Contact UsGet started

Creating a bastion host

Written by
Updated at November 8, 2024

If you have ever had an interest in early modern fortifications, the word bastion should sound familiar to you. A bastion is a structure projecting outward from the outer wall of a fortification. Just like early modern fortresses, computer networks require multi-layer protection against external attacks. Such network bastions are called bastion hosts, and they form part of a network perimeter.

A bastion host is a virtual machine with a public IP address assigned to it to enable SSH access. Once set up, the bastion host acts as a jump server allowing you to securely connect to VMs with no public IP addresses. In this guide, you will learn how to deploy a bastion host and secure your access to remote virtual machines residing inside your virtual private cloud (VPC).

A bastion host will help you make your VPC servers less vulnerable. Administration of specific servers will be carried out within a proxy connection via a bastion host over SSH.

To create a bastion host:

  1. Prepare your cloud.
  2. Create an SSH key pair.
  3. Create networks.
  4. Create security groups.
  5. Reserve a static public IP address.
  6. Create a virtual machine for your bastion host.
  7. Test your bastion host.
  8. Add a virtual server to your bastion host's internal segment.
  9. Connect to the VM you created.

If you no longer need the resources you created, delete them.

test-vm172.16.16.12172.16.16.254172.16.17.12 51.250.110.18Public IPbastion-internal-segmentVPCCLOUDbastion-external-segmentbastion-hostinternal-bastion-sg Security group egress: TCP port 22 Destination Self ingress: TCP port 22 Source 172.16.16.254/32sequre-bastion-sg Security group ingress: TCP port 22 Source 0.0.0.0/0

Getting started

Sign up for Yandex Cloud and create a billing account:

  1. Go to the management console and log in to Yandex Cloud or create an account if you do not have one yet.
  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one.

If you have an active billing account, you can go to the cloud page to create or select a folder for your infrastructure to operate in.

Learn more about clouds and folders.

The infrastructure support cost includes:

Create an SSH key pair

To connect to a VM over SSH, you need a key pair: the public key resides on the VM, and the private one is kept by the user. This method is more secure than connecting with login and password.

Note

SSH connections using a login and password are disabled by default on public Linux images that are provided by Yandex Cloud.

Cisco Cloud Services Router (CSR) 1000v only supports keys generated using the RSA algorithm.

To create a key pair:

  1. Open the terminal.

  2. Use the ssh-keygen command to create a new key:

    ssh-keygen -t rsa -b 2048

    After you run the command, you will be asked to specify the names of files where the keys will be saved and enter the password for the private key. The default name is id_rsa. Keys are created in the ~/.ssh directory.

    The public part of the key will be saved to the <key_name>.pub file.

  1. Run cmd.exe or powershell.exe.

  2. Use the ssh-keygen command to create a new key:

    ssh-keygen -t rsa -b 2048

    After you run the command, you will be asked to specify the names of files where the keys will be saved and enter the password for the private key. The default name is id_rsa. The keys are created in C:\Users\<username>\.ssh\ or C:\Users\<username>\ depending on the command-line interface.

    The public part of the key will be saved to a file named <key name>.pub.

Create keys using the PuTTY app:

  1. Download and install PuTTY.

  2. Make sure that the directory where you installed PuTTY is included in PATH:

    1. Right-click My computer. Click Properties.
    2. In the window that opens, select Additional system parameters, then Environment variables (located in the lower part of the window).
    3. Under System variables, find PATH and click Edit.
    4. In the Variable value field, append the path to the directory where you installed PuTTY.

  3. Launch the PuTTYgen app.

  4. Select RSA for the type of pair to generate and set the length to 2048. Click Generate and move the cursor in the field above it until key creation is complete.

    ssh_generate_key

  5. In Key passphrase, enter a strong password. Enter it again in the field below.

  6. Click Save private key and save the private key. Do not share its key phrase with anyone.

  7. Save the key to a text file. To do this, copy the public key from the text field to a text file with the name id_rsa.pub. Please note that the key must be written as a single line (no returns or line breaks).

Warning

Save the private key in a secure location, as you will not be able to connect to the VM without it.

Create an external network and an internal one

Create an external network and subnet

  1. In the management console, go the folder where you want to create an infrastructure for your bastion host.

  2. In the list of services, select Virtual Private Cloud.

  3. In the top-right corner, click Create network.

  4. Enter a name for the network: external-bastion-network.

  5. Disable the Create subnets option.

  6. Click Create network.

  7. Create a subnet:

    1. At the top right, click Create subnet.

    2. Specify the subnet parameters:

      • Name: bastion-external-segment.
      • Zone: ru-central1-b.
      • CIDR: 172.16.17.0/28.

    3. Click Create subnet.

Create an internal network and subnet

  1. In the management console, go the folder where you want to create an infrastructure for your bastion host.

  2. In the list of services, select Virtual Private Cloud.

  3. In the top-right corner, click Create network.

  4. Enter a name for the network: internal-bastion-network.

  5. Disable the Create subnets option.

  6. Click Create network.

  7. Create a subnet:

    1. At the top right, click Create subnet.

    2. Specify the subnet parameters:

      • Name: bastion-internal-segment.
      • Zone: ru-central1-b.
      • CIDR: 172.16.16.0/24.

