What is a bastion host?
A bastion host is a specially hardened server at the edge of a network that acts as the single controlled gateway between an untrusted network, such as the internet or the office network (IT), and a protected network, such as an OT environment. Because a bastion host is deliberately exposed to the untrusted network, it runs as little software as possible, is strictly configured, and logs everything that happens on it. In industrial environments, a bastion host prevents administrators or suppliers from connecting directly to a PLC, a SCADA server or an engineering station from a less trusted zone.
🧠 Where does the term bastion host come from?
In fortress design, a bastion is the projecting stronghold that takes the first attack and is therefore built extra strong. The networking term is attributed to Marcus J. Ranum, who in a 1990 article on firewalls described a bastion host as a system identified by the firewall administrator as a critical strong point in the network security.
In its original sense, a bastion host is any system that is deliberately reachable from an untrusted network: a web server, mail server, DNS server, proxy or VPN concentrator in the DMZ. Today most people use the term more narrowly: an administrative access point through which administrators enter a protected network via SSH or RDP. In that sense, bastion host overlaps almost entirely with jump server.
🔧 How does a bastion host work?
A typical administrative session through a bastion host follows five steps:
- Connect - the user connects to the bastion host via SSH (port 22), RDP (port 3389) or a web interface over HTTPS (port 443). Often a VPN gateway sits in front of it.
- Authenticate - the user signs in with a personal account and MFA; shared accounts are not allowed.
- Authorise - through access control based on RBAC and least privilege, the bastion host decides which target systems and protocols this user may reach, possibly only within an approved time window.
- Relay - the bastion host opens the session to the target system on the user’s behalf. The firewall only permits traffic from the bastion host to that target.
- Record - the session is logged, often recorded with session recording and forwarded to a SIEM for real-time monitoring. The session is terminated after inactivity or when the time window expires.
Think of a bastion host as a digital security airlock: anyone who wants in always passes through the same door, is checked, and leaves a trail.
🔄 What is the difference between a bastion host and a jump server?
In practice the two terms are often used as synonyms. The difference lies mainly in the scope of the concept.
| Aspect | Bastion host | Jump Server |
|---|---|---|
| Meaning | Broad: any hardened system at the network edge | Specific: a stepping stone for administrative sessions |
| Examples | Web server, DNS server, proxy, admin access point | Windows server with RDP tools, Linux host for SSH |
| Typical location | DMZ or network perimeter | DMZ or IDMZ, sometimes a second one in the OT zone |
| Users | Depends on the role: public or administrators | Administrators, engineers and suppliers only |
| Logging and audit | Essential, because it is exposed | Essential, because it reaches sensitive systems |
Importantly, a well-built jump server is a bastion host. Logging is optional for neither. The old idea that a jump server can be less strictly secured is wrong.
🏭 How is a bastion host used in OT networks?
In industrial networks following the Purdue Model, the bastion host usually sits in the IDMZ, at level 3.5 between the enterprise network and the control networks. Common uses:
- Remote access for suppliers - a machine builder first signs in to the bastion host and only then gets a session to its own equipment, tied to a work permit or change.
- Administration by in-house engineers - from an office workstation to an engineering station or HMI in the production environment, without any direct route.
- Remote maintenance - out-of-hours fault diagnosis, approved by the operator on duty.
- File transfer - controlled exchange of PLC programs or patches, with a malware scan on the bastion host.
- Oversight - session logs and recordings feed anomaly detection and incident investigation.
Larger sites often work with two tiers: a bastion host in the IDMZ for access from IT, and a jump host or engineering station in the OT zone that holds the heavy engineering software. This creates defence in depth.
🔐 How do you secure a bastion host?
