Demilitarized zone (DMZ) or screened-subnet firewall—This is a small, isolated network for an organization’s
public servers, bastion host information servers and modem pools. The DMZ connects the untrusted network to the
trusted network, but it exists in its own independent space to limit access and availability of resources. As a result,
external systems can access only the bastion host and possibly information servers in the DMZ. The inside router
manages access to the private network, accepting only traffic originating from the bastion host. The filtering rules
on the outside router require the use of proxy services by accepting only outbound traffic on the bastion host. The
key benefits of this system are that an intruder must penetrate three separate devices, private network addresses are
not disclosed to the Internet, and internal systems do not have direct access to the Internet.