@
msg7086 DMZ 是安全措施，NAT 是为了能够被公共访问到，两者经常一起使用，但并不能说 DMZ 是用 1:1 NAT 实现的。某论坛上看到的这段话解释得很清楚：
The idea of a DMZ is that you have servers that need to be accessed from the internet, as we all know. The DMZ is a separate subnet that's logically outside of your inside LAN by applying security policies to what traffic can reach it. The bigger issue is servers get hacked. Now, if that server is in a DMZ, logic would indicate that you've also created rules in your firewall (which has DMZ and inside facing interfaces) NOT to allow any traffic to originate from that DMZ server and make connections to your inside LAN, protecting your inside LAN if that DMZ server gets compromised. If you put that server on your internal LAN and then NAT a public internet IP to it, people are connecting from the internet to that server in your LAN, and if they crack it they will have access to everything else on your inside LAN from that box. If it were in a DMZ and gets hacked, the firewall will block the hacker from making connections to the inside LAN from it.
What Sosipater is saying about how you'll probably use NAT in your DMZ anyway because many people create a separate DMZ subnet and assign private, non-internet-routable IPs like 192.168.x.x to the servers in the DMZ. You then have to "NAT" whatever public internet IP, from your ISP, to that private IP assigned to the server. In this case, you're using BOTH a DMZ and NAT.
Either way, if the server is going to be accessed from the Web, use a DMZ! Its a best practice and just the smart way to go. You already have a firewall. The only cost associated should be if you get payed OT or not... ;-)