Eliminate the DMZ Security Dilemma: A Modern Secure Proxy Architecture for MFT
Learn how to eliminate DMZ security risks in managed file transfer with a secure proxy architecture. Explore session break vs. passthrough models, reduce attack surface, and modernize MFT security without exposing internal systems.
Organizations today exchange massive volumes of data with partners, customers, and internal systems. From financial transactions to healthcare records to operational data pipelines, these file transfers often contain sensitive information that must be protected at every stage of the managed file transfer (MFT) journey.
Modern file transfer protocols such as SFTP, FTPS, HTTPS, and AS2 are designed for secure, reliable data exchange. However, they require external partners to initiate inbound connections to systems at the edge of an organization’s network. This creates a challenge for security teams: enabling externally reachable endpoints in the demilitarized zone (DMZ) while preventing sensitive data exposure and maintaining strict separation between public-facing infrastructure and internal systems.
This article examines the limitations of traditional DMZ architectures, outlines how secure reverse proxy architecture addresses these challenges, and details how Stonebranch implements and enhances this model across diverse use cases.
Key Takeaways
- Traditional DMZ models (store-and-forward and drop zones) introduce security and operational risks.
- The secure reverse proxy architecture is a modern alternative that eliminates inbound firewall exposure and removes data from the DMZ.
- Two secure reverse proxy models (direct passthrough and session break) provide distinct security, performance, and inspection tradeoffs.
- Modern MFT security requires per-use-case architectural flexibility, not a one-size-fits-all approach.
- Stonebranch enables two distinct reverse proxy models in a single deployment, allowing organizations to align security controls with real-world requirements.
- By combining reverse proxy architecture with orchestration, Stonebranch delivers secure, automated, and end-to-end MFT across hybrid IT environments.
What is the DMZ Security Dilemma?
In the world of MFT, the DMZ security dilemma is the friction between two essential but opposing requirements:
- The Business Need: To trade data with the outside world, your systems must be reachable. Partners and customers need a "front door" to drop off or pick up files.
- The Security Mandate: To protect sensitive assets, your systems must be isolated. Regulations and internal policies dictate that your most valuable data should never be exposed to the public internet.
To reconcile these competing demands, organizations have historically adopted one of two architectural approaches at the network edge. While each attempts to balance accessibility and security, both introduce tradeoffs that can undermine one side of the equation.
1. Store-and-Forward
In this model, an MFT server is placed directly in the DMZ. When a file is received from an external partner, the server immediately forwards it to the internal network.
At first glance, this seems efficient. But it comes with a critical flaw: to forward files internally, the DMZ system requires inbound access through the firewall into the trusted network.
This effectively weakens, or even bypasses, the protective boundary that the DMZ was meant to enforce. If the DMZ server is compromised, attackers can potentially gain an immediate foothold in internal systems.
2. DMZ Drop Zone
The alternative approach avoids direct forwarding by turning the DMZ into a temporary storage area. Files are written to an MFT server in the DMZ, and internal systems periodically poll and retrieve them.
While this preserves firewall boundaries, it introduces a different set of problems:
- Sensitive data is stored in the most exposed part of the network.
- Files remain accessible during polling intervals, increasing risk.
- Delays in retrieval can impact downstream processing and SLAs
In effect, the DMZ becomes a high-value target, holding exactly the data organizations are trying to protect.
The Modern Alternative: Secure Reverse Proxy Architecture
To eliminate these risks, industry leaders are shifting toward a secure reverse proxy architecture. Instead of placing an MFT server in the DMZ, a lightweight companion proxy acts as a neutral intermediary. It does not need to store data locally, or punch holes into the secure network firewall.
How it works:
- A persistent secure tunnel is established to the proxy server from within the secure zone
- External connections are then received by the proxy on dedicated listener ports
- Depending on the mode, the proxy will either:
- Interrupt the session, then replay it over the secure tunnel to the backend MFT.
