I have recently sat in some networking lectures and have a few questions about DMZ.

The example that I was given was: I have an office, in which it has a private network. In that private network, there is a database which stores all of the office's figures, as well as bank transaction details and staff details.

There was a requirement for the office's headquarters to access the store's figures. The lecturer introduced DMZ, but didn't go into enough detail.

Q1. Would the DMZ simply have a web server sitting within it, which would then get updated periodically by the private network's database? (only updating the web server with the store's figures of course). Or would the web server be the one querying the internal database? Pardon my ignorance here.

Q2. Assuming that there were two firewalls installed in the network, Firewall 1 only allowing traffic from the Internet destined for the DMZ, and Firewall 2 only allowing traffic from the DMZ to the internal network. How would the private network have Internet access? Would Firewall 1 and Firewall 2 also be set up to allow HTTP and HTTPS traffic destined for the private network?

Please note, that computer networking is my weakest subject, so I apologise in advance if I have missed anything fundamental out. I am just looking to enhance my understanding of DMZ.

Thanks in advance.

2 Answers 2


Q1: Either way would work, and it would likely be dependent on the application. One could argue that pushing the data to the web server might be more secure.

Q2: The firewalls also allow connections to start from the inside (trusted) to the outside (untrusted). This is the default policy for most firewalls. Note that the direction (who is initiating the connection) is important here: inside to outside is normally allowed, outside to inside is only allowed for specific hosts and protocols.

  • That's great thank you for this. However I do have a follow up question regarding question 2. If say, Computer A on the private network wanted to access youtube, and the firewall allowed inside to outside connection on port 80. When youtube responds, how would the firewall know to allow youtube to send the data back to Computer A? Would you set a rule on the firewall, stating: allow outside to inside connection via port 80? Thanks again.
    – Lockey
    Dec 21, 2016 at 16:22
  • Firewalls are (usually) stateful devices. That means that the firewall tracks the outgoing SYN packet from the private network, and when the ACK returns, the firewall checks to see that it matches the outgoing connection. If so it forwards the packet, otherwise it drops it. You can read more here: en.wikipedia.org/wiki/Stateful_firewall
    – Ron Trunk
    Dec 21, 2016 at 16:26
  • Understood. Thank you for your time, it is much appreciated.
    – Lockey
    Dec 21, 2016 at 16:31
  • 1
    If you find my answer helpful, please click accept. Otherwise it keeps popping up looking for an answer.
    – Ron Trunk
    Dec 21, 2016 at 16:32

The paradigm of a DMZ (as I've learned it) is "consider all hosts in the DMZ as being hacked". The network protection by a firewall should ensure that even in this ("worst") case the data on the internal network is safe from external access.

If you have to expose some of your data to the internet you publish it on a server in the DMZ. In a DMZ malicious attacks from outside directly hit the hosts whereas attacks against internal resources hit the firewall - and firewalls are designed and equipped to withhold attacks of various sorts, in contrast to multi-purpose servers (or operating systems).

Following this line of thought you would implement one rule that data from the inside will always be pushed into the DMZ and never actively pulled from the DMZ. In case a DMZ server is compromised it cannot pull data or use services you have not intended or explicitly denied in the first place.

This has consequences though. For instance, a server might query an external time source which has to reside on the internet then. Or if the server needs to resolve internal names via DNS one would install a second DNS in the DMZ with a subset of the data.

Regarding your questions:

Firewalls usually have multiple ports and control traffic between those ports with 'rules' or 'policies'. A DMZ would always be connected to a port of it's own, likewise the internal LAN and the WAN. So you have all means to allow certain services, to/from certain sources or destinations, at certain times etc. Everything not mentioned explicitly is denied. Today's firewalls will try to protect the servers and hosts behind it by various means like IPS or Application Control, that is, content inspection. They do more than just allow or deny traffic and route it, and are then called UTM firewalls or NGFW (next generation FW).

From the above one would only allow pushing data onto the DMZ webserver and never allow access from it to internal resources.

In your case though I would not even consider to put sensitive data into the public. If HQ has data that a branch needs it should access the branch server via IPsec VPN. The data will be transfered in private, to authenticated partners and will be monitored for integrity.

  • That's great thanks for that explanation it has cleared up a lot for me. I also think VPN would be the best option for this, having the server inside the private network. I guess a good use of the DMZ would be to use it for a public WI-FI?
    – Lockey
    Dec 22, 2016 at 18:59
  • Absolutely, with only one policy allowing traffic to the 'net. Other uses: mailserver, public website. Dec 23, 2016 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.