DMZ (Demilitarized Zone): Design, Function and Examples

What is a DMZ?

The term comes from the military. There, a demilitarized zone is a buffer strip between two territories, for example between North and South Korea. In IT, the DMZ is a buffer area between the unsafe internet and the trusted internal network.

Companies place all systems there that must be reachable from the internet. These systems are attacked especially often. If one of them is taken over, the attacker is at first stuck in the DMZ. Another firewall blocks the way into the internal network.

How Does a DMZ Work?

The network is split into three zones: internet, DMZ and internal network. Firewall rules define which traffic is allowed between the zones. The basic rule is: everything that is not explicitly allowed is blocked.

• Internet → DMZ: only the services that are needed, for example websites over HTTPS.
• DMZ → internal network: blocked by default. Exceptions are made one by one and kept narrow, for example to pass email on to the internal mail server.
• Internal network → DMZ: allowed for administration and updates, but only from defined systems.
• Internet → internal network: no direct access.

An example: a company runs a web shop. The web server sits in the DMZ. The database with customer data sits in the internal network. The web server may only reach the database through one single, tightly controlled path. If the web server is hacked, the attacker cannot simply access other internal systems.

DMZ Design: One or Two Firewalls

DMZ with One Firewall

A firewall with three ports separates the internet, the DMZ and the internal network. This option is low-cost and easy to manage. It is common in small and mid-sized companies. The downside: if this one firewall fails or is set up wrongly, all zones are affected.

DMZ with Two Firewalls

An outer firewall sits between the internet and the DMZ, an inner one between the DMZ and the internal network. So an attacker has to get past two hurdles. Often the two firewalls come from different vendors. Then a flaw in one product alone does not help. This option takes more effort, but it is safer. It suits higher protection needs.

Which Systems Belong in the DMZ?

• Web servers for the website, shop or customer portal
• Mail relay or mail gateway that accepts and checks email
• Reverse proxy that forwards requests to internal applications
• Public DNS servers for your own domain
• VPN gateways for remote access. Read more under VPN.
• Servers for data exchange with customers and partners

Not in the DMZ: systems with sensitive data or central importance. These include databases with customer data, file servers, Active Directory and backup systems. They stay in the internal network.

DMZ on a Home Router: Beware of "Exposed Host"

Many routers for homes and small offices have a setting called "DMZ" or "exposed host". It forwards all requests from the internet to one single device, such as a game console or a camera.

This has little to do with a real DMZ. The device still sits in the same network as all other devices. But it can be reached from the internet in full. If it is taken over, the attacker has access to the whole home or office network. It is better to open only the ports that are really needed.

Benefits of a DMZ

• Smaller attack surface: Only a few, deliberately opened systems can be reached from the internet.
• Limited damage: A hacked server in the DMZ does not automatically open the internal network.
• Clear rules: Traffic between the zones is documented and easy to trace.
• Better monitoring: At the borders, traffic can be checked on purpose, for example with an intrusion detection system.

Limits and Risks

• Misconfiguration: One rule that is too loose between the DMZ and the internal network undoes the protection.
• Outdated systems: Servers in the DMZ can be attacked directly. Missing updates are especially dangerous here. See patch management.
• Attacks from inside: A DMZ protects against attacks from the internet. It does not help against an attacker who is already in the internal network.
• New ways of working: Cloud services and mobile work blur the line between inside and outside.

DMZ, Network Segmentation and Zero Trust

The DMZ is a special form of network segmentation. Modern networks go one step further. They also split the internal network into zones, for example for administration, production and guests. This way, an attacker cannot move around freely.

Zero trust goes even further: no access counts as trusted by default, not even from your own network. The DMZ remains a useful building block for everything that must be reachable from the internet.

Best Practices for a Secure DMZ

1. Block by default: Only allow traffic that is explicitly needed at the firewall.
2. Harden systems: Only run the services on the servers that are really needed.
3. Patch fast: Updates for systems in the DMZ come first.
4. Log and monitor: Record and review access to and from the DMZ. See security logging and monitoring.
5. Separate administration: Admin access only from defined systems and with separate accounts.
6. Review rules: Check firewall rules regularly and remove old openings.
7. Get it tested: A penetration test shows whether the separation really holds.

Conclusion

A DMZ separates everything that must be reachable from the internet from the internal network. If a public server is hacked, the damage stays limited. For this to work, you need strict firewall rules, up-to-date systems and regular checks. Together with segmentation and zero trust, the DMZ remains a fixed part of secure networks.