Internet pass-through from DMZ to external Wireless Router

Question

Hello, 
 
 First off, I've found this forum an extremely useful resource and mostly managed to find the info I need by searching, alas I can't seem to find the answer to the following. 
 
 I use an SG115 with the Sophos UTM home license, along with an AP55c AP. So far I've been fine with the 50 IP limit. Now, with all my smart plugs etc I'm starting to regularly skirt the 55 IP limit. 
 
 I'd like to move all my IoT devices onto a segregated network so that they don't count against the IP limit. They only need internet access and obviously no access back into the internal network, or each other. I have a Mikrotik wireless router lying around unused so I'd like to use that for this purpose. 
 
 My theory is that I can use the DMZ port on the SG to pass-through the Internet connection to the miktrotik, where I can set the wireless rules. I 'think' I need to do the following, can someone please tell me if I'm way off base here? thanks in advance: 
 
 1- Create the DMZ Interface on the UTM, Eth2 (DMZ) and give it an IP e.g. 192.168.88.2 
 2- Create a Masq rule as follows - Network - Any, Interface DMZ 
 3 - Firewall Rule - Source - Any, Services - Web Surfing, Destinations - DMZ, ALLOW 
 
 Then on the Microtik side, the Router IP is 192.168.88.1, set WAN address to 192.168.88.2 
 will this work? 
 
 Thanks in advance 
 -Phil

apijnappels · Answer

When you hit the IP-limit you could have a look at the (also free) XG firewall product, there's no IP limit anymore (but it's totally different from UTM so you need to relearn a lot). 
 Using additional routers to hide IP's from the UTM is probably against the license agreement so I don't recommend it but you could probably do this more easy: 
 Connect the additional router inside your LAN with it's WAN port and connect IOT devices to the LAN port of the additional router. 
 If no traffic needs to go to the IOT devices, then that's all to it, no additional setup on the UTM needed.

BAlfson · Answer

Hi Phil - your first thread - welcome to the UTM Community! 
 Interesting - the first time I've seen this question asked in such a way that I thought about how to "hide" a subnet and not contravene the licensing agreement... 
 If you're not using anything other than NAT and Firewall for your IoT network, I think you would be in compliance: 
 
 Make an Exception for 192.168.88.0/30 for everything in Intrusion Prevention. 
 Don't include 192.168.88.0/30 in Web Filtering. 
 Exclude 192.168.88.0/30 in Application Control. 
 Add 192.168.88.0/30 to 'Threat Exceptions' in 'Advanced Threat Protection'. 
 
 If anyone sees something I missed, please comment. 
 Cheers - Bob