DMZ Firewall Network Diagram

A company that hosts its own website, mail and VPN must let strangers connect to those servers without letting them near the internal network. The classic answer is a DMZ (screened subnet) between two firewalls. This diagram shows the zones, the servers in each, the allowed and blocked flows, and the rules behind them.

1. The Diagram

Two-Firewall DMZ (Screened Subnet) Internet Edge Firewall vendor A, outside Reverse Proxy WAF, TLS termination Mail Relay SMTP 25 in VPN Gateway remote staff Internal Firewall vendor B, inside App Servers 8443 from proxy only Mail Server 25 from relay only DB + Users never from DMZ red: blocked path, internet straight to LAN Edge rules (in order) any -> proxy tcp/443 allow any -> relay tcp/25 allow any -> vpn udp/51820 allow any -> any deny + log Internal rules: proxy -> app 8443, relay -> mail 25, vpn -> LAN; else deny DMZ 172.16.1.0/24 Internal LAN 10.0.0.0/16
  1. Edge firewall. Faces the internet and allows only the three published services into the DMZ. The last rule is an explicit deny with logging.
  2. DMZ. The screened subnet holds the servers that must accept connections from strangers: a reverse proxy with a WAF that terminates TLS, an SMTP relay and a VPN gateway. If one is compromised, the attacker is still outside the LAN.
  3. Internal firewall. A second firewall, ideally from a different vendor so one bug does not open both, admits only specific flows from specific DMZ hosts: proxy to app servers on 8443, relay to the mail server on 25, VPN users to the LAN.
  4. Internal LAN. The database and user workstations accept nothing from the DMZ directly. The red dashed arrow is the path the design exists to block: internet straight to the LAN.

2. How to Read It

How to Read a Network Topology Diagram Device router / switch / host labelled box per device physical / L2 link solid line = cable or port uplink / trunk yellow = emphasis dashed boundary groups devices allowed traffic blocked / failure arrows only show flows zone / VLAN / subnet

Security zones are dashed boundaries coloured by trust: yellow for the semi-trusted DMZ, green for the trusted LAN. Green arrows are permitted flows (they should match the rule boxes); red dashed arrows are flows that must fail.

When you review a DMZ diagram, look for arrows that start in the DMZ and end deep inside the LAN, such as a web server talking straight to the database. Those are the paths an attacker uses after compromising a public server.

3. Variant: Three-Legged Firewall

Variant: Three-Legged Firewall Internet Firewall 3 interfaces eth0 outside Web / Mail / VPN LAN + servers one box enforces both boundaries DMZ (eth1, security level 50) Inside (eth2, security level 100)

Smaller sites use one firewall with three interfaces. Traffic between any two zones still passes the policy, so the logical design is the same, but a single device or misconfiguration now guards both boundaries. It is cheaper and simpler; the two-firewall layout gives defence in depth.

4. Pros, Cons, and When to Use

Pros

Cons

When to use

When not to use

5. As Diagrams-as-Code

Graphviz (DOT) with clusters for zones and coloured edges for policy:

digraph dmz {
  rankdir=TB; node [shape=box, style=rounded];
  internet [shape=ellipse];
  edge_fw [label="Edge Firewall"]; int_fw [label="Internal Firewall"];
  subgraph cluster_dmz { label="DMZ 172.16.1.0/24"; proxy [label="Reverse Proxy"]; relay [label="Mail Relay"]; vpn [label="VPN Gateway"]; }
  subgraph cluster_lan { label="Internal LAN 10.0.0.0/16"; app [label="App Servers"]; mail [label="Mail Server"]; db [label="DB + Users"]; }
  internet -> edge_fw [color=green];
  edge_fw -> proxy [label="443"]; edge_fw -> relay [label="25"]; edge_fw -> vpn [label="51820/udp"];
  proxy -> int_fw; relay -> int_fw; vpn -> int_fw;
  int_fw -> app [label="8443"]; int_fw -> mail [label="25"];
  internet -> db [color=red, style=dashed, label="blocked"];
}