Creating a DMZ in OpenWRT

In computing, a DMZ (demilitarized zone) is a method for separating untrusted traffic from a trusted network. One of the most common implementations of this would be for supporting a publicly accessible server (such as web) on a local internet connection. The server sits in the DMZ and can be accessed from the Internet, but it cannot access the trusted network.

OpenWRT probably needs no introduction, the brilliant open source and community driven Linux based embedded router stack. I run it on my Netgear WNDR3800.

Netgear WNDR3800 running OpenWRT

Netgear WNDR3800 running OpenWRT

I have an ODRIOD-U3 (little ARM box) running Fedora, which runs a web server. This is what I want to make publicly available in my DMZ.

So, how to create a DMZ in OpenWRT? Some commercial routers have a single button “make a DMZ” and everything is handled behind the scenes for you. Not so with OpenWRT; it’s powerful, transparent, and only does what you tell it to, so we have to create it manually.

Physical devices

My router has a bunch of physical interfaces:

  • eth0 (switch)
  • eth1 (ethernet)
  • wlan0 (wireless card)
  • wlan1 (5GHz wireless card)

The eth1 device maps to the physical WAN port on the back of the router. It’s important to note that the physical interfaces may differ from router to router, depending on the chipsets.

The Switch

The switch (eth0) includes a number of ports, including the four physical ones on the back of the router, a fifth one that’s not used, as well as one that connects to the CPU.

The switch supports VLANs (virtual LANs), and by default OpenWRT puts all of those ports into VLAN 1. This means that physical connections in those four ports at the back are on the same virtual switch and are able to communicate with each other. You can imagine that if I changed the VLAN of one of those ports to VLAN 10, that the device plugged into that port would no-longer be able to communicate with other devices on the switch. This is the basis for our DMZ.

That VLAN 1 actually creates a new interface on the router:

  • eth0.1 (VLAN 1)

The configuration of the switch (including the mapping of ports to VLANs) is available under the switch menu, Network -> Switch.

Note: The port numbers on the switch in OpenWRT do not necessarily map in the right direction to the back of the router. In my case, port 0 on the switch is port 4 on the back of the router.

Creating a new VLAN

The first thing we want to do is create VLAN 10 and then assign one of the ports to that VLAN, removing it from VLAN 1.

  • Browse to Network -> Switch
  • Click Add to make a new VLAN entry
  • Set this new entry’s VLAN ID to 10
  • In the VLAN 1 row, change Port 0 to off
  • In the VLAN 10 row, change Port 0 to untagged
  • In the VLAN 10 row, change CPU port to tagged
Create VLAN

Create VLAN

Setting VLAN to untagged tells the switch to add the appropriate VLAN tag to each ethernet frame as the traffic exits that port. The setting tagged means that the switch should expect that traffic leaving the port has already been tagged, perhaps by the operating system running on the device which is attached to the port.

Port 0 (port 4 on the back of the router) is now in VLAN 10, while the remaining three ports are in VLAN 1 and so it is now isolated from the others. The CPU is also in VLAN 10, else we would not be able to pass any traffic to port 0.

That new VLAN 10 creates a new interface on the router:

  • eth0.10 (VLAN 10)

Interfaces

In OpenWRT you create virtual network interfaces which map to physical devices on the router. These are available under the Network -> Interfaces menu.

For example, my router has:

  • LAN (for my internal local area network)
  • WAN (for the external Internet connection)

One or more physical devices are attached to these zones, for example in my case:

  • LAN (bridges VLAN 1 eth0.1, wlan1 and wlan0 together)
  • WAN (eth1)

The LAN bridge creates a new interface on the router:

  • br-lan (bridged LAN)

Creating a new interface

Once we have created our new VLAN, we want to create a new a interface for the DMZ. In the same way that the VLAN 1 device, eth0.1, is attached to the LAN interface, we will attach VLAN 10 device, eth0.10, to our new DMZ interface.

  • Browse to Network -> Interfaces
  • Click Add New Interface to make a new DMZ zone
  • Set the name of the new interface to DMZ
  • Leave the protocol of the new interface to static
  • Ensure bridge over multiple interfaces remains unchecked
  • For the interface, select only VLAN Interface: “eth0.10”
  • Click Submit
Create Interface

Create Interface

You should be presented with a new configuration screen for this interface.

