Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a bunch of machines I want to access from internet (via DDNS), but for security want to separate them from the rest of my machines at home.

Q1) Am I right in saying that I need a firewall with at least 3 network segments - one for internet, one for DMZ, and one for the rest of my stuff?

Q2) Should the setup should be:

             /--> DMZ
Internet -> FW
             \--> Internal  

Q3) Whats would be the minimum set of requirements for hardware FW that would do the job above?

share|improve this question
Q3) is off-topic since we don't do shopping/product recommendations here. – Karan Jul 18 '13 at 4:45
@Karan edited the question – Francis Appa Jul 18 '13 at 4:56

I you only need a few ports open on those machines, you could just use PAT (Port Address Translation), sometimes called NAT in router configuration. That is really enough for home use, I think. You can map your public port to local machines local port and thus public domain will be able to access them.

Yeah, another possibility is to implement the scheme @Q2. This would be a little more secure.

share|improve this answer
I guess the issue is that if I enable remote desktop to those machines, someone could guess my password and then get inside my network. Would be better to have them inside an isolated DMZ I think. – Francis Appa Jul 18 '13 at 5:41
I wouldn't consider opening the management port like RD to the public secure at all either. Try to go with VPN. Does your router support that? There are a lot of cheaper ones even that support at least pass-through VPNs – Ashtray Jul 18 '13 at 5:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.