What is "DMZ" in network security "?

DMZ is the abbreviation of "demilitarized zone" in English. It is called "isolation zone" in Chinese, also known as "non-military zone ". It is a buffer zone between a non-security system and a security system to solve the problem that the external network cannot access the internal network server after the firewall is installed, this buffer zone is located in a small network area between the enterprise's internal network and the external network. Some public server facilities can be placed in this small network area, such as Enterprise Web servers, FTP servers, and forums. On the other hand, such a DMZ region is more effective in protecting the internal network, because such network deployment, compared with the general firewall solution, has another level for attackers.
Network Equipment developers have developed firewall solutions using this technology. It is called the "structure mode of the Non-Military Zone ". DMZ is usually a filtering subnet. DMZ constructs a security zone between the internal network and the external network. The DMZ firewall solution adds a security line for the internal network to be protected, which is generally considered to be very safe. At the same time, it provides public servers in a region, which can effectively avoid the conflict between the public and internal security policies of some interconnected applications. The DMZ area usually includes bastion hosts, Modem pools, and all public servers. However, you must note that e-commerce servers can only be used for user connection, real e-commerce background data needs to be placed in the internal network.

In this firewall solution, there are two firewalls, the External Firewall defends against external network attacks, and manages access to DMZ from all internal networks. The internal firewall manages DMZ access to the internal network. The internal firewall is the third security line in the internal network with the External Firewall and bastion host). When the External Firewall fails, it can also protect the internal network. In the LAN, Internet access is controlled by the internal firewall and the DMZ bastion host. In such a structure, a hacker must use three independent regional external firewalls, internal firewalls, and bastion hosts to access the LAN. The attack difficulty is greatly enhanced, and the security of the corresponding internal network is also greatly enhanced, but the investment cost is also the highest.