Advanced DMZ works quite well with EdgeRouter X running OpenWRT.
My setup is odd at the moment - Bell
R3000 is the edge device providing DHCP within
192.168.2.0/24 range to wireless clients and used for IPTV. Downstream of the
R3000 is the EdgeRouter X - used for ethernet connection for home server, IoT devices, etc. Since I havent purchased a wireless AP yet -
R3000 has to provide the W
LAN for now.
Here's the setup:
R3000 -
192.168.2.0/24 LAN subnet
ERX -
192.168.1.0/24 LAN subnet
What I needed is:
a) devices connecting to
ERX (
192.168.1.0/24) not being double-NATd
b) devices within
192.168.2.0/24 must be able to communicate with devices in
192.168.1.0/24 and vice versa
I've soft bricked
ERX a couple of times paying with static routes - but eventually figured it out. Here's how I got it working.
NOTE: ERX is not running Ubiquiti EdgeOS as mentioned before, but OpenWRT 18.06.02
1) Connect
ERX WAN interface eth0 to any
LAN ports on the
R3000
2) On OpenWRT
WAN interface eth0 is configured as a DHCP client out of the box - which is perfect
2.1) At this point
ERX will grab a DHCP address from the
R3000, something like 192.168.2.20/24
3) Enable Advanced DMZ on
R3000 in Firewall settings and select the
ERX MAC address. Apply. Reboot
ERX then
R3000
4) After both devices come back from reboot verify if
ERX WAN interface is grabbing a public IP address via DHCP from
R3000. Mine was without an issue.
5) On
ERX create a new interface with a static address. Assign the interface to
WAN zone and give it an IP address within the
R3000 LAN range that's outside of DHCP - for example 192.168.2.250/24. I named mine ROS because it reminded of the "Router-on-a-Stick" hahaha.
6) On the
R3000 in the advanced settings > Static Routing - create a static route to
192.168.1.0/24 going via 192.168.2.250/24 (interface created in
ERX in the step above)
At this point everything is done. The only remaining part is to add a firewall rule(s) on
ERX to specify what traffic, if any, will be accepted from
192.168.2.0/24. For example if you choose to allow all traffic, the rule would be something like:
"Any traffic
From IP range
192.168.2.0/24 in
wan
To IP range
192.168.1.0/24 in
lan"
Screenshots
ERX interfaces
Red = WAN Zone
Green = LAN Zone
R3000 static route