you want to prevent attackers from running any sort of traceroute into your dmz and discovering the internal structure