Excellent Wikipedia discription:
In computer security, a demilitarized zone (DMZ), more appropriately known as demarcation zone or perimeter network, is a physical or logical subnetwork that contains an organization's external services to a larger, untrusted network, usually the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's Local Area Network (LAN).
Contents [hide]
1 Rationale
2 Services that belong in the DMZ
2.1 Web Servers
2.2 E-mail Servers
3 Architectures
3.1 Single Firewall
3.2 Dual Firewalls
4 DMZ host
5 References
6 See also
[edit] Rationale
In a network, the hosts most vulnerable to attack are those that provide services to users outside of the LAN, such as e-mail, web and DNS servers. Due to the increased potential of these hosts being compromised, they are placed into their own subnetwork in order to protect the rest of the network if an intruder was to succeed. Hosts in the DMZ should not be able to establish communication directly with any other host in the internal network, though communication with other hosts in the DMZ and to the external network is allowed. This allows hosts in the DMZ to provide services to both the internal and external network while still protecting the internal network.
[edit] Services that belong in the DMZ
Generally, any service that is being provided to users in an external network should be placed in the DMZ. The most common of these services are web servers, mail servers, ftp servers and DNS servers. In some situations, additional steps need to be taken to be able to provide secure services.
[edit] Web Servers
Web servers may need to communicate with an internal database to provide some specialized services. Since the database server is not publicly accessible and may contain sensitive information, it should not be in the DMZ. Generally, it is not a good idea to allow the web server to communicate directly with the internal database server. Instead, an application server can be utilized to act as a medium for communication between the web server and the database server. This may be more complicated, but provides another layer of security.
[edit] E-mail Servers
Due to the confidential nature of e-mail, it is not a good idea to store it in the DMZ. Instead, e-mail should be stored on an internal e-mail server. The mail server in the DMZ should pass incoming mail to the internal mail server and the internal mail server should pass outgoing mail to the external mail server. Ideally, all communications should be initiated by the internal mail server.
[edit] Architectures
There are many different ways to design a network with a DMZ. Two of the most basic methods are with a single firewall, also known as the three legged model, and with dual firewalls. These architectures can be expanded to create very complex architectures depending on the network requirements.
[edit] Single Firewall
A single firewall with at least 3 network cards can be used to create a network architecture containing a DMZ. The external network is formed from the ISP to the firewall, the internal network is formed from the second network card, and the DMZ is formed from the third network card. The firewall becomes a single point of failure for the network and must be able to handle all of the traffic going to the DMZ as well as the internal network.
[edit] Dual Firewalls
A more secure approach is to use two firewalls to create a DMZ. The first firewall must be configured to allow both traffic destined for the DMZ as well as traffic for the internal network. The second firewall must be configured to only allow traffic destined for the internal network that is not originating from the DMZ. The first firewall must be able to handle a much larger amount of traffic than the second firewall. While this architecture is more costly, its increased protection usually offsets the cost.
[edit] DMZ host
Some home routers refer to a DMZ host. A home router DMZ host is a host on the internal network that has all ports exposed, except those ports forwarded otherwise. By definition this is not a true DMZ, since it provides no security between the host and the internal network. That is, the DMZ host is able to connect to hosts on the internal network, but hosts in a real DMZ are prevented from doing so by the firewall that sits between them.
