Demilitarized Zone Computing
You set up demilitarized zone computing by placing public apps inside an isolated perimeter subnet. Two firewalls filter traffic between the open web, this buffer zone, and your private network. Most teams build this layout with dual firewalls and strict routing tables. Still, broad internal roles still let users run risky queries once they log in. How demilitarized zone computing works in practice A perimeter network splits your system into three distinct zones. The outer firewall checks pac
Confidential Computing: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up demilitarized zone computing by placing public apps inside an isolated perimeter subnet. Two firewalls filter traffic between the open web, this buffer zone, and your private network. Most teams build this layout with dual firewalls and strict routing tables. Still, broad internal roles still let users run risky queries once they log in.
How demilitarized zone computing works in practice
A perimeter network splits your system into three distinct zones. The outer firewall checks packets coming from the public internet first. It only allows web traffic to reach public servers in the middle zone. These public servers handle web requests, mail transfer, and domain name lookups.
Your private databases and core systems sit behind a second internal firewall. This inner wall blocks direct traffic from the public internet to private hosts. Public servers in the middle zone can talk to internal databases over specific ports. If an attacker breaks into a web server, the inner wall stops lateral movement.
Cloud teams build this same layout using virtual subnets and security groups. They place load balancers in a public subnet with an internet route. App servers and databases stay in private subnets with no public IP addresses. Routing tables and network rules control which subnet can send packets to another.
Setting up perimeter firewall and routing rules
Start by listing every service that external users must reach from the web. Place only those front-end hosts inside the isolated perimeter subnet. Next, write outer firewall rules that drop all inbound traffic by default. Open only the exact ports needed for encrypted web traffic.
Then set up the inner firewall to inspect traffic heading toward your private zone. Allow packets only from specific perimeter hosts to exact internal database ports. Block all outbound traffic from the private zone directly to the open web. Finally, turn on packet logs at both firewall points to track blocked attempts.
What network perimeters solve and what they miss
Perimeter zones excel at blocking unapproved network scans and random external attacks. They stop outsiders from reaching your internal database ports directly from the web. This design shrinks the surface area that an external attacker can probe.
Confidential Computing: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Still, network rules only check IP addresses and port numbers at the border. They do not inspect what happens after an engineer or app logs in. Developers still need to reach production databases inside the private zone to fix bugs.
Teams often grant broad database roles or shared keys for these support tasks. Once a session passes the inner firewall, the network cannot read the commands inside. An engineer can run a drop table command or read raw customer rows. A compromised app server in the perimeter can also pull thousands of records.
Network walls decide which host can talk to another host. They cannot approve single SQL statements or mask sensitive fields like emails and card numbers. Locking down modern systems requires control over each command and query in flight.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev sits inline in the protocol beside each supported service as an open-source proxy, a sidecar for your database or API. For every query or command an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human approval.
First, hoop.dev guardrails block banned queries before they run or hold risky ones for review, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What hosts belong in a perimeter subnet?
Place web servers, reverse proxies, mail relays, and public API endpoints in this zone. Never store raw customer databases or domain controllers inside the perimeter subnet.
Do cloud networks still need a perimeter zone?
Yes, cloud networks use public and private subnets to separate internet traffic from data stores. Still, cloud teams must pair subnet rules with strict identity and query controls.
Why is a dual firewall layout safer than a single firewall?
A dual layout uses two separate rule sets to guard your private network. An attacker must bypass two distinct barriers before reaching any internal database.