The inner router is configured to force all outgoing connections through the bastion host. Attempts to connect directly to other services are blocked. The bastion host validates both incoming and outgoing requests for services. For instance, it may trap and discard incoming pings. On another level, even single pings can be used to identify targets for more sophisticated attacks.
Some services are more risky than others.
If your users don't need a service and it's a security risk , you can turn it off at the firewall. If it's a necessary service you can often use a proxy on the firewall to make the service safer. Proxy agents for FTP, WWW and SMTP e-mail are common. One thing firewalls can't prevent is leakage caused intentionally by disgruntled or greedy employees. Accidental leakage on the other hand, can often be detected and prevented by a firewall enhancement called the Standard Mail Guard.