I'm on the road a lot for work so and I was thinking I might take an old laptop and set up some VM labs to play around with on it that I can access when I'm away from home.

It would just be a dedicated server running a couple VMs, nothing important would be on it and the only thing that would happen if it got hacked and messed up would be that I'd be a little annoyed that I had to reset it when I got home.

So, rather than spending a bunch of time configuring my router and firewall and such to make it accessible but secure, I thought I might just drop it in the DMZ and be done with it.

Now, I'm not very familiar with DMZs or their operation. I can set an IP to be in the DMZ, but that's about the extent of it.

If I were to do this, no matter how vulnerable or poorly configured my little VM server is, will it pose any risk to the internal network? Or is my network exactly as secure regardless of whether or not I have machines in the DMZ?

  • This is preciselywhat a VPN is used for. You expose a single service/server with DMZ, allow for external connections, but only while connected to the VPN. This allows you to connect to the VMs or any device on the network, but only while connected, to the VPN. – Ramhound Apr 28 '16 at 19:06

DMZ is a misnomer in most (if not all) consumer routers. There is no “zone”, after all. The correct term is “Exposed Host”. This clarifies things a little.

The Exposed Host is not separated from the rest of the network. It still resides on the same broadcast domain. If it were to be compromised, the attacker would have unfettered access to the local network. (Unless it is otherwise separated.)

Also, if any “internal” services are running on your Exposed Host, they would suddenly be Internet-accessible.

A better way would be to set up a VPN service (like OpenVPN, requires only a single TCP or UDP port) and forward ports for this service only.


Short answer:yes

if only opening and forwarding certain ports to a specific machine, you only need to worry about security on those ports.

DMZ opens all ports and routes them to one machine. If an attacker gets control of the DMZ box using an exploit, yes they are now inside your network.

My understanding is DMZ should only be used for very temporary needs.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.