Because the bastion host is an attacker’s first target, it deserves more attention than any other server. The table maps the main measures to the system requirements (SRs) in IEC 62443-3-3.
| Measure | In practice | Link to IEC 62443-3-3 |
|---|---|---|
| Hardening | Minimal installation, one function, unnecessary services and software removed | SR 7.7 (least functionality) |
| Strong authentication | Personal accounts, MFA, preferably phishing-resistant | SR 1.1 RE 2 (MFA via untrusted networks, from SL 3) |
| Access via untrusted networks | Only after explicit approval and over an encrypted connection | SR 1.13 |
| Session management | Session lock and automatic termination after inactivity | SR 2.5 and SR 2.6 |
| Logging | All sign-ins and actions sent to Syslog/SIEM | SR 2.8 (auditable events) |
| Network restriction | Firewall rules: known sources and target systems only | Conduits in the Zones and Conduits Model |
| Patch Management | Patch quickly; the bastion host is not a sensitive OT system | Process requirement from IEC 62443-2-1 |
In addition, do not install engineering software, email or a web browser on a bastion host that faces the internet, and do not simply join it to the office Active Directory domain. Otherwise a compromised domain gives an attacker direct control over the gateway itself.
🧭 How do you set up a bastion host step by step?
- Inventory access needs - which users and suppliers need access, to which systems and how often?
- Decide the location - usually the IDMZ, with one firewall towards IT and one towards OT, in line with network segmentation under IEC 62443.
- Choose the technology - a hardened Linux or Windows server, an open-source gateway such as Apache Guacamole (RDP, SSH and VNC through the browser), or a PAM solution with a built-in bastion function, such as WALLIX Bastion.
- Set up identity and permissions - MFA, role-based permissions, temporary accounts for suppliers and password vaults that inject credentials.
- Arrange logging and recording - connect to the SIEM and keep recordings long enough for incident investigation.
- Test and review - check periodically that no bypasses exist next to the bastion host, such as forgotten modems or suppliers’ own remote support tools.
Cloud. Managed variants exist in cloud environments. Azure Bastion provides RDP and SSH access over TLS on port 443, so virtual machines need no public IP address; session recording is part of the Premium tier.
Dutch and EU context. Organisations covered by NIS2 and the Dutch Cybersecurity Act (in force since 15 August 2026) must take appropriate measures for access control and multi-factor authentication. A bastion host with MFA and session logging is a concrete way to demonstrate this for administrative and supplier access, including towards compliance and audits. See also Supplier Security for the arrangements with suppliers.
❓ Frequently asked questions
Is a bastion host the same as a firewall?
No, a bastion host is a hardened server, whereas a firewall filters traffic based on rules. They do work together: the firewall ensures that only the bastion host may connect to the protected network, and the bastion host checks and records who uses that connection.
Where do you place a bastion host in an OT network?
A bastion host for OT access usually sits in the IDMZ, at level 3.5 of the Purdue Model, between two firewalls. This way there is no direct route from the office network or the internet to the control systems.
Does a bastion host always need MFA?
A bastion host that is reachable from an untrusted network should always use MFA. IEC 62443-3-3 requires multi-factor authentication for access via untrusted networks from security level 3, and NIS2 explicitly names multi-factor or continuous authentication as a measure.
Can a bastion host replace a VPN?
A bastion host can partly replace a VPN, because it grants access to specific systems rather than to an entire network. In practice the two are often combined: the VPN gives access to the IDMZ, and the bastion host determines which OT systems a user may reach.
What is Azure Bastion?
Azure Bastion is a managed bastion host service from Microsoft that lets you connect to virtual machines in Azure via RDP or SSH over TLS on port 443. The virtual machines therefore need no public IP address, and in the Premium tier sessions can be recorded.
Does a bastion host fit within Zero Trust?
A bastion host can be a building block of a Zero Trust approach, because it checks and records every session. Zero Trust goes further, however: access is evaluated per request even after sign-in, whereas a classic bastion host is mainly a fixed checkpoint at the network perimeter.
📌 In summary
A bastion host is the hardened, closely monitored access point through which all administrative and supplier access to a protected OT network passes. With MFA, role-based permissions, strict firewall rules and full session logging, a bastion host prevents direct connections and strengthens access management at a single central point in your OT architecture.