What happens if an attacker has found a technique for sending packets through the firewall to the DMZ without the packets being checked?
Suppose the attacker doesn't know the internal addresses of hosts in the DMZ. Can the attacker arrange for a packet to be sent to the www server in the DMZ without the firewall checking the packet? (I'm thinking about email spoofing and email forgery).
If we assume the firewall itself hasn't been compromized to the point were the attacker can reconfigure it or make any modifications then it is pretty unlikely that the attacker would be able to drastically redirect traffic to different internal destinations unless.
If they have gotten complete control over the firewall, then they would be able to do pretty much anything you could do with it as an admin.
