Core network --> Firewall Internal Zone --> Inner DMZ Firewall --> Outer Firewall --> Internet Based User

I can't think of any reason why "Inner DMZ firewall" would make this topology more secured from a network security perspective. Assume you take out the "Inner DMZ firewall" so you're left with Core network --> Firewall Internal Zone --> Outer Firewall --> Internet Based User.

For some reason having an additional firewall definitely sounds more safer. Thoughts?

  • What does the inner DMZ firewall do that the other two don't? And why? It's possible the answer is not "nothing", perhaps for efficiency reasons. E.g. the outer firewall (that also has to handle the rest of the network) might let a large part of traffic go to the DMZ unexamined, and let the firewall/IDS on the DMZ machine pick it up. (Other possibilities exist too).
    – LSerni
    Feb 12, 2016 at 7:42

2 Answers 2


That diagram appears incorrect. Typically you have it arranged slightly differently if you are using two layers of firewalls.

Core network-->Inner firewall-->DMZ-->Perimeter firewall-->Internet user

This lets you protect not only the servers in the DMZ from at least some attacks from outside, you also protect your core network from attack from a compromised device in the DMZ.

In reality, you may have one firewall appliance acting as both inner and outer firewalls, as well as segregating sections of the DMZ from each other (eg by service, or by risk profile, or by platform), through multiple interfaces and/or VLANs, or you may use separate firewalls from different vendors in order to avoid a compromise of both through one exploit. This will all depend on your risk and threat profile.


In addition to Rory's answer. These days your network can be devided in several zones. These zones are segregated from each other using firewalls and often have additional measures like IPS/IDS at the demarcation points. If you are wondering why you would zone things further, it's for the simple reason of data classification or business usage.

For instance if you are running a banking network it can make sense to segregate network management zones, developer zones, user zones, payment traffic zones, trading zones and SWIFT connectivity zones from eachother. Some banks go even further and segregate their staff from each other for instance fraud investigations, internal audit, corporate banking, retail banking,...

Stacking firewalls doesn't make you safer but it can allow you to only expose certain services to certain networks. The art of firewall zoning is ensuring things do not become overly complex, but still having ample control in place.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .