Network security infrastructure: NAT, firewalls, bastion hosts and DMZ
In short: NAT lets a private network use its own addresses and share a few public ones. Firewalls enforce least privilege between networks; host-based and network-based firewalls complement each other. Public services should sit in a DMZ so that a compromised web server does not expose the internal LAN.
Network Address Translation (NAT)
NAT lets an organisation use private IP addresses internally while the device at the edge (router or firewall) translates them to public addresses on the internet. It saves public addresses and hides the internal layout from outsiders.
| Type | How it maps | Typical use |
|---|---|---|
| Static NAT | One private address to one fixed public address | A server that must be reachable from outside |
| Dynamic NAT | Private addresses take a free public address from a pool | Organisations with a block of public addresses |
| PAT (NAT overload) | Many private addresses share one public address, told apart by port number | Almost every home and office internet connection |
Firewall principles
- Least privilege: allow only the traffic and access that is genuinely needed; deny everything else.
- Separation of duties: no single person should control every part of a sensitive task. Give administrators separate logins with different privileges rather than one all-powerful account.
- Single choke point: a firewall only protects traffic that passes through it. One unmanaged connection around it (a rogue modem, an open Wi-Fi bridge) makes it worthless.
Host-based vs network-based firewalls
| Host-based | Network-based | |
|---|---|---|
| Where | Software on each server or PC (for example Windows Defender Firewall) | Appliance, virtual appliance or cloud service at a network boundary |
| Strengths | Moves with the machine (laptops, VMs migrating between hosts); rules tailored to each host; still protects inside the LAN | One place to manage; protects every device behind it; scales with bandwidth; no install on each server |
| Weaknesses | Must be managed on every device; can be disabled if the host is compromised | Does not see traffic between hosts on the same segment; a single point of failure without redundancy |
Most organisations use both: network firewalls at the edges and host firewalls as a second layer.
What a firewall cannot do
- Stop attacks hidden in traffic it allows, such as malicious content inside normal web traffic, unless it inspects that content.
- Protect against insiders, such as a disgruntled employee already inside the network.
- Stop traffic that bypasses it.
- Reliably catch every virus across the huge range of operating systems and file types: that needs endpoint protection too.
Firewall types and bastion hosts
- Packet filter (stateless): checks each packet’s addresses, ports and protocol against rules, with no memory of earlier packets.
- Stateful packet filter: tracks each client-server session and only accepts packets that belong to a valid one, so out-of-context packets are dropped.
- Application-level gateway (proxy): the client talks to the proxy; the proxy checks the request is legitimate for that application, then makes the request on the client’s behalf.
- Circuit-level gateway: relays TCP (and UDP) connections between two networks, deciding which connections are allowed; once set up, it passes data without examining the content.
- Bastion host: a hardened machine running only one exposed service, with everything else removed. With nothing else running, there is less to attack and less to go wrong.
The demilitarised zone (DMZ)
A business needs a public web or mail server, but putting it inside the trusted network invites attackers in. The answer is a separate segment, the DMZ, just outside the trusted network.
DMZs are used for public services, test and lab environments and guest networks. The trade-off is more complex design and a little extra latency; how much depends on the design and the level of security required.
Practice
Which NAT type lets 50 PCs share one public IP address?
Give one advantage of a host-based firewall over a network-based one.
Why place a public web server in a DMZ instead of the internal LAN?
Key takeaways
- NAT maps private addresses to public ones; PAT lets many hosts share one address.
- Firewalls apply least privilege and must be the only path between networks.
- Use host-based and network-based firewalls together.
- Firewalls cannot stop insiders, bypass routes or every threat inside allowed traffic.
- Public services belong in a DMZ, separated from the trusted LAN.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.