@consmast 

From the WAN side of the ER605, any port not explicitly forwarded to specific host on the LAN side, will get forwarded to the IP that you specify as the DMZ.  In short you are fine.

Imagine you have two webservers running on port 80, let's call the A and B.  Initially, you set A as your DMZ with no other custom settings.  Anyone trying to connect to your WAN public IP on port 80 will connect to port 80 on A.  Now imagine you set a forwarding rule, specifically for TCP port 80 so that port 80 now goes to B.  In this case, outside requests will now go to B only.  Regardless, all hosts on the LAN can continue to access either A:80 or B:80 normally regardless of whether a DMZ or forwarding rules are in place.

  @consmast 

Looking forward to your questions.  To be super clear, DMZ is only from WAN-to-LAN, it does not prevent any LAN-to-LAN activity, so yes, so if your DMZ host is compromised, it can be used to attack any other host on your LAN.

If the above scenario is of concern, then the DMZ host should be in a separate subnet, with suitable ACLs applied to prevent any DMZ-host initiated communication to the rest of your LAN subnet(s), and this may involve adding a switch to your solution get stateful ACLs (Omada gateway ACLs are limited).

  @consmast 

What I would like to achieve is:

• WWW-server is available from the outside
• Laptop1 and Laptop2 can reach WWW-server within LAN
• WWW-server cannot reach Laptop1 and Laptop2

As all machines are within same LAN connected via switch I believe ER605's DMZ is not play any role in this setup, correct?

CORRECT

Then questions:

1. how to configure the best the desired setup on the ER605?

I WOULD SUGGEST CREATING TWO LAN SUBNETS ON THE ER605.  ONE WILL BE THE DMZ SUBNET, THE OTHER WILL BE YOUR NORMAL LAN SUBNET, EACH WILL HAVE THEIR OWN VLAN ID ASSIGNED.  KEEP VLAN1 FOR THE LAN AND CREATE VLAN10 FOR THE DMZ.  CONFIGURE ONE OF THE ROUTER PORTS TO BE NATIVE TO VLAN10 AND PLUG THE SERVER INTO THIS PORT.

2. should I use VLANs if I have all devices connected to one switch? Or it's better to define new LAN connected to particular port

YOU ASSIGN VLAN10 TO ONE OF THE ER605 LAN PORTS AND DIRECTLY CONNECT YOUR SERVER TO THIS.

3. if VLAN setup is advised: should I configure it on ER605 or TL-SG1016PE?

ER605

4. is there any more detailed documentation for ER605?

NOT REALLY.  HOWEVER I THINK (HAVE NOT TESTED) WE WILL USE THREE FEATURES OF THE ER605.  THE FIRST ONE WILL BE TO CREATE A ROUTER ACL TO BLOCK VLAN1 FROM TALKING TO VLAN10.  THIS BLOCKS THE ENTIRE SUBNET AND IS NOT STATEFUL AND WILL PREVENT THE SERVER FROM REACHING OTHER DEVICES ON YOUR LAN SUBNET.  THE SECOND FEATURE IS THE WAN IP REFLECTOR, SO WHEN LOCAL DEVICES WANT TO REACH THE SERVER, THEY DO NOT USE ITS LOCAL LAN IP, THEY USE THE PUBLIC WAN IP (OR DNS ADDRESS IF YOU HAVE THAT SETUP) OF THE ER605, AND THE ER605 WILL HAIRPIN THIS CONNECTION TO THE SERVER BECAUSE THE DMZ IS POINTING IT THERE.  THE THIRD FEATURE IS TO CONFIGURE THE ER605 DMZ TO BE THE IP OF THE SERVER.

And bonus questions (my curiosity) regarding your example with WWW servers A and B (previous reply): if I put 2 hosts with WWW server running into NAT-DMZ without any specific forwarding rules, reaching WAN:80 will redirect me to which hosts?

THE ER605 DEFINES A DMZ IP, NOT A DMZ SUBNET, SO YOU CAN ONLY SPECIFY 1 HOST WITHOUT SPECIFIC FORWARDING RULES.

  @consmast 

Just personal experience with the gear :)

Yes you can trunk VLAN 10 through the switch too for bonus points, but you will want to test your isolation.