Editing DMZ (computing) (section)

==DMZ host==

Some [[Router (computing)|routers]] have a feature called '''DMZ host'''. This feature could designate one [[Node (networking)|node]] (PC or other device with an IP address) as a DMZ host. The router's firewall exposes all ports on the DMZ host to the external network and hinders no inbound traffic from the outside going to the DMZ host.<ref name="DmzHost1">{{cite web |title=What is a DMZ and how to configure DMZ host |url=https://www.tp-link.com/us/support/faq/28/ |website=tp-link.com |publisher=TP-Link Systems Inc |date=27 April 2017}}</ref><ref name="DmzHost2">{{cite web |title=What does the DMZ setting on routers do |url=https://www.microcenter.com/tech_center/article/6780/what-does-the-dmz-setting-on-routers-do |website=MicroCenter.com |publisher=Micro Electronics |access-date=14 December 2024}}</ref> This is a less secure alternative to [[port forwarding]], which only exposes a handful of ports. This feature must be avoided, except when:<ref name="DmzHost2" />

* The node designated as DMZ host is the downstream firewall of the actual DMZ (perhaps the router itself isn't part of a home network)
* The node runs a powerful firewall capable of regulating internal security
* The sheer number of ports is too great for the port-forwarding feature
* Correct port forwarding rules could not be formulated in advance
* The router's port forwarding is not capable of handling relevant traffic, e.g., [[6in4]] or [[GRE tunnel]]s 

In all but the first scenario above, the DMZ host feature is used outside a true DMZ configuration.