I'm trying to setup a network configuration in my company like the one in the picture below. A web server publicly accessible in the DMZ but insulated from the internal LAN.

For the firewall I'm using the Cisco RVS4000 4-Port Gigabit Security Router with VPN router.

enter image description here

Before setting the DMZ configuration on the router, I was able to ping and ssh back and forth from the LAN host to the server, which I understand as "the server is in the LAN".

After configuring the router to set the server into the DMZ, I'm still able to ping and ssh in both directions on both hosts and I expected to not being able to ping from the server to the host on LAN, which leads to my question:

  1. Do I need to configure ACL or NAT rules to insulate the server to create connections to the LAN host? If yes, then what is the DMZ setting doing?

  2. The DMZ was not supposed to setup the router to block access to the internal LAN?

Any help would be appreciated. Thanks in advance.

  • Maybe check your configuration. Setting up a DMZ should segment you from the LAN
    – user17070
    Aug 6, 2015 at 6:36
  • maybe u should set up ACL on the firewall that doesnt allow pings from server to LAN. and NAT can be used for people on the outside network i.e. internet
    – Manny265
    Aug 7, 2015 at 6:11
  • Yeah, thanks Manny264. But as dfdfsfg said, DMZ should segment the server from the LAN, right? If so... I'm not sure what the DMZ is doing then I'll just set ACL rules.
    – pzamuner
    Aug 7, 2015 at 18:29
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12, 2017 at 4:23

1 Answer 1


technically speaking , ASA allows traffic from higher security level toward the lower level security area unless if u define an explicit ACL to do so. Your local are security level should have higher level than DMZ and DMZ higher than outside area. IF you follow this rule u should not be able to initiate any traffic from DMZ toward yr local area nodes. Based on this rule, nobody from outside have access to yr DMZ area so u should define Static NAT or PAT to allow traffic to yr servers from outside area. I hope this will help you. Thank you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.