Where to set up the DMZ host of Mercury Tenda router? The port mapping failed and I ended up only exposing an old computer.

Last month, I wanted to use my mobile phone to connect to my old computer at home for streaming at work. I had to fill up a bunch of Moonlight ports on the router, and I added them one by one, but I still couldn't connect to the outside. Later, I switched the Mercury D191G to the DMZ host and only filled in 192.168.0.50 With one address, the mobile phone traffic is passed directly. This incident made me take a hard look at the DMZ switch that I had never touched.

Let’s talk about the conclusion first: DMZ is not a metaphysics. It exposes all the ports of an internal network device to the public network at once. It's really easy to save trouble, and it's really dangerous to be dangerous. This article writes about the two backend paths of Mercury and Tengda, and by the way, I explain the two pitfalls I stepped on. Later, I configured it once again on my neighbor's Tenda AC10. The switches of both companies are called DMZ hosts, but the menu positions are different, so I wrote them separately for the two machines at hand.

Let’s first explain clearly what the DMZ host is for.

The router acts as a wall by default, and packets from the outside are discarded if they do not match the rules. Port forwarding is a designated door opened on the wall. For example, if you point 3389 to the computer in the study, only the packets with the number 3389 from outside can come in. The DMZ host is different. It removes this wall from a certain device, and sends all ports from 1 to 65535 to this machine, no matter which door is knocked outside.

The price is also very direct: This device is equivalent to standing naked on the public network. The scanner will try whatever port it sees. If the device's own firewall and password don't keep up, it's easy to have trouble. So I only use DMZ for devices that can't tell which ports they need. Take the Moonlight I built this time as an example. TCP alone involves ports 47984, 47989, and 48010, and UDP also has a string of 47998, 47999, 48000, 48002, and 48010. It is very laborious for Mercury’s old backend to fill in the rules one by one. At this time, it is appropriate to use DMZ to test the connection first. For things like NAS and monitoring that can identify ports, it is better to do port mapping honestly, don't be lazy.

The relationship between the two was first discovered by me in What is the difference between port forwarding and DMZ? I figured it out. Just remember one sentence: Port forwarding opens doors one by one, while DMZ dismantles the entire wall.

Mercury D191G: Hidden among advanced users

The Mercury D191G I have on hand uses the new interface. Browser loses melogin.cn , after logging in, click "Advanced Settings" in the upper right corner, pull down the menu on the left, find "Advanced User" and click on it. There are three entrances to the virtual server, DMZ host, and UPnP side by side. The first time I got stuck here, I kept looking for the "forwarding rules", but couldn't find anything after searching for a long time.

After clicking on "DMZ Host", first turn the switch above to ON, and then fill in the device IP in "DMZ Host IP Address". For example, my streaming computer is 192.168.0.50 , and finally click Save. The older Mercury interface is another trick: After logging in, go directly to "Forwarding Rules", there is a "DMZ Host", select Enable DMZ status, fill in the IP and save it. So don’t use an old screenshot to compare it to the new backend. The menu positions of the two generations are inherently different.

It should be noted here that the DMZ can only be filled with one device at a time. If you fill it out 192.168.0.50 , other devices other than this machine are still blocked by the wall and will not run naked along with it.

Tenda AC10: The DMZ host in more functions

I got the AC10 from Tenda. tendawifi.com After logging in, click "More Features", then click "Advanced Settings", and there will be "DMZ Host" below. Turn on the switch, fill in the "host IP address" and confirm. This path is different from that of Mercury, but fortunately Tengda wrote it more straightforwardly and did not change the name.

I also clicked on my neighbor's AX12 once. The entrance is similar, under more functions or advanced settings, just look for the four words "DMZ host". If you even tendawifi.com You can't get in. Please line up the login entrance first. I'm here 192.168.0.1 Can't open, can't get in For the few mistakes I have written in this article, the reasons can probably be found 80% of the time.

Tenda's old firmware also had a version that placed DMZ near the "virtual server", but the menu name basically didn't work, it was just called DMZ host. If it really doesn't exist, upgrade the firmware first. Some old firmware hides this function deeper.

Before you start, do two things first

DMZ fills in the internal network IP, which must be fixed. Because the router is restarted and the device is reconnected to the Internet, DHCP may change the address. You put it today 192.168.0.50 Throw it into the DMZ, and tomorrow that computer will become 192.168.0.101 , DMZ points to an empty address.

The most stable way to fix an IP is to statically assign it in the router and tie the device MAC and IP together. The binding steps of Mercury Tengda, I am here How to fix IP for Mercury Tenda router It is written in more detail. Complete this step first and then come back to open the DMZ. Don't use the device to fill in the static IP by yourself. Mobile phones and tablets won't let you fill it in, and it's easy to bump into others after changing WiFi.

The second thing is to check whether your public IP is genuine. Enter the running status of the router, look at the WAN port IP, then use mobile traffic to open Baidu and search "IP" to see the public network address displayed, and check both sides. If the WAN port IP starts with 100.64, 10, 192.168 or 172.16 to 172.31, it means that the operator has put you in the large internal network. No matter how well the DMZ is opened, the external network cannot find your home. In this case, you either need to apply for public network IPv4 from the operator, or change to IPv6 or intranet penetration, which cannot be saved by router settings.

The two pitfalls I have stepped into are the easiest for novices to get stuck.

The first pitfall is that the internal network test is always accessible, and the external network test always fails. I first used my home WiFi to access the public network IP and port. I was happy when it seemed to be connected, but when I arrived at the company, I still couldn't connect. Later I realized that many routers have NAT backflow turned on by default, and the public network address can be looped back when tested on the home network. This only means that the internal network link is good, but it does not mean that the external network can really come in. When testing the DMZ, you must turn off the WiFi on your mobile phone and use the traffic test.

The second pitfall is that the optical modem has no bridge, which is equivalent to two layers of routing. If the WAN port of your router has an internal network address such as 192.168.1.x, it means that the optical modem is dialing, and the DMZ is only exposed to the optical modem layer, and the external network still cannot enter. This requires either entering the optical modem and doing mapping or DMZ, or directly changing the optical modem to bridge and letting the router dial up. Two-layer forwarding is troublesome to configure. For home use, it is best to change the bridge in one step.

• Use traffic for the intranet test, do not use your own WiFi.
• The WAN port IP is the internal network address, so deal with the optical modem first.
• The WAN port IP is an address like 100.64. Don't bother, the operator doesn't give you a public IP.

After starting the operation, finish it quickly and don’t let the equipment run naked all the time.

The DMZ is for testing problems and temporary use, not for the main aircraft to live in it all year round. After I tested the Moonlight streaming, I turned off the DMZ and went back to map the ports required for streaming. Because the old computer was not patched very much and all ports were exposed for a long time, I felt uneasy.

If some devices really can only rely on DMZ, then do at least three things: Set a strong password for the device, apply all system patches, and leave only the DMZ external rule in the router. Devices such as game consoles that do not have remote desktop access are relatively safe. Old Windows computers, NAS, and surveillance video recorders are not easy to use.

How to choose between port mapping and DMZ? I will give you a table to finish.

Finally go in this order: Fix the IP, check the public network IP, process the optical modem, turn on the DMZ test, turn it off or tighten the port mapping after the test. Don’t let a device run around naked on the public network overnight, let alone leave an old computer with DMZ enabled hanging on the router. This is the biggest lesson I learned from this time.