- Accept the connection, then relay the connection over the secure tunnel to the backend MFT.
The result:
- No data stored is ever stored in the DMZ.
- No inbound firewall holes from the internet to the internal network.
- Authentication and authorization remain in the trusted zone (except when deployed in a session break pattern).
- Protocol agnostic and transparent to partners.
- Minimal DMZ footprint compared to traditional DMZ approaches.
Choosing Your Secure Proxy Mode: Passthrough vs Session Break
The decision between session break and direct passthrough is not binary across an entire deployment, and a modern MFT solution shouldn't force you into a single security posture.
A well-designed secure proxy enables per-listener or per-route selection, allowing organizations to apply the right model to each specific use case rather than accepting a single architecture-wide tradeoff.
1. Direct TCP Passthrough (Transparent Tunnel)
In direct passthrough mode, the proxy accepts the inbound TCP connection and bridges it to the internal server without terminating the session. The TLS or SSH handshake completes end-to-end between the two endpoints; the secure proxy relays bytes bidirectionally without parsing or interpreting protocol framing. It never sees decrypted content, making it effectively a TCP passthrough; it is, in effect, a secure TCP pipe.
Passthrough benefits:
- End-to-end cryptographic integrity: The internal server retains full control of session keys and certificates. A compromised proxy cannot decrypt traffic in flight as the cryptographic chain between client and server is unbroken.
- Full authentication fidelity: The backend sees the original handshake and can validate any authentication method it supports: SFTP public key, password+key MFA, client certificates, or future mechanisms, all with no proxy-side changes required.
- Reduced DMZ attack surface: A protocol-agnostic byte relay has fewer code paths, fewer parsers, and fewer potential misconfigurations than a full session-break proxy.
- Simpler failure modes: Failures reduce to connection refused or timeouts. No auth mismatches, no dual-layer certificate negotiation, no protocol translation errors.
Passthrough tradeoffs:
- No DMZ-boundary content inspection: All antivirus scanning, DLP checks, and payload inspection must occur on the internal MFT server. Files enter the trusted network before being scanned.
- No edge authentication: Unauthenticated TCP connections are routed to the internal server. The internal server must withstand all authentication attempts, including brute-force and credential-stuffing attacks. Rate limiting and lockout policies at the internal server are therefore essential.
- Reduced proxy-layer visibility: Proxy-side audit logs are limited to connection metadata: source IP, destination, and timestamps. Per-command and per-user logging depends entirely on the internal server.
Passthrough is best for:
- SFTP workloads where end-to-end SSH integrity and public key authentication are required or preferred.
- High-performance bulk file transfer between known, trusted trading partners where content inspection adds no practical value.
- Deployments where the internal MFT server already implements robust content scanning, authentication controls, and rate limiting.
- Environments prioritizing operational simplicity and a minimal DMZ footprint.
- Migration scenarios from an existing DMZ drop zone where the internal server already enforces all necessary security controls.
- Existing customers migrating from a legacy direct-passthrough proxy who expect continuity of behavior and authentication capabilities.
2. Session Break (Application-Layer Termination)
In session break mode, the proxy terminates the inbound TLS or SSH session directly, presents its own certificate to the connecting client, and completes the handshake itself. Unlike transparent passthrough, where the proxy acts as a byte-level TCP bridge and never sees decrypted content, session break gives the proxy full visibility into the decrypted stream: protocol commands, file metadata, headers, and payload bytes. It then initiates a separate, independent session to the internal MFT server using its own or a configured backend certificate. Two session keys exist simultaneously; the proxy holds both.
Session break benefits:
- Edge authentication: Enforce MFA, mutual TLS, or challenge-response at the DMZ boundary, preventing unauthorized clients from reaching internal servers.
- Inline content inspection: ICAP/ICAPS integration enables antivirus, DLP, and malware scanning at the perimeter, before files enter the trusted network.
