Network Security DMZ Architecture
A DMZ (Demilitarized Zone) is a separate network segment that sits between the public internet and an organization's internal network. Systems that must accept connections from the internet — web servers, email servers, DNS servers, VPN gateways — live in the DMZ. This architecture ensures that if an attacker compromises a DMZ system, they face a second security barrier before reaching the internal network where sensitive data and critical infrastructure live.
Why a DMZ Is Necessary
WITHOUT DMZ: INTERNET → [Firewall] → [Web Server + Internal Network together] If attacker compromises the Web Server: → Attacker is directly on the internal network → Has unfiltered access to HR systems, Finance DB, everything → One compromise = total breach WITH DMZ: INTERNET → [Firewall 1] → [DMZ: Web Server] → [Firewall 2] → [Internal Network] If attacker compromises the Web Server: → Attacker is in the DMZ only → Must bypass Firewall 2 to reach internal network → Firewall 2 denies all unpermitted traffic from DMZ → One compromise ≠ total breach
Classic Two-Firewall DMZ Architecture
INTERNET
│
┌────────▼────────┐
│ FIREWALL 1 │ (Perimeter Firewall)
│ External FW │ Allows: 80, 443, 25, 53 inbound
│ │ Denies: everything else
└────────┬────────┘
│
┌─────────────▼─────────────┐
│ D M Z │
│ ┌─────────┐ ┌─────────┐ │
│ │Web │ │Email │ │
│ │Server │ │Gateway │ │
│ └─────────┘ └─────────┘ │
│ ┌─────────┐ ┌─────────┐ │
│ │DNS │ │VPN │ │
│ │Server │ │Gateway │ │
│ └─────────┘ └─────────┘ │
└─────────────┬─────────────┘
│
┌────────▼────────┐
│ FIREWALL 2 │ (Internal Firewall)
│ Internal FW │ Very restrictive rules
│ │ DMZ → Internal: very limited
└────────┬────────┘
│
┌─────────────▼──────────────┐
│ INTERNAL NETWORK │
│ ┌──────────┐ ┌─────────┐ │
│ │Database │ │HR │ │
│ │Servers │ │Systems │ │
│ └──────────┘ └─────────┘ │
│ ┌──────────┐ ┌─────────┐ │
│ │Finance │ │Employee │ │
│ │Systems │ │PCs │ │
│ └──────────┘ └─────────┘ │
└────────────────────────────┘
What Goes in the DMZ
System | Why It Belongs in DMZ ---------------------|--------------------------------------------------- Web Server | Accepts HTTP/HTTPS from anyone on the internet Email Gateway/MTA | Accepts inbound SMTP from external mail servers DNS Server (auth) | Responds to DNS queries from the internet VPN Concentrator | Accepts VPN connections from remote users Reverse Proxy | Sits in front of internal web apps FTP/SFTP Server | External file transfers Partner API Gateway | External partner integrations WAF (Web App FW) | Inspects web traffic before it reaches web server
Firewall Rules Between Zones
Zone → Zone | Typical Rules -------------------------|--------------------------------------------------- Internet → DMZ | Allow 80 (HTTP), 443 (HTTPS), 25 (SMTP), 53 (DNS) DMZ → Internet | Allow DNS, NTP, OS updates from specific sources Internet → Internal | DENY ALL (internet should never reach internal directly) Internal → DMZ | Allow management ports (22/SSH) from admin hosts only DMZ → Internal | Very limited: only specific needed queries (e.g., Web → DB) | Allow TCP 3306 from Web Server IP to DB Server IP only Internal → Internet | Allow outbound via proxy (port 8080 or 443) Internal → DMZ | Allow management, monitoring, log collection
Single Firewall DMZ (Three-Legged)
A three-legged firewall uses a single firewall appliance with three network interfaces: one for the internet, one for the DMZ, and one for the internal network. This is less secure than a two-firewall design (a firewall compromise exposes everything) but requires only one appliance and is common in small-to-medium deployments.
THREE-LEGGED FIREWALL:
[INTERNET]
│
┌────▼────┐
│Interface│ eth0 (WAN - internet)
│ │
│Firewall │ eth1 (DMZ - 172.16.0.0/24)
│ │ → Web Server, Email, DNS
│ │
│ │ eth2 (LAN - 192.168.1.0/24)
└─────────┘ → Internal PCs, Servers, Databases
One firewall manages all three zones.
All traffic between any two zones passes through this single device.
Risk: Single point of failure and single point of compromise.
DMZ Design for Specific Services
Web Application with Database
Internet → [WAF in DMZ] → [Web Server in DMZ] → [App Server in DMZ]
│
[Firewall 2] ──────────►
│
[Database in Internal Network]
Web Server can query Database ONLY on specific port (3306 MySQL)
Database server rejects all other connection attempts
Database never directly reachable from internet or DMZ
Email Flow
Inbound email:
[External Mail Server] → [Email Gateway in DMZ (spam filter, AV scan)]
→ [Internal Mail Server in internal network]
Outbound email:
[Internal Mail Server] → [Email Gateway in DMZ (DLP scanning, relay)]
→ [Internet]
External mail servers never communicate directly with the internal mail server.
DMZ email gateway inspects all mail in both directions.
Common DMZ Configuration Mistakes
Mistake | Risk -------------------------------------|------------------------------------------- DMZ servers have internet access | Malware on DMZ server phones home DMZ to Internal rules too permissive | Compromise spreads to internal network No monitoring on DMZ systems | Attacks undetected DMZ systems share admin accounts | One breach gives access to all DMZ systems Database placed in DMZ | Data directly accessible from internet side No patching of DMZ systems | Unpatched vulnerabilities exploited immediately Single firewall with no redundancy | Firewall failure = no internet access
The DMZ architecture is one of the most important security patterns in network design. Every organization with internet-facing services should implement a DMZ. The additional firewall and the physical separation between internet-reachable systems and internal resources dramatically reduces the blast radius of any successful external attack.