I have an ISP provided router modem (BT Smart Hub TypeA) that everyone at home connects to (wifi and cabling) and I want to leave this as is, so it remains as the DHCP, using 192.168.0.x/ as the subnet and mask, with NAT. I also have a Netgear DGND3700 connected (it’s WAN Port) to the BT Router (LAN port1) using a static IP ( for the Netgear, set on the BT. I turned on the DMZ setting on the BT router and configured the DMZ to use the static IP ( of the Netgear router. The Netgear LAN settings have a different IP range to the BT router (192.168.1.x/ and have DHCP and NAT enabled.

The plan is to connect ‘smart’ appliances and cheap Chinese internet enabled devices to the Netgear in the DMZ so that they can reach the Internet, not see/access the home network (192.168.0.x) and avoid double NAT.

Everything connects well and can see the internet from both routers, no complaints from the kids on the BT router and the Netgear, and it’s devices, access the internet fine.

My problem is that when I connect to the Netgear, my computer/phone gets a Netgear IP address but can still access devices on the other subnet. The whole purpose was to prevent devices on the Netgear from seeing devices on the BT router.....and I assume not even be able to access the BT router.

What am I doing wrong? Please help....it’s driving me nuts changing settings and getting nowhere!!!



Yeah...you're confusing Router with Firewall here. NAT != Firewall either, though sometimes it can serve as one. The problem is traffic from your Netgear must traverse teh 192.168.0.X network in order to reach to get to be NAT'd to the internet. Everything connected to the Netgear is being double-natted, and i'm not sure what makes you think it isn't. The WAN-side of the router is receiving a private IP address from your main router. DMZ doesn't mean that double-nat isn't happening.

As far as solving this, you have some options; you can try setting firewall rules on the Netgear to block access to everything but; but that's probably more trouble than its worth. You could ask your service provider for a second IP address, and plug your Netgear directly into your ONT (if you have fiber service), or split your modem's port with a switch (Modem<>Switch<>[Router1|Router2]).

The remaining option is to ditch the BT Router and put in something with a proper firewall (i'm fond of Ubiquiti's EdgeRouter devices, but there are many other options) that can implement a proper DMZ with its own broadcast domain and subnet, all in one device, negating the need to have the second router at all (you could of course still use that second router as an access point to provide wireless service for that network, via a dedicated SSID and password arrangement).

FWIW, I do something similar to the latter; I have an <myssid>-iot wireless network that runs on a separate VLAN throughout the house to 3 UniFi access points, which also broadcast <myssid>. My EdgeRouter is the "gateway" for both networks, and I have firewall rules implemented so that I can talk to things in the IOT space (to manage them), but they don't have unfettered access back into the house space. I also do a <myssid>-guest network with the same principle, that has internet access, but is otherwise wholly separated from the other two networks. The big asterisk on this setup is that its not for the faint of heart. I think I have about $600 sunk into it, or thereabouts. YMMV; but at least count I had like 60 devices routinely connected or connecting, so I had outgrown the single-AP consumer-grade stuff a long time ago.

  • Thx @peelman! It’s fair to say “a little knowledge makes me dangerous”! 🤣 so I am not certain on the NAT point, I just know I’ve got the problem and trying to work this out for myself!!!! So an edgerouter er-x 5 (ebay.co.uk/itm/324347768226)looks about right for me, is that the cheap/entry level one you refer too? I’ll just spend days learning and self teaching.... 😉🤬😜. Fri what u said, I can set different subsets per port on the ER? I see no wifi so access points are required..but 8’ve worked that out already. Is that about right for the ER X5? Thx again – Julian Bennett Oct 30 '20 at 22:39
  • ER-X is a good entry level model. I think I have the ER-4; You can have mutliple subnets on the same port, in the same broadcast domain, or you can separate them out by VLAN to segment the traffic completely. In the latter case, you need switches and/or access points that can support VLANs as well. I have a UniFi switch and UniFi Access points; but like I said, my setup is..."special". – peelman Nov 3 '20 at 13:12
  • thx again! I've been researching and bought an ER X5. Started to play with it and worked out how to set a Subnet and a DHCP per Ethernet port. Obviously I have a lot of playing to do before I settle on the full setup but so far so good! I really appreciate the suggested direction, it seems to be exactly what I need on a budget combined with the knowledge limitation that is the Human behind all this! ;-) I expect to learn a lot from here on in. – Julian Bennett Nov 4 '20 at 14:18
  • @JulianBennett hopefully things continue to go well for you. Can you make this as an accepted answer? – peelman Jan 5 at 13:56
  • Thanks for the nudge....done! For everyone else, it took some playing and reading but the edge router is great! Good to learn on and great tools available as well as a VERY helpful community that goes with it. I’ve now got 4 networks with extensive rules between them and gone way beyond what I initially needed. When I had issues with 2 XBOX and port forwarding the community were fantastic! A great place to start learning, I’m happy to help others now too, if you dare to try me!😬😱 – Julian Bennett Jan 6 at 15:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.