DMZ Design
Protect public services.
DMZ Design is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is a DMZ
A DMZ (demilitarized zone) is a network segment that sits between the untrusted internet and the trusted internal network.
It holds services that must be reachable from outside.
Why a DMZ Exists
Public services like web and mail servers must accept connections from the internet.
Placing them in a DMZ means that if one is hacked, the attacker is still separated from your internal systems.
Three Zones
A DMZ design has three trust levels.
- Untrusted - the internet
- Semi-trusted - the DMZ
- Trusted - the internal LAN
What Goes in the DMZ
Typical DMZ residents are internet-facing services.
- Web servers
- Mail relays
- Public DNS
- Reverse proxies
Sensitive databases stay inside, not in the DMZ.
Single-Firewall Design
One common layout uses a three-legged firewall: a single firewall with three interfaces, one each for internet, DMZ, and internal.
It is simpler and cheaper, but the one firewall is a single point of failure.
Dual-Firewall Design
A stronger layout uses two firewalls, with the DMZ between them.
An outer firewall faces the internet; an inner firewall guards the LAN. An attacker must defeat both to reach inside.
Internet to DMZ Rules
From the internet, allow only the exact public services.
For example, permit inbound HTTPS to the web server and block everything else, including direct database access.
allow tcp internet -> dmz-web port 443
deny tcp internet -> dmz-web anyDMZ to Internal Rules
The most important rule: tightly restrict DMZ-to-internal traffic.
A DMZ web server may reach an internal database only on the one needed port, and the internet can never reach inside directly.
No Direct Internet to Internal
A core principle: the internet must never connect straight to the internal network.
All inbound traffic terminates in the DMZ, which then makes its own controlled requests inward.
Hardening DMZ Hosts
Because DMZ hosts are exposed, harden them well.
- Remove unneeded services
- Patch quickly
- Run only the required application
Assume they will be attacked.
Monitoring the DMZ
The DMZ is a prime target, so watch it closely.
Log all traffic crossing its boundaries and use intrusion detection to catch compromise attempts early.
Quick Check
Test your understanding of DMZ design.
Recap
DMZ design principles:
- Place public services in a semi-trusted DMZ between internet and LAN
- Use single- or dual-firewall layouts with strict inter-zone rules
- Never allow direct internet-to-internal access; harden and monitor DMZ hosts
Frequently asked questions
Is the “DMZ Design” lesson free?
Yes — the full text of “DMZ Design” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “DMZ Design”?
Protect public services. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “DMZ Design” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.