What Is Demilitarised Zone
To answer what is demilitarised zone, it is a buffer subnet in a network. It sits between the public internet and your private internal systems to contain attacks. Public users reach your web apps inside this middle zone. Meanwhile, your core databases stay safe behind a second wall of rules. How what is demilitarised zone works in practice Security teams build a demilitarised zone, or DMZ, using one or two firewalls. The outer firewall takes traffic from the open internet and checks basic p
Is Demilitarised Zone: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To answer what is demilitarised zone, it is a buffer subnet in a network. It sits between the public internet and your private internal systems to contain attacks.
Public users reach your web apps inside this middle zone. Meanwhile, your core databases stay safe behind a second wall of rules.
How what is demilitarised zone works in practice
Security teams build a demilitarised zone, or DMZ, using one or two firewalls. The outer firewall takes traffic from the open internet and checks basic port rules.
It only lets web or mail traffic reach the servers in the middle subnet. If an attacker breaks into a web server there, they hit the inner firewall next.
The inner firewall blocks direct traffic from the public internet to the private network. It only lets specific servers in the middle zone talk to internal databases.
Engineers and AI agents also run workflows that cross these network boundaries. An automated script might pull data from a public API and write to an internal store.
To do this, the app in the middle zone holds a database key. The inner firewall checks the source IP and port, then opens the path.
Security and operational tradeoffs of perimeter zones
Network zones are great at stopping random port scans from the outside world. Still, a firewall only sees IP addresses and ports, not who is running a query.
Apps and agents in the middle zone still need static keys to log in. If an attacker steals a web server, they also get those stored database keys.
Is Demilitarised Zone: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Once an active session starts over an allowed port, the firewall steps back. It does not check which SQL commands run or which tables get read.
Network roles and subnet rules cannot rewrite sensitive fields inside a query result. Raw emails, phone numbers, card numbers, and national IDs flow back over the open port.
Managing firewall rules for every new microservice or AI agent also slows teams down. Engineers wait on ticket queues just to open a single port for a test.
When teams finally get network access, they often share one broad service role. That shared role makes it hard to see which person or bot ran a bad command.
Moving from network zones to command-level control
Modern cloud setups still use public and private subnets to group their servers. Yet relying on IP walls alone leaves a big gap during active database sessions.
Teams need a way to check every single command after the network check passes. They also need to tie every action to a real user or agent identity.
Adding field masking at the data layer protects private rows during live queries. Masking rewrites matched fields like emails and card numbers in results before they leave.
This approach keeps your public zone safe even if a server gets compromised. Attackers cannot dump raw customer tables just because a firewall port is open.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Why do teams put web servers in a demilitarised zone?
Web servers must talk to unknown users on the open internet every day. Putting them in a buffer zone keeps attackers away from private internal databases.
What is the difference between a single and dual firewall DMZ?
A single firewall setup uses three network ports on one box to split traffic. A dual firewall setup places two separate firewalls around the buffer zone for stronger isolation.
Does a DMZ protect internal databases from compromised web apps?
No, because the web app usually needs an open port to read database tables. If attackers take over the app, they can use its stored keys over that port.