Lets say I have three networks in my topology : Internal network, DMZ, Internet. And my DMZ Area contains a lot of servers, but lets say in this example that it contains only a DNS Server and a Web Server. enter image description here

So, should I use public IP addresses or private addresses for the servers that are on the DMZ network ?

If the answer is Public IP Addresses : Isn't it a little bit unpractical ? (because I guess that this way, each server on the DMZ should have a public IP)

If the answer is Private IP Addresses : how could it work knowing that the DNS Server will answer with private addresses for the persons that request the IP of the Web server.

I don't know if my question is clear, if it isn't, tell me in the comments and I will try to make it better.

Edit : Forgive if I am saying some non sense, it is the first time that I configure a DMZ, and I'm confused.


There's more than one way to go:

Using public ip adresses

Everything in your DMZ has a public address. Everything that you don't want to be accessible from the internet does not belong into your DMZ and will then get a private address.

Using private ip adresses

Everything in your DMZ has a private address. For every system that needs to be accessible from the internet you have a public ip with a corresponding NAT rule on your firewall.

Using this variant you'll have a hard time to make sure your internal systems get the same connectivity to your DMZ as external systems. You'll either need to make you internal systems talk to the public adresses (and NAT these requests, too) or you'll need a so-called split-DNS setup where your DNS-Zone looks differently depending on who is asking (i.e. public ip returned for external queries, private ip returned for internal queries).

I personally prefer the first method and just go with public addresses as it makes management much less complex.


You don't want internal systems connecting to the DMZ. That's the purpose of the DMZ, to host something on the internet but keep it separate from the rest of your network in case something gets compromised. So using private IP addresses is fine. In mostly all cases, better, because then you don't have to bridge interfaces on your firewall.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.