DMZ on SOHO routers is a joke!

January 10, 2008

If I talk to people with a DSL router/NAT they sometimes tell me they have placed a PC or gaming console into a DMZ (Demilitarized zone) and now they are secure. If I hear something like this I am at the brink of crying. Why?

First let’s take a look at how this routers are making their version of a DMZ. You specify the IP address of the device which should be in the DMZ. Basically that’s it. This IP address is from the same subnet as your other internal devices, which should be protected from the systems in the DMZ. But this is not the case in this scenario! Why? The device in the DMZ can communicate without filtering by a firewall to the devices in the internal network – which is the same anyway. In theory it would be possible by a filtering bridge (Layer2) but at the SOHO routers I checked it’s just an internal switch. As their version of DMZ cannot protect your internal network from your DMZ devices if they get compromised, you are in the false impression of being secure.

How to make a secure DMZ setup with a SOHO router?

I recommend to install openwrt onto your router if you’re fit enough with Linux. You can then specify (at least at the Linksys WRT54GL routers I always buy/recommend) which VLAN should be untagged on which switch port (the Linksys has an internal 6 port switch – 1 for the CPU, 1 for the uplink and 4 for devices). After you’ve specified the VLANs you can configure separate subnets for the internal network and the DMZ. After that configure the firewall rules so that only the internal network can initiate connections to the DMZ but not the other way round.

The problem with this setup is that it requires a lot more knowledge than the wrong version above, and the described solution therefore is not passable for the majority of the users. Anyway this post should show the users of such a DMZ at least the design flaws in their DMZ. And maybe, just maybe, some SOHO DSL router manufacture will create a real DMZ feature.
This is my first blog entry in the IT security segment, so please tell me what you think about it. Thx.

2 Comments »

RSS feed for comments on this post. TrackBack URI

  1. Nice one, good article

    Comment by namd0gma1 — May 11, 2009 #

  2. short, sweet, and spot-on
    read it for a uni assignment involving the Linksys WRT54G

    Comment by Abe — June 1, 2009 #

Leave a comment

XHTML: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Powered by WordPress
Entries and comments feeds. Valid XHTML and CSS. 37 queries. 0.076 seconds.