DMZ built of combination of MASQUERADE and/or FullNAT and/or DNAT???

@dilandau  the objective, I don't know I read at a couple of places here, that a DMZed interface needed firewall+masquerading+DNAT or Firewall+fullNAT, 

I didn't manage to get any results with FullNAT, 
I also read that Masquerading is SNAT, so I figured that was the reason , I read that what was neeeded is firewall+masquerading+DNAT
I'm not hosting any server, all I want is a full DMZed interface, I want devices connected to that interface to have a FULL unfiltered unbiased unfirewalled un-nothing access to the internet, like if it was directly connected.

so if I understand what your saying, is that the DNAT + firewall#4 is needed ONLY if I'm hosting, and I would need unsollicited packets coming in ...
in my case connections are always initiated from inside, no need for that...

so for the other item, I think I get this, internet does not equal anyIPv4....
so by designating internet, instead, I would NOT have to drop packets in rule#1...since the firewall would drop them anyway...
good point !
finally 
firewall live log shows white lines concerning the DMZed interface, webfiltering is OFF, IPS is applied only to interface-MAIN and interface-GUEST, so DMZ is not concerned
the problems with web-browsing :
well the wheel spins to oblivion, 
but If I :
ping www.google.com
or
traceroute www.google.com
I get "unknown host" 
but if I do it with an address
ping 8.8.8.8
or
traceroute 8.8.8.8
it's successful

so that must be DNS...

I'm not hosting any server, all I want is a full DMZed interface, I want devices connected to that interface to have a FULL unfiltered unbiased unfirewalled un-nothing access to the internet, like if it was directly connected.

For this all that are necessary is Firewall rules to allow traffic and a NAT Masq rule.

so if I understand what your saying, is that the DNAT + firewall#4 is needed ONLY if I'm hosting, and I would need unsollicited packets coming in ...
in my case connections are always initiated from inside, no need for that...

Yes. that is correct.

so for the other item, I think I get this, internet does not equal anyIPv4....
so by designating internet, instead, I would NOT have to drop packets in rule#1...since the firewall would drop them anyway...
good point !

Yes, the Internet object is the same as ANY but is bound to the Interface with the Default gateway. So it only always traffic that traverses the External Interface.

 IPS is applied only to interface-MAIN and interface-GUEST, so DMZ is not concerned

You can't turn the IPS on for specific interfaces, so add the DMZ to the local networks or if you want it unfiltered create an exception for the DMZ network. Check the IPS log, it may be blocking the DNS traffic or it may be an Issue with OpenVpn as Barry mentioned.

dilandau 

dilandau said:

Yes, the Internet object is the same as ANY but is bound to the Interface with the Default gateway. So it only always traffic that traverses the External Interface.

 

What if there are 2 external interfaces, and the one designated as the default gateway is NOT the one the traffic sould go through,

how the firewall rule should be then?

It cannot be AnyIPv4, it cannot be InternetIPv4, what should it be ? 

External(Address) or External(Network) or ???

Thanks.

The Traffic Selector would be 'Internal (Network) -> {Services?} -> Any' for a WAN connection without a default gateway.

Back before we had Uplink Balancing with Multipath rules, we had to use Policy Routes to get traffic to go out a second WAN interface.  I would give your second WAN connection a default gateway and use Multipath rules to select which traffic should go through which connection.  This would make your existing WAN-1 firewall rules also work for WAN-2.

Cheers - Bob

The Traffic Selector would be 'Internal (Network) -> {Services?} -> Any' for a WAN connection without a default gateway.

Back before we had Uplink Balancing with Multipath rules, we had to use Policy Routes to get traffic to go out a second WAN interface.  I would give your second WAN connection a default gateway and use Multipath rules to select which traffic should go through which connection.  This would make your existing WAN-1 firewall rules also work for WAN-2.

Cheers - Bob