  • Set IPv4 address to something in a new range different to LAN, e.g. if your LAN is 192.168.1.1 then set DMZ to 192.168.0.1
  • Leave the rest of the settings blank, you do not need to set routes, or IPv6 if you don’t want to
Interface Configuration

Interface Configuration

  • Click on the Advanced Settings tab
  • Ensure Bring up on boot is ticked
  • If you don’t want IPv6, untick Use builtin IPv6-management
Interface Configuration - Advanced

Interface Configuration – Advanced

  • Click on the Physical Settings tab, should already be set to eth0.10
Interface Configuration - Physical

Interface Configuration – Physical

  • Click on the Firewall Settings tab
  • Under Create / Assign firewall-zone select unspecified -or- create and type dmz
  • Click Save and Apply
Interface Config - Firewall

Interface Config – Firewall

  • If you want to run DHCP on your DMZ, then under DHCP Server click Setup DHCP Server button, leave default settings
Interface Config - DHCP

Interface Config – DHCP

We now have a new interface or zone called for the DMZ that’s set to use out DMZ VLAN. It has a new firewall policy assigned to it, dmz, which we now need to configure.

Firewall

Now we need to configure the firewall to do a few things:

  • Allow the DMZ to talk to the WAN zone, so that devices can access the Internet
  • Allow the LAN zone to talk to the DMZ, but not the other way around
  • Add some traffic rules opening ports 53 and 67, so that devices from the DMZ can access DNS and DHCP services on the router’s DMZ IP address
  • Finally, forward the HTTP port (80) from external internet WAN interface onto a device in the DMZ

Let’s do zone settings first.

  • Browse to Network -> Firewall
  • Under the Zones section on General Settings page, edit the dmz zone
  • Leave the name set to dmz
  • Set input to reject, so that we drop all incoming packets by default
  • Leave output as accept, although you could set this to reject by default but you’ll require specific outgoing rules as required (like for Yum updates)
  • Leave Masquerading and MSS clamping disabled
  • Under Covered networks ensure that only dmz is selected
Firewall

Firewall

  • Under the section Inter-Zone Forwarding, ensure Allow forward to destination zones is set only to WAN
  • ensure Allow forward from source zones is set only to LAN
Zone Forwarding

Zone Forwarding

  • Click Advanced Settings tab
  • If you don’t want IPv6, you can set Restrict to address family to IPv4 only
  • Tick Enable logging on this zone, so that we can see what’s happening
Firewall Configuration - Advanced

Firewall Configuration – Advanced

Now let’s do port forwards.

  • Click on the Port Forwards tab
  • Under New port forward section, give a name, such as dmz-http
  • Set Protocol to TCP
  • Set External zone to WAN
  • Set External port to 80
  • Set Internal zone to DMZ
  • Set Internal IP address to your DMZ server, e.g. 192.168.0.100
  • Set Internal port to 80
  • Click Add when you’re happy
  • Repeat for HTTPS port 443 if you want to run a secure server
Port Forwarding

Port Forwarding

Finally, let’s finish with traffic rules.

  • Click on the Traffic Rules tab
  • Under Open ports on router, set a name like dhcp-dns
  • Under Protocol, select UDP
  • Under Port, set 53
  • Click Add
  • Find your new rule in the list and click edit
  • Set Destination address to your router’s DMZ IP address
  • Repeat for DHCP port 67 UDP if you want to use router’s DHCP server, but don’t set the destination address as DHCP is broadcast
Firewall Traffic - DHCP & DNS

Firewall Traffic – DHCP & DNS

If you want to be able to ping the router from the DMZ clients, do this.

  • Set a name like ping-dmz
  • Set protocol to Other
  • Click Add
  • In the new configuration page, set Protocol to ICMP
  • Set Match ICMP type to echo reply
  • Set Source zone to dmz
  • Leave Destination zone to Device (input)
  • Set Destination address to your router’s DMZ IP address
  • Click Save
Firewall Traffic - Ping

Firewall Traffic – Ping

Checking the logs

Remember we told the router to log the DMZ? Well now we can monitor the firewall rules by browsing to Status -> Kernel Log. Here you should be able to see any rejects that are happening, which is useful to work out why something isn’t happening as you expect on the DMZ.

