Back to blog

Architecture  ·  Design  ·  July 2026

Network Architecture
Perimeter & DMZ Design

If you publish anything to the internet — a website, a mail server, a booking portal, a VPN — you need to decide where it lives and what can reach it. Put it on the LAN and a compromise owns everything; put it nowhere and nobody can use it. The DMZ is the answer, and where you place your firewall(s) is the architecture.

Architecture DMZ Firewall Perimeter Security

Internet FW 3-leg DMZ (published services) web mail Internal LAN (trusted) staff servers Internet → DMZ: allowed (specific ports) Internet → LAN: denied DMZ → LAN: denied (key rule) LAN → DMZ/Internet: allowed

A DMZ (demilitarised zone) is a network segment for the systems that must be reachable from the internet, positioned so that if one of them is compromised, the attacker still can't reach your internal LAN. That last clause is the entire point. Anything internet-facing is, by definition, the most likely thing to be breached; the architecture's job is to ensure a breached web server is a bad day, not a total loss.

The design is about firewall placement and traffic direction. The load-bearing rule is DMZ → LAN: deny — published services may talk to the internet and be reached from it, but they must not be able to initiate connections inward. Internal hosts reach out freely; the internet reaches only specific DMZ ports; nothing from outside or the DMZ reaches the trusted LAN uninvited. This builds on segmentation and the zone-based firewall, applied to the highest-stakes boundary you have.

Reads alongside

01

One Firewall, Three Legs — the SMB Default

A single firewall with three interfaces — internet, DMZ, LAN — and a policy between each pair. Cheapest and entirely adequate for most businesses.

The three-legged (or "three-homed") firewall is the pragmatic standard: one device, three zones, three sets of rules. Internet→DMZ permits the published ports (443 to the web server, 25/587 to mail). Internet→LAN denies everything unsolicited. DMZ→LAN denies (the critical rule). LAN→anywhere is permitted, statefully. It's simple, one place to manage, and for a hotel, office, or clinic publishing a couple of services it's exactly right. The theoretical weakness — one device is one thing to compromise or misconfigure — is managed with good change control and monitoring, not by reflexively buying two firewalls.

02

Two Firewalls — the Screened Subnet

An outer firewall between internet and DMZ, an inner firewall between DMZ and LAN. The DMZ sits sandwiched between them. More robust, more expensive, and worth it above a certain risk threshold.

In the classic screened-subnet (back-to-back) design, an attacker who breaches a DMZ host still faces a second, separate firewall — ideally from a different vendor — before reaching the LAN. That defence-in-depth matters when the published services are high-value or the internal network is highly sensitive (payment processing, healthcare records, anything regulated). The cost is two devices, two rule sets, and more operational overhead. Reserve it for genuine risk, not prestige: a small business publishing a brochure site does not need two firewalls; a company processing card data in-house probably does.

◆ Don't Forget East-West and the DMZ's Own Segmentation

Perimeter thinking fixates on the internet boundary, but the DMZ needs internal discipline too. If your DMZ holds a web server and a mail server, a compromise of one shouldn't trivially own the other — segment within the DMZ, or at least restrict DMZ-to-DMZ traffic. And the modern reality is that most attacks, once inside, move east-west; a perfect perimeter with a flat interior just means the attacker roams freely after the first foothold. The perimeter is necessary, not sufficient — pair it with internal segmentation and, ideally, zero-trust east-west control.

03

Publishing Services Safely Reference

How a service actually gets exposed matters as much as where it sits. A few patterns keep the attack surface honest.

PatternWhy
Reverse proxy in the DMZ, app behind itOne hardened front door; the app server never faces the internet directly
Only the required ports, to the specific hostPublish 443 to the web VM — not "the DMZ"; deny the rest
Terminate VPN at the firewall/DMZ, not the LANRemote access lands in a controlled zone, not straight onto trusted infra
Outbound-initiated tunnels for CGNAT/Starlink sitesNo inbound public IP needed; the service dials out to a broker
Log and monitor DMZ→anywhereA DMZ host suddenly scanning the LAN is your breach alarm

Takeaways

  1. A DMZ isolates internet-facing systems so a breach of a published service can't reach the trusted LAN — that clause is the whole point.
  2. The load-bearing rule is DMZ → LAN: deny. Published services face out, never initiate inward.
  3. Three-legged single firewall is the SMB default — one device, three zones, adequate for most published-service needs.
  4. Two firewalls (screened subnet) add defence-in-depth for high-value/regulated environments — reserve it for real risk, not prestige.
  5. Segment within the DMZ and control east-west — a perfect perimeter around a flat interior just lets the attacker roam after one foothold.
  6. Publish minimally — reverse proxy, specific ports to specific hosts, VPN terminating in a controlled zone, and monitor DMZ-initiated traffic.

Publishing services to the internet and unsure they're safely placed?

NOCTIS designs internet perimeters across Crete — DMZ placement, firewall architecture, and safe publishing patterns — so a compromised public service stays contained, not catastrophic.

Book a Discovery Call →