I am wondering if there is any best practice firewalling rules that should be put in effect in most modern networks.

For example should the network atleast have the following firewall zones?

  • Client network
  • DMZ
  • Customer facing network (internett)

Is it considered best practice to keep and maintain firewalls inside the zones (on each individual server) aswell as on the zones itself?

I would appriciate any tips regarding best practice designs of firewalls.

  • 1
    I think it would really depend on what those firewalls are supposed to be protecting. Could you describe the environment in which these firewalls would be used? What level of assurances are necessary, etc.
    – Steve
    Nov 1, 2011 at 22:38

2 Answers 2


'Best' is probably not the right word here, as the specifics vary with needs, however 'standard' industry practice for enterprise level financial services organisations (a good benchmark) includes:

Client network, with segregated access-controlled subnets for specific key assets (usually customer databases, HR data, financial data)


Multiple DMZ's - usually split either by function or risk profile (eg a DMZ for transactional services, one for remote access for staff, and another for 3rd party connections)


Internet, remote clients etc

Firewalls should be from different vendors eg Juniper, Cisco, Checkpoint etc. to increase the time an attacker would take to get past them both (would require two exploits)

  • What logic would you use to determine which Firewall vendors segregate which networks?
    – Steve
    Nov 2, 2011 at 2:41
  • 1
    In practice it doesn't seem to matter, however if pressed I would suggest using the one with the highest throughput rate as the external one, as it will have to deal with more traffic.
    – Rory Alsop
    Nov 2, 2011 at 8:50

should the network at least have the following firewall zones?

Not necessarily.

It's a fairly common model though.

I'd recommend (in addition to all the usual security measures)

  • implementing the OS firewall on all machines as well as using dedicated firewall devices where appropriate
  • implementing proper egress filtering on the OS as well as on the network devices

Also, getting your routing set up correctly is an essential part of network security.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .