Right DMZ's De-Militarized Zones

Say you have two networks say an untrusted one such as the internet and a trusted one such as your home network.

You have a service on your trusted network that you want to provide to the untrusted one, the quick and dirty way to do this is port forwarding.

This way traffic bound for say a web server on the entry point of your router to the untrusted network (your external IP address) gets redirected to a specific machine on your trusted network.

The trouble with this approach is that if this specific machine gets compromised (or the attacker manages to confuse the port forwarding) then the attacker has potentially gained access to your entire trusted network.

So what you do is have 3 networks rather than 2, a trusted one, an untrusted one and a DMZ. In a "proper" set up these would actually be separately wired networks either vlan'd off or actually on separate switch hardware. But in most of the home gateway routers I have seen it's simply a different subnet for the Trusted and DMZ networks.

Now all of the machines that you want to serve the untrusted network sit in the DMZ, with VERY specific rules about how the DMZ interfaces can talk to your trusted and untrusted networks.

This way if an attacker compromises one of your external services, they still need to fight your firewall before getting access to your trusted network.

What you will probably be doing is using the "main" computer to provide external services anyway. In this case there is little advantage to using a DMZ.