In their most secure implementations, bastion host application gateways provide nearly unbreakable security for information resources. Packet filtering decisions are made by extracting and evaluating data from all layers of the OSI network model. Stateful inspection firewalls screen data packets against defined network access rules, like a packet filter. The firewall accepts packets that match the application's state and updates firewall state information changed by the packet. If a packet conflicts with the current state of the application, the firewall logs and discards the packet.
Stateful inspection is a promising new technology.
Filtering data packets based on the dynamic state of the application could provide the security protection of an application gateway, without actually running the application code. If this approach proves reliable enough, it eliminates the need to develop and run proxy applications on bastion hosts. Predefined filter rule sets could be used to deploy new applications and technologies, instead of application proxies. When security weaknesses are discovered in new or existing applications, rules can be added to the rule base to correct them. Commercial firewalls came to market in 1994, in direct response to the explosion in Internet use.