Im facing some problems trying to create a DMZ virtual machine in Hyper-v.

Firstly, i want to create a DMZ so the company's smartphones can be managed remotely.We have an ESET ERA server installed, so we want to install the Mobile Device Connector on a DMZ environment.

The host has 2 NIC's, one for the LAN and one that i use for the DMZ. I created a virtual switch for the 2nd NIC, and used it as External for the DMZ machine. The DMZ machine must connect to a virtual server that has the ESET Remote Administrator installed.At least with the SQL.

We have a Watchguard XTM 26 firewall, i created an optional ( since watchguard doesn't use the term DMZ) interface and connected the 2nd NIC to the optional interface directly. Now, the machine shouldn't have any contact with the rest of the LAN, yet i can ping it from any PC, except from the other virtual servers we have.

What i had in mind was to create the DMZ environment, the server on the DMZ to be isolated, and control the connections with the firewall.

I have various policies in mind, but seeing as the DMZ server has connection with the LAN, i dont see how it will work.

My question is : Can you see what i did wrong, and/or could you show me a good practice doing something similar ?

If you need more information , please tell me.

Thank you.


So you separated one of the ports from the switch group on the Watchguard? I don't know if on Watchguards if all the LAN ports default to being in a switch group.

I don't see anything labelled "option" on the back of that Watchguard device.

You will want to set your default gateway for your DMZ network and then create static routes for your internal subnets for your LAN adapter.


It seems that Watchguard allows communication between Optional and Trusted Interfaces. That was the problem. I thought that by default it doesnt allow communication between Optional and Trusted. All i had to do is create the policity Deny All from Trusted to DMZ.

Thank you all for your time.

  • I am glad you figured things out but I wanted to make a slight correction. A Watchguard device will only allow traffic to pass as defined by its policy configuration. However, the the Ping policy that is added by default to a new configuration will allow pings from Any-Trusted and Any-Optional to Any which would allow you to ping the optional network from the trusted and vice versa. The default starter configuration would not have allowed any other communication between networks though. I usually modify the default to use the Any-External and Firebox aliases in the To field instead of Any.
    – learley
    Jul 26 '16 at 21:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.