How does a router logically process packets going into and out of the DMZ?

Question

I wanted to ask this question because of the fact that through CompTIA Network+, I learned that internet exposed services/servers/devices are to be placed in the DMZ like email servers, DNS servers, Web servers, and etc.

I also got to know that this is done in order to keep the internal network safe should these servers end up getting compromised.

But the problem is that nobody really explained WHY the DMZ makes the internal network safer and nor how it gives more protection that merely putting it on a different subnet.

Though I for one understood that the DMZ does make these servers become put in "between" your internal network and the internet.

So for the purpose of getting to the bottom of this mystery, I think the best approach would be for me to understand how routers or routing in general works for the DMZ.

Additional info such as answering questions like "can devices from the DMZ have access to the web interface of the router without extra configuration on the side of the router?" would be much appreciated as well.

Answer 1

First off i would point out that Routers do not use DMZ's, unless the Router has a Firewall module or is Firewall capable and you actually set it up.

Cisco Press has made an excellent article about the DMZ and how it works. I've provided a complete Cisco ASA 5505 configuration guide on how to set it up with a DMZ. The article is a bit old, but it explains very well how it all works and why you would use it.

I've added a link of how an ASA processes a packet. It doesn't matter if the packet is destined for a DMZ, the Firewall uses the same method for all packets.

Essentials First: Life in the DMZ

The Demilitarized Zone (DMZ) is a term used in the military to define a buffer area between two enemies. Perhaps the most commonly acknowledged DMZ in the world is the DMZ between North Korea and South Korea, which separates them because they have not yet signed a permanent peace treaty since the Korean War. Perhaps this is an interesting piece of military and political trivia that you did not know, but how does it relate to securing your network and firewalls?

If your company has a self-hosted public website complete with email servers, you might consider using a two-interface (inside and outside) firewall and have the firewall create translation rules that direct the inbound traffic to the correct servers on your private network. Although this might seem like a safe thing to do, it could be disastrous if a talented hacker sets his sights on you. Connecting web, mail, and FTP servers located on the inside of your network to the Internet can be dangerous and, in some cases, simply not recommended. Secure FTP is also an option but the same rules apply.

Well, some smart people got together a long time ago and said, “Hey—let’s put a third interface on the firewall and call it a DMZ.” Sending traffic from the Internet inbound directly to your private network is a bad idea. Adding the third interface to a standard firewall made things both easier and quite a bit safer when deploying Internet accessible servers and services (www, email, and so on). If you were going to sell computers out of your house, you would not want people coming inside your house to buy one, would you? Of course not; you would want to set up a little shop in the garage or on the front porch, thus preventing people that you do not know from wandering all over your house and tampering with your comic book collection or going into your fridge to make a sandwich.

A DMZ is an interface that sits between a trusted network segment (your company’s network) and an untrusted network segment (the Internet), providing physical isolation between the two networks enforced by a series of connectivity rules within the firewall. The physical isolation aspect of a DMZ is important because it enables Internet access only to the servers isolated on the DMZ and not directly into your internal network, as shown in Figure 7-3.

In Figure 7-3, the segment connected to the DMZ interface contains the mail, web, and application servers. Rules applied to the DMZ interface prevent traffic from the Internet from going beyond the segment attached to it.

The biggest benefit to a DMZ is in isolating all unknown Internet requests to the servers on the DMZ and no longer allowing them into your internal network. However, some additional benefits to deploying a firewall with a DMZ can help you better understand what happens in your network and thereby increases security:

• Auditing DMZ traffic
• Locating an IDS (Intrusion Detection System) on the DMZ
• Limiting routing updates between three interfaces
• Locating DNS on the DMZ

This section discussed what a DMZ is and provided a general example of how to use one. The following case studies examine a requirement for a DMZ and why you should use one in a network given a specific set of criteria.

Complete Cisco Press article about the DMZ: http://www.ciscopress.com/articles/article.asp?p=1823359&seqNum=5

Complete configuration guide for the Cisco ASA 5505 and how to setup a DMZ: https://www.speaknetworks.com/cisco-asa-dmz-configuration-example/

Example is made by Jack Wang, CCIE #32450

How does an ASA process a packet? https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113396-asa-packet-flow-00.html

Answer 2

DMZ is a separate network segment and it does not use to access internal network. All Inbound connections are accepted by DMZ Servers only. Anything you need to keep publicly or services which has unlimited connections, should place in DMZ.

If you want to access your private network. You need to establish VPN connections. Private system should keep in private.

DMZ should not place between LAN and Internet. It should be a separate Zone. Because you should not access LAN through DMZ because it will increase Attack surface