网络中的DMZ是什么？
我必须配置一个托管在公司网络中的 Java 应用程序。那么什么是DMZ以及如何打通来暴露服务呢？
I have to configure a Java application which is hosted in side a corporate network. So what is DMZ and how to get through to expose the services?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
DMZ 区域是本地（家庭或公司）网络的一个区域，可从外部（互联网）访问。
通常，在家庭路由器中，有一个配置允许您指定哪台计算机 (IP) 位于 DMZ 中，并且路由器会将来自互联网的请求转发到该计算机。然后，该计算机可以托管可供互联网使用的服务（http、ftp、ssh...）。根据路由器的不同，这或多或少是可配置的。
就你的情况而言，我不认为在java应用程序中需要做任何特殊的事情（除了将服务器套接字绑定到正确的IP上......如果你有多个，但你可能没有）。您必须配置公司路由器（或要求 IT 人员）才能将您的计算机添加到 DMZ。他们可能会给您一个外部 IP（与您的计算机内部 IP 匹配），可用于从互联网访问您的服务。
The DMZ zone is an area of your local (home or corporate) network that is accessible from the outside (internet).
Typically, in home router there is a configuration that allows you to specify which computer (IP) is in the DMZ and the router will forward requests from the internet to that computer. That computer can then host services (http, ftp, ssh, ...) that will be available to the internet. Depending on the router, this will be more or less configurable.
In your case, I dont think that there anything special to do in the java application (other than binding the server socket on the right ip... if you have more than one which you probably don't). You will have to configure the corporate router (or ask IT) to add your computer to the DMZ. They will probably give you an external ip (matched to your computer internal ip) than can be used to access your service from the internet.
您需要 DMZ 的原因及其提供的好处。总体思路是，将面向公众的服务器放在“DMZ 网络”中，以便可以将它们与私有的、受信任的网络分开。用例是，因为您的服务器具有公共面孔，所以可以远程获取 root 权限。如果发生这种情况，并且恶意方获得了对您服务器的访问权限，他应该被隔离在 DMZ 网络中，并且不能直接访问私有主机（或数据库服务器，例如位于私有网络内部而不是在非军事区）。
如何做到这一点：有多种方法，但“书本示例”是利用两个防火墙（当然，您可以使用一个防火墙和智能配置达到相同的结果，尽管硬件隔离更好）。您的主防火墙位于互联网和服务器之间，第二个防火墙位于服务器和专用网络之间。在第二个防火墙上，理想情况下，从服务器到专用网络的所有访问都将被禁止（当然，它将是一个全状态防火墙，因此如果您启动从专用网络到服务器的连接，它将起作用）。
因此，这是 DMZ 的相当高层次的概述。如果您想要更多技术细节，请相应地编辑您的问题。
从堆栈交换网站复制：https://security.stackexchange.com/questions/3667/what-is-the-real-function-and-use-of-a-dmz-on-a-network
Reasons why you want a DMZ and the benefits it offers. The general idea is that you put your public faced servers in the "DMZ network" so that you can separate them from your private, trusted network. The use case is that because your server has a public face, it can be remotely rooted. If that happens, and a malicious party gains access to your server, he should be isolated in the DMZ network and not have direct access to the private hosts (or to a database server for example that would be inside the private network and not on the DMZ).
How to do it: There are several ways, but the 'book example' is by utilizing two firewalls (of course you can achieve the same result with one firewall and smart configuration, although hardware isolation is nicer). Your main firewall is between internet and the server and the second firewall between the server and the private network. On this second firewall, all access from the server to the private network ideally would be forbiden (of course it would be a statefull firewall so if you initiate a connection from the private network to the server it would work).
So, this is a fairly high level overview of DMZ. If you want more technical details please edit your question accordingly.
copied from stack exchange web site : https://security.stackexchange.com/questions/3667/what-is-the-real-function-and-use-of-a-dmz-on-a-network
DMZ（网络）：
DMZ (network):