Why a DMZ? Network segmentation with OPNsense

9 November 2026 · OPNsense · Network · Firewall

Keeping exposed servers apart from the internal network, and proving it works.

A web or mail server is reachable from the Internet: it is the most exposed machine. Putting it on the same network as the workstations and the directory gives an attacker a springboard.

The idea

• WAN: the Internet
• DMZ: the exposed servers
• LAN: workstations, directory, data

The firewall sits in the middle and decides on every flow.

Basic rules

• Everything is denied by default
• WAN to DMZ: only the published ports (443 for example)
• LAN to DMZ: administration from specific hosts only
• DMZ to LAN: denied. This is the rule that matters

Proving the block

A rule you have not tested is an assumption. From a DMZ server, try to reach a LAN machine, then check the denial in the firewall logs.

# from the DMZ
ping -c 3 192.168.10.10      # must fail
nc -zv 192.168.10.10 445     # must fail

In OPNsense, Firewall > Log Files > Live View then shows the blocked packets. That proof is what goes into an audit file.