For example, disable the dmz-ping rule and then try to ping the router from your DMZ server. Refresh the Kernel Log and you should see entries appear.

Testing

Plug in a device, see if it gets an IP address. Try to ping 8.8.8.8 (Google DNS server), then try to ping google.com.

Set up a web server on your DMZ box, or use netcat to listen on port 80. Get your external IP address from the router, or Google “my ip”. Now get a friend to browse to your IP and see if you see your web server.

Nice.

21 Responses to “Creating a DMZ in OpenWRT”

  1. Nader says:

    Nice!!!

  2. Adrian says:

    Thanks Christopher. Was looking for this kind of tutorial, simple and yet detailed and complete.

  3. Tyson says:

    Thanks for this! Good stuff!!

  4. HOT__SPOT says:

    Great tutorial!
    Just a small correction; to enable PING the type of ICMP is echo-request not echo-reply

  5. Jeroen says:

    Thanks, exactly what I was looking for!

  6. Alan says:

    Very nice writeup. Stuff like this has tremendous value.

  7. Sajas says:

    I tried what you did but now my ps4 which was the dmz ip address wont get internet connection. while it did before i tried this. could you know where my mistake could be?

  8. Chris says:

    I would suggest plugging a computer into the port and see what it looks like.

    Does it get an IP address set? If not it could be dhcp problem so you need to check the firewall section about allowing DHCP.

    Does it have a default route? If not, you can’t look up anything.

    Does it have DNS set and does DNS work? If not, you might need to check the firewall section about allowing DNS.

  9. Sajas says:

    the RX is 0. does this mean something to you? im sorry im not much of an expert. just trying to DMZ my ps4 to get NAT type open

  10. Julian says:

    Excellent tutorial. Thanks for sharing.

  11. DwnLdr says:

    Good tutorial, but if the DMZ netmask was empty, all traffic has been blocked. After I set it (255.255.255.0) all gone fine!

  12. omar says:

    thanks for tuto this is what i need now

  13. subie says:

    Hi,

    Does DMZ VLAN make the other LAN ports can’t access the internet? I would like to have 2 separate networks on one router, one with access to internet and the other is for local intranet only ( no internet access).

  14. Chris says:

    No, those other ports should still work.

  15. Mark says:

    Hi,

    I’ve followed your tutorial and everything works except my DMZ server timeouts when I run wget or apt-get update. Ping for both 8.8.8.8 and google.com issued on a server works so dns config is fine but it seems that firewall is somehow blocking other traffic :(. WAN -> DMZ and LAN -> DMZ connections are also fine.

  16. Chris says:

    Hmm.. maybe check your openwrt logs to see if there are packets being dropped? I assume you’re allowing all traffic between DMZ and WAN and not blocking anything external? If you can, maybe to a tcpdump on the router and see what’s happening with your packets. Maybe they are going out bt not getting NAT’d and so there’s no return traffic, or something.

  17. Prasad says:

    Thank you Chris for this article.

    I finally got a DMZ setup on my router (WNDR3800).
    Just wanted to list somethings that caused me a problem… hopefully someone can benefit.

    1. Interface Configuration picture: there are two ipv4 listed one is 192.168.0.1 and the other 192.168.1.1 – is confusing for newcomers like me.
    2. I had to set the netmask – was causing me issues
    3. Highly recommend setting up DHCP on DMZ – caused me issues.

    I was setting up a minecraft server for my son in DMZ. Just
    the port forwarding from wan to dmz did not work for me. I had to setup an additional port forward from lan to DMZ via the routers external ip(the ip that the world sees – google whats my ip). With just one rule(wan to DMZ), I couldn’t get to the server I had setup in DMZ. I could get to the server with the ip but not through the domain(myminecraft.ddns.net) from noip.com.

  18. Chris says:

    Cool and thanks for posting the issues you ran into, hopefully will help others.

Leave a Reply