Setting up a DMZ / Exposed Host on a router can be useful when a specific device needs to receive unsolicited inbound Internet traffic, such as when using a dedicated firewall or router behind an ISP-provided gateway.
This guide explains how to configure a DMZ host, assign it a stable local IP address, verify the configuration, and understand the important security differences between a consumer router's DMZ Host feature and a true network DMZ.
Warning
Setting a device as a "DMZ Host" on a consumer router typically forwards unsolicited inbound Internet traffic to that device instead of filtering it with the router's normal inbound firewall rules. NAT is generally still performed.
If the DMZ host is a router or firewall such as OPNsense, it can handle the inbound traffic and apply its own firewall rules.
Requirements
- Access to your router’s administrative console (typically via 192.168.1.1 or 192.168.0.1).
- The local IP address or MAC address of the host machine.
Assign a Static IP to the Host
DMZ targets need a stable internal IP address so the router doesn't route traffic to the wrong device later.
Navigate to DHCP / LAN Settings in your router dashboard.
Use Address Reservation (or Static Lease) to lock your target host's IP address (e.g., 192.168.1.100) to its MAC address.
Alternatively, manually assign a static IP address directly within the target host's operating system.
Locate the DMZ / Exposed Host Settings
Log into your router's Web Interface and find the DMZ menu:
- TP-Link / Netgear: Advanced NAT Forwarding (or Forwarding) DMZ
- ASUS: WAN DMZ
- MSI / Linksys: Security (or App & Gaming) DMZ
- FRITZ!Box: Internet Permit Access Port Sharing Exposed Host
Enable DMZ and Assign the Host
Toggle the switch to Enable DMZ (or Exposed Host).
Enter the static IP address of the target machine (or select it from the connected device drop-down list).
Click Save or Apply.
Apply & Reboot
Reboot the router (or disconnect and reconnect the target machine from the local network) to clear stale NAT translation tables and enforce the new rule.
Verification
To verify the setup, run a service on the DMZ host (e.g., an HTTP server or game server) and check if an outside port-checker tool (such as YouGetSignal Open Port Checker) can reach your public WAN IP address on that port without explicit port forwarding rules.
For example, suppose you have an ISP-provided gateway (such as a fiber optic ONT modem/router combo) and want to use a custom OPNsense router as your main firewall. If the ISP router settings lack a Bridge / Passthrough Mode option, your best workaround —without buying new hardware— is to place the OPNsense router in the DMZ.
This forwards all unsolicited inbound traffic directly to OPNsense. Although this results in double NAT and isn't ideal, it works well as a functional solution.
Consumer "DMZ Host" vs. True Network DMZ
Consumer "DMZ Host"
Consumer "DMZ Host" forwards all unassigned external traffic directly to one IP on your main local network. It offers zero network isolation—if that device is breached, the attacker gains immediate access to every other device on your LAN.
True DMZ (Enterprise)
True DMZ (Enterprise) places the exposed server on a completely separate, firewall-isolated subnet or VLAN.
If the server is compromised, strict firewall rules keep the attacker trapped and blocked from pivoting into your private network.
Configuring a DMZ / Exposed Host can solve specific networking requirements, particularly when a second router or firewall needs to receive inbound traffic from an ISP gateway.
However, a consumer router's DMZ Host feature does not provide network isolation, so it should not be confused with a true enterprise DMZ designed to protect the private LAN.