The network configuration expected by the bastion setup described here is one with a single firewall between the internal network (LAN) and the Internet (WAN), where this single bastion host is itself the firewall.
Everything you need to secure your internal network from the horrors of the outside Internet can be had for free. What better price could you pay for your computing security? And for this price, why wouldn’t you secure your network? The base of this security comes from the FreeBSD operating system.