JamesGosling.com, Free Novell Resources, downloads, links and documents

Screening routers	Most basic. Uses only the packet-filtering to control/monitor network traffic that passes through border. Risk of break-in is high. Each host on the private network is exposed to the Internet.
Bastion hosts	Bastion host represents the private network on the internet –point of contact for incoming traffic & acts as a proxy server allowing internal clients access to external services. Bastion hosts run only a few services, such as email, ftp, dns or web-service. Does not require any authentication or store any company-sensitive data.
Screened hosts	A combination of bastion host and screening router. Screening router adds security by using internet access to deny or permit certain traffic from the bastion host, and is first stop for traffic, which can continue only if the screening router lets it. Can be used with NAT and packet filtering to block certain ports. Fairly secure because security risk is limited to the screening router.
Dual-homed hosts	A server with at least two network interfaces – acts as a router between the networks it is attached to. Routing is disabled so that IP packets do not pass directly to other networks. Systems inside/outside communicate via the dual-homed host, not directly. Access to the internet is via proxy services and an IP/IP gateway. Break-in is limited to hosts reachable from the Internet, although any illegal access badly compromises security.
Screened subnets	A variation of a screened host - bastion host placed on its own subnetwork. Screening router placed either side – one between the subnet and the private network and the other between the subnet and the internet.
Tri-homed hosts	Combines elements of a screening router & screened host, overcoming limitations of each. Security is centred on the screening routers by using interfaces for the internet, private network, and subnets that contain bastion hosts and application servers.

ICMP & Dynamic NAT
Dynamic NAT translates the addresses in IP headers of the following inbound ICMP packets (all others are dropped) :

To disable NAT implicit filtering (default off) to allow access to all services running on the server (such as HTTP, FTP, or Telnet)