Why don't you just remove the route between DMZ and other networks?

If you have a route in the router, block it there; if you defined VIFs in the switch, remove the VIFs. Normally, neither the router nor the switch have Inter-VLAN routing enabled for different networks, so Inter-VLAN routing has to be explicitely allowed in the router or in the switch.

Also be aware that a real DMZ is firewalled from the rest of the network by two firewalls – one between the WAN and the DMZ and one between the DMZ and the rest of the network. You would not physically connect the DMZ to any of the devices managing the remaining network such as switches. Reason for this is that if a hacker gains access to a system inside the DMZ (e.g. a server connected to a switch), he could use it to further explore the LAN network by trying to hack the switch. Other devices in the LAN should be only connected to the second firewall which isolates the DMZ from the WAN. This can be another router, too.

@Mike63 ok, so I think you don't actually want a DMZ, but a guest network. Maybe my »HowTo set up a guest network« recipe (method 2) can show you a way of setting up an isolated network using VLANs. You can see the principle there, it's not only related to wireless APs/EAPs, but shows how to set up isolated VLANs for wired devices, too. Maybe this helps.

You could implement this using ACLs in the switch, too, but it will be much harder to maintain over time, e.g. when devices are being replaced, MAC addresses/IP changes etc. I prefer to use routers for isolation/routing/sharing resources.

Mike63 wrote

I did try the 2-Cable-Solution, but I wanted to avoid the fully isolated guest config.

 

Regarding the second router, I thought that a VLAN with L2+-Routing could work as a virtual stand-in. It seems for that to work I would need a VLAN-aware Router first hand.

Not necessarily, but it can make setups somewhat harder if you only have ACLs. A stateful firewall also allows blocking/accepting as with ACLs, but it allows many more functions not necessarily found in managed switches.

For example, in my network I use VLANs for isolation and for separation of broadcast domains. I do use switch ACLs on my T1600G to grant a single management laptop access to the management VLAN and to permit access from wireless EAPs in the guest VLAN (not a DMZ) to an EAP controller running in the management VLAN, both without sending the traffic through the router. ACLs and Inter-VLAN routing in the switch is a very nice feature, but an L2+ switch is not meant to replace a router, it rather takes some load away from the router in big networks.

Now, I would like to set up a routed port on the switch to the router so that I can restrict traffic between my local VLAN-splitted networks and the router to Internet traffic only. That's a scenario where switch ACLs have to be used anyway, since for such a setup access control can't be done on the router.

My switch is a T1600G-28TS HW V1, it has VLANs, VIFs and routing features. But it has no DHCP server. This means I can not use routed ports for this use case, so I need to still use a VLAN trunk for passing all other LAN traffic to the router, just b/c of DHCP. You see, I'm in a similar situation like you are.

OTOH I could use an external DHCP server, but hey, costs for mains power will increase again next year. That could be a reason for me to upgrade to a switch with L2+ services when I become rich :-), probably a T2600G, but maybe preferably a T1700G-28TQ. They both have real cool features for a very good price nowadays.

But for now I use what I have and I'm really happy with that. 30 years ago such switches did cost around 10k to 15k.

So, I will try to stage my older Horst 9370 as second router and see my mileage. Gaming might be an issue, though. Kids and their  Dad do this sometimes 😎. 

Double NAT might cause problems ony for multi-user games connecting to a game server outside your network, which need a smooth and fast connection to the server (see this FAQ as an example). Double-NAT increases latency somewhat. But it causes no problems at all for games inside the local network. Also, double NAT affects port forwarding (you need two forwardings, one for each router) or UPnP (which I always turn off anyway).

Are there special requirements to activate NAT on the second router?

NAT in the topology shown above was meant only as a protection of the LAN against accesses from within the DMZ if a server would become exploited by Hugo Hacker.

The alternative if you don't use a DMZ at all would be to turn off NAT in the second router and use a simple static network route on the horstBOX to pass traffic from the Internet to the LAN over the second router.

Most SOHO routers which have a port labeled »WAN« or »Internet« always do NAT out of the box. Multi-purpose routers allow to enable/disable NAT. There are even multiple NAT functions to choose from (DNAT, SNAT, MASQUERADE). See the iptables / netfilter documentation for examples how NATing is done on Linux-based routers.

In case of horstBOX SNAT is always activated, but can't be turned off, thus making the horstBOX a vollhorstBOX. :-)

I need to use this router for telephony too, but I use it also as the cable modem for my main router running under a second public IP. Thus, my main router runs in parallel to the horstBOX, whose LAN is unused except for access to the horstBOX's web UI.

If so, I would rather invest in some older discounted pfsense firewall or mikrotik router.

pfSense is based on FreeBSD Unix, which has an excellent stability. FreeBSD is often used for critical services running on Internet servers and it is also the base system in Apple's MacOS. MikroTik runs the proprietary RouterOS, I have no experience with this. I did choose EdgeRouter-X which is based on Debian Linux and runs Vyatta. Vyatta is somewhat more difficult to config in my opinion, but the ER-X uses a MIPS CPU and thus has a stunning I/O performance (≥ 930 Mbps NAT throughput with hardware off-loading turned on). MIPS CPUs have been originally designed for SGI supercomputers and some CPU types have been scaled down for use in embedded systems, that's why they are so fast compared to ARM CPUs, which come from the other, power-save side and had been scaled up for speed. I'm definitely biased here, since I worked with SGI MIPS systems most part of my life, still use them today.

Last but not least there is OpenWRT, which runs on 1.500+ embedded platforms such as WLAN routers including TP-Link WDR and Archer series. OpenWRT is a full-fledged Linux, but stripped down for embedded systems. It is very versatile as well as very user-friendly at the same time. I use OpenWRT on another router in my network, too.

Mike63 wrote

 

Oh, I guess adding a second VLAN in the trusted environment for e.g. the isolated home office workplace would then work out-ofxthexbox.

All routers/OSes mentioned above lets you freely create any network you want including VLANs, yes.