Where to set up Xiaomi router DMZ? Port forwarding is at the bottom, confirm the public IP before opening it.

Last month, I connected a Hikvision DS-7808N-F1 at home to Xiaomi AX3000T and wanted to use my mobile phone to watch surveillance playback at work. The after-sales service said that opening a DMZ is the easiest thing to do, but I browsed through the Mijia App for a long time and only saw speed limit, anti-censorship, and child mode, but no DMZ at all. Later, I switched to a computer 192.168.31.1 , you can find it at the bottom of the port forwarding page in the advanced settings. This switch is not hidden deep, but the pit is all outside the switch. Today I will explain the entrance, pre-inspection and finishing.

What exactly is DMZ? Push the entire machine to the public network, not just open a door

After all the devices at home go out, only one public IP is displayed to the outside world. This IP first falls on the WAN port of the router. When someone knocks on the door, the router does not know which internal network device to send the request to by default, so it blocks all requests. Port forwarding is to open a designated door. For example, the external network 8080 can only be forwarded to 192.168.31.66 this machine ； DMZ is different. It passes all traffic that does not match the rules to one device.

It is more intuitive for me to take the monitoring host as an example. This DS-7808N-F1 usually uses port 8000 to view real-time preview, and may use other ports for playback. I can’t count which ones to open for a while. DMZ is just trying to save trouble: I only fill in an intranet IP 192.168.31.66 , which is equivalent to telling the router that in addition to the rules that have been written, all remaining connections coming from the outside will be sent to it. Port forwarding only opens the door, but DMZ moves the machine directly to the guard, so that anyone outside can reach it.

The difference between these two concepts, I am What is the difference between port forwarding and DMZ? I’ve broken it down once, and I’ll just remember one sentence here.: For home users, if you can specify a port, port forwarding will be done first, and DMZ will be left for last.

Check the public IP address before opening, otherwise filling it out will be in vain.

This was the pit I stepped into first. Before the rules page was opened, my mind first defaulted to "if you have broadband, you will have a public IP address." However, after filling it out, I couldn't connect to the company. Later, I put the router's WAN port IP and the IP detected from the mobile phone traffic together, and found that they didn't match up.

The judgment method is not complicated. First step, enter 192.168.31.1 , find the WAN port IP in common settings or Internet settings, and copy the address. The second step is to use mobile phone traffic to open ip.cn , or search "IP" directly to see the address it displays. The third step is that if the two addresses are the same, it means that the public IP really falls on your Xiaomi router, and DMZ or port forwarding can be used.

My broadband here does not require a public IP, and the WAN port of the router shows 100.64.100.23 , the mobile phone traffic was found to be another address starting with 113.108. There is a large intranet of the operator in the middle, which is often called NAT444 or double NAT. At this time, if you open the DMZ in the Xiaomi router, your home cannot be touched at all from the outside, and it will always spin in circles no matter how you measure it. You have to ask the operator for a public IP first, or have the optical modem change to bridging and let the Xiaomi router dial by itself.

How to check double NAT and how to deal with it on the optical modem side? I'm here What does double NAT mean? Wrote in. I only emphasize one sentence here: As long as the WAN port IP starts with 100.64 to 100.127, 10, 192.168, 172.16 to 172.31, there is basically no public IP. Solve this layer first, and then come back to open the DMZ.

31.1 Four steps in the background: Advanced Settings→Port Forwarding→Scroll to the bottom

There is indeed no DMZ in the Mijia App. Enter it through the mobile browser. 192.168.31.1 What I saw was also a simplified version, and I jumped repeatedly between the phone and the app on the first night. After sitting back at the computer, I straightened it out, and the path was only four steps.

The first step is to connect the computer to the Xiaomi router and open the browser. 192.168.31.1 , you can also lose miwifi.com . The second step is to go to common settings and find advanced settings. The third step is to click port forwarding. Step 4: Scroll down the page to the end. The DMZ switch is lying there. Don’t use the search box to find it. Some firmwares cannot be found.

If even 192.168.31.1 It cannot be opened by itself, then DMZ is a later matter, press first Xiaomi router 192.168.31.1 What should I do if I can’t open it and can’t get in? Check, otherwise the page will not be accessible. If you really don’t have a computer at hand, you can also try switching to the desktop version of the web page using your mobile browser, but it’s still unstable due to the many steps, so I don’t recommend using your mobile phone.

