• Glossary
  • What is DMZ (demilitarized zone)?

Security glossary

What is DMZ (demilitarized zone)?

A DMZ (demilitarized zone) is a security architecture that places an organization's external-facing services in a separate subnetwork between the internet and the internal network. It uses firewall rules to limit traffic in each direction, so a compromised public server has restricted access to internal systems.

Let's simplify your DDI
Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button
Key takeawaysKey takeaways are generated with AI assistance. Because automated summaries can occasionally contain errors or miss important context, always refer to the full blog post for complete information.

A DMZ (demilitarized zone) is a network security architecture that isolates external-facing services such as web servers, mail gateways, and DNS servers in a separate subnet between the internet and the internal network, using firewall rules to restrict traffic and limit lateral movement if a public server is compromised. By implementing strict firewall policies that allow inbound traffic only to required ports and protocols while blocking DMZ hosts from initiating connections to internal systems except for narrowly defined flows, organizations reduce the risk of a single exploited server giving attackers direct access to sensitive internal resources like databases and directory services. Proper DMZ implementation requires consistent rule management, regular audits, monitoring at zone boundaries, and alignment with security frameworks like NIST SP 800-41 and compliance standards such as PCI DSS to maintain the isolation that prevents attackers from moving laterally through the network.

  • A dual-firewall DMZ architecture places the DMZ between two independent firewalls ideally from different vendors to prevent a single misconfiguration or firewall exploit from exposing all network zones.
  • Overly permissive DMZ rules that allow unrestricted access between the DMZ and internal network, forgotten test servers, and stale firewall rules are common failure points that erode the security boundary and enable lateral movement.
  • Cloud and hybrid environments implement the DMZ principle through security groups, network ACLs, and separate virtual networks rather than physical firewalls, applying the same segmentation and trust boundary concepts to workloads outside traditional data centers.

DMZ at a glance

AttributeValue
Full nameDemilitarized zone
CategoryNetwork security architecture
Primary useIsolating public-facing servers from the internal network
OSI layerLayers 3 and 4 for typical firewall filtering, with inspection at higher layers on some firewalls
Related termsFirewall, Network segmentation, Reverse proxy, Bastion host, Zero trust

How DMZ works

A DMZ is built from network segmentation and firewall policy. Traffic between the internet, the DMZ and the internal network is controlled at each boundary.

  1. Place services in a separate segment: Servers that must be reachable from outside, such as web servers, mail gateways, public DNS servers and reverse proxies, are put on their own subnet or VLAN rather than on the internal network.
  2. Filter inbound internet traffic: A firewall allows only the required ports and protocols from the internet to the specific DMZ hosts, for example HTTPS to a web server, and drops everything else.
  3. Restrict traffic from the DMZ inward: A second set of rules, on the same firewall or a separate internal one, blocks DMZ hosts from initiating connections to the internal network except for narrowly defined flows, such as a web server reaching one database port.
  4. Control outbound traffic: Internal users and DMZ hosts are limited to approved outbound destinations and services, which reduces the paths available to malware.

Common designs use a single firewall with three interfaces or two firewalls with the DMZ between them. The default posture is that internal hosts may reach the DMZ, while the DMZ cannot freely reach the internal network. Logging at the boundaries supports detection and investigation.

Why DMZ matters in enterprise networks

Any server reachable from the internet is exposed to constant scanning and attack. A DMZ assumes that some of these servers will eventually be compromised and limits what an attacker can do next. Without it, a single exploited web server on a flat network can give an attacker direct access to file servers, databases and directory services.

The design is a long-standing recommendation in network security guidance, including NIST Special Publication 800-41 on firewalls and firewall policy, which describes placing publicly accessible servers in a separate network segment. Segmentation of this kind also supports compliance requirements, such as the PCI DSS requirement to restrict inbound traffic to system components in the cardholder data environment and to keep public-facing systems off the internal network.

A DMZ fails when its rules are loosely managed. Broad permit rules from the DMZ to internal subnets, forgotten test servers, shared credentials between zones and unpatched hosts all erase the isolation it is meant to provide. Regular rule reviews, strict change control and monitoring of DMZ traffic keep the boundary meaningful. Cloud and hybrid environments apply the same idea through security groups and separate virtual networks, though the controls differ from physical firewalls.

DMZ vs ACL (Access Control List)

A DMZ is a network architecture that isolates public-facing services in their own segment, while an ACL is a rule list that permits or denies traffic and is one of the tools used to enforce a DMZ boundary. What is ACL?

AttributeDMZACL (Access Control List)
TypeNetwork design patternFiltering rule set
ScopeDefines a separate segment and the trust boundaries around itApplies to a single interface, device or resource
Enforced byFirewalls, routers, VLANs and segmentation togetherRouters, switches, firewalls and operating systems
PurposeLimit the damage if an exposed server is compromisedAllow or deny specific traffic based on match criteria

DMZ vs NAT (network address translation)

A DMZ separates exposed services from the internal network for security, while NAT rewrites IP addresses in packets and does not by itself provide that separation. What is NAT?

AttributeDMZNAT (network address translation)
Primary functionSegmentation and traffic controlAddress translation
Security roleDeliberate trust boundary with restrictive rulesIncidental; hides internal addressing but is not a security control
Typical use togetherDMZ hosts may use static NAT to be reachable from the internetMaps public addresses to DMZ or internal hosts

Common DMZ issues

Rules such as any-to-any between the DMZ and the internal network defeat the design. A compromised web server can then reach databases and domain controllers directly, which is a common finding in penetration tests.

Application teams often request broad access from DMZ servers to internal databases or directory services. Limit it to the specific hosts, ports and protocols the application needs, and review these rules regularly.

Decommissioned servers leave behind firewall rules and DNS records that still allow traffic. Attackers can use forgotten hosts, so tie rule changes to change management and audit them.

With one firewall holding all three interfaces, a misconfiguration or an exploit of the firewall exposes every zone. Outages also cut off both public services and internal connectivity unless the firewall is deployed as a high availability pair.

Teams that do not log denied and allowed flows at the DMZ boundary often cannot tell when a server has been compromised. Unusual outbound connections from DMZ hosts are a key early signal.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

DMZ FAQ

Related terms

Article

ACL (Access Control List)

Limits which entities are allowed to perform certain functions against a DNS server, such as sending queries or performing dynamic updates.

Learn more
Article

NAT (network address translation)

Remapping one IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device.

Learn more
Article

RFC 1918 networks

Ranges of IP addresses set aside for private use on TCP/IP networks.

Learn more
Article

OSI model

A conceptual model that characterizes and standardizes the communication functions of a telecommunication or computing system.

Learn more
Article

Recursive DNS server

Responsible for providing the proper IP address of the intended domain name to the requesting host; the first servers contacted as the result of a request.

Learn more
Article

Authoritative DNS server / Authoritative name server

Provides original and definitive answers to DNS queries.

Learn more
Article

Transport layer security (TLS)

A cryptographic protocol to provide communications security over a computer network.

Learn more
Article

Virtual IP Address (VIP)

An IP address that doesn’t correspond to an actual physical network interface; uses include network address translation, fault-tolerance, and mobility.

Learn more
Browse the full glossary