What is the Routing Relation among the WAN, LAN and DMZ Ports in Different System Modes?

TL-ER6120 , TL-ER6020 , TL-ER5120
Recent updates may have expanded access to feature(s) discussed in this FAQ. Visit your product's support page, select the correct hardware version for your device and check either the Datasheet or the firmware section for the latest improvements added to your product.
On TP-Link ER series routers, like TL-ER6120, there are three available system modes (NAT, Non-NAT and Classic) suiting for different network requirements. For more information about the three system modes, please refer to the FAQ 676.
And on TP-Link ER series routers, there is a DMZ port, which is also call Hard DMZ to distinguish from the NAT-DMZ (also called software DMZ) function.
Note: the TL-ER604W has no DMZ port.
The Introduction of DMZ port
DMZ (Demilitarized Zone) is a network which has fewer default firewall restriction than the LAN does. It allow all the devices connected to the port to be exposed to the Internet for some special-purpose services.
The DMZ related function, such as DHCP server, will be available only when the DMZ is enabled as show in the picture below.
Note: you may need to reboot the router to bring this change into effect.
The Routing Relation among the WAN, LAN and DMZ port in different System Mode
As we can see in the picture above, the DMZ physical port can work in Public and Private Mode. In different DMZ Modes and different System Modes, the WAN, LAN and DMZ ports have different routing relationship. Here is the detailed instruction.
1. NAT & Classic Mode
In DMZ-Private Mode, the hosts in the LAN and DMZ can communicate with the WAN (Internet) via NAT, which means the IP address and port will be translated; while the hosts in the LAN and DMZ areas can communicate directly according to the route table without translating IP address. Hosts in the WAN cannot communicate with LAN and DMZ initiatively because of the NAT.
In DMZ-Public Mode, the hosts in the LAN can communicate with the WAN and DMZ via NAT; The hosts in the WAN and DMZ talk to each other according to the route table. The hosts in the WAN and DMZ cannot talk to the LAN initiatively as well in this situation.
2. Non-NAT Mode
In Non-NAT Mode, no matter what kinds of modes the DMZ port works in, the hosts in all the three areas communicate with each other according to the route table. The NAT function of this router will be disabled at all in this situation.
The Routing Relation among the Multi WAN Ports
For routers with multi WAN ports like TL-ER6120, the routing relation among the WAN ports has some difference in different System Modes.
1. NAT mode
In NAT mode, the hosts in different WAN areas are unreachable via the router.
2. Non-NAT & Classic Mode
In non-NAT and Classic Mode, the hosts in the different WAN areas can communicate with each other according to the route table.
By concluded, we can have all the situation in the table below:
Is this faq useful?
Your feedback helps improve this site.
What’s your concern with this article?
- Dissatisfied with product
- Too Complicated
- Confusing Title
- Does not apply to me
- Too Vague
- Other
Thank you
We appreciate your feedback.
Click here to contact TP-Link technical support.

TP-Link Community
Still need help? Search for answers, ask questions, and get help from TP-Link experts and other users around the world.
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy . Don’t show again
This website uses cookies to improve website navigation, analyze online activities and have the best possible user experience on our website. You can object to the use of cookies at any time. You can find more information in our privacy policy . Don’t show again
Basic Cookies
These cookies are necessary for the website to function and cannot be deactivated in your systems.
TP-Link
SESSION, JSESSIONID, accepted_local_switcher, tp_privacy_base, tp_privacy_marketing, tp_smb-select-product_scence, tp_smb-select-product_scenceSimple, tp_smb-select-product_userChoice, tp_smb-select-product_userChoiceSimple, tp_smb-select-product_userInfo, tp_smb-select-product_userInfoSimple, tp_top-banner, tp_popup-bottom, tp_popup-center, tp_popup-right-middle, tp_popup-right-bottom, tp_productCategoryType
Youtube
id, VISITOR_INFO1_LIVE, LOGIN_INFO, SIDCC, SAPISID, APISID, SSID, SID, YSC, __Secure-1PSID, __Secure-1PAPISID, __Secure-1PSIDCC, __Secure-3PSID, __Secure-3PAPISID, __Secure-3PSIDCC, 1P_JAR, AEC, NID, OTZ
Zendesk
OptanonConsent, __cf_bm, __cfruid, _cfuvid, _help_center_session, _pendo___sg__.<container-id>, _pendo_meta.<container-id>, _pendo_visitorId.<container-id>, _zendesk_authenticated, _zendesk_cookie, _zendesk_session, _zendesk_shared_session, ajs_anonymous_id, cf_clearance
Analysis and Marketing Cookies
Analysis cookies enable us to analyze your activities on our website in order to improve and adapt the functionality of our website.
The marketing cookies can be set through our website by our advertising partners in order to create a profile of your interests and to show you relevant advertisements on other websites.
Google Analytics & Google Tag Manager
_gid, _ga_<container-id>, _ga, _gat_gtag_<container-id>
Google Ads & DoubleClick
test_cookie, _gcl_au