DMZ (Demilitarized Zone)

A DMZ (demilitarized zone) is a network segment placed between the Internet and the internal network, hosting services such as web, mail and DNS servers that must be reachable from outside.

Why it matters

If a public server is compromised, the attacker lands in the DMZ rather than directly on the internal LAN. Firewall rules allow Internet traffic to the DMZ on specific ports, allow limited traffic from the DMZ inward, and block everything else. Home routers often have a "DMZ host" option, which is different and simply exposes one device fully.

Example

Internet -> [Firewall] -> DMZ: web server 10.1.1.10
                   |
                   -> Internal LAN 10.0.0.0/24 (no direct Internet access)

The web server may query a database on the LAN only through a narrow rule, such as TCP 5432 from that one host.

Common mistakes

• Treating a home router's DMZ host feature as a true DMZ. It removes protection for that device.
• Letting DMZ servers initiate broad connections into the internal network.
• Failing to patch and monitor DMZ hosts because they feel isolated.

Related

• Firewall
• Port forwarding
• VLAN
• Reverse proxy

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.