Software Firewalls Cannot Be Bastion Hosts