View source for PCI-1.3:

Examine firewall and router configurations, as detailed in PCI-1.3.1, PCI-1.3.2, PCI-1.3.3, PCI-1.3.4, PCI-1.3.5, PCI-1.3.6, PCI-1.3.7, and PCI-1.3.8, to determine that there is no direct access between the Internet and system components, including the choke router at the Internet, the DMZ router and firewall, the DMZ cardholder segment, the perimeter router, and the internal cardholder network segment.