What is a screened subnet?
A screened subnet is a separate network segment that sits between the internet and an organization's internal network. It holds the systems that outsiders must reach: public web servers, reverse proxies and load balancers, mail relays, public DNS servers and file transfer servers for partners. Firewalls screen the traffic on both sides of it, so the internet can reach only the services published there, and those servers can reach only a few named destinations inside.
The older name is DMZ, short for demilitarized zone, and both names still appear in documentation, firewall menus and exam questions. The design starts from one assumption: anything the internet can reach will be attacked, and one of those servers may eventually be compromised. The screened subnet exists so that a compromise there does not hand the attacker the internal network.
How a screened subnet is built
Two designs are common:
- Three-legged firewall: one firewall with three interfaces, one each for the internet, the screened subnet and the internal network. It is cheaper and simpler to run, but a single device enforces every boundary.
- Dual firewall: an external firewall between the internet and the screened subnet, and an internal firewall between the screened subnet and the LAN. An attacker has to get through two devices to reach internal systems. Buying the two firewalls from different vendors means one product flaw does not open both.
In the cloud, the same idea is a public subnet whose security groups and network ACLs allow only the published ports, with the application and database tiers in private subnets behind it.
Example rule set
Every boundary starts from default deny, and each allowed flow names a source, destination, protocol and port. A company that runs a public website might use a policy like this:
| From | To | Allowed |
|---|---|---|
| Internet | Screened subnet | TCP 443 to the web servers' public address (80 only to redirect to HTTPS) |
| Internet | Internal network | Nothing |
| Screened subnet | Internal application tier | Web servers to one application server on one port |
| Screened subnet | Internet | Approved update sources only; no general browsing |
| Management zone | Screened subnet | SSH or RDP from the jump server only |
The database stays out of the screened subnet. The web server reaches data through an application tier behind the internal firewall, so the data sits at least two boundaries from the internet. Blocking general outbound traffic from the screened subnet also stops a common attacker move, a reverse shell that calls back from a compromised server. Denied log entries showing a web server trying to reach a domain controller on TCP 445 or 389 are a strong sign that the server has been compromised and someone is probing inward.
Screened subnet vs. internal network, guest network and a router's DMZ host
- Internal network: holds workstations and internal servers that the internet should never reach directly. Forwarding a port from the internet to an internal server makes that server internet-facing without the isolation a screened subnet provides.
- Guest network: gives visitors internet access and no route to internal zones. It isolates untrusted clients, while a screened subnet isolates servers that untrusted clients connect to.
- SOHO router DMZ host: many home and small office routers have a setting labeled DMZ that forwards all unsolicited inbound traffic to one internal device. That device still sits on the same LAN as everything else, so it is not a true screened subnet; it is a port forward for every port. Forwarding only the specific ports a service needs is safer.
Screened subnet on the CompTIA Security+ exam
Screened subnets fall under SY0-801 objective 3.2, which covers making architecture decisions that protect the infrastructure, including security zones and where devices are placed. Scenario wording such as "customers must reach the server from the internet" or "publicly accessible web server" points to the screened subnet. The tempting wrong answers break the zone model: putting the database in the screened subnet so the web server can reach it easily, leaving the public server on the internal network behind a port forward, or placing the jump server in the screened subnet. Keep one rule in mind: sensitive data belongs at least one boundary deeper than anything the internet can reach. Expect DMZ and screened subnet to be used interchangeably. The term also appears in A+ Core 2 (220-1202) objective 2.10, in the context of securing SOHO networks.