DMZ

The term DMZ (De-Militarized Zone), is generally used to describe the geographical area separating North Korea from South Korea in the 1950s, after the Korean War. The entire area was liberally hosed down with Agent Orange, a powerful defoliant, (toxic to humans, and allegedly the cause of many diseases in GIs) that stripped the land of vegitation, in an attempt to prevent cross border incursions

DMZ

(common) Literally, De-Militarized Zone. Figuratively, the portion of a private network that is visible through the network's firewalls (see firewall machine). Coined in the late 1990s as jargon, this term is now borderline techspeak.

-- Jargon file 4.3.0

From the game of Diplomacy, a DMZ (De-Militarized Zone) is a territory where two or more players agree not to enter without previous consent of the others.

This agreement is usually made to avoid conflict in critical spots of the game board, specially in the early game where alliances are not yet defined, but also on the late game where keeping a strong long-lasting alliance is critical.

The player who invades a DMZ is said to have 'broken' it and is usually seen as an agressor.

Imagine you want to host your own publicly available web server within your office, where you have a small LAN. You want people to be able to reach your office from the internet, because they need to query your web server and access its pages, but you would not want them to browse your own PC's or file servers. The solution in this case is usually to use a firewall (something like a properly configured linux box with multiple network cards or a hardware solution like a Cisco PIX) that allows for multiple protected zones on each of its nework cards.

In our simple case we would likely have three separate nertwork cards:

• one going to the general internet;
• one going to the office LAN; machines "behind" this port are rendered completely invisible from the internet, likely using NAT and port filtering;
• one going to the DMZ; machines here are partially visible from the internet using appropriate port filtering rules.