How Does a Home Network Actually Work? From LAN/WAN to WISP, VLAN, and VPN
A home network can be pictured in its simplest form like this:
Internet
│
ISP Network
│
Home Router
│
┌─────────────┼─────────────┐
│ │ │
Laptop Phone NAS
Enter fullscreen mode Exit fullscreen mode
The home router connects two different worlds: the external network reached through the ISP, and the local network where devices such as laptops, phones, TVs, and NAS systems live.
Behind this seemingly simple topology, concepts such as LAN, WAN, subnets, DHCP, routing, NAT, firewalls, bridging, and VLANs all work together.
1. The Home Network, the ISP, and the Internet Side
LAN and WAN
LAN — Local Area Network refers to the local side of a router. Devices such as laptops, phones, smart TVs, printers, and NAS systems usually live on this side.
Suppose the router’s LAN address is:
192.168.1.1/24
Enter fullscreen mode Exit fullscreen mode
Devices on the network might have addresses such as:
Laptop 192.168.1.20
Phone 192.168.1.30
NAS 192.168.1.50
Enter fullscreen mode Exit fullscreen mode
All of them belong to the same local IP network:
192.168.1.0/24
Enter fullscreen mode Exit fullscreen mode
In practical terms, the LAN is the side of the router where the local devices managed by that router reside.
WAN — Wide Area Network, on the other hand, refers to the side where the router connects to an upstream network outside its own LAN.
In a typical home network:
Internet / ISP
│
WAN
│
Router
│
LAN
│
Home Devices
Enter fullscreen mode Exit fullscreen mode
LAN and WAN do not describe different types of Ethernet cables or fundamentally different physical connections.
The same ordinary Ethernet connection can serve as a LAN connection in one topology and a WAN connection in another.
Consider two routers connected together:
Internet
│
Upstream Router
LAN: 192.168.1.1
│
│ Ethernet
▼
Downstream Router
WAN: 192.168.1.50
LAN: 192.168.10.1
Enter fullscreen mode Exit fullscreen mode
The 192.168.1.0/24 network is:
- the LAN of the upstream router,
- but the WAN-side network of the downstream router.
So LAN and WAN are relative concepts. Their meaning depends on the router from whose perspective the topology is being viewed.
Upstream and Downstream
In networking, the direction toward the Internet or a higher-level network is generally called upstream.
The direction toward end-user devices is generally called downstream.
For example:
Internet
│
Upstream Router
│
Downstream Router
│
Laptop
Enter fullscreen mode Exit fullscreen mode
The router closer to the Internet is upstream relative to the router behind it.
This terminology becomes particularly useful when several routers are connected in sequence.
What Does the ISP Do?
An ISP — Internet Service Provider connects the home network to the wider Internet.
At a very high level:
Home Devices
│
Home Router
│
ISP Network
│
Internet
Enter fullscreen mode Exit fullscreen mode
The ISP provides connectivity between the subscriber’s network and its own infrastructure, and from there to other networks on the Internet.
Depending on the connection type and ISP architecture, the router or modem/router receives an IP configuration on its ISP-facing side.
If the router receives an address such as:
203.x.x.x
Enter fullscreen mode Exit fullscreen mode
and that address is globally routable, it can be a public IP address.
The topology may then look like:
Internet
│
Public IP
│
Home Router
│
Private LAN
192.168.1.0/24
Enter fullscreen mode Exit fullscreen mode
But a WAN address is not necessarily a public address.
Public IPs, Private IPs, and CGNAT
IPv4 defines several address ranges for private networks:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
Enter fullscreen mode Exit fullscreen mode
For example:
192.168.1.0/24
Enter fullscreen mode Exit fullscreen mode
is a private subnet.
A laptop using:
192.168.1.20
Enter fullscreen mode Exit fullscreen mode
does not appear on the global Internet as 192.168.1.20.
That address only has meaning inside the relevant private network.
A common home setup looks like this:
Laptop
192.168.1.20
│
Home Router
│
Public IP
203.x.x.x
│
Internet
Enter fullscreen mode Exit fullscreen mode
The router translates traffic from private local addresses to its Internet-facing address.
However, many ISPs use CGNAT — Carrier-Grade NAT.
In that case, even the home router may not receive its own public IPv4 address.
A simplified topology might look like this:
Home LAN
192.168.1.0/24
│
Home Router
WAN: 100.64.x.x
│
ISP CGNAT
│
ISP Public IP
│
Internet
Enter fullscreen mode Exit fullscreen mode
Address translation may therefore happen at two different levels:
192.168.1.20
│
Home Router NAT
▼
100.64.x.x
│
ISP CGNAT
▼
Public IP
Enter fullscreen mode Exit fullscreen mode
The public address is owned or managed by the ISP’s CGNAT infrastructure and may be shared by multiple subscribers.
This leads to an important distinction:
A WAN address and a public IP address are not the same thing.
WAN describes the role of an interface: it is the router’s upstream-facing side.
Whether the IP assigned to that interface is public, private, or shared depends on the surrounding network architecture.
2. How Is a Local IP Network Defined?
Subnets
A subnet defines the boundary of a Layer 3 IP network.
For example:
192.168.1.0/24
Enter fullscreen mode Exit fullscreen mode
is a subnet.
The /24 prefix means that the first 24 bits represent the network portion of the IPv4 address.
Its subnet mask is:
255.255.255.0
Enter fullscreen mode Exit fullscreen mode
For this network:
Network address: 192.168.1.0
Host addresses: 192.168.1.1 - 192.168.1.254
Broadcast address: 192.168.1.255
Enter fullscreen mode Exit fullscreen mode
Devices such as:
Laptop 192.168.1.20/24
NAS 192.168.1.50/24
Enter fullscreen mode Exit fullscreen mode
belong to the same subnet.
But:
192.168.10.20/24
Enter fullscreen mode Exit fullscreen mode
belongs to a different subnet.
Two hosts on the same subnet can normally communicate without sending the traffic through a router.
For example:
Laptop: 192.168.1.20
NAS: 192.168.1.50
Enter fullscreen mode Exit fullscreen mode
are part of the same Layer 3 network.
But:
Laptop: 192.168.1.20
Server: 192.168.10.50
Enter fullscreen mode Exit fullscreen mode
are on different subnets, so communication between them requires routing.
Default Gateway
When a host wants to reach an IP address outside its own subnet, it normally sends the packet to its default gateway.
Suppose a laptop has:
IP: 192.168.10.20
Gateway: 192.168.10.1
Enter fullscreen mode Exit fullscreen mode
If