What is a Bastion Host? Comparing with VPNs for Secure Remote Access

There are many ways to provide a secure connection between users and company resources, one of which is through a bastion host. A bastion host is usually a highly restricted and heavily monitored server that provides access from the public internet to a private network. Another way to create a secure connection between users and company resources is by adding them to a virtual private network (VPN). A VPN creates a private connection between two devices by creating an encrypted tunnel directly between the requesting device and its destination.

Bastion hosts and VPN technologies both emerged in the 1990s, and the primary difference between bastion hosts and VPNs is that a bastion host, by necessity, creates a single point of entry or failure, whereas a VPN creates separate encrypted private tunnels for each connection.

This article will cover bastion hosts in detail, address their use cases and limitations, and compare them to VPNs such as Tailscale — an alternative that can be superior in terms of latency and security.

What is a bastion host?

Also known as a jump box (or jump host), a bastion host is a hardened computer meant to withstand cyberattacks: It will disable any unnecessary network services and run only the bare minimum of applications — such as a proxy server, load balancer, or firewall — in order to provide a connection, leaving far fewer attack vectors to be exploited.

Bastion hosts act as secure gateways, ensuring strong authentication and protection against cyberattacks while providing remote access to private networks through secure connections like SSH and RDP. Bastion hosts are also fitted with logging and monitoring in their underlying operating system (such as Linux) to help you identify any attacks or security incidents.

Bastion hosts are encased in external firewalls within a demilitarized zone (DMZ). The DMZ allows bastion hosts to be accessed by an external client. This is necessary to provide an entry point for public networks into the network; however, if the connection is compromised in the DMZ, the network is also compromised.

Bastion hosts control access to internal resources from external networks, balancing security and functionality in network architecture.

In a standard virtual computer environment, unhealthy or unnecessary servers are discarded or replaced. By contrast, a bastion host gets specific attention to maintain the secure environment. In other words, servers are treated as pets as opposed to cattle in the DevOps model.

How Bastion hosts work

Bastion hosts function as a secure bridge between private and public networks. Typically placed outside the business firewall in a Demilitarized Zone (DMZ), they are connected to both the private network and the external network. Employees must connect to the bastion host using a secure connection, such as Secure Shell network communication protocol (SSH). The bastion host then verifies the employee’s identity before granting access to the private network. This process ensures that only authorized personnel can access the internal network, thereby reducing the risk of cyberattacks. By acting as a controlled access point, bastion hosts help maintain the integrity and security of internal network resources.

Types of Bastion Hosts

There are several types of bastion hosts, each designed to meet different security needs:

• Single-bastion inline hosts: These hosts place a single fortified server between untrusted networks, like the public internet, and internal network assets. This setup provides a straightforward and effective barrier against external threats.
• Dual-bastion host setups: These configurations use two fortified servers between an untrusted external network and internal network assets, creating a layered defense mechanism. This approach enhances security by adding an extra layer of protection.
• Internal bastion hosts: These hosts are fortified servers located within internal networks, operating behind network firewalls and not directly exposed to an external network. They provide an additional layer of security for sensitive internal resources.

Each type of bastion host plays a unique role in network security, offering varying levels of protection based on the specific needs of the organization.

Bastion host use cases for secure remote access

Here’s a breakdown of how bastion hosts function and their key advantages in securing remote access:

• Remote Accessibility. A bastion host operates remotely on a server. Users connect to the bastion host via SSH to run queries on a private network. Secure access is ensured through technologies like SSH agent forwarding, safeguarding sensitive assets and internal resources.
• Common Use Cases. Administrators frequently use bastion hosts to execute SQL queries on databases inaccessible from the public internet.
• Access Management for IT Admins. IT admins can control access to resources without exposing login credentials. Bastion hosts support highly secure environments with customizable access control policies for different user groups.
• Ease of Setup. Bastion hosts are simpler to set up compared to VPNs, as they require only a basic server instead of extensive network infrastructure.
• Data Exfiltration Protection. VPN users can inadvertently download sensitive files, leaving them vulnerable once disconnected. Bastion hosts mitigate this risk by allowing admins to disable folder redirection, preventing unauthorized data removal from internal networks.

Bastion hosts give organizations with remote workforces enhanced control over file use and dissemination, making them ideal for companies with many remote employees.

Best Practices: Implementing Bastion Hosts

Implementing bastion hosts requires careful planning and configuration to ensure they are secure and effective. Here are some best practices for a successful implementation:

• Minimize the attack surface: Remove all unnecessary software or processes to reduce potential vulnerabilities.
• Implement access control measures: Use network-level controls and secure SSH connections to protect remote access.
• Automate patch management: Keep bastion host firmware up-to-date by automating patch management processes.
• Monitor and log user access: Regularly monitor and log user access and session activity to detect potential security threats.
• Use SSH safely: Protect remote connections with multi-factor authentication and regularly update SSH keys to maintain security.

