DMZ

DMZ Architecture

A Demilitarized Zone is a network segment that sits between an untrusted external network and a trusted internal network, hosting services that must be reachable from outside — web servers, mail relays, DNSDomain Name System. The hierarchical, distributed naming system that translates human-readable domain names (e.g., example.com) into IP addresses (e.g., 93.184.216.34). Often called the "phonebook of the internet." resolvers, and Reverse ProxyA server that sits in front of backend servers, forwarding client requests and returning responses on their behalf. Used for SSL termination, load balancing, caching, and hiding the origin server's identity. nodes. The classic dual-firewall DMZ uses two FirewallA network security device or software that monitors and filters incoming and outgoing traffic based on predefined rules. Firewalls can block traffic by IP address, port number, protocol, or application-layer content. devices: the outer firewall permits only specific protocols from the internet to the DMZ; the inner firewall permits only specific protocols from the DMZ to the internal network. A breach of a DMZ host does not automatically yield access to internal systems.

Single vs. Dual Firewall

The single-firewall (three-legged) DMZ uses one firewall with three interfaces: external, DMZ, and internal. It is simpler to manage but relies on a single device whose compromise would expose all three segments. The dual-firewall design provides defense in depth — using different vendors reduces the probability that the same vulnerability affects both perimeter devices. Modern deployments often combine physical firewalls with host-based controls via NACNetwork Access Control. A security approach that enforces policies on devices attempting to join a network, verifying identity, health (antivirus, patches), and compliance before granting access. Integrates with RADIUS and 802.1X. and application-layer proxies.

DMZ in Cloud Environments

Cloud architectures implement DMZ concepts using security groups, network ACLs, and VPC subnets. An internet-facing Load BalancerA device or service that distributes incoming network traffic across multiple backend servers to ensure no single server is overwhelmed. Improves availability, reliability, and scalability of web applications. subnet serves as the DMZ tier, with application and database subnets behind it accessible only through security group rules. Bastion HostA hardened, publicly accessible server that serves as the sole entry point for administrative SSH or RDP access to an internal network. Bastion hosts (or jump boxes) reduce the attack surface by concentrating and auditing remote access. instances in the DMZ subnet provide SSH access to internal resources without exposing internal IPs to the internet. Network SegmentationThe practice of dividing a network into smaller, isolated segments to limit the blast radius of security breaches and improve performance. Implemented through VLANs, subnets, firewalls, or micro-segmentation in zero-trust architectures. principles that govern physical DMZ design apply equally to cloud VPC architectures.