My question is in regards to network security.

I understand that there should be a demilitarization zone at the border for your network. It is there where the perimeter firewall should live and other DMZ servers. After which there is another DMZ firewall and then your trusted network.

I guess I am having trouble understanding the core concept of the firewall. Is it an actual piece of hardware? (I have seen both hardware and software online). How do firewalls work in tandem with Active Directory? And what servers live in the DMZ zone? Is there an application where you control firewall controls over the other servers? or is the firewall regulated manually in each server?

I know its a lot of questions, but the concept is still a bit muddy for me. Any and all help would be grateful. Also if there are any articles or websites where this is explained in detail would great. I've done my fair search but since I am not quite sure what to look for I feel like I am going in circles.

2 Answers 2


Is it an actual piece of hardware? (I have seen both hardware and software online).

as you stated, it can be both. Windows has a built in firewall ... but there are also hardware devices that are dedicated to the task (usually for larger networks)

How do firewalls work in tandem with Active Directory?

Um, it doesn't? Unless I am missing something in your question they are unrelated. Both can be use for security, but firewall is to protect against network traffic at lower levels through rules and filtering and AD is more for protection against unauthorized access to a specific computer at the application level through use of credentials and permissions.

what servers live in the DMZ zone?

Servers that host external information and services ... like a web server or email server.

Is there an application where you control firewall controls over the other servers? or is the firewall regulated manually in each server?

Firewalls can be administered remotely via a GUI or via SSH ... it is also possible for a firewall rule to be automatically created via tools like fail2ban

  • Hi Caffeine Thank you for your reply so there are some firewalls out there that mention integration with AD.. so I guess that's where my confusions arose from. So if I have my web server in the DMZ and someone on my internal network needs/want to use the web they would have to go through the secure webserver first in the DMZ before going out to the internet correct? Also, if you can please take a look at the logical diagram I created of a mock network (still trying to get the pieces to fit) and let me know if its correct? TY! drive.google.com/file/d/0B-EVoJjlNsGpc09TdXd1NDdoYzQ/view
    – Conde
    Commented Aug 24, 2016 at 15:49
  • As far as firewall being integrated into AD ... I would assume this has nothing to do with your end users and has more to do with uses your Domain Credentials in order to Administer the Firewall via GUI Commented Aug 24, 2016 at 16:21
  • As far as your network diagram ... its slightly off you have 2 diff firewalls displayed however the right most one ... isnt ... the whole point of a DMZ is that there is nothing between that device and the router. In your case you most likely don't want your proxy server or your web server in the DMZ ... instead you most likly want to port forward ports 80 and 443 to the web server ... and proxy should NEVER exist on DMZ Commented Aug 24, 2016 at 16:23

In the drawing below you have three networks which are connected though a firewall. The role of the firewall is to limit the traffic between these networks.

Limiting the traffic means that you can decide that only traffic going to a certain port (say, 22) is allowed, how often you can connect to a given host from another one etc.

There is nothing special neither in the networks nor in the ports.

Some networks have special names, like Internet for instance. For a firewall this is a network like others. Some other networks may be called LAN, DMZ or Mike.

Historically, networks having special usages were names with their own names. DMZ is an example of such a network. The idea is that this is a network which is exposed to a "public" one (usually called Internet) and to a "private" one. Going further, it was designed as a sink: you can only get in there, and once you are in you do not leave to other networks. This way, if something in this network is compromised, the compromission is limited to it only.

There are other networks which got their own names: LAN (traditionally your private network, not exposed), WAN (traditionally a network to join your other networks, not exposed to the public one(s)), etc.

The main reason for a firewall is to ensure compartimentalization, on a device which is not part of the compartimentalized network. Only then comes the naming which is just a rough agreement to simplify the communication between network/system engineers.

enter image description here

To your questions now.

Conceptually a firewall is software. You can get it as a network appliance which comes with some management software, or use software firewalls (iptableson Linux for instance) -- you will obviously needs some hardware too.

The firewall understands network packets - whether they come from Active Directory, a web server or a music stream does not matter.

You can also have a firewall built into the OS of the machine you are using - this is for instance the case for Linux and Windows. In such cases you usually firewall traffic for your machine only (you do not want anyone to connect to you for instance, even if you have exposed some service)

Please note that a lot of this traditional naming is now obsolete and is really used as a high-level simplification.

Note: This is a simplified view, mostly true (= it is not complete)

  • Hi WoJ Thank you for your reply! I was trying to figure out a way to upload an image on here to show you what Ive been doing so far. Here is a link instead. I also have been reading into ACL, subnets, and packet forwarding tho it is not explicitly detailed in the image, its more of a logical view. Can you please look it over and let me know if I am on the right track? Thank you! drive.google.com/file/d/0B-EVoJjlNsGpc09TdXd1NDdoYzQ/view
    – Conde
    Commented Aug 24, 2016 at 15:44
  • This is not the best architecture, security-wise (bear in mind that there is an operational and performance perspective as well). I would rather have your first fw connected to internet, to a zone with the guest wifi, another one with the dmz services and a link to the second fw. This second fw would cover separate internal zones (the ones you call subnets on your chart). This is more standard but again, you also have to weight in ops and performance.
    – WoJ
    Commented Aug 24, 2016 at 15:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .