Xarph Best Practice #3: An isolated network with a bastion host you can reach from outside is insufficiently isolated.