What exactly is the difference between port forwarding and DMZ? To connect my home NAS on the foreign internet, I tried both

Last month, I tried to see photos from my home NAS at the office, but I just couldn't connect. After some research, I found out: the router by default blocks all external connections outside the door. To access home devices from outside, you either use port forwarding or open DMZ. These two terms yielded a bunch of tutorials, but honestly, most didn't clearly explain the differences. I tried to copy them and ended up messing up—once DMZ was activated, my old camera at home had a weak password scanned the next day. This article breaks down these two things thoroughly, both of which I personally tested using my own network. If you find it too long, just flip to the middle to check the comparison chart. software router players and those who install surveillance recommend reviewing from the beginning—the pitfalls are all at the front.

clarify first: Why does the foreign network default to not connect to your home

your router actually does two things: "translation + gatekeeper." Intranet devices use private addresses, like 192.168.31.0. Hundreds of millions of families worldwide use the same system, and once they step outside your door, they don't recognize you. What truly represents your home internet access is the public IP assigned to you by the carrier (if any).

Here's

question: If a data packet from the external network taps the 5000 port of your public IP, how does the router know whether to transfer to the NAS, surveillance, or computer? It doesn't know. So the default policy is to reject everything—this is the fundamental reason you can't connect to your home devices on the external internet. Note that this "default refusal" is a good thing; it's not a lazy router. Among dozens of devices in your home, if even one has admin123 with the password, it will be scanned by someone when opened.

port forwarding and DMZ are two different ways to open the door to this "default denial." One used a key to precisely open a door, the other tore down an entire wall.

port forwarding: leave only one door and stick the device name tag

The logic for forwarding

ports is simple: tell the router, "Any port from the external network that knocks on a public IP port will be forwarded to a port on a device on the internal network." I added a link in the Xiaomi router backend (Advanced Settings → Port Forwarding): external port 5000, internal IP 192.168.31.20 (fixed address of my Feiniu NAS), internal port 5000. After saving, you can directly access the NAS management page using "Public IP:5000" on the external network.

this is like community access control only allowing visitors who announce 'Looking for Building 3, 502,' while everyone else is blocked. The smaller the port range, the more controllable the risk—NAS only exposes one web port, and services like SSH and SMB are completely invisible from the outside.

a few practical details I've stepped on:

• intranet devices must first fix their IP address; otherwise, once DHCP changes addresses, forwarding rules become mere formality. For NAS, I bind the MAC address in the background, and don't enable AP mode on the router; otherwise, there won't be forwarding functionality. I'll explain this in detail later
• External ports should not use the default settings. The NAS web default is 5000, but on the external network, I actually typed the public IP 53211 and forwarded it to the internal network at 5000—changing to an uncommon external port visibly reduced the number of automatic scans hits
• Protocol Choosing TCP or TCP/UDP depends on the service. NAS web uses TCP, some games require UDP for online play, so if you're unsure, choose both

DMZ: The entire device runs bare to the public network, convenient but requires careful consideration

DMZ even more brutal. Open the DMZ host in the router's backend and enter a local IP (for example, 192.168.31.30). The router will send all connections external network that you haven't initiated actively to this machine. This means all ports from 1 to 65535 on this device are open to the outside.

When is

convenient? I installed a surveillance host for my parents' home, and the vendor's app wanted to do P2P direct connection. The documentation didn't even tell you which port it used, so port forwarding was basically impossible. In this kind of "not knowing which port to open" scenario, DMZ shuttle is the easiest way. My old network camera was the same—lost the manual, but DMZ finally fixed it.

the mishap I mentioned at the beginning is here. That old camera had the default password as admin. The DMZ had been open for less than a day, and I checked the connection records and found that an overseas IP had logged in. So the DMZ has three iron laws:

first rule: devices entering the DMZ must first change the default password and upgrade the firmware. Second, try to choose equipment that is already well-equipped (choose big manufacturers, don't buy white-label monitors). Third, if you can use port forwarding, don't use DMZ. DMZ is a safety net when you really don't know which port to open, not the first choice.

comparison between the two: How to choose clearly in one table

by the way, the two are mutually exclusive concepts rather than mutually exclusive functions, but in actual configuration, the DMZ will "swallow" port forwarding—traffic prioritizes DMZ. So don't open both at once—pick one.

biggest pitfalls aren't in routers: optical modems and public networks IP

my first night with all my configurations correct, but I just couldn't connect to the external network. In the end, I realized the problem wasn't with the router, but with my optical modem. Nowadays, most optical modems are router-based. The public IP is actually given to the modem, and your router only receives the private address assigned by the modem. When you set up port forwarding on the router, it opens the door to the 'optical modem internal network'; packets from the external network are blocked by the optical modem.

There are two ways to

solution. One is to convert the optical modem to a bridge, allowing the router to dial directly and get a public IP address—a one-time solution. If you're more hands-on, you can check out my previous article on converting optical modem to bridge. The other is that the optical modem doesn't change it. In the backend, the optical modem also forwards your router's address via a port (or DMZ), turning it into a 'dual-layer forwarding.' It works, but every time you add a rule in the future, you have to change two places, which is annoying.

second pitfall is even more unsolvable: many operators default to not giving you a public IP address. The home only gets a private network address starting with 100.64 or 10. In this case, no matter how well the port forwarding matches the DMZ, it won't help—your home has no access to the public network at all. Call customer service to request a public IP (they say you need to install surveillance), and they'll usually provide it; If you really can't provide it, go for internal network penetration or IPv6. I previously wrote an article three ways to connect to a home NAS external networks, comparing DDNS and penetration solutions, so I won't repeat them here.

my final configuration and safety habits

My current solution is: optical modem bridge, Xiaomi router dial-up, public IP bound to DDNS domain (otherwise, if the IP changes, contact will be lost); NAS forwards only one modified high-level port, manages a 20-bit password, and enables two-step authentication in the background; The monitoring host isolates the old router from the guest network and then runs the DMZ; even if it is breached, it cannot reach the NAS layer.

add three habits earned at the cost of your life. For forwarded services, the password must be a long random string; a weak password means it is unprotected. Keep the remote management feature in the router management backend turned off, and don't expose the entry point where you manage the router. Every month or two, I check the NAS login failure login—it's all foreign IPs testing passwords. This is normal, and it means the door is tightly closed—one success record is the real problem. Once you have more devices, first check how many devices have at home, then decide which ones are worth exposing to the external network—not every device needs to be opened.

Summary of the sequence: First, confirm the presence of a public IP address, then resolve the optical modem bridging or dual-layer forwarding. Next, fix the device to a fixed IP. If port forwarding is possible, avoid touching the DMZ. If you must open the DMZ, strengthen the password and isolate the device. Following this order, the matter of connecting to home on foreign networks can basically be done in one go.