Bob, a system administrator at TPNQM SA, concluded one day that a DMZ is not needed if he properly configures the firewall to allow access just to servers/ports, which can have direct internet…

DMZ provides value with stateless firewalls because network segmentation itself limits lateral movement, regardless of the firewall's ability to track connection state.

Firewall rules based on destination IPs do not provide the same isolation as a physical or logical DMZ segment, since a compromised DMZ server can still attempt to pivot to internal hosts on the same flat network.

A DMZ separates publicly accessible servers from internal hosts at the network topology level, which is a defense-in-depth principle independent of whether the firewall is stateful or stateless. Even a stateless firewall enforcing DMZ segmentation is more secure than a flat network, because an attacker who compromises a DMZ server still cannot directly reach internal workstations without crossing an additional network boundary.

A stateless firewall can still enforce DMZ boundaries using ACLs on routed segments; the DMZ concept is not contingent on stateful inspection capability.