Network › Module 4 › Lesson 1
What a DMZ Is For
A DMZ is a sacrificial front room — then keep public separate from app
Visual · dmz_purpose
DMZ = limited public role, not “the whole inside.”. Original Cyberlium.
Opening
A DMZ is not a moat sticker. It is a room you are willing to expose, with a door you are not.
DMZ (demilitarized zone) is an old military metaphor that stuck in networking: a place where strangers may knock, and where the crown jewels are not supposed to sit. The public web listener belongs there. The identity store, backups, and admin plane do not. If “DMZ” on a slide is just NAT toward the same VLAN as payroll, you have a vocabulary word, not an architecture. ORIGINAL Cyberlium — not a vendor firewall cert, not a home-WAN “DMZ host” checkbox lab (that checkbox often just forwards everything to one PC — a gift). as YOUR lab app.
1. Public role vs interior role — two dests, two jobs
The public role answers strangers: TLS terminator, reverse proxy, maybe a static site. It should hold almost no long-term secrets. The interior role holds data and identity. A DMZ is the policy that those roles do not share a room. Packets from the world terminate on public; public talks to app only on a named path you wrote.
Consumer routers labeled “DMZ” often mean “forward all inbound to this LAN IP.” That is the opposite of a limited public role — it is a hole. If you see Router Admin, STOP: do not tick that checkbox as homework. Stay on / 8793 cartoons.
2. Exposure budget: what the front room is allowed to lose
If the public process is compromised, what still works? If the answer is “everything, because it had domain admin and the database on disk,” you did not have a DMZ. You had a porch with the house keys under the mat. Design as if 8783 will be rude someday; 8793 should still require a second hop you control.
On loopback you cannot be “hacked from the internet” by this toy — that is the point of 127.0.0.1. The literacy still holds: separate processes, separate secrets, named talk from public to app. Never publish either bind on 0.0.0.0 to “feel exposed.”
Command guide
Exposure budget: what the front room is allowed to lose
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
import socket
for name, port in (("public", 8783), ("app", 8793)):
s = socket.socket(); s.settimeout(0.4)
r = s.connect_ex(("127.0.0.1", port))
s.close()
print(name, "127.0.0.1:%s" % port, "up" if r == 0 else "down")
PYCommand — copy this
curl -sS -m 2 -I "http://127.0.0.1:8783/" | head -n 8
3. What a DMZ is not
It is not “the Wi-Fi password is long.” It is not cloud metadata as a treasure hunt. It is not putting jump hosts, backups, and IdP in the same public room because the diagram had one yellow box. Next lessons name jump thinking and a never-list.
Refuse: nmap the WAN, hydra the router, BeEF on a café page, 0.0.0.0 binds, 169.254.169.254 recipes. Your artifacts are role files and later two listeners.
Command guide
What a DMZ is not
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap sudo apt install python3
macOS:
Command — copy this
brew install nmap brew install python3
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
grep -E "public_role|app_role" "$HOME/cyberlium-lab/t11-m04-roles.txt"
python3 - << 'PY'
PUBLIC_HOST, APP_HOST = "127.0.0.1", "127.0.0.1"
for h in (PUBLIC_HOST, APP_HOST):
if h != "127.0.0.1":
raise SystemExit("refusing non-loopback DMZ cartoon bind")
print("dmz cartoons ok", PUBLIC_HOST, 8783, APP_HOST, 8793)
print("never: WAN DMZ checkbox, nmap, 0.0.0.0")
PY4. What you ship: two named roles and a refused consumer-DMZ checkbox
public 8783 vs app 8793 written. DEMO identified or STOPPED. No WAN DMZ host enabled. No 0.0.0.0. No LAN/WAN scans. Notes chmod 600.
5. What you record before the next lesson
Date. DMZ = limited public role. Consumer checkbox ≠ architecture. SAFE cartoons /:8793. DEMO GATE. NEVER nmap/hydra/0.0.0.0. File t11-m04-l01-what-dmz.txt.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Enable “DMZ host” on TP-Link toward your laptop. nmap the WAN interface. Bind the app toy to 0.0.0.0 so “the DMZ is real.”
Right
Write two roles on loopback dests. Leave the gateway checkbox alone. Next: Jump Hosts and Bastion Thinking.
Mission: name public vs interior without touching WAN forwards
1) / STOP if router. 2) Write public vs app 3) Write why a consumer DMZ checkbox is not this lesson. Never scan. Never 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor why all-ports forward is the opposite of a DMZ — not how to expose RDP from home.
Knowledge Check
APPLY: curl http://192.168.0.1/ is Netgear Router Admin with a “DMZ Host” toggle. You:
Multiple choice
Knowledge Check
APPLY: True or False: A DMZ is any yellow box on a slide that faces the internet, even if it holds the IdP and backups.
True or False
Knowledge Check
APPLY: Public process is compromised but app secrets were only on 8793 with a named hop. What worked?
Multiple choice