Bastion host

A bastion host, also called a jump box, is a hardened server placed at the edge of a private network. It is the one machine that accepts inbound SSH (Secure Shell) or RDP (Remote Desktop Protocol) connections from outside. Engineers connect to the bastion first, then hop from it to servers in private subnets that have no public IP address.

How it works

The bastion sits in a public subnet with a firewall rule that allows port 22 only from known addresses, for example 203.0.113.10/32. Private instances allow SSH only from the bastion's security group. With OpenSSH, ssh -J user@bastion user@10.0.2.15 jumps through the bastion in one command. Teams also use it to tunnel database ports from a laptop.

Why it matters in production

A bastion shrinks the attack surface to one host, but that host becomes a high-value target. Someone has to patch it, rotate SSH keys, keep audit logs and pay for it to run all day. Many teams on AWS now replace bastions with identity-based access such as SSM Session Manager, which needs no open inbound ports.

See also

• AWS SSM Session Manager

• Network address translation

• Infrastructure as code

On the One2N blog

• How to port-forward from EC2 instances without the need for opening any SSH ports or creating bastion hosts

• Terraform: best practices and gotchas

• How to test TCP connectivity without curl using bash /dev/tcp

References

1. Origin of the term

2. ssh(1) manual: the -J ProxyJump option (OpenBSD)