Classic Dual Router DMZ
As security started to become a problem on the Internet, savvy network administrators migrated to a dual-router system, as shown in Figure 7-4. This is traditionally referred to as a DMZ. Today, many refer to a third segment on a firewall as a DMZ, but this is not strictly correct because the firewall is still protecting the third segment.
Figure 7-4. Dual-Router DMZ
Figure 7-4. Dual-Router DMZ
The main benefit of this design over a single router is that the public servers are separated from the rest of the internal network. A compromise of a server in the DMZ does not automatically allow attacks against internal servers. The attacker still must get through the second router. This filtering router can be set up with more restrictive ACLs than the first router, but without stateful filtering, the internal systems are still fairly open to attack.
Continue reading here: Stateful Firewall DMZ Design
Was this article helpful?