By following these best practices, organizations can ensure that their bastion hosts are secure and effective in controlling access to internal networks. This approach helps maintain robust network security and protects sensitive data from unauthorized access.

Bastion host shortcomings

Bastion hosts have a number of disadvantages including the need for a firewall administrator which plays a crucial role in managing network security through bastion hosts and jump hosts (or servers), making critical decisions about network access and maintaining the security of specific systems.

Other shortcomings include:

• Management overhead
• Network vulnerability
• Susceptibility to cyberattacks
• Reliance on access keys
• Single point of failure

Management overhead

With a bastion host, users contact a specific server to access company infrastructure. Since the server is the ingress point for everyone — as opposed to individual connections between devices — this introduces a notable bottleneck with a great deal of operational overhead.

Network vulnerability in bastion hosts

If the bastion server is down, no one can access the network, and the server can be overloaded with concurrent connections or a targeted attack.

Companies may also be managing multiple bastion hosts for different networks. Even though some configuration can be automated, the more bastion hosts a company must manage, the greater the risk of misconfiguration, outdated patches, or an incorrect script exposing the server to cyberattack.

Implementing perimeter access control security, such as firewalls and bastion hosts, is crucial for protecting network systems by establishing barriers that regulate who can enter and interact with the network.

Susceptibility to cyberattacks

The cybersecurity landscape is always changing. Just like new software can disrupt the technology market, new advances in threat technology can make current security measures outdated.

This increases vulnerability, and if bastion servers aren’t up to date and at the cutting edge of security practices, they can become obsolete and susceptible to cyberattack.

Reliance on access keys for perimeter access control security

Each bastion host has a set of public and private access keys that other servers can use to connect securely to it. Only the host knows the private key, and doesn’t share this data.

It’s best practice to frequently rotate access keys to flush out any hacking attempts on the key. Due to the lack of enforceable controls surrounding them, keys are not always rotated, making it difficult to properly secure certifications.

Single point of failure

Most importantly, a bastion host is a single point of entry to a secure system, meaning that it’s also a single point of failure. Once a bastion host is compromised, everything it has access to is compromised as well. This can make bastion hosts a primary target for cyberattacks.

Given these shortcomings, admins often look for another solution that provides the security and scalability needed for a large remote workforce. This is where a modern, WireGuard®-based corporate VPN can provide an elegant solution.

Why use a VPN instead of a bastion host for private network?

You should use a VPN instead of a bastion host for private network because, as we’ve learned, bastion hosts tend to rely on SSH to provide a connection. This introduces a number of security concerns:

• SSH relies on users following traditional security best practices, such as strong passwords and key rotation.
• These practices are often ignored; in fact, modern security best practices suggest avoiding passwords entirely in favor of more secure options such as single sign-on (SSO).
• Malicious software on the internet continuously scans for SSH servers and tries to guess weak passwords.
• SSH does not force users to rotate keys, so even though it’s best practice, almost no one does it.

Because the main risk to a bastion host is its single point of failure, employees can lose access to shared resources in the event of a cyberattack, and a compromised or stolen key can lead to the entire network being compromised.

VPN alternative solutions like Tailscale improve the security of the connection by moving the SSH connection to a private mesh network. This network is end-to-end encrypted through the mesh VPN network, providing secure remote access to a company's resources.

Advantage of using a VPN instead of a bastion host

The biggest advantage of using a VPN instead of a bastion host is that a VPN creates a private, direct connection, which represents a reduced attack surface compared to that of a bastion host. This is unlike bastion hosts which are accessible on the public internet.

If you have a global footprint, the traffic in your network may have traversed a long distance to pass through the bastion host before reaching the private network. This adds latency and limits throughput.

How Tailscale can help

Tailscale keeps all VPN servers on their private peer-to-peer network, which is more secure and also faster than managing individual bastion hosts directly. It also automatically rotates your access keys on the secure network to provide an additional built-in security benefit.

Tailscale also supports multi-factor authentication, which requires users to log in using an additional device only they have access to. With Tailscale, only authorized users can connect to the SSH server.

Tailscale's solution replaces the need for bastion hosts entirely by moving resources, and therefore SSH connections, inside a virtual private network — which also improves security and reduces latency.

Understand who we built Tailscale for in this article, and watch how easy it is to get started with Tailscale for free in this quick start guide.