Relay Host Host Firewall Architecture
You build a relay host host firewall architecture by placing local packet filters on both the stepping-stone server and the destination machines. First, you lock down incoming ports on the intermediate node and allow traffic only from approved addresses. Teams often set up these local rules to block outside attackers from reaching private servers. Still, broad port rules often let anyone on the stepping-stone server reach every internal machine. How a relay host host firewall architecture work
Zero Trust Architecture + Firewall Configuration: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You build a relay host host firewall architecture by placing local packet filters on both the stepping-stone server and the destination machines. First, you lock down incoming ports on the intermediate node and allow traffic only from approved addresses. Teams often set up these local rules to block outside attackers from reaching private servers. Still, broad port rules often let anyone on the stepping-stone server reach every internal machine.
How a relay host host firewall architecture works
In a relay host host firewall architecture, network traffic passes through two separate host-level packet filters. Outside users first reach the intermediate server over a single open port, such as SSH. The local firewall on that first machine drops all other incoming requests right away. It checks the source IP address and the destination port before letting the packet through.
Next, the user forwards their session from the intermediate node to a private backend server. That backend server also runs its own local packet filter on its network interface. The backend rule only accepts incoming packets that come from the intermediate server IP address. If a machine from another subnet tries to talk to the backend, the local rule blocks it. This two-step setup keeps private databases and internal apps off the public internet. Admins manage these rules using local kernel filters on each operating system. Both machines log dropped packets and accepted network sessions to their local disks.
What local packet filters solve and what they miss
Host-based firewalls are great at stopping unauthorized network scans and blocking unused ports. They make sure that nobody can bypass the stepping-stone server to hit a backend machine. If an attacker compromises a web server in another zone, the database firewall blocks their IP. This stops basic lateral movement across the network.
Still, host firewalls only inspect network addresses and port numbers at layer three and layer four. Once the filter allows a port, it cannot see what happens inside the encrypted tunnel. The setup decides which machine can open a socket, not what commands run inside the session. If an engineer logs in through the approved path, the firewall lets every command pass. It cannot tell the difference between a safe status check and a destructive delete statement. Also, sharing static keys or broad network access on the intermediate node creates big risks. When multiple users share the same stepping-stone IP, the backend firewall treats all their traffic the same. Teams still lack control over individual queries, shell commands, and sensitive data in flight.
Managing local rules across large server fleets
Keeping host rules in sync across hundreds of machines takes a lot of daily work. Every time you add a new stepping-stone server, you must update every backend machine. If a single rule has a typo, engineers get locked out during urgent outages. To avoid lockouts, teams often widen the allowed subnet range on the backend hosts. Over time, these broad subnet rules undo the safety of the original design.
Zero Trust Architecture + Firewall Configuration: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Auditing also becomes hard when connection logs live on dozens of separate machines. Security teams must collect and merge packet logs from both the relay and the backend hosts. Even then, network logs only show IP addresses and timestamps, not user identities or actions. When sensitive records like emails, phone numbers, or card numbers cross the wire, packet filters cannot mask them. Teams need a way to inspect commands and rewrite sensitive fields without managing complex IP tables.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What is the difference between a network firewall and a host firewall?
A network firewall runs on a dedicated appliance at the edge of a subnet. A host firewall runs directly inside the operating system of each individual server.
Do backend servers still need local firewalls behind a relay host?
Yes, backend servers need local rules to block lateral traffic from other internal machines. They should only accept traffic on required ports from the approved intermediate server IP.
Can a host firewall block bad database queries or shell commands?
No, a host firewall only checks IP addresses and port numbers during packet delivery. It cannot read or filter the commands and queries inside an encrypted session.
Short role checks help teams work fast. Simple rules make each review clear. Good logs keep every team safe. Scoped keys stop bad changes early.