DMZ + switch question

[invictius]

1) I heard about using DMZ instead of unblocking countless ports, and particularly for the ps2s' DNAS feature. However, apparently, it's not a wise thing to do with a pc connected. I just used my routers' IP address for the host IP, and wham, all my ports are unblocked. I'm running a software firewall, is using DMZ like this particularly risky?

2) If I plug a switch into my dsl router, will that mean that all pc's connected to that router will have internet access without having to set IP addresses, and can I have the pc's all see each other on a LAN without any more settings than is normally used for say, a crossover (IP+subnet)?

[=ACID RAIN=]

1) DMZ is risky, yes. However the likelihood of being found on the web and hacked purposefully is unlikely. Software firewalls are the weakest and can fail open (meaning they get killed and the computer is vulnerable, whereas a router could lock up and fail closed). So is there a risk? Yes. Will you get nailed as a result? It's a toss up. Flip a coin haha.

2) Most routers are DHCP by default, so unless you forced static IPs, your computers will grab IPs assigned by the router as soon as they see each other. A switch is a "passive" device, if you will, only forwarding packets to ports. I could go into layer 2 and 3 of the OSI model at this point, but I'll keep it simple since this is a new topic for you ;). At this point since all the PCs are behind the same gateway with the same subnet, they will see each other, yes. No need to do anything else for that to happen. If you want shares, just share a folder on a given PC and then from another go to start > run > and type in \\192.168.1.2 (example IP, you can also use hostname if browser elections have already worked themselves out, take a while though) and hit enter.

[skidooosl]

what type of router do you have? are we talking a true DMZ or what the Home routers (linksys, netgear, dlink ect..)call a "DMZ"???

A DMZ is a seperate network segment from your internal network... servers that require external access are placed in a DMZ segment and access can be controled via firewall policy from both internal computers and from the internet.... this does not have to mean wide open access from the internet, for example if it is an web server you would open 80 or 443 from the internet to the server and you could also do the same from the internal network to the server.... what they call a DMZ on a residential router is.... weird....

if you have a firewall that can run dd-WRT or openWRT you can assign one of the switch ports to a new VLAN and set it up as an interface with a different IP address...

for example
switch ports 1 - 3 Internal: 192.168.0.1 / 24
switch port 4 DMZ : 10.0.1.1 / 24

you could then create firewall rules to allow access to the 10.0.1.1/24 network from both the internet and internal network for only access that is required.

when you plug a PC into your modem what IP address is assigned? if it is an internal address that will work by plugging in a switch.... if you get an external address it may or may not work.... AND your ISP may or may not be angry