[SOLVED] DMZ Host.

[onemoretimex]

Hey guys just wanted to run something by with you all.


I currently have a modem/router supplied by my ISP that is used for everything in my house be it wired or wifi.

However I've recently bought a few IOT Devices and just to be on the safe side wish to keep them separate from all my other home devices.

Among the devices is another router, So i was thinking of putting the second router on DMZ host then connecting any other devices I wished to function away from my home network to the router.

I know putting the router into dmz host would be putting it outside of my isp modem/routers firewall but as it comes with its own firewall it would then be protected and anything else that I connect up to it also is this a good way to do it ?

Would this in a way create two networks that cant interact or contact each other because of the firewall on my isp modem/router ?

 

[bill001g]

DMZ does not work the way you think it does on a consumer router. I am not sure why they call this DMZ it functions nothing like what the concept of a DMZ is.

All it does it put a port forwarding rule in that says all unknown incoming session should go to that IP.

This design does not protect your main network from these devices. Anything on the WAN side of the IOT router is considered internet and since you main network is plugged on the wan side the IOT device can have access
What doesn't work is the reverse. You main lan can not open initial sessions to IOT device they can only respond to session the IOT devices open.

So to some extent you would get more security if you reverse this and put all your main devices behind a second router. The IOT device could then not get to your lan but your lan could get to the IOT.

To really isolate this you could also put a third router in between the main network and the ISP router. You would then have more of a actual DMZ between your 2 networks...ie the little network between the 3 routers.

What might also work depending on the router you are using for the IOT router. It depends on if it has actual firewall or packet filter functions. Say your main network is 192.168.1.x and your second network is 192.168.2.x. You might be able to put in a firewall rule that say no traffic can go between 192.168.2.x and 192.168.1.x.
This must be done on the IOT router. The ISP router like most other consumer router has no ability to filter traffic going lan/lan. Consumer routers can only filter traffic going wan/lan.