- Here's a Tech Tip about a DMZ or demilitarized zone.
Sometimes you have a system
that you want to be accessible from the internet.
But you don't want people on the internet to access the rest
of your computers on your Local Area Network.
That's when it's good to use a DMZ.
This allows that system to be somewhat protected,
but people that access that system won't be able
to access the rest of the computers on the LAN.
Which are fully protected.
It requires a special firewall configuration.
But it can be a great solution
if you have a server that you want to put
on the internet and allow people access.
So let's show an example of that now.
That demilitarized zone or DMZ is an area
that is part of your overall network.
But separated from the LAN.
Here's our LAN computers.
Here's the DMZ section.
And it usually provides server access
to users on the internet as I mentioned.
So users out on the internet here might want to connect
to your web server or to your FTP server.
Keep these servers on the DMZ
and separate from the Local Area Network.
It's often set up as a third-leg off the firewall.
Could be set up in a back to back configuration,
but this is pretty common as well.
Your firewall might have three connections.
One goes to the LAN and that's gonna use a LAN address,
a private address on the LAN network.
So our LAN is 172.29.0.0, in this example.
That's a class B private.
The address the firewall might use to connect
to that is 172.29.250.200, just for example.
So we have our switch here.
Our computers connected to the LAN
so that switch and then the firewall makes a connection
to that switch as well.
They're all on that 172.29 network.
The second connection is out to the internet.
And the firewall or the router
with built-in firewall gets that public address
from the ISP, or you set it statically.
And that's also often known as a serial address,
65.43.18.1 that's the public address in this example.
That's a class A public.
That allows your regular connectivity
to the internet and all connections from the LAN.
Clients are protected by the firewall.
Now we mentioned previously, you could do port forwarding
through the firewall to a computer to act as a server.
But the more secure way to do it is through the DMZ.
And so here's the third-leg from the firewall
and we're keeping these physical connections separate.
We have the LAN and the DMZ.
And so the third connection goes
to another switch on the DMZ section.
This is separate from the LAN.
It's kind of a halfway point
between the internet and the LAN, really.
And you have this using the class C network
192.168.100.0, that's just an example.
That's just the IP we decided to use here.
And the switch gets an IP address on that network,
and so do the servers, and so does the firewall connection.
And in this case, 192.168.100.200.
So we have that whole class C private IP network
that now users on the internet can connect
to through the firewall and into the DMZ,
get to your web server, your FTP server.
And all you have to have open here
is port 80 for the web server,
and port 21 for the FTP server.
And then this connection can be completely
firewalled to the LAN.
Let's show an example on our router here.
We have the DMZ section up here.
We have the DMZ configuration.
And right now it's not enabled.
We could enable it and then select
what the DMZ host IP address would be.
Now it could just be one computer connected
to this device and that could be anything.
It could be 192.168.0.110 because actually the network
that this device is on is 192.168.0,
but you could use other IP addresses.
You could use a different IP network.
You could use an actual switch, if you wanted to.
And so let's say you did a switch as 201.
And then you could have servers connected to that.
On say, 202, 203, 204 and so on.
So you can set up a DMZ,
a very basic one on devices like this.
But you can go much more into depth
with more powerful firewalls by Cisco and Juniper
and CheckPoint.
And you can set up particular servers and ports.
We mentioned previously port forwarding,
previously in the lesson.
And you could do that on this particular device
with the Virtual Server option.
And you see that here, I have a virtual server
on 192.168.0.105 and that's using port 21.
So that individual port will be open on that one computer.
And this device will let traffic go through FTP.
But again, the DMZ's a great way to do it
because then you could do an entire group
of computers connected to one switch
and have that act as a separate
type of thing on your network.
Even if you have one of these basic four port SOHO routers,
one port could go out to that switch
and then you apply that switch's IP address here.
As long as it's a layer three switch.
Otherwise it could just be one computer
that's doing all your server activity.
I don't know if you're running FTP, or web,
or email, or games, or downloads, or who knows what.
But that IP address would be applied here.
And so the SOHO router would allow people through
to that computer.
But it won't allow people
through to the rest of the network,
the rest of the typical LAN on 192.168.0.
So the DMZ is a nice option for that.
You're keeping everything physically separate
on a third-leg, so to speak.
So there's a little bit about the DMZ,
and that pretty much wraps up this lesson.
Make sure you know your wireless standards,
your encryption types, your wireless channels.
Know what network address translation
and port forwarding does.
Understand DHCP and know what the DMZ is as well.
So that's it for this lesson
on wireless networks and SOHO networking.