Networking

Hardening Infrastructure with a Bastion Host

Network Design diagram · made in Skemio

Network diagram showing an admin connecting through the internet to a DMZ bastion host, which routes verified SSH sessions to private databases and servers.
Network diagram showing an admin connecting through the internet to a DMZ bastion host, which routes verified SSH sessions to private databases and servers.
Open it in SkemioMake your own

What it shows

  • Eliminates public IPs from internal databases and workload servers.
  • Enforces hardware MFA, session timeboxing, and raw keystroke logging.
  • Limits attack surface to a single hardened Linux endpoint in a DMZ.

The takeaway

One strictly monitored gateway beats fifty firewalled SSH pinholes every time.

More network design diagrams