What EXACTLY is Bastion? | SSH Jump, Port Forwarding & Netflix

0:00 In most modern infrastructures, sensitive resources like production databases, application servers or internal dashboards are kept inside private networks. These networks are intentionally isolated from the public network to reduce the attack surface and prevent unauthorized access. Engineers still need to connect to these internal systems for deployments, troubleshooting or maintenance. The challenge is that these machines don't have public IP addresses, can't be reached directly over the Internet, and sit behind strict firewalls and security group rules.

0:33 One option is to set up a VPN that connects your laptop directly to the private network. While VPNs work, for some cases, they often give broad access once connected, which goes against the principle of least privilege. VPNs can also be slower to provision, harder to audit per session activity, and less granular in controlling which internal resources internally user can reach. A bastion host solves this differently. Instead of giving you a blanket connection to the whole network, it provides a single, tightly controlled entry point.

1:04 You connect to a bastion first and from there you reach only the resources you are authorized to access. This keeps the private network invisible to the outside world, while still allowing secure auditable access for those who need it. A bastion host is a specially configured server that acts as the secure gateway between a public network like the Internet and a private network. It's sometimes called a jump host or jump box because you jump through it to reach other systems.

1:37 What makes it different from a normal server is its role and configuration. It has public ip, so authorized users can connect to it from anywhere. It runs only the essential services required for remote access, most commonly SSH for Linux or RDP for Windows. It has strong authentication, often multi factor authentication, detailed logging of every session, and strict firewall rules controlling what it can talk to. And all administrative connections to the private network go through this one machine, making it easier to monitor and control.

2:11 So? So when you connect to a bastion host, you don't stop there. It's just the first hop from the bastion. You ssh, RDP or port forward to other machines that are not reachable directly from the public Internet. Think of it as a secure guardhouse at the network's edge. You enter there, get your identity verified, and only then you are allowed to proceed to the specific area you are permitted to access. The core idea is simple. Instead of connecting directly to private resource, you first connect to the bastion host and from there you connect to the target system.

2:44 So basically you connect from your local machine to the bastion host. For Linux or Unix systems this is usually over ssh. For Windows system it might be over RDP or a secure SSH client. The bastion host verifies your identity, typically with public key authentication and sometimes mfa. Your access level is determined by server side rules or IAM policies. From the bastion, you connect to the private resource. This could be another SSH hop or a local port forwarding tunnel.

3:16 This command here makes your local localhost 3306 point to the database's private port via the bastion. We'll talk about it soon. And then the traffic flows securely. The public Internet only ever sees traffic between you and the bastion, and the bastion talks to the private system over internal non public network routes. Now, once you are inside a bastion, there are a couple of ways to reach the system you actually care about. The method you choose depends on whether you just need terminal access or if you want to run local tools against something in the private network.

3:51 Let's look at the two most common connection patterns you'll come across. First, the SSH job. Instead of connecting to the bastion I than typing another SSH command to reach your target machine, you can do it in one go. It's cleaner, faster, and avoids the awkward double SSH step. For example, you need to log into an internal web server that has no public ip. By using just the J option, your SSH client hops through the bastion automatically.

4:20 You just log in once and you're inside in open ssh. When people say SSH jump, they are almost always talking about using the hyphen J flag, which is the proxy jump feature. Sshjump is more of a concept. Connect your host through another host proxy jump is the specific open SSH implementation of that concept. By the way, there are many SSH implementations out there, both open source and commercial, like OpenSSH, Putty, WinSCP and others.

4:51 I have actually made a deep dive video on how SSH works, covering everything from key pairs to encryption and tunneling. You can find that in my channel security playlist. Next we have local port forwarding. This is perfect when you want to use a local app like a database client or a browser to connect to something in the private network without installing that app on the bastion. So here you're telling the SSH listen on my laptop's port 3306 and whenever something sends traffic there, securely forward that traffic to PrivateDB 3306 via the SSH tunnel to the bastion.

5:28 Now, when you connect to localhost 3306 on your own laptop, your traffic securely tunnels through the bastion and lands on the private database. For example, you open MySQL Workbench on your laptop, point it to localhost 3306 and you are actually talking to your production database that's completely hidden from the public Internet. Now, sometimes you don't have just one bastion. You have to go through two or more before you can reach your target system. And this happens in large enterprise or sensitive environments where networks are segmented for security.

6:03 For example, you might have a Bastion one, which is a corporate bastion accessible from the Internet via VPN or MFA. And then you have a Bastion 2, which is a project specific bastion only reachable from inside the corporate network. And a private server, which is your actual target, like a production database or an internal app server. Without modern SSH features, you would have to ssh into bastion1. From there, ssh into bastion2 and finally ssh into the private server.

6:33 That's three separate logins. With open SSH proxy jump, you can chain them in one command. For example, this tells SSH to automatically hop through the bastions before connecting to the final host. Let's look at how Netflix secures engineers access to its production infrastructure. Netflix runs thousands of microservices and data stores inside private AWS VPCs. And none of these production systems are exposed to the public Internet, not even for employees. Instead, Netflix uses a hardened bastion host layer integrated with their internal identity platform.

7:09 Here is how it works. Say an engineer needs to troubleshoot a service in production. They first connect to a bastion host, but they can't even start the SSH session without passing through oktamfa. This ensures stolen SSH keys alone aren't enough to gain access. Once inside the bastion, they can only reach the system tied to their role. A backend engineer may have SSH access to application servers, but not to the payment database. This is enforced by AWS security groups and IAM policies.

7:40 Every SSH command run through the bastion is logged. Session activity can be replayed if needed during security investigations. And access to the bastion is time bound. Sessions automatically expire, reducing the risk if an engineer's machine is compromised. Netflix likes this setup because it keeps things tight and controlled. They are just one doorway to the Internet, the bastion. It also means engineers only see what they're supposed to see, so there is no chance of accidentally poking around in the wrong system.

8:11 And since all the admin access flow through the single entry point, it's easy to monitor activity and respond quickly if something suspicious happens. This model is so effective that even during large scale incidents where multiple teams might need emergency access, Netflix can open a temporary bastion access. Or for just the right people then revoke it instantly when the work is done. Of course, bastions aren't the only game in town anymore. AWS has AWS System Manager Session Manager, which lets you connect to private instances right from the browsers or cli, no public IP needed.

8:46 Google offers IAP or Identity Aware proxy, which adds identity checks before giving you access to apps or SSH. And then there are zero trust platforms like Teleport or StrongGM that are designed to replace traditional bastions altogether. While bastions are powerful, they're not always the best solution. Platforms like AWS ssm, Google IAP or Teleport authenticate users based on identity, not network location. They remove the need for public jump box entirely. And if your VPN is granular enough to give access only to the system you need and you have strong logging and mfa, a bastion may be redundant CI CD pipelines or automated scripts connecting to private resources often use direct VPC peering or service endpoints instead of going through a bastion.

9:35 And finally, in small setups, a bastion can add unnecessary steps and maintenance overhead without significant security gains. So next time you hear the term bastion host, you'll know it's not just another server, it's a secure front door to your private infrastructure. Whether you're debugging production database, deploying to internal servers, or managing cloud workloads, understanding bastions will make you safer, faster, and more effective engineer. And if you found this breakdown useful, hit like subscribe and share it with a teammate who still thinks a bastion is just a medieval castle.