    3. Click Create subnet.

Create security groups

Create a security group for your bastion host

Create a security group and configure the rules for the bastion host's inbound traffic for it to be accessible from the internet.

  1. In the management console, go the folder where you want to create an infrastructure for your bastion host.

  2. In the list of services, select Virtual Private Cloud and the external-bastion-network network.

  3. In the left-hand menu, select Security groups.

  4. Click Create security group.

  5. Enter the security group name: secure-bastion-sg.

  6. Under Rules, go to the Ingress tab and click Add rule.

  7. Specify the rule settings:

    • Port range: 22.
    • Protocol: TCP.
    • Source: CIDR.
    • CIDR blocks: 0.0.0.0/0.

  8. Click Save in the rule creation window and then in the security group creation window.

Create a security group for internal hosts

Create a security group and set up rules for incoming traffic from the bastion host to internal hosts:

  1. In the management console, go the folder where you want to create an infrastructure for your bastion host.

  2. In the list of services, select Virtual Private Cloud and the internal-bastion-network network.

  3. In the left-hand menu, select Security groups.

  4. Click Create security group.

  5. Enter the security group name: internal-bastion-sg.

  6. Under Rules, go to the Ingress tab and click Add rule.

  7. Specify the rule settings:

    • Port range: 22.
    • Protocol: TCP.
    • Source: CIDR.
    • CIDR blocks: 172.16.16.254/32.

  8. Click Save in the rule creation window.

  9. Go to the Egress tab and click Add rule.

  10. Specify the rule settings:

    • Port range: 22.
    • Protocol: TCP.
    • Destination name: Security group.
    • Security group: Current.

  11. Click Save in the rule creation window and then in the security group creation window.

Reserve a static public IP address

The bastion host will need a static public IP address to run.

  1. In the management console, go the folder where you want to create an infrastructure for your bastion host.
  2. In the list of services, select Virtual Private Cloud.
  3. In the left-hand panel, select IP addresses.
  4. Click Reserve address.
  5. In the window that opens, select the ru-central1-b availability zone.
  6. Click ** Reserve**.

Create a VM for the bastion host

After you created the subnet and security group, proceed to create a virtual server for the bastion host:

  1. In the management console, go the folder where you want to create an infrastructure for your bastion host.

  2. In the list of services, select Compute Cloud.

  3. At the top right, click Create virtual machine.

  4. Enter the VM name: bastion-host.

  5. Select the availability zone: ru-central1-b.

  6. Under Boot disk image:

    • In the Marketplace tab, select the NAT instance powered by Ubuntu 22.04 LTS product.
    • Click Use.

  7. Under Network settings, configure the first network interface:

    • Subnet: bastion-external-segment.
    • Public IP: Click List and select the IP address reserved earlier.
    • Security groups: secure-bastion-sg.

  8. Click Add network interface and configure the second network interface:

    • Subnet: bastion-internal-segment.

    • Public IP: No address.

    • Security groups: internal-bastion-sg.

    • Expand the Advanced section:

      • In the Internal IPv4 address field, select List.

      • Click Reserve. In the window that opens:

        • In the Internal IPv4 address field, enter 172.16.16.254.
        • Click Create.

    Note

    Make sure the first interface on the new VM belongs to an external segment, since the default gateway is automatically specified on this interface.

    Specify a public IP address for the external segment only. For the internal segment, specify an internal static IP address.

  9. Under Access, enter bastion as the username in the Login field.

  10. In the SSH key field, paste the contents of the public key file.

  11. Click Create VM.

As soon as the server VM starts and gets the Running status, you will see the public IP address assigned to it in the Public IP address field.

Test the bastion host

After you start your bastion host, try to connect to it via the SSH client:

ssh -i ~/.ssh/<name_of_private_key_file> bastion@<public_IP_address_of_bastion_host>

Add a virtual server to the internal segment of the bastion host

To administer your servers, add a network interface to the internal network segment of the bastion host, bastion-internal-segment.

If you already have a virtual machine, add another network interface to it. If not, create a new machine to test your bastion host configuration:

  1. In the management console, go the folder where you want to create an infrastructure for your bastion host.

  2. In the list of services, select Compute Cloud.

  3. At the top right, click Create virtual machine.

  4. Enter the VM name: test-vm.

  5. Select the availability zone: ru-central1-b.

  6. Under Boot disk image, select an operating system.

  7. Under Network settings, configure a network interface:

    • Subnet: bastion-internal-segment.
    • Public IP: No address.
    • Internal IPv4 address: Auto.
    • Security groups: internal-bastion-sg.

  8. Under Access:

    1. Disable the Access by OS Login option.
    2. In the Login field, enter the username: test.
    3. In the SSH key field, paste the contents of the public key file.

