RTFM · Networking

Consumer DMZ Host and Exposed Host

A consumer router's DMZ Host is usually an IPv4 catch-all forwarding rule to one LAN machine. It is not an enterprise DMZ network, and it makes the selected Saphira host responsible for rejecting unwanted traffic.

The name causes real confusion

In an enterprise design, a DMZ is a separately routed and firewalled network segment with carefully controlled paths to the Internet and internal systems. On a consumer router, DMZ, DMZ Host, Exposed Host, or Default Server commonly means something much narrower: inbound IPv4 traffic that matches no existing forwarding rule is sent to one internal address. It does not create a new network cable, a separate VLAN, or an extra protective firewall.

What a home-router DMZ Host means

Internet
    ↓
Home router public IPv4
    ↓
DMZ / Exposed Host setting
    ↓
One chosen LAN address: 192.168.1.50
    ↓
Saphira firewall
    ↓
Only services nftables allows

Never set a family laptop, desktop, NAS full of unrelated data, or an unprepared server as DMZ Host. Before enabling it, Saphira must have a tested default-deny firewall and a safe management path.

When explicit forwarding is better

Use explicit forwarding when you need a small, known service set: normally TCP 80/443 for a website, and only the MailDragon ports you genuinely provide. The router then drops or handles unmatched traffic itself, reducing the number of services that must rely on the host firewall. Explicit rules are easier to audit months later.

Choose deliberately
Need	Better choice	Reason
One web site	Explicit TCP 80 and 443 forwarding	Small, reviewable exposure.
A mail server plus web services	Explicit rules for each required TCP port	Mail and web exposure remain visible in the router.
Dedicated household edge host running several deliberately filtered services	DMZ Host after host firewall testing	The host is intentionally the IPv4 edge, not an accidental target.
IPv6 services	IPv6 router and host firewall rules	Consumer IPv4 DMZ settings normally do not control IPv6.

Prepare the Saphira edge before router exposure

1. Give the host a stable address
Reserve 192.168.1.50 in the router DHCP server. Confirm it with ip addr after renewal or reboot.
2. Write a default-deny host firewall
Allow established connections, loopback, necessary ICMP/ICMPv6, management from a trusted source or VPN, and only public service ports. Validate before loading it.
3. Verify every listener
Use ss -lntup. Stop or reconfigure anything that should not be reachable; a DMZ Host delivers attempts for unlisted ports too.
4. Enable the router setting
Find DMZ, DMZ Host, Exposed Host, Default Server, NAT, or Firewall. Enter the reserved address only, save, and test from a remote network.

Pre-exposure evidence

# Before enabling the router setting.
nft -c -f /etc/nftables.conf
rc-service nftables restart
ss -lntup

# Then inspect what the host actually receives during a controlled external test.
tcpdump -ni eno1 'tcp port 80 or tcp port 443'
nft list ruleset

Prove it works: The firewall is the boundary

A permitted public service responds from outside. An unpermitted TCP port is refused or dropped according to the policy, and nftables counters or tcpdump show that the decision happened on Saphira rather than by luck.

IPv6 is not controlled by this checkbox

IPv6 is normally routed, not hidden behind IPv4 NAT. A Saphira host may already have a global IPv6 address through Router Advertisements or a delegated prefix. The consumer router's IPv4 DMZ Host cannot make that address safe or unsafe; the router IPv6 Firewall and Saphira nftables IPv6 policy are the relevant controls.