Currently i build a new network for our company which is not my specialism as i'm actually a software engineer so excuse me when this is a stupid question.

I read a lot about networking last few weeks and as we have multiple webservers i assume we need a DMZ. What i understood should all servers which deliver services to the "public" (so internet) be placed inside the DMZ. After everything i read i still have some questions about this because it does not makes sense for me to place them in a "seperated" part of the network.

  1. Why should i place servers which deliver services to the "public" be in a "isolated" part of the network? I understand that this is intended to protect the "internal network" for intruders but as i forward only required ports to servers that need to deliver "public services", intruders are not be able to access other servers at al?
  2. I also read that 2 things about webservers specifically;

    • That they should be placed inside the DMZ and need access/rule/route to the database servers which should be placed in the internal network as they only deliver services to the web servers
    • That they should placed in the internal network like the database servers. In this case there should be a proxy server in the DMZ which "routes" the traffic to the correct web server (in the internal network).

    In both cases again i do not understand the sense of the DMZ as the proxy server or the webservers still need access to the internal network to access the web server(s) or database server(s). I assume if you are able to access the web server you are also be able to "hop" further into the network to devices where connection is possible to? What is the best practice here in terms of "where to place my webservers and do i need a proxy?"

Just for your idea, we use 1 single firewall (PfSense) where a DMZ is configured.

  • The idea of the DMZ is that if the servers are pwned, you still have a firewall that restricts access into the internal network. without it, the attackers have full access to everything. – Ron Trunk May 28 '20 at 15:33
  • I understood this so far but when someone is able to pwn servers in the DMZ i think they will also be able to "hop" from the DMZ to the "internal network" as there will be always a connection between those 2? --- I also wonder if a DMZ is always a physical interface on the firewall or is it also "allowed" (good practice) to use a VLAN as DMZ? In this case the "DMZ packets" will also be routed via trunk ports to other switches, is this acceptable? – CodeNinja May 29 '20 at 7:05

Student at best here. I've learned to apply and learn from the results when working with networks. The DMZ is a perfect front line. DMZ is a type of isolation; you can call it the front end of your network. Use it to log the events, provide access to the public, and throttle what the public can access. A network with the least connections is a secure network.

  • A better answer might be to explain why a DMZ is "a perfect front line." What makes it so? – Ron Trunk May 28 '20 at 18:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.