DMZ Netowrk
You build a dmz netowrk by placing a buffer subnet between the internet and your private network. You then set firewall rules to check all traffic that enters or leaves this zone. Most teams put public web servers and mail servers inside this perimeter subnet. Outside users can reach those public apps without entering the core network. Still, teams often open broad port ranges so engineers can log in and fix bugs. When network rules are too wide, one bad login exposes every internal database.
Netowrk: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You build a dmz netowrk by placing a buffer subnet between the internet and your private network. You then set firewall rules to check all traffic that enters or leaves this zone. Most teams put public web servers and mail servers inside this perimeter subnet. Outside users can reach those public apps without entering the core network. Still, teams often open broad port ranges so engineers can log in and fix bugs. When network rules are too wide, one bad login exposes every internal database.
How to set up a dmz netowrk architecture
A standard perimeter zone uses either one firewall with three network ports or two separate firewalls. In the single firewall design, one port faces the public internet. A second port links to the perimeter zone, and the third connects to your private systems. This layout is cheap to run, but one broken device puts every subnet at risk.
The dual firewall design gives you a much stronger boundary. The outer firewall sits in front of the perimeter zone and filters public internet traffic. It only lets outside users reach specific ports on your public web servers. The inner firewall sits between the perimeter zone and your private network. It blocks public servers from opening raw links into your private data stores. If an attacker takes over a web host, the inner firewall stops them from moving deeper.
Planning subnet rules and host routing
When you set up your perimeter zone, you must list every service that needs public traffic. Web apps, DNS servers, and mail relays belong in this outer subnet. Databases, source code hosts, and internal tools must stay inside the private network. You assign each server a static private IP address inside the perimeter range. Then you set up network address translation on the outer firewall to route public requests.
Next, you lock down how servers talk to each other inside the zone. A web server should never talk directly to a mail server in the same subnet. You can use host firewalls or local VLAN rules to block east-west traffic between neighbors. You also need strict egress rules so compromised hosts cannot download malicious files from the web.
Netowrk: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What perimeter firewalls solve and what they miss
Network zones and firewalls are great at filtering packets by IP address and port number. They stop random internet scanners from touching your private databases directly. They also limit how far an attacker can move after a public server falls.
Still, perimeter rules only check where traffic comes from and which port it hits. Once an engineer or app logs in through an allowed port, the firewall steps aside. It cannot read the database queries or shell commands running inside that open session. Teams still share long-lived SSH keys and database passwords to manage hosts inside the zone. Also, standard network logs only show connection times and byte counts, not the exact commands run. If a query returns sensitive emails, phone numbers, or card numbers, the firewall cannot mask them. Perimeter controls decide who connects, not what individual statements or commands do in flight.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
What servers belong inside a perimeter subnet?
Any server that talks directly to outside internet users belongs in the perimeter zone. Common examples include web servers, DNS hosts, and email relays. Databases and internal business apps must stay inside the private network.
Is one firewall enough for a perimeter zone?
A single firewall with three network ports works for small setups and test labs. Still, two separate firewalls give much better safety for production systems. If the outer firewall fails, the inner firewall still protects your private data.
Why do teams need controls beyond firewall rules?
Firewalls only inspect IP addresses and ports during the initial network handshake. They cannot see or block risky SQL queries or shell commands inside an active session. Teams need command-level checks and field masking to protect sensitive data in flight.