- Protocol-aware threat filtering: Full protocol visibility allows the proxy to detect and block malformed or anomalous commands before they reach internal systems.
- Edge logging: Per-command, per-user audit logging at the DMZ boundary, independent of internal server logs.
- Rate limiting and DoS mitigation: Connection throttling, rate limiting, and IP-based blocking are applied at the proxy before backend resources are touched.
Session break tradeoffs:
- Certificate/key management: Valid TLS certificates and keys are required for every hosted domain or listener, adding complexity and lifecycle overhead.
- Authentication constraints: Password credentials can be relayed; public keys cannot. The proxy never holds the client's private key, making SFTP public key auth and password+key auth architecturally unsupported.
- Double authentication: Authentication must occur at both the proxy and the backend, adding significant complexity to identity and access management (IAM).
Session break is best for:
- Regulated environments that require demonstrable content inspection before data enters the trusted zone.
- Deployments integrating ICAP/ICAPS for inline antivirus or DLP scanning.
- Scenarios where edge authentication and multi-factor enforcement reduce backend load and risk.
- FTPS and HTTPS workloads where edge TLS termination and session state management are acceptable tradeoffs.
- Compliance mandates that require explicit evidence of perimeter inspection in audit documentation.
The Stonebranch Advantage: Flexible, Orchestrated MFT by Design
Many organizations work with a mix of partners, protocols, and compliance needs, which can make a single proxy approach difficult to apply consistently.
Stonebranch addresses this challenge through a unified approach to orchestrated MFT, combining Universal Data Mover Gateway (UDMG) with Universal Secure Proxy (USP) as part of the broader Universal Automation Center (UAC) platform.
Within this architecture, USP serves as the secure edge component for UDMG, enabling safe, controlled external connectivity without compromising the internal environment.
Together, UDMG and USP allow organizations to:
- Apply the Right Model per Use Case: Support both passthrough and session break modes, aligned with specific partner, protocol, or compliance requirements.
- Orchestrate Beyond Transfer: Integrate secure file movement into end-to-end workflows, ensuring that transfers trigger downstream processing, validation, and business logic across hybrid IT environments.
- Maintain Centralized Control: Manage proxy behavior, transfer logic, and orchestration policies entirely from within the trusted network to keep credentials, authentication, and control planes securely internal.
- Eliminate DMZ Risk Without Sacrificing Flexibility: Remove data from the DMZ while still enabling external accessibility, aligning security architecture with real-world operational needs.
By embedding secure proxy capabilities within its comprehensive orchestration and MFT solution, Stonebranch enables organizations to replace point solutions with secure, scalable, and fully orchestrated data movement across hybrid IT.
Final Thoughts
Stronger firewalls only go so far. What really makes the difference is how the system is designed. By removing data from the DMZ and utilizing outbound-only communication, you can bridge the gap between business accessibility and absolute security.
Whether your priority is high-performance SFTP transfers via passthrough or rigorous HTTPS inspection via session break, the goal remains the same: secure, automated, and compliant data movement.
By supporting both connection models within a single deployment, Stonebranch gives organizations the flexibility to match their proxy architecture to their actual security posture, compliance requirements, and operational capabilities
Explore Secure MFT with Stonebranch
Learn how the Stonebranch managed file transfer solution secures and orchestrates data movement across hybrid IT environments, and see what’s new in the latest UDMG and USP releases.
Author
Robert Oslin
Principal Product Manager
Robert Oslin is responsible for the product lifecycle of Stonebranch’s Managed File Transfer solution, UDMG. With over 25 years of experience in the MFT space, he previously served at GlobalSCAPE, where he helped grow a successful FTP client brand into a Gartner Magic Quadrant™ enterprise solution—culminating in a successful IPO. Robert holds a Bachelor of Business Management from WGU University Texas and brings a deep understanding of enterprise-grade file transfer and product strategy.
