What is a bastion host?

Ayan Hussain

Jul 26, 2026 · 4 min read

A bastion host is a server deliberately exposed to the public internet that acts as the single entry point to a private network. Everything else in the network sits behind it, unreachable directly. If you want to SSH into one of those private machines, you connect to the bastion first, then from the bastion to the target.

The term comes from military architecture. A bastion is a projecting part of a fortification designed to allow defenders to cover adjacent walls. The analogy is direct: one hardened point you defend carefully, rather than trying to defend everything.

Why use one?

If you run ten servers and expose port 22 on all ten to the internet, you have ten surfaces for attackers to scan, probe, and attempt logins against. Move all ten to a private network and expose only the bastion, you have one. That one can be audited, monitored, and hardened more thoroughly than ten could be.

Bastions also centralize SSH access logs. Every connection goes through the same point, so you have one place to look when reviewing who accessed what and when.

How it works

Your private servers have no public IP address. The bastion does. When you SSH, you connect to the bastion, and the bastion relays the connection forward.

The modern way to do this with OpenSSH is ProxyJump:

ssh -J user@bastion user@private-server-ip

Or in ~/.ssh/config:

Host private-server
  HostName 10.0.1.50
  User ec2-user
  ProxyJump bastion

Host bastion
  HostName 52.x.x.x
  User ec2-user
  IdentityFile ~/.ssh/my-key.pem

After that, ssh private-server handles the whole chain automatically.

What makes a good bastion configuration

Port 22 should be locked to specific IP ranges, not open to the world. If your team works from known IP addresses, allow only those. Otherwise, at minimum, allow your home and office IPs and disable the rule when you are not actively using it.

Disable password authentication on the bastion. Key-only access means a leaked password is not enough to get in.

Enable detailed logging. On Linux, AuthorizedKeysFile and sshd logging can be piped to a centralized log store so access is auditable.

Do not install unnecessary software on the bastion. It should do one job.

AWS and cloud-specific bastion setup

On AWS, the bastion sits in a public subnet with an Elastic IP. Your application servers sit in private subnets with no public IP. The security group on the bastion allows inbound port 22 from your IP range. The security groups on private servers allow port 22 only from the bastion's security group ID.

AWS also offers Session Manager, which lets you connect to private instances through the AWS console without a bastion at all. It is worth evaluating if you want to eliminate the bastion entirely and use IAM-based access control instead.

Using SSHDock with a bastion host

SSHDock has built-in jump host support. In the connection form, expand the "Jump Host" section, enter the bastion's public IP and your private key, and SSHDock tunnels through it to the private server automatically.

For a broader look at SSH hardening on the server itself, see our guide to securing SSH.