they just don't have dedicated firewall. That doesn't mean they can't run ipfilter or whatever, on the hosts themselves with default deny. In fact he mentioned

they just don't have dedicated firewall. That doesn't mean they can't run ipfilter or whatever, on the hosts themselves with default deny. In fact he mentioned port knocking. You pretty much need some kind of host firewall for that.