We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Cloud Infrastructure
Free preview: the first 2 parts of this 6-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Cloud Infrastructure
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
Your web application needs to be reachable from the internet. Your database absolutely must not be. But they need to communicate with each other. How do you allow public access to some resources while keeping others completely hidden?
The answer is a DMZ, demilitarized zone. Borrowed from military terminology (the buffer zone between North and South Korea), a network DMZ is a separate network segment that sits between the public internet and your private internal network. Public-facing services (web servers, load balancers, API gateways) live in the DMZ. Everything else lives behind it.
If an attacker compromises a server in the DMZ, they cannot directly reach the internal network. The DMZ acts as a sacrificial layer, exposed enough to serve traffic, isolated enough to protect what matters.
In 2013, Target was breached through an HVAC vendor's credentials. The attackers moved laterally from the HVAC system to point-of-sale terminals because the network had no proper segmentation. A DMZ architecture with strict firewall rules between zones would have contained the breach to the HVAC segment. The lateral movement that led to 40 million stolen credit cards would have been blocked at the inner firewall.
Traditional DMZ (on-premises):
Internet -> Outer Firewall -> DMZ -> Inner Firewall -> Internal Network
Two firewalls with different rule sets. Even if an attacker bypasses the outer firewall and compromises a DMZ server, the inner firewall blocks access to the internal network.
Cloud DMZ (modern):
Internet -> Internet Gateway -> Public Subnet (DMZ) -> Security Groups/NACLs -> Private Subnet (Internal)
| DMZ Component | Purpose | Cloud Equivalent |
|---|---|---|
| Outer firewall | Filter internet traffic | Security Groups + NACLs on public subnet |
| DMZ servers | Handle public requests | Load balancers, reverse proxies, WAF |
| Inner firewall | Protect internal network | Security Groups + NACLs on private subnet |
| Internal servers | Business logic, data | App servers, databases in private subnets |
What belongs in the DMZ:
What does NOT belong in the DMZ: