Technical data

5.7 DMZ (Exposed Host) 112

5.7 DMZ (Exposed Host)

DMZ is short for Demilitarized Zone.

A demilitarized zone is a network area (a subnetwork) that sits

between your internal network and an external network, usually

the Internet. The point of a DMZ is that connections from the

internal and the external network to the DMZ are permitted,

whereas connections from the DMZ are only permitted to the

external network. Hosts in the DMZ may not connect to the

internal network. This allows the DMZ’s hosts to provide services

to the external network while protecting the internal network

in case intruders compromise a host in the DMZ. For someone

on the external network who wants to illegally connect to the

internal network, the DMZ is a dead end.

Figure 5.19: DMZ

The HorstBox uses a slightly different approach. The DMZ (Ex-

posed Host) connects to the internal network without further

security. That is, the DMZ host is able to connect to hosts on

the internal network, but hosts in a real DMZ are prevented from

doing so by the ﬁrewall that sits between them.

Default: DMZ deactivated.