RV320 - DMZ setup

[groupetechno]

Hello,

I just bought an RV320 router. I have completed the basic configuration of my local network. Now I want to put a server (RDP) in a DMZ. This server must be accessible from the Internet only on port 3389 and this server must not have access to the local network (for security reasons).

What is the simplest method to do this on a RV320 knowing that I have only one server to expose?

I noticed that the notion of DMZ is in several places in the configuration (DMZ Host, DMZ / WAN port, Vlan, etc.). I do not quite understand the differences.

Thank you

[Ami Xiao]

Hi 

DMZ host more like port forwarding, it forward all traffic from wan to specified lan address.

You should use DMZ port. By default DMZ port host not allow to access local network but allow all traffic from wan to dmz, you could add access rule on firewall to limit only port 3389 accessible.

[groupetechno]

Hi,

I read that DMZ port requires a separate WAN Ip address. I have only one Wan IP. I'm not sure that works. Also, when I connect to this port (after activation), nothing append (dhcp, traffic, etc..).

I try something that it's seem work but I'm not sure that is secure. I create a new network (different from my lan network) but I don't create Vlan. I set Ip adress of my server (that i want expose) with new network information and create a redirection on port 3389. Is it bad ?

[Ami Xiao]

Due to new multiple subnet able to communicate with lan network, u should create new vlan for your server and make sure intervlan function is uncheck, then setup a redirection to port 3389, that will be ok.

[groupetechno]

Thank you very much for your help.

May I have one last question?  When I create a Vlan for my new network, I have to indicate if the router ports are tagged or untagged. What should I chose for each port ? For now the server is not directly connected to the router but I can do it if necessary.

[Ami Xiao · Accepted solution]

If the port is tagged, your device must bring VID label (setup in network card) to obtain corresponding pool. Otherwise, router will offer you the PVID pool (untagged).

For example:

If your device on LAN3 with VID label router will offer you VLAN1 pool, if without VID label will get VLAN4 ip pool.

[Rickam]

Hi groupetechno,

I've been struggling for years to get the DMZ configured properly on my RV320.   As it is now, I can use the hardware DMZ port for my server, but can only receive packets from the WAN.  I can't initiate connections or ping the outside world from the DMZ so this makes it difficult to get updates etc.      

Like you, I also read somewhere "that the DMZ port requires a separate WAN IP address" from the ISP.  I feel like that would be mentioned somewhere in the documentation, but it's not.    Nonetheless I can't get it configured properly. I just can't crack it.
nowhere can I configure a firewall rule to allow DMZ to WAN. 

I don't want to use the "DMZ host" feature on this router (seems like a bad idea).   Was your solution to set up your own DMZ subnet, and set up your own firewall rules to block your custom DMZ to LAN?

Is this a universal concept that the DMZ port is designed to use additional public IP addresses purchased from the ISP.  The documentation for the RV340 series may suggest this, so maybe there is no way I can get this to work.  

[groupetechno]

With configuration on network card setup, everything work well. Thank you !

Initially I wanted the workstation (server) connected to port # 3 to be automatically in the Vlan 4. I understand that this can not be done with this router?

[Ami Xiao]

If your device can't bring vlan tag by network card, you can set port#3 vlan4 as untagged as well.