What is a DMZ in network security?

A special network segment for servers reachable by outside users, isolated from the internal network so external access can be tightly controlled.

A DMZ (Demilitarized Zone) is a special network segment where servers accessible to outside users are located.

* Public-facing servers live in the DMZ; the firewall gives the internet controlled access to them while strictly guarding the internal LAN. *

Key characteristics:

• Located between the internal network and the internet
• Protected by the firewall
• Allows controlled external access to specific services (web servers, email servers)
• Enables network administrators to apply specific security policies to public-facing hosts
• Isolates public services from the internal network

Go deeper:

• DMZ (computing) — Wikipedia — single- vs dual-firewall DMZ designs and which services belong there.