After turning on the DMZ switch, the system will ask you to select an intranet device. Don’t make the wrong choice here, especially if you have a bunch of Mijia devices at home, the list will look like a phone book. I am used to writing down the IP and MAC of the target device on paper in advance. For example, Hikvision NVR is fixed to 192.168.31.66 , directly check the number when selecting, without guessing based on the device name.

After selecting, click Save and take effect. Some firmwares will not clearly indicate success after saving, and will only jump back to the previous page. Go back to the port forwarding page and see that the DMZ switch is still on, which means it has taken effect.

How to verify from the external network after filling in the form?: Use mobile data, don’t use home WiFi

When I verified it for the first time, I connected to WiFi at home to access the public IP and port 8000, but it couldn't be opened. I almost turned the DMZ off and on, and restarted the router three times. Later, I changed the mobile phone data and it was connected in one go. There is a special term for this difference called NAT backflow. Many home routers do not support it. If you use the public IP to access yourself from the intranet, it will be blocked as a loopback. It is not a mismatch of the rules.

I later fixed the verification sequence into three steps. First, confirm that the internal network of the target device is normal, for example, another mobile phone can be connected to the home WiFi to access it. 192.168.31.66:8000 , if it can be opened, it means that the service itself is alive. Second, mobile phone traffic accesses the public IP plus port 8000. If it can pass, it means the DMZ is in effect. Third, if the internal network is connected but the traffic is blocked, go back to the previous section to check the public IP address, and do not restart the router again.

There is also a situation where the internal network cannot be opened. The problem is that the device firewall or the service is not up. Windows can be run from the command line netstat -ano | findstr 8000 , see if any process is listening ； For Hikvision's monitoring, you can check the ports and firewalls in the system settings. DMZ just dismantled the door, and there must be someone behind the door. This is not nice to hear, but it is the most effective.

Do NAS and cameras need to open DMZ? My conclusion is that if you can’t open it, don’t open it.

In the days after opening the DMZ for monitoring, I went through the router logs. At two or three in the morning, there were always strange IPs scanning ports 22, 23, and 3389. Although I finally filled in NVR instead of NAS, I thought that if I filled in Synology, it would be equivalent to exposing SSH, web backend, and file services. No matter how strong the password is, it will not be able to withstand being scanned every day.

So my principle is very simple: If you can count the service ports, use manual port forwarding. ； If there are too many ports and you are confused, consider DMZ and only open it on the days when it is needed. For example, for NAS running Feiniu or Synology, the web backend is usually 5000 or 5001. There is only one port for file transfer. It can be clearly counted, so there is no reason to push out the entire machine. Xiaomi’s port forwarding path, I just wrote an article How to set up port forwarding on Xiaomi router , just in the same advanced settings.

What is really suitable for DMZ is the kind of old surveillance, old DVR, old video conferencing host, the port table cannot be found in the document, and it needs to be used remotely immediately. This kind of equipment is very old, and the system may not have been updated in three years. Opening DMZ for a long time is equivalent to using the weakest machine in the house as a front. My approach is to use DMZ to get things done first, remember the port, then change back to manual port forwarding, and then turn off DMZ.

Remember to turn it off after taking the test. If you really want to turn it on for a long time, do these four things.

If you are like me and only watch the monitoring temporarily for a few days, be sure to go back to the port forwarding page and turn off the DMZ switch after finishing the work. This switch is for releasing everything, not automatically turning it off when the point is reached. If you forget to turn it off, it will stay on.

If there is an old piece of equipment that must be operated for a long time, then at least do the following four things:: Fix the device IP first, so that the IP does not change after restarting. 192.168.31.66 float to 192.168.31.70 ； Change the default password again and don’t let the combination of admin plus 123456 run around naked. ； If the firmware of the device can be upgraded, upgrade it. If the old DVR cannot be upgraded, then don’t store important data. ； Finally, only the required ports are placed in the device's own firewall, so that one less layer is added.

Finally, the ending. Xiaomi router DMZ path is not difficult to remember: computer in 192.168.31.1 , Advanced Settings→Port Forwarding→at the bottom of the page, open it and select an intranet IP. The real sequence should be to check the public IP first, then figure out whether the entire device must be exposed, and then take action. I am here What does double NAT mean? The light-cat layer mentioned in this article often determines success or failure more than the switch in Xiaomi's backend. First, clear the public IP line. DMZ is not a decoration.