1

Router: Asus RT AC-66U

Setup:

Router, IP 10.0.0.1
Apache2 server, IP 10.0.0.2
Clients etc., IP 10.0.0.X

Virtual servers:
All traffic on port 80 forwarded to 10.0.0.2, port 80.

Pretty simple setup.

However - the router also has a virtual DMZ function. What little I know about DMZ is that it's for web servers and others that are accessible from the internet, who in the DMZ are isolated from the LAN, so that breaking into them makes it harder to get access to the LAN than if they were not in a DMZ. Is this fairly correct?

What I'm wondering is: Is the isolation between external connections to the DMZ server and the LAN the "only" difference from just forwarding/virtual servers, as I'm doing now? And: Won't I still have to forward/virtual server the port 80 traffic to the apache2 server even if it's in the DMZ?

3

If you place a server into the DMZ, basically it's the same as enabling port forwarding, but for all ports at your router. It's a rather easy 'fix' to the issue of not knowing which ports you need to forward, or useful when you know you're going to manage the firewall of this device independently.

It's sometimes part of the lan (generally not but see notes below), and accessible as such however you'd want to setup a independent firewall on this device, as now every port is accessible.

Some routing devices may set it so that the device isn't accessible from the lan and some may allow assigning a separate public IP which would have all the traffic pointed to (instead of the IP of the router itself)., however this is device specific.

On a device which only handles one IP, setting up a DMZ will sometimes mean that you can only have 'one' server on the lan side, as while port forwarding allows you to forward ports to different servers, for obvious reasons you can only have the public IP pointing towards one internal device.

  • +1 to "this is device specific". I set up a DMZ with my home TP-Link router hoping it would be completely isolated from the rest of my LAN. Not so. tp-link.com/us/FAQ-28.html According to TP-Link, their DMZ "is not a true DMZ" – Will Haley Apr 4 '18 at 22:06
1

Your understanding of the point of a DMZ is correct. Generally, no traffic is allowed to originate from the DMZ back to the LAN (unless there's a requirement to open specific ports, but care should be taken) in case one of the DMZ servers is hijacked.

Is the isolation between external connections to the DMZ server and the LAN the "only" difference from just forwarding/virtual servers, as I'm doing now?

If I understand correctly; yeah, pretty much.

Won't I still have to forward/virtual server the port 80 traffic to the apache2 server even if it's in the DMZ?

It depends. Normally on domestic grade routers you assign the IP address of a machine to be in the DMZ and then all incoming ports are routed to that box. You might have the option to only enable specific ports but it depends on the make/model of your router.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.