Any server or device within the DMZ is provided limited access to the LAN, acting as a firewall to keep unwanted traffic from accessing the internal network without hampering access to the service.