1
00:00:06,570 --> 00:00:11,570
- Here's a Tech Tip about a
DMZ or demilitarized zone.

2
00:00:11,730 --> 00:00:13,380
Sometimes you have a system

3
00:00:13,380 --> 00:00:16,740
that you want to be
accessible from the internet.

4
00:00:16,740 --> 00:00:20,280
But you don't want people on
the internet to access the rest

5
00:00:20,280 --> 00:00:23,340
of your computers on
your Local Area Network.

6
00:00:23,340 --> 00:00:26,340
That's when it's good to use a DMZ.

7
00:00:26,340 --> 00:00:30,180
This allows that system
to be somewhat protected,

8
00:00:30,180 --> 00:00:32,520
but people that access
that system won't be able

9
00:00:32,520 --> 00:00:35,340
to access the rest of
the computers on the LAN.

10
00:00:35,340 --> 00:00:37,380
Which are fully protected.

11
00:00:37,380 --> 00:00:40,050
It requires a special
firewall configuration.

12
00:00:40,050 --> 00:00:41,820
But it can be a great solution

13
00:00:41,820 --> 00:00:44,010
if you have a server that you want to put

14
00:00:44,010 --> 00:00:47,970
on the internet and allow people access.

15
00:00:47,970 --> 00:00:50,190
So let's show an example of that now.

16
00:00:50,190 --> 00:00:54,210
That demilitarized zone or DMZ is an area

17
00:00:54,210 --> 00:00:58,200
that is part of your overall network.

18
00:00:58,200 --> 00:00:59,850
But separated from the LAN.

19
00:00:59,850 --> 00:01:02,160
Here's our LAN computers.

20
00:01:02,160 --> 00:01:04,323
Here's the DMZ section.

21
00:01:06,120 --> 00:01:08,160
And it usually provides server access

22
00:01:08,160 --> 00:01:10,440
to users on the internet as I mentioned.

23
00:01:10,440 --> 00:01:13,890
So users out on the internet
here might want to connect

24
00:01:13,890 --> 00:01:17,160
to your web server or to your FTP server.

25
00:01:17,160 --> 00:01:19,230
Keep these servers on the DMZ

26
00:01:19,230 --> 00:01:21,723
and separate from the Local Area Network.

27
00:01:22,920 --> 00:01:25,950
It's often set up as a
third-leg off the firewall.

28
00:01:25,950 --> 00:01:28,950
Could be set up in a back
to back configuration,

29
00:01:28,950 --> 00:01:30,810
but this is pretty common as well.

30
00:01:30,810 --> 00:01:33,180
Your firewall might
have three connections.

31
00:01:33,180 --> 00:01:38,180
One goes to the LAN and that's
gonna use a LAN address,

32
00:01:38,610 --> 00:01:41,190
a private address on the LAN network.

33
00:01:41,190 --> 00:01:45,360
So our LAN is 172.29.0.0, in this example.

34
00:01:45,360 --> 00:01:46,983
That's a class B private.

35
00:01:48,030 --> 00:01:51,060
The address the firewall
might use to connect

36
00:01:51,060 --> 00:01:56,060
to that is 172.29.250.200,
just for example.

37
00:01:56,790 --> 00:01:58,530
So we have our switch here.

38
00:01:58,530 --> 00:02:00,510
Our computers connected to the LAN

39
00:02:00,510 --> 00:02:03,270
so that switch and then the
firewall makes a connection

40
00:02:03,270 --> 00:02:04,920
to that switch as well.

41
00:02:04,920 --> 00:02:08,610
They're all on that 172.29 network.

42
00:02:08,610 --> 00:02:11,160
The second connection
is out to the internet.

43
00:02:11,160 --> 00:02:13,230
And the firewall or the router

44
00:02:13,230 --> 00:02:16,830
with built-in firewall
gets that public address

45
00:02:16,830 --> 00:02:19,740
from the ISP, or you set it statically.

