A DMZ creates a buffer between untrusted external networks and trusted internal networks.
Single firewall DMZ. One firewall with interfaces: external, DMZ, and internal. Simpler but a single point of failure.
Dual firewall DMZ. External firewall faces the internet. Internal firewall protects internal resources. Compromise of the external firewall still leaves internal protection.
DMZ rules:
- Internet to DMZ: Allow only specific services
- DMZ to internal: Block most traffic
- Internal to DMZ: Allow management
- DMZ to internet: Restrict outbound