What is DMZ?

A DMZ (demilitarised zone) is a network segment for internet-facing servers, kept apart from the internal network by a firewall.

Public-facing services such as web, mail or DNS servers are the most exposed machines a network has, so they are the most likely to be compromised. Putting them on the same LAN as staff computers would give an attacker who breaks into one of them a direct path to everything else. A DMZ puts them on their own segment, usually a separate interface or VLAN on the firewall, and the firewall enforces different rules for each direction:

• internet to DMZ: allowed, but only to the specific services offered (for example TCP 443 to the web server);
• LAN to DMZ: generally allowed, so staff can use and manage those services;
• DMZ to LAN: denied by default, with narrow exceptions such as a web server reaching one database;
• DMZ to internet: limited to what the servers actually need, such as updates.

The term comes from the military idea of a buffer strip between two sides. Designs vary: a single firewall with three or more legs is common, while some networks place the DMZ between an outer and an inner firewall. Servers in a DMZ often have public addresses, or private addresses reached through DNAT port forwards. Be wary of the "DMZ host" setting on home routers: it forwards every unsolicited inbound connection to one internal machine, which is the opposite of isolating it. A DMZ is only as good as the rules on the DMZ-to-LAN direction, and forgetting return traffic for permitted connections is a common mistake. The Zone-based firewall on VyOS lesson builds WAN, LAN and DMZ zones with a ruleset per direction.