Regarding the DMZ Host (private IP address), it is a local computer exposed to the Internet. Therefore, an incoming packet will be checked by Firewall and NAT algorithms in BILLION BROADBAND ROUTER , then passed to the DMZ host when packet is not sent by hacker and not limited by virtual server list. Besides, there are some IP protocols that do not have port number information. There is no way to use Virtual Server setting to forward incoming packet. Therefore, DMZ host is the easy to forward this kind of packets. If you enable and set virtual server and DMZ host, the precedence is Virtual Server and then DMZ. For example, the incoming packet will be checked with Firewall rules, Virtual Server rules and then DMZ host.