How does DMZ work on Linksys WRT54G?

Hi,

I thought that a DMZ required that there be a 3rd physical network
interface on the router, so that traffic to the DMZ would be physically
separated from the LAN (ie., the DMZ is another, untrusted, LAN). The
firewall/router software would determine whether to pass packets to/from
the DMZ and internet, would block *all* requests from the DMZ to the LAN
(actually the DMZ couldn't even see the LAN), and yet the LAN can access
the DMZ machine.

But the Linksys WRT54G allows me to set the IP address of the DMZ, to be
an IP on the same subnet as the LAN.

What is going on here? Can I trust that a machine called the "DMZ" on
this router is unable to pass any requests to machines on the LAN?
Perhaps I need a better explanation of how a DMZ is supposed to work.

Thanks for input.

Good day!

--
_____________________
Christopher R. Carlen
(E-Mail Removed)
Suse 8.1 Linux 2.4.19

Chris Carlen wrote:

> I thought that a DMZ required that there be a 3rd physical network
> interface on the router, so that traffic to the DMZ would be physically
> separated from the LAN (ie., the DMZ is another, untrusted, LAN). The
> firewall/router software would determine whether to pass packets to/from
> the DMZ and internet, would block *all* requests from the DMZ to the LAN
> (actually the DMZ couldn't even see the LAN), and yet the LAN can access
> the DMZ machine.
>
> But the Linksys WRT54G allows me to set the IP address of the DMZ, to be
> an IP on the same subnet as the LAN.
>
> What is going on here? Can I trust that a machine called the "DMZ" on
> this router is unable to pass any requests to machines on the LAN?
> Perhaps I need a better explanation of how a DMZ is supposed to work.

Let's put it this way: Linksys is misusing the term "DMZ" here. Their
"DMZ" is simply a machine to which any incoming connections are allowed.
It does no further filtering, and the "DMZ" machine is not restricted from
contacting other machines on the internal network.

A true DMZ would require a separate DMZ interface and subnet, or the use of
two routers, with the inside machines being behind both, and the DMZ
machine being behind just one of them.

If you want to set up a true DMZ with the Linksys routers, you'll need two
of them.

--
ZZzz |\ _,,,---,,_ Travis S. Casey <(E-Mail Removed)>
/,`.-'`' -. ;-;;,_ No one agrees with me. Not even me.
|,4- ) )-,_..;\ ( `'-'
'---''(_/--' `-'\_)

Travis Casey wrote:
> Let's put it this way: Linksys is misusing the term "DMZ" here. Their
> "DMZ" is simply a machine to which any incoming connections are allowed.
> It does no further filtering, and the "DMZ" machine is not restricted from
> contacting other machines on the internal network.

Thanks for the reply.

I think "false advertizing" might not be too strong a word. I'm rather
pissed about Linksys misrepresenting like this.

Good day!


--
_____________________
Christopher R. Carlen
(E-Mail Removed)
Suse 8.1 Linux 2.4.19

On Fri, 02 Jul 2004 18:47:49 -0700, Chris Carlen
<crobc@BOGUS_FIELD.earthlink.net> wrote:

>Travis Casey wrote:
>> Let's put it this way: Linksys is misusing the term "DMZ" here. Their
>> "DMZ" is simply a machine to which any incoming connections are allowed.
>> It does no further filtering, and the "DMZ" machine is not restricted from
>> contacting other machines on the internal network.
>
>Thanks for the reply.
>
>I think "false advertizing" might not be too strong a word. I'm rather
>pissed about Linksys misrepresenting like this.
>
>Good day!

Wait until you find out that it doesn't even work properly as
implemented! Running, for exaple, apache w/ namevirtualserver doesn't
work behind a linksys - even in the dmz. That indicates that some
level of filtering/munging is happening even in the so-called dmz.

I used my linksys as a gravity test and inplemented a real firewall.

Mike-

--
If you're not confused, you're not trying hard enough.
--
Please note - Due to the intense volume of spam, we have installed
site-wide spam filters at catherders.com. If email from you bounces,
try non-HTML, non-encoded, non-attachments,




----== Posted via Newsfeed.Com - Unlimited-Uncensored-Secure Usenet News==----
http://www.newsfeed.com The #1 Newsgroup Service in the World! >100,000 Newsgroups
---= 19 East/West-Coast Specialized Servers - Total Privacy via Encryption =---

On Sat, 03 Jul 2004, Michael W. Cocke <(E-Mail Removed)> wrote:
> On Fri, 02 Jul 2004 18:47:49 -0700, Chris Carlen
><crobc@BOGUS_FIELD.earthlink.net> wrote:
>
>>Travis Casey wrote:
>>> Let's put it this way: Linksys is misusing the term "DMZ" here. Their
>>> "DMZ" is simply a machine to which any incoming connections are allowed.
>>> It does no further filtering, and the "DMZ" machine is not restricted from
>>> contacting other machines on the internal network.
>>
>>Thanks for the reply.
>>
>>I think "false advertizing" might not be too strong a word. I'm rather
>>pissed about Linksys misrepresenting like this.

DMZ as used by SuSEfirewall2 refers to public IPs, and inexpensive
broadband routers cannot even handle more than 1 public IP (and usually
not more than 1 LAN subnet). So broadband routers in general use DMZ to
refer to a LAN IP that gets any ports not forwarded elsewhere and it is up
to the user to secure things from there.

> Wait until you find out that it doesn't even work properly as
> implemented! Running, for exaple, apache w/ namevirtualserver doesn't
> work behind a linksys - even in the dmz. That indicates that some
> level of filtering/munging is happening even in the so-called dmz.

Some routers that can do loopback (LAN2LAN via public IP) will also start
showing IP of router instead of actual client once you have used the
loopback (even subsequent access from internet clients). Not sure if that
affects Linksys, since my only Linksys devices are WAP11, WET11 and 10/100
pc card.

I had no trouble doing NameVirtualHost on a now obsolete Dlink DI-704 by
simply forwarding port 80 (no-ip.com names), and it did proper loopback.
Although, when I did incoming smtp to LAN box, I had to set Linux smtp
server LAN nic to mtu 1492 (same as PPPoE mtu on router) for that to work.

But I now use Linux as pppoe/router and for testing apache and smtp. The
only uninitiated ports I let in are 22, 25 and 80.

--
David Efflandt - All spam ignored http://www.de-srv.com/