Demilitarized Zone (DMZ).

A DMZ is a perimeter subnet sandwiched between two firewalls (or a multi-legged firewall) where systems that must be reachable from the internet — web servers, mail relays, reverse proxies, VPN concentrators — are placed. The outer firewall lets defined inbound traffic reach the DMZ, while the inner firewall tightly restricts what the DMZ may initiate toward the internal network, ideally only specific application protocols to specific hosts. The architecture limits the blast radius of a compromise: even if an attacker takes over a DMZ host, they still face a strong policy boundary before reaching internal data. Modern designs add zero-trust controls, WAFs, and microsegmentation to harden this boundary further.

Why the inner firewall matters

The whole value of a DMZ collapses if a perimeter host can freely reach internal systems. The 2017 Equifax breach illustrates the failure mode: attackers exploited an unpatched Apache Struts flaw (CVE-2017-5638) in the internet-facing online dispute portal, then moved to internal databases and exfiltrated data on ~147 million people between May and July 2017. A tightly egress-filtered DMZ — where the compromised web app could not open arbitrary connections inward — would have blunted that lateral movement.

Two design rules follow. First, treat the DMZ as semi-trusted, never trusted: inbound rules from the internet should be narrow, and outbound rules from the DMZ toward the LAN should be even narrower, allowing only the exact protocol, port and destination host each service needs (a web tier reaching one API endpoint, a mail relay reaching one SMTP host). Second, avoid dual-homed hosts that straddle both zones, since a single compromised NIC bypasses the firewalls entirely.

Cloud equivalents replace physical firewalls with subnets, security groups and NACLs — a public subnet fronted by a load balancer, a private subnet for application and data tiers — but the principle is identical: constrain what the exposed tier can talk to.

flowchart LR
  I[Internet] -->|inbound 443| OF[Outer firewall]
  OF --> DMZ[DMZ subnet<br/>web / mail / reverse proxy]
  DMZ -->|only defined app protocol| IF[Inner firewall]
  IF --> LAN[Internal LAN<br/>databases / AD / users]
  DMZ -.->|blocked: arbitrary<br/>inbound to LAN| LAN