Configure DMZ in RouterOS

Article Title: Configure DMZ in RouterOS. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

DMZ is the abbreviation of "demilitarized zone" in English. It is called "isolation zone" in Chinese, also known as "non-military zone ". It is a buffer zone between a non-security system and a security system to solve the problem that the external network cannot access the internal network server after the firewall is installed, this buffer zone is located in a small network area between the enterprise's internal network and the external network. Some public server facilities can be placed in this small network area, such as Enterprise Web servers, FTP servers, and forums. On the other hand, such a DMZ region is more effective in protecting the internal network, because such network deployment, compared with the general firewall solution, has another level for attackers.

The vro has three NICs.
CODE

[Admin @ gateway] interface> print
Flags: X-disabled, D-dynamic, R-running
# Name type RX-RATE TX-RATE MTU
0 R Public ether 0 0 1500
1 R Local ether 0 0 1500
2 r dmz-zone ether 0 0 1500
[Admin @ gateway] interface>

Add all required IP addresses to the NIC
CODE [Admin @ gateway] ip address> print
Flags: X-disabled, I-invalid, D-dynamic
# ADDRESS NETWORK BROADCAST INTERFACE
0 192.168.0.2/24 192.168.0.0 192.168.0.255 Public
1 10.0.0.254/24 10.0.0.0 10.0.0.255 Local
2 10.1.0.1/30 10.1.0.0 10.1.0.3 DMZ-zone
3 192.168.0.3/24 192.168.0.0 192.168.0.255 Public
[Admin @ gateway] ip address>

Add default static routes to vrouters
CODE [Admin @ MikroTik] ip route> print
Flags: X-disabled, I-invalid, D-dynamic, J-rejected,
C-connect, S-static, r-rip, o-ospf, B-bgp
# DST-ADDRESS G GATEWAY DISTANCE INTERFACE
0 S 0.0.0.0/0 r 192.168.0.254 1 Public
1 DC 10.0.0.0/24 r 0.0.0.0 0 Local
2 DC 10.1.0.0/30 r 0.0.0.0 0 DMZ-zone
3 DC 192.168.0.0/24 r 0.0.0.0 0 Public
[Admin @ MikroTik] ip route>

Add IP address 10.1.0.2 and gateway address 10.1.0.1 to the DMZ server

Configure the dst-nat rule to enable the DMZ server to access through the Internet address 192.168.0.3.
CODE [Admin @ gateway] ip firewall dst-nat> add action = nat \
\... Dst-address = 192.168.0.3/32 to-dst-address = 10.1.0.2
[Admin @ gateway] ip firewall dst-nat> print
Flags: X-disabled, I-invalid, D-dynamic
0 dst-address = 192.168.0.3/32 action = nat to-dst-address = 10.1.0.2
[Admin @ gateway] ip firewall dst-nat>