Manual

Recipe: a server reachable from the internet

Reachable from outside and nowhere else: a server in its own segment.

The goal: a server that is reached from the internet, in a network of its own, so that a break-in on that server does not take your desks, your NAS and your cameras with it.

What you need

  • A router that does VLANs, so the Office router with VLANs role.
  • A public address on WAN. If you are behind a modem that still routes, or behind CGNAT, fix that first; see Opening a port.
  • A port for the server, or a switch that carries the new VLAN over the trunk.
  • A fixed address for the server. Set it on the server itself, or switch DHCP off for this VLAN; the VLAN table has no list of fixed leases.

Step by step

  1. Create the VLAN. In the VLANs section add a row, id 50 for instance, name vlan50-dmz, address 192.168.50.1/24. Internet on, because the server has to fetch updates. Management off.
  2. Tick Isolated. That adds a firewall rule dropping new connections from the DMZ to all your other networks and leaving only the internet.
  3. Assign the port. If the server hangs off the router directly, set that port to access with VLAN 50. If it hangs off a switch, the trunk towards it has to carry VLAN 50 tagged. The network board and the checks tell you whether that is right.
  4. Arrange the other direction. Isolated is about traffic from the DMZ. Traffic from your office network to the DMZ is still open with the default choice. To pin that down exactly, set traffic between VLANs in the Firewall section to only what is ticked in the matrix, tick office to DMZ and leave DMZ to office empty. Replies always come back, so that is enough to administer the server.
  5. Open the port. Under Port forwarding add a forward: TCP 443 to 192.168.50.10. Forward only what is really needed. Two ports is no disaster, forwarding everything to one address is.
  6. Protect the router itself. Mark your office VLAN as the management VLAN and switch on router manageable only from the management VLAN. A compromised server then cannot reach WinBox or SSH.
  7. Do not forget IPv6. If you use IPv6 there is no NAT, so your forward does not apply there. In the IPv6 section add a row under extra allowed from the internet with the port and the IPv6 address of the server. Leave it out and the server is not reachable over IPv6, which is a perfectly good choice as long as you make it deliberately.

Testing that it is right

  • From outside: take your phone off the Wi-Fi and reach the public address on the forwarded port. If that works, the way in stands.
  • From the DMZ: ping an address on your office network from the server. That has to fail. Ping 1.1.1.1: that has to work.
  • From the office: reach the server on its internal address. That has to work if you ticked it that way.
  • Towards the router: try WinBox on 192.168.50.1 from the server. That has to be closed.
  • On the device, /ip firewall nat print stats and /ip firewall filter print stats show which rules actually get hit. A rule counting zero is doing nothing.

What to watch out for

  • The server is now on the internet. The router's firewall protects your network, not the server itself. Updates, its own firewall and a decent password stay your job.
  • Outbound traffic is open. A compromised server may still reach out. To narrow that, add a custom filter rule in the forward chain allowing only the ports the server really uses.
  • Do not forward management ports. Open 3389, 445, 23 or 21 and the tool warns you. Rightly so: those are the ports that get scanned around the clock.
  • Testing from inside says little. If it works from outside but not from inside, you are looking at hairpin NAT or a static DNS record, not at a mistake in your firewall.
  • A DMZ is not a guest network. To give visitors internet without access to your things, the guest network is the right recipe.

When a VPN is the better answer

If only you, or only your colleagues, need that server, open nothing at all. A WireGuard tunnel lets you in as if you were at the office, and from outside there is no port to scan for. A DMZ is meant for services strangers have to reach: a website, a mail server, a game server. For anything only known people use, a VPN is simpler and safer. See VPN for the road.

Want to try it right away? Open the configurator