What is a DMZ?
The DMZ — demilitarized zone — told as a story about putting the shop that village guests visit in a yard between two walls.
The shop that village guests visit sits deep inside the castle.A bakery, a letter counter — a shop guests visit has to be open to the village. But this shop sits right next to the vault.
Break the shop, and the vault is one step away.A door open to guests is open to thieves too. One crack in the shop's note slot, and the whole castle is open.
A DMZ is the yard between two walls.The shop goes in the yard, and guests come no farther. The door from the yard into the castle is very narrow (two walls), and a watchman stands in the yard.
Shops are kept apart, and there is exactly one door inside.The bakery may ask inside for exactly one thing — the bread ledger. The errand runner who goes inside for village guests lives in the yard too, and a note checker stands at the counter. Only a few with a special key ever pass the doorkeeper.
Even if the shop breaks, it ends in the yard.The thief is stuck in the yard and the bell rings in the guard room. The shop closes for a while, but the vault is safe. Modern castles ask at every door inside the yard too.
DMZ = put the shops village guests visit in the yard between the outer and inner walls; guests stop at the yard, the way inside is one narrow door, and a watchman stands in the yard. If a shop breaks, it ends in the yard.
A separate network segment between an external and an internal firewall where internet-facing servers — web, mail — are placed, so that a compromised public server doesn't lead straight into the internal network. Only the minimum ports and services needed are opened inward.
When grown-ups say it
- DMZ
- The yard between the walls. Shops that must be open to the village live here. The only link inward is one narrow door.
- External & internal firewall
- The outer wall and the inner wall. The outer wall lets guests into the yard; the inner wall lets through only agreed errands. → the wall with many doors
- Public-facing server
- The shop in the yard. The bakery, the letter counter — anyone from the village may come, so they get broken most. That's why they live in the yard.
- Reverse proxy
- The errand runner in the yard. Goes inside on the guest's behalf, so the guest never even sees the inner door. → the runner who goes for you
- Jump server · bastion host
- The doorkeeper at the narrow door. The only path from the yard inward. Only those with a special key pass. → the master key in the vault
- Segment
- The dotted lines in the yard. If the bakery breaks, the letter counter is still apart. → halls divided by ribbon
- East-west traffic
- Errands between the shops. Not guests from the village (north-south), but movement sideways inside the yard. The watchman looks at this. → the one who watches the halls
- Zero trust
- Asking at every door, even in the yard. The yard is still used, but being in it earns no trust. → the castle that asks at every door