DMZ

A DMZ (demilitarized zone) is a network segment between the internet and the internal network. It houses services that must be accessible from the outside, such as web servers, mail relays, and partner portals.

The core purpose of a DMZ is damage control: if an attacker compromises a server in the DMZ, they do not automatically gain access to internal systems, as the firewall between the DMZ and LAN only permits strictly defined traffic.

In practice, a DMZ is implemented as a separate VLAN or a dedicated interface on a firewall, with rules that block all traffic to the internal network by default.

Practical examples

A company hosts an e-commerce site on its own server. The server resides in the DMZ and is only allowed to access the database on a single port within the internal network and nothing else.

Business relevance

Without a DMZ, every publicly accessible server is a direct entry point into the entire network. Segmentation is therefore one of the most cost-effective and efficient security measures.

Common mistakes

Typical errors include rules that allow access from the DMZ to the entire LAN and servers in the DMZ that are joined to the domain using a domain administrator account.

How VitalIT helps

At VitalIT, we design, deploy, and maintain business networks, including segmentation, Wi-Fi, VPN, and firewalls. Learn more on our IT infrastructure page.