Glossary · Networking

DMZ (Demilitarized Zone)

A DMZ is a separate network segment that holds public-facing servers, isolating them from the internal network behind additional firewall rules.

Updated October 6, 2026

A DMZ (demilitarized zone) is a network segment placed between the Internet and the internal network, hosting services such as web, mail and DNS servers that must be reachable from outside.

Why it matters

If a public server is compromised, the attacker lands in the DMZ rather than directly on the internal LAN. Firewall rules allow Internet traffic to the DMZ on specific ports, allow limited traffic from the DMZ inward, and block everything else. Home routers often have a "DMZ host" option, which is different and simply exposes one device fully.

Example

Internet -> [Firewall] -> DMZ: web server 10.1.1.10
                   |
                   -> Internal LAN 10.0.0.0/24 (no direct Internet access)

The web server may query a database on the LAN only through a narrow rule, such as TCP 5432 from that one host.

Common mistakes

  • Treating a home router's DMZ host feature as a true DMZ. It removes protection for that device.
  • Letting DMZ servers initiate broad connections into the internal network.
  • Failing to patch and monitor DMZ hosts because they feel isolated.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · NetworkingConnection DrainingConnection draining lets a load balancer stop sending new requests to an instance while allowing its existing connections to finish before removal.Glossary · NetworkingFirewallA firewall is software or hardware that allows or blocks network traffic according to rules based on addresses, ports and protocols.Glossary · NetworkingFTP (File Transfer Protocol)FTP is an old, unencrypted protocol for moving files between a client and server using separate control and data connections.Guide · Hosting & CDNApache vs nginx Troubleshooting: Logs, Config Tests and Common ErrorsSide-by-side troubleshooting for Apache and nginx: where logs live, config test commands, restart vs reload, and fixes for the most common startup and runtime errors.8 min readGuide · Downtime & ErrorsCloudflare 520-526 Errors Explained: Meaning and Fixes for EachA code-by-code guide to Cloudflare 520, 521, 522, 523, 524, 525, 526 and 530 errors, with origin tests, SSL mode fixes and firewall rules that resolve them.10 min readGuide · Hosting & CDNDocker Website Down? A Step-by-Step Troubleshooting ChecklistDiagnose a dockerized website that is down: container state, exit codes, published ports, healthchecks, logs, reverse proxy upstreams, OOM kills and full disks.9 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.