DMZ and network segmentation: Separating servers from the home network

In short: A DMZ is a shielded network zone for servers reachable from the internet; segmentation limits the damage when a device is taken over.

In more detail: In a flat network every device reaches every other. If a single one (for example an insecure IoT device or a public server) is hacked, the whole network is open to the attacker. Segmentation divides the network into zones between which a firewall controls traffic.

In Depth

The DMZ (demilitarised zone)

Servers that must be reachable from the internet (web servers, mail servers) sit in their own zone, separated from the internal network:

Internet ── Firewall ── DMZ (web server)
               │
               └── Internal network (PCs, printers)

Rules: from the internet only the DMZ servers and only certain ports may be reached; from the DMZ no free connections into the internal network; the internal network may administer the DMZ. This keeps a hacked web server trapped in its zone.

At home

• A guest network for visitors and IoT devices (smart TV, cameras, sockets), separated from the private network. Many routers offer it.
• VLANs in better routers/switches separate areas virtually (private, IoT, servers, guests).
• The “DMZ function” of many Fritz!Boxes and routers (exposed host) forwards all ports to one device and is not a real DMZ; it is risky and should be avoided.
• For home servers: port forwarding selectively and preferably access via VPN.

Principles

Least privilege (allow only necessary connections), defence in depth (several protective layers), default: block everything, allow exceptions, logging and monitoring, updates. In companies zero trust (check every request, also internal) and micro-segmentation are added.

Implementation

Plan zones (users, servers, guests, management, IoT), define firewall rules between zones and test that forbidden connections really fail (for example with nmap, ping, curl). Document the network diagram and keep devices up to date.

See also: Firewall, VLAN, NAT, Homelab and self-hosting, Least privilege