Cyberlium

Network › Module 4 › Lesson 1

BeginnerModule 4Lesson 1/5

What a DMZ Is For

A DMZ is a sacrificial front room — then keep public separate from app

15 min+40 XP3 quiz
Module progress1 of 5

Visual · dmz_purpose

DMZ = limited public role, not “the whole inside.”. Original Cyberlium.

Opening

A DMZ is not a moat sticker. It is a room you are willing to expose, with a door you are not.

DMZ (demilitarized zone) is an old military metaphor that stuck in networking: a place where strangers may knock, and where the crown jewels are not supposed to sit. The public web listener belongs there. The identity store, backups, and admin plane do not. If “DMZ” on a slide is just NAT toward the same VLAN as payroll, you have a vocabulary word, not an architecture. ORIGINAL Cyberlium — not a vendor firewall cert, not a home-WAN “DMZ host” checkbox lab (that checkbox often just forwards everything to one PC — a gift). as YOUR lab app.

1. Public role vs interior role — two dests, two jobs

The public role answers strangers: TLS terminator, reverse proxy, maybe a static site. It should hold almost no long-term secrets. The interior role holds data and identity. A DMZ is the policy that those roles do not share a room. Packets from the world terminate on public; public talks to app only on a named path you wrote.

Consumer routers labeled “DMZ” often mean “forward all inbound to this LAN IP.” That is the opposite of a limited public role — it is a hole. If you see Router Admin, STOP: do not tick that checkbox as homework. Stay on / 8793 cartoons.

2. Exposure budget: what the front room is allowed to lose

If the public process is compromised, what still works? If the answer is “everything, because it had domain admin and the database on disk,” you did not have a DMZ. You had a porch with the house keys under the mat. Design as if 8783 will be rude someday; 8793 should still require a second hop you control.

On loopback you cannot be “hacked from the internet” by this toy — that is the point of 127.0.0.1. The literacy still holds: separate processes, separate secrets, named talk from public to app. Never publish either bind on 0.0.0.0 to “feel exposed.”

Command guide

Exposure budget: what the front room is allowed to lose

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/

═══ COMMANDS ═══

Command — copy this

python3 - << 'PY'
import socket
for name, port in (("public", 8783), ("app", 8793)):
  s = socket.socket(); s.settimeout(0.4)
  r = s.connect_ex(("127.0.0.1", port))
  s.close()
  print(name, "127.0.0.1:%s" % port, "up" if r == 0 else "down")
PY

Command — copy this

curl -sS -m 2 -I "http://127.0.0.1:8783/" | head -n 8

3. What a DMZ is not

It is not “the Wi-Fi password is long.” It is not cloud metadata as a treasure hunt. It is not putting jump hosts, backups, and IdP in the same public room because the diagram had one yellow box. Next lessons name jump thinking and a never-list.

Refuse: nmap the WAN, hydra the router, BeEF on a café page, 0.0.0.0 binds, 169.254.169.254 recipes. Your artifacts are role files and later two listeners.

Command guide

What a DMZ is not

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install nmap
sudo apt install python3

macOS:

Command — copy this

brew install nmap
brew install python3

Windows:

Command — copy this

choco install nmap  # or download https://nmap.org/download.html

Download https://python.org/downloads/

═══ COMMANDS ═══

Command — copy this

grep -E "public_role|app_role" "$HOME/cyberlium-lab/t11-m04-roles.txt"
python3 - << 'PY'
PUBLIC_HOST, APP_HOST = "127.0.0.1", "127.0.0.1"
for h in (PUBLIC_HOST, APP_HOST):
  if h != "127.0.0.1":
      raise SystemExit("refusing non-loopback DMZ cartoon bind")
print("dmz cartoons ok", PUBLIC_HOST, 8783, APP_HOST, 8793)
print("never: WAN DMZ checkbox, nmap, 0.0.0.0")
PY

4. What you ship: two named roles and a refused consumer-DMZ checkbox

public 8783 vs app 8793 written. DEMO identified or STOPPED. No WAN DMZ host enabled. No 0.0.0.0. No LAN/WAN scans. Notes chmod 600.

5. What you record before the next lesson

Date. DMZ = limited public role. Consumer checkbox ≠ architecture. SAFE cartoons /:8793. DEMO GATE. NEVER nmap/hydra/0.0.0.0. File t11-m04-l01-what-dmz.txt.

6. Wrong vs right: stranger networks vs literacy on systems you own

Worked failure — same network word, opposite target. Right never needs a café or campus LAN.

  • Wrong

    Enable “DMZ host” on TP-Link toward your laptop. nmap the WAN interface. Bind the app toy to 0.0.0.0 so “the DMZ is real.”

  • Right

    Write two roles on loopback dests. Leave the gateway checkbox alone. Next: Jump Hosts and Bastion Thinking.

Mission: name public vs interior without touching WAN forwards

1) / STOP if router. 2) Write public vs app 3) Write why a consumer DMZ checkbox is not this lesson. Never scan. Never 0.0.0.0.

Stuck? Ask Cyberlium AI Mentor

Ask Mentor why all-ports forward is the opposite of a DMZ — not how to expose RDP from home.

Knowledge Check

1

APPLY: curl http://192.168.0.1/ is Netgear Router Admin with a “DMZ Host” toggle. You:

Multiple choice

Knowledge Check

2

APPLY: True or False: A DMZ is any yellow box on a slide that faces the internet, even if it holds the IdP and backups.

True or False

Knowledge Check

3

APPLY: Public process is compromised but app secrets were only on 8793 with a named hop. What worked?

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)