How is the DMZ segmented for an n-tier web application, and which firewall rules go with it?
The DMZ is split into zones that follow the tiers: an application zone with the web server and a data zone with the database, optionally with an exposed zone holding a WAF in front. The data tier talks only to the web server it serves, and the data zone can run entirely on private IP addresses.
* Each tier gets its own zone, and each zone boundary only lets through what the next tier needs. *
Sketched rules for the segmented DMZ:
| Boundary | Allow | Everything else |
|---|---|---|
| Internet → application zone | internet -> webserver: allow http(s) |
internet <-> deny all |
| Application zone → data zone | webserver -> db: allow sql |
db <-> deny all |
Adding a WAF puts a third zone on top: the WAF in an exposed zone with the only public IP, the web server in the application zone and the database in the data zone, both private. The gain is that a compromised web server does not hand over the database's whole network neighbourhood, and the database is never reachable from outside at all. In a single flat DMZ, the database would sit right next to the internet-facing servers.
Go deeper:
NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy — firewall placement, DMZ layouts and rule-set policy.- Multitier architecture — Wikipedia — the tiers that the zones mirror.