diff --git a/docs/ansible.md b/docs/ansible.md
index bed95f108f06fe0471fe0ec618b9681e3038f87a..ff7eb1d9d8c08dc21ab087995d11315b2e8d30bd 100644
--- a/docs/ansible.md
+++ b/docs/ansible.md
@@ -119,3 +119,17 @@ ansible-playbook -i inventory/inventory.ini cluster.yaml \
 ```
 
 Note: use `--tags` and `--skip-tags` wise and only if you're 100% sure what you're doing.
+
+Bastion host
+--------------
+If you prefer to not make your nodes publicly accessible (nodes with private IPs only),
+you can use a so called *bastion* host to connect to your nodes. To specify and use a bastion,
+simply add a line to your inventory, where you have to replace x.x.x.x with the public IP of the
+bastion host.
+
+```
+bastion ansible_ssh_host=x.x.x.x
+```
+
+For more information about Ansible and bastion hosts, read 
+[Running Ansible Through an SSH Bastion Host](http://blog.scottlowe.org/2015/12/24/running-ansible-through-ssh-bastion-host/)
\ No newline at end of file
diff --git a/inventory/inventory.example b/inventory/inventory.example
index c08e84ae627f2ef9a32a0daa1b61ec55818d0278..1d10cdce05f3a50e6135c1ae903e41701e7b33ce 100644
--- a/inventory/inventory.example
+++ b/inventory/inventory.example
@@ -8,7 +8,7 @@
 # node6 ansible_ssh_host=95.54.0.17  # ip=10.3.0.6
 
 # ## configure a bastion host if your nodes are not publicly reachable
-# bastion ansible_ssh_host=xxx.xxx.xxx.xxx
+# bastion ansible_ssh_host=x.x.x.x
 
 # [kube-master]
 # node1