A demilitarized zone (DMZ) is an isolated network segment that hosts internet-facing services and separates them from an organisation’s internal network.
How a DMZ works
Servers that must be reachable from the internet – web and mail servers, public DNS, reverse proxies, VPN gateways – are placed in a separate segment between the internet and the internal LAN. Firewalls enforce strict rules:
- the internet may reach only the specific ports published in the DMZ;
- DMZ hosts may open only narrowly defined connections to internal systems, such as a web server to its database;
- internal users reach the DMZ through controlled paths.
Common designs use either two firewalls in series (often from different vendors) or one firewall with three interfaces – external, DMZ and internal. NIST describes the concept as a “screened subnet”. On home routers, “DMZ host” means something different: a single device to which all incoming traffic is forwarded, which actually removes protection.
Why a DMZ matters
Public-facing servers are the most exposed part of the attack surface and are regularly compromised through unpatched vulnerabilities. A DMZ limits the damage: an attacker who takes over a web server is still separated from domain controllers, file servers and workstations, which makes lateral movement harder and gives defenders time to detect the intrusion. Industrial networks use the same idea between IT and OT systems.
Best practices
- Deny by default and document every allowed connection.
- Never store sensitive data or domain-joined admin credentials on DMZ hosts.
- Monitor DMZ traffic closely, especially connections initiated towards the internal network.
- Keep DMZ systems hardened and patched first.
