The bastion host is a server, though, and would be exposed to the internet.