DMZ and 2nd router

Question

I have an ISP provided router modem (BT Smart Hub TypeA) that everyone at home connects to (wifi and cabling) and I want to leave this as is, so it remains as the DHCP, using 192.168.0.x/255.255.255.0 as the subnet and mask, with NAT. I also have a Netgear DGND3700 connected (it’s WAN Port) to the BT Router (LAN port1) using a static IP (192.168.0.253) for the Netgear, set on the BT. I turned on the DMZ setting on the BT router and configured the DMZ to use the static IP (192.168.0.253) of the Netgear router. The Netgear LAN settings have a different IP range to the BT router (192.168.1.x/255.255.255.0) and have DHCP and NAT enabled.

The plan is to connect ‘smart’ appliances and cheap Chinese internet enabled devices to the Netgear in the DMZ so that they can reach the Internet, not see/access the home network (192.168.0.x) and avoid double NAT.

Everything connects well and can see the internet from both routers, no complaints from the kids on the BT router and the Netgear, and it’s devices, access the internet fine.

My problem is that when I connect to the Netgear, my computer/phone gets a Netgear IP address but can still access devices on the other subnet. The whole purpose was to prevent devices on the Netgear from seeing devices on the BT router.....and I assume not even be able to access the BT router.

What am I doing wrong? Please help....it’s driving me nuts changing settings and getting nowhere!!!

Thx

Answer 1

Yeah...you're confusing Router with Firewall here. NAT != Firewall either, though sometimes it can serve as one. The problem is traffic from your Netgear must traverse teh 192.168.0.X network in order to reach 192.168.0.1 to get to be NAT'd to the internet. Everything connected to the Netgear is being double-natted, and i'm not sure what makes you think it isn't. The WAN-side of the router is receiving a private IP address from your main router. DMZ doesn't mean that double-nat isn't happening.

As far as solving this, you have some options; you can try setting firewall rules on the Netgear to block access to everything but 192.168.0.1; but that's probably more trouble than its worth. You could ask your service provider for a second IP address, and plug your Netgear directly into your ONT (if you have fiber service), or split your modem's port with a switch (Modem<>Switch<>[Router1|Router2]).

The remaining option is to ditch the BT Router and put in something with a proper firewall (i'm fond of Ubiquiti's EdgeRouter devices, but there are many other options) that can implement a proper DMZ with its own broadcast domain and subnet, all in one device, negating the need to have the second router at all (you could of course still use that second router as an access point to provide wireless service for that network, via a dedicated SSID and password arrangement).

FWIW, I do something similar to the latter; I have an <myssid>-iot wireless network that runs on a separate VLAN throughout the house to 3 UniFi access points, which also broadcast <myssid>. My EdgeRouter is the "gateway" for both networks, and I have firewall rules implemented so that I can talk to things in the IOT space (to manage them), but they don't have unfettered access back into the house space. I also do a <myssid>-guest network with the same principle, that has internet access, but is otherwise wholly separated from the other two networks. The big asterisk on this setup is that its not for the faint of heart. I think I have about $600 sunk into it, or thereabouts. YMMV; but at least count I had like 60 devices routinely connected or connecting, so I had outgrown the single-AP consumer-grade stuff a long time ago.