  9. Click Create VM.

Connect to the created VM

If connecting to the VM over SSH via an internal IP address, you will use your bastion host as a jump host.

To simplify and configure SSH access, add the -J (ProxyJump) parameter to the SSH command:

ssh -i ~/.ssh/<name_of_private_key_file> -J bastion@<public_IP_address_of_bastion_host> test@<internal_IP_address_of_virtual_server>

The SSH client will automatically connect to the internal server.

You can use the -J flag in OpenSSH version 7.3 or higher. In earlier versions, -J is not available. The easiest and most secure alternative is to use standard I/O redirection (the -W flag) to forward the connection through the bastion host. Here is an example:

ssh -i ~/.ssh/<name_of_private_key_file> -o ProxyCommand="ssh -W %h:%p bastion@<public_IP_address_of_bastion_host>" test@<internal_IP_address_of_virtual_server>

Additional connection options

Using an SSH agent for connections via the bastion host

By default, server access is only set up for authentication using a public SSH key. We do not recommend storing keys directly on your bastion hosts, especially without a passphrase. Use an SSH agent instead. In this case, private SSH keys will only be stored on your computer and you will be able to safely use them for authentication on the next server.

To add a key to an authentication agent, use the ssh-add command. If the key is stored in the ~/.ssh/id_rsa file, it is added automatically. You can also set a specific key to use by running the command below:

ssh-add <key_file_path>

If using macOS, you can create the ~/.ssh/config file. In this case, you can use the following command to upload the keys to the agent:

AddKeysToAgent yes

The following command used to connect to the bastion host allows you to perform agent forwarding and log in to the next server by providing the credentials from your local machine:

ssh -A bastion@<public_IP_address_of_bastion_host>

Windows users can use Pageant and upload their private key file to it. Next, to ensure agent forwarding, open the PuTTY configuration window and select Connection → SSH → Authentication.

Access to services through SSH tunnels

Sometimes, SSH access alone is not enough to complete your task. If that is the case, use SSH tunnels to easily connect to web applications and other services used to process inbound connections.

The main types of SSH tunnels are local, remote, and dynamic:

  • A local tunnel is an open port in a local loopback interface, which connects to the IP:port address on your SSH server.

    For example, you can connect local port 8080 to the web_server_IP_address:80 address accessible from your bastion host and then open http://localhost:8080 in your browser:

    ssh bastion@<public_IP_address_of_bastion_host> -L 8080:<web_server_IP_address>:80

  • A remote tunnel works in the direction opposite to that of the local tunnel by opening a local port for connection to a remote server.

  • A dynamic tunnel provides a SOCKS proxy on a local port with connections established from a remote host. For example, you can set up a dynamic tunnel on port 1080 and then specify it as a SOCKS proxy in your browser. As a result, you will be able to connect to any resources that are accessible from your bastion host and reside in a private subnet.

    ssh bastion@<public_IP_address_of_bastion_host> -D 1080

These methods rely on simple replacement that often requires a VPN connection as well as a combination with ProxyJump or ProxyCommand connections.

Windows users can set up tunnels using PuTTY by selecting Connection → SSH → Tunnels.

For easy connections to Remote Desktop Services (RDS), i.e., Windows hosts running in a cloud, you can use port redirection (the local one in particular) by establishing a tunnel connection to port 3389 and then connecting to localhost via an RDS client. If the RDS client is already awaiting connection on the local machine, you can choose a different port as shown in the example below:

ssh bastion@<public_IP_address_of_bastion_host> -L 3390:<Windows_host_IP_address>:3389

Transferring files

For Linux clients and servers, you can configure SCP to securely transfer files through the bastion host to internal hosts and back. Do this using the same ProxyCommand and ProxyJump options specified in the SSH command line. Here is an example:

scp -o "ProxyJump bastion@<public_IP_address_of_bastion_host>" <file_name> bastion@<internal_IP_address_of_virtual_server>:<path_to_file>

If you are a Windows client user, one of the most popular SCP applications for Windows is WinSCP. To transfer files via your bastion host to a remote Linux machine:

  1. Create a session to connect to a private host IP without a password. Set up an SSH key on the Linux machine.
  2. In the left-hand navigation menu, click Advanced and select Tunnel.
  3. Enter the IP address and username for your bastion host. In the Private key file field, select and set the private key file to use for authentication on your bastion host.
  4. In the left-hand navigation menu, select Authentication under SSH.
  5. Make sure to select Allow agent forwarding.
  6. Choose the private key to use for authentication on a private host.

This configuration enables a direct file transfer between your Windows machine and Linux private host. The bastion host will secure connections between them.

If using Windows hosts residing behind a Linux bastion, you can transfer files using RDP via a tunnel. This method ensures an efficient and secure file transfer.

How to delete the resources you created

To stop paying for the resources you created:

Previous
Setting up networking between resources in different folders
Next
Creating a tunnel between two subnets using OpenVPN Access Server