46
00:02:19,740 --> 00:02:22,470
And that's also often
known as a serial address,

47
00:02:22,470 --> 00:02:27,470
65.43.18.1 that's the public
address in this example.

48
00:02:27,570 --> 00:02:29,040
That's a class A public.

49
00:02:29,040 --> 00:02:30,570
That allows your regular connectivity

50
00:02:30,570 --> 00:02:34,050
to the internet and all
connections from the LAN.

51
00:02:34,050 --> 00:02:36,213
Clients are protected by the firewall.

52
00:02:37,200 --> 00:02:39,510
Now we mentioned previously,
you could do port forwarding

53
00:02:39,510 --> 00:02:42,900
through the firewall to a
computer to act as a server.

54
00:02:42,900 --> 00:02:46,350
But the more secure way to
do it is through the DMZ.

55
00:02:46,350 --> 00:02:49,500
And so here's the
third-leg from the firewall

56
00:02:49,500 --> 00:02:52,110
and we're keeping these
physical connections separate.

57
00:02:52,110 --> 00:02:54,840
We have the LAN and the DMZ.

58
00:02:54,840 --> 00:02:56,940
And so the third connection goes

59
00:02:56,940 --> 00:03:00,810
to another switch on the DMZ section.

60
00:03:00,810 --> 00:03:02,460
This is separate from the LAN.

61
00:03:02,460 --> 00:03:03,990
It's kind of a halfway point

62
00:03:03,990 --> 00:03:06,390
between the internet and the LAN, really.

63
00:03:06,390 --> 00:03:09,600
And you have this using
the class C network

64
00:03:09,600 --> 00:03:13,560
192.168.100.0, that's just an example.

65
00:03:13,560 --> 00:03:16,440
That's just the IP we decided to use here.

66
00:03:16,440 --> 00:03:19,890
And the switch gets an IP
address on that network,

67
00:03:19,890 --> 00:03:24,630
and so do the servers, and so
does the firewall connection.

68
00:03:24,630 --> 00:03:28,200
And in this case, 192.168.100.200.

69
00:03:28,200 --> 00:03:32,460
So we have that whole
class C private IP network

70
00:03:32,460 --> 00:03:36,060
that now users on the internet can connect

71
00:03:36,060 --> 00:03:39,030
to through the firewall and into the DMZ,

72
00:03:39,030 --> 00:03:41,370
get to your web server, your FTP server.

73
00:03:41,370 --> 00:03:43,530
And all you have to have open here

74
00:03:43,530 --> 00:03:46,800
is port 80 for the web server,

75
00:03:46,800 --> 00:03:49,920
and port 21 for the FTP server.

76
00:03:49,920 --> 00:03:52,260
And then this connection can be completely

77
00:03:52,260 --> 00:03:54,120
firewalled to the LAN.

78
00:03:54,120 --> 00:03:58,290
Let's show an example on our router here.

79
00:03:58,290 --> 00:04:01,050
We have the DMZ section up here.

80
00:04:01,050 --> 00:04:02,940
We have the DMZ configuration.

81
00:04:02,940 --> 00:04:04,890
And right now it's not enabled.

82
00:04:04,890 --> 00:04:07,260
We could enable it and then select

83
00:04:07,260 --> 00:04:09,930
what the DMZ host IP address would be.

84
00:04:09,930 --> 00:04:12,510
Now it could just be
one computer connected

85
00:04:12,510 --> 00:04:16,110
to this device and that could be anything.

86
00:04:16,110 --> 00:04:21,110
It could be 192.168.0.110
because actually the network

87
00:04:21,360 --> 00:04:24,720
that this device is on is 192.168.0,

88
00:04:24,720 --> 00:04:26,580
but you could use other IP addresses.

89
00:04:26,580 --> 00:04:28,824
You could use a different IP network.

90
00:04:28,824 --> 00:04:33,780
You could use an actual
switch, if you wanted to.

91
00:04:33,780 --> 00:04:37,260
And so let's say you did a switch as 201.

92
00:04:37,260 --> 00:04:39,873
And then you could have
servers connected to that.

93
00:04:40,860 --> 00:04:45,450
On say, 202, 203, 204 and so on.

94
00:04:45,450 --> 00:04:46,830
So you can set up a DMZ,

95
00:04:46,830 --> 00:04:49,230
a very basic one on devices like this.

96
00:04:49,230 --> 00:04:51,090
But you can go much more into depth

97
00:04:51,090 --> 00:04:54,840
with more powerful firewalls
by Cisco and Juniper

98
00:04:54,840 --> 00:04:56,490
and CheckPoint.

99
00:04:56,490 --> 00:04:59,850
And you can set up
particular servers and ports.

100
00:04:59,850 --> 00:05:02,820
We mentioned previously port forwarding,

101
00:05:02,820 --> 00:05:04,380
previously in the lesson.

102
00:05:04,380 --> 00:05:06,300
And you could do that on
this particular device

103
00:05:06,300 --> 00:05:09,090
with the Virtual Server option.

104
00:05:09,090 --> 00:05:10,920
And you see that here,
I have a virtual server

105
00:05:10,920 --> 00:05:15,920
on 192.168.0.105 and that's using port 21.

106
00:05:16,350 --> 00:05:20,700
So that individual port will
be open on that one computer.

107
00:05:20,700 --> 00:05:25,320
And this device will let
traffic go through FTP.

108
00:05:25,320 --> 00:05:27,270
But again, the DMZ's a great way to do it

109
00:05:27,270 --> 00:05:29,760
because then you could do an entire group

110
00:05:29,760 --> 00:05:32,250
of computers connected to one switch

111
00:05:32,250 --> 00:05:34,260
and have that act as a separate

112
00:05:34,260 --> 00:05:35,610
type of thing on your network.

113
00:05:35,610 --> 00:05:39,240
Even if you have one of these
basic four port SOHO routers,

114
00:05:39,240 --> 00:05:42,300
one port could go out to that switch

115
00:05:42,300 --> 00:05:45,930
and then you apply that
switch's IP address here.

116
00:05:45,930 --> 00:05:47,880
As long as it's a layer three switch.

117
00:05:47,880 --> 00:05:49,470
Otherwise it could just be one computer

118
00:05:49,470 --> 00:05:51,570
that's doing all your server activity.

119
00:05:51,570 --> 00:05:53,670
I don't know if you're
running FTP, or web,

120
00:05:53,670 --> 00:05:56,776
or email, or games, or
downloads, or who knows what.

121
00:05:56,776 --> 00:05:59,970
But that IP address would be applied here.

122
00:05:59,970 --> 00:06:03,570
And so the SOHO router
would allow people through

123
00:06:03,570 --> 00:06:04,950
to that computer.

124
00:06:04,950 --> 00:06:06,390
But it won't allow people

125
00:06:06,390 --> 00:06:10,230
through to the rest of the network,

126
00:06:10,230 --> 00:06:15,230
the rest of the typical LAN on 192.168.0.

127
00:06:16,740 --> 00:06:19,860
So the DMZ is a nice option for that.

128
00:06:19,860 --> 00:06:22,290
You're keeping everything
physically separate

129
00:06:22,290 --> 00:06:24,660
on a third-leg, so to speak.

130
00:06:24,660 --> 00:06:27,150
So there's a little bit about the DMZ,

131
00:06:27,150 --> 00:06:29,370
and that pretty much wraps up this lesson.

132
00:06:29,370 --> 00:06:32,250
Make sure you know your
wireless standards,

133
00:06:32,250 --> 00:06:35,970
your encryption types,
your wireless channels.

134
00:06:35,970 --> 00:06:38,460
Know what network address translation

135
00:06:38,460 --> 00:06:40,500
and port forwarding does.

136
00:06:40,500 --> 00:06:45,030
Understand DHCP and know
what the DMZ is as well.

137
00:06:45,030 --> 00:06:46,470
So that's it for this lesson

138
00:06:46,470 --> 00:06:48,723
on wireless networks and SOHO networking.