graysonf
Premium,MVM
join:1999-07-16
Fort Lauderdale, FL
| reply to wayjac
Re: IP Passthrough and DMZ
When normally configured, your router provides Network Address Translation and Port Address Translation (NAT & PAT). I'm not going to call this a 'firewall' but it does provide machines connected behind it some level of protection in that the machine is not entirely and directly exposed to the internet.
When you use the so called 'DMZ' or 'IP Passthrough' features, the target machine loses all benefits of NAT & PAT. This approach does simplify things in that port forwarding is no longer required - everything just works. But the downside is huge.
Also, the concept of DMZ here is completely bogus in that your entire network is at risk if the DMZ'd machine becomes compromised.
A real DMZ is a separate network with the firewall in between the DMZ network of machines, and the LAN. Real DMZ capability is available on real routing code types of firewalls, but not these cheap home routers. If you want this or need it, it's easy enough to get. |
|
wayjac
Premium
join:2001-12-22
Indy | So IP Passthrough and DMZ are ok when implemented on a router/modem connected to a router? |
|
graysonf
Premium,MVM
join:1999-07-16
Fort Lauderdale, FL
| You're missing the point. Nothing is accomplished by putting a machine in DMZ or Passthrough if that machine is behind more than one router.
Do yourself a favor and don't use these features until you understand the problems they also introduce. |
|
