I'm trying to setup a network configuration in my company like the one in the picture below. A web server publicly accessible in the DMZ but insulated from the internal LAN.
For the firewall I'm using the Cisco RVS4000 4-Port Gigabit Security Router with VPN router.
Before setting the DMZ configuration on the router, I was able to ping and ssh back and forth from the LAN host to the server, which I understand as "the server is in the LAN".
After configuring the router to set the server into the DMZ, I'm still able to ping and ssh in both directions on both hosts and I expected to not being able to ping from the server to the host on LAN, which leads to my question:
Do I need to configure ACL or NAT rules to insulate the server to create connections to the LAN host? If yes, then what is the DMZ setting doing?
The DMZ was not supposed to setup the router to block access to the internal LAN?
Any help would be appreciated. Thanks in advance.