I found out our DMZ zone is not as secure as it should be.
We use NAT to translate internet services from DMZ to internet.
We have some developers out of organization. Some of them connect via client-to-client tunnel to specific server. But for some we open ssh/rdp ports on translated addresses.
The point is: when developer connects to his specific server, he has access to all other servers in DMZ zone.
So being in one subnet with other servers, he has network access to all other servers. This is very insecure practice. I see here 3 solutions:
Create iptables/firewall template and apply it locally on each server in DMZ zone. The problem here: it makes much manual work. Developer has root/administrator access so he can disable firewall on his server. To prevent it we should configure separate permissions, which makes more manual work.
Put every DMZ host in separate zone with /31 subnet. On internet firewall create virtual static router for each server. Actually, I like it more. The problem is here: still has manual work on creating each server. Mess in internet firewall in static routes and rules.
Deploy enterprise solution, such as cloudstack or openstack. The problem is here: we are small hosting company that hosts only services that we develop. We have about 10 servers that have remote access from foreign developers. Next year we plan for 10 more.
You didn't mention the switch model, but a lot of switches support Private VLANs which only allow a switch port to access the configured uplink switch port. This is often used in hosting to prevent one hosted server from being able to access another hosted server. You can isolate each switch port from all the other switch ports to provide your customers privacy.
Wikipedia has an article which can give you an overview of Private VLANs:
Private VLANs in hosting operation allows segregation between
customers with the following benefits:
No need for separate IP subnet for each customer.
Using Isolated VLAN, there is no limit on the number of customers.
No need to change firewall's interface configuration to extend the number of configured VLANs.
Actual configurations will differ between switch manufacturers.
/31to double your usable addresses since it doesn't waste two addresses per subnet.