- [Instructor] When opening a file port
and enabling port forwarding, a risk is
that some internal hosts, such as web servers,
are now accessible on the internet.
There's always a chance
of an attacker compromising the web server.
A compromised web server
in the same network could infecting other hosts,
and make them vulnerable too.
DMZ is a solution to preventing this unfortunate scenario.
DMZ stands for demilitarized zone.
It's a buffer area between an internal network
and an external network.
Therefore, DMZ further separates the internal network
into a publicly, accessible area,
and a protected area off limits to public access.
DMZ allows us to avoid a situation
where an internal network is directly exposed
to the external network.
This way, a compromised host in the DMZ does
not affect other hosts and make them less vulnerable.
DMZ also allows more fine-grained network traffic monitoring
by further dividing an internal network
and placing more security controls.
One-legged topology is the most basic DMZ architecture.
Topology here means a structure of how we connect hosts.
To create a one-legged DMZ,
we need to build on a net firewall host
by connecting a DMZ subnet to it.
We also need one more network interface card
that is a third network interface card,
and a switch to connect multiple hosts
to the new network interface card.
The diagram here shows that you could introduce a DMZ
to an existing net firewall host by adding another switch,
and the third network interface card.
The reason this setup is called "one-legged DMZ" is
that the DMZ is connected
to only one network interface card.
In a full-blown DMZ,
there'll be two network interface cards involved.
One connected to the first net firewall host
facing the external network, and the other connected
to the second net firewall host facing the internal network.