Outside Vendor Inside Users Figure 25-2. DMZ connecting to a vendor The DMZ In a network like this, the firewall would be configured as follows: Inside network The inside network can initiate connections to any other network, but no other network can initiate connections to it. Outside network The outside network cannot initiate connections to the inside network or to the DMZ. The inside network can initiate connections to the outside network, but the DMZ cannot. The DMZ cannot initiate connections to any network. Only the inside network can initiate connections to the DMZ. Multiple DMZ Example The real world is not always as neat and orderly as my drawings would have you believe. The examples I've shown are valid, but larger companies have more compli- cated networks. Sometimes, a single DMZ is not enough. Figure 25-3 shows a network with multiple DMZs. The design is a combination of the first two examples. Outside is the Internet, and inside are the users. DMZ-1 is a connection to a vendor. DMZ-2 is where the Internet servers reside. The security rules are essentially the same as those outlined in the preceding section, but we must now also consider whether DMZ-1 should be allowed to initiate connections to DMZ-2, and vice versa. In this case, the answer is no. Internet Outside Email server DMZ-1 Vendor DMZ-2 DNS server Inside Users Figure 25-3. Multiple DMZs Chapter 25: Firewall Theory The firewall should be configured as follows: Inside network The inside network can initiate connections to any other network, but no other network can initiate connections to it. Outside network The outside network cannot initiate connections to the inside network, or to DMZ-1. The outside network can initiate connections to DMZ-2. DMZ-1 DMZ-1 cannot initiate connections to any other network. Only the inside network can initiate connections into DMZ-1. DMZ-2 DMZ-2 can initiate connections only to the outside network. The outside network and the inside network can initiate connections to DMZ-2. Alternate Designs The Internet is 