What is a bastion router? How different is it from a firewall?

A bastion router is a router hardened for maximum security, positioned at the edge of a network to connect a less secure network (like the Internet) to a more secure internal network. It is configured to run only essential services, reducing its attack surface. Its primary function is routing, but it also performs basic packet filtering, acting as an initial line of defense. For example, a bastion router might be configured to only allow DNS queries from specific internal servers to reach external DNS servers, blocking all other outgoing DNS traffic, or to permit only certain inbound connections to a DMZ.

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Firewalls enforce access control policies and can be hardware appliances, software applications, or a combination. They operate at various layers of the OSI model, offering features from basic packet filtering to stateful inspection and application-layer filtering. More information on firewall fundamentals is available in E. Hall's Internet Firewall Essentials.

The key difference lies in their primary function and scope. A bastion router is primarily a router, configured for security, that offers rudimentary firewall capabilities through packet filtering. Its role is often as a first-line network device in a layered security architecture, such as a demilitarized zone (DMZ) setup for an FTP server as discussed by J.M. Adams at FTP server security strategy for the DMZ. A firewall, on the other hand, is a dedicated security device whose main purpose is to enforce access control policies and protect a network. While a bastion router might offer basic security, a dedicated firewall provides more advanced and comprehensive security features, including stateful packet inspection, deep packet inspection, and integration with intrusion prevention systems, as outlined by C. Semeria in Internet Firewalls and Security: A Technology Overview. Security concepts like firewalls are foundational to network protection, as described in texts such as Joseph Migga Kizza's Guide to Computer Network Security.