Internet) according to security rules.

1. **Packet-filtering firewall:** checks each packet's header (IP, port, protocol) against ACLs. Fast, but stateless and cannot see application data.
2. **Stateful inspection firewall:** tracks connection state (TCP handshake, sessions) and permits only packets that belong to a valid, established connection.
3. **Application-level gateway (proxy firewall):** works at layer 7; a proxy for each application (HTTP, FTP, SMTP) examines content and hides internal hosts. Slower but most secure.
4. **Circuit-level gateway:** relays TCP connections after checking the handshake (e.g. SOCKS), without inspecting data.
5. **Next-generation / UTM firewall:** adds deep packet inspection, IPS, antivirus and application awareness.

Architectures: screened host, dual-homed host, and screened subnet (DMZ).

#### Roles of a bastion host

A **bastion host** is a hardened computer placed at the edge of the network (often in the DMZ), exposed to the Internet and expected to be attacked.

- Acts as the main contact point and **gateway/proxy** for traffic between the inside and the outside.
- Runs only essential services; unnecessary software, accounts and ports are removed (hardened).
- Hosts public services such as web, mail relay, DNS and FTP, so internal servers are not exposed.
- Performs authentication, **logging and auditing** of all access.
- Hides the internal network (address translation, proxying) and enforces policy at a single choke point.

```text
 Internet --[Ext router]--[Bastion host]--[Int router]-- LAN
                           (DMZ)
```

If the bastion is compromised, the inner router or firewall still protects the internal network.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What does a stateful inspection firewall do beyond a packet filter?
   A. Inspects only the payload of e-mail
   B. Tracks connection state and permits only packets of valid, established connections
   C. Relays TCP without checking
   D. Works only at layer 7
   Answer: B. Stateful firewalls track sessions such as the TCP handshake. (Key point: Stateful inspection)

2. Which firewall type is a proxy for each application and is slower but most secure?
   A. Packet-filtering firewall
   B. Circuit-level gateway
   C. Application-level gateway
   D. Stateless router
   Answer: C. Application-level gateways work at layer 7, examine content and hide internal hosts. (Key point: Application gateway)

3. What is a bastion host?
   A. A hardened computer at the network edge, often in the DMZ, expected to be attacked
   B. A backup server inside the LAN
   C. A switch for internal users
   D. A DNS cache
   Answer: A. It runs only essential services and acts as the main gateway/proxy exposed to the Internet. (Key point: Bastion host)