D-Link DFL-1600 User Manual page 35

3.2. What does a Firewall NOT protect against? 15
result.
It is now common practice to locate web servers in demilitarized zones,
where they communicate with data sources on protected networks. In such
cases, data-driven attacks pose a huge threat.
The problem with holes between DMZs and internal networks is not really
a problem in itself. Rather, it is a consequence of the problems discussed
above. Many people open up these holes without being aware of the
problems they may cause, which is why we have chosen to highlight this
problem in a separate section.
The reason for locating a web server in a DMZ is simple - the server cannot
be relied upon to be completely secure. What happens if someone gains
control over the server and there is an open hole through which access can
be gained to data sources on the internal network? The result is that the
"protected" network is open to attack from the Internet, using the web
server as an intermediate.
Do not underestimate the effects of this vulnerability! In our experience,
even the most inexperienced of attackers need only a few minutes to gain
access to protected networks using standardized and well-known techniques,
specifically developed to exploit this type of hole.
The simplest defense against this is increased segmentation of the network.
By locating the data source, e.g. an SQL server, in a separate network
segment and preventing it from communicating directly with the rest of the
network, you can limit the damage caused by such an attack.
Note
The problem here is not IP packets being routed via the servers in the
DMZ, so therefore disabling "IP forwarding" would not provide any
protection. The problem is that intruders can execute commands on these
servers the same way that anyone at the keyboard could.
It should also be noted that your internal network would still be vulnerable
to attack even if the channel between the DMZ and the internal network is
made up of a non-routable protocol such as NetBEUI. Again, the problem
is not IP packets traversing from insecure networks to the internal network.
D-Link Firewalls User's Guide