Have a private network with servers that required SSH access. Since the instances are in a private subnet, they cannot be accessed directly via SSH and require a public Bastion host to access.
Workstation -> via SSH -> Bastion -> via SSH Forwarding -> private subnet instnce
We use a NAT host as a public gateway to the private network.
User -> via HTTP -> NAT -> via private networking -> private subnet instance
What are the benefits of keeping the Bastion & NAT hosts separate? What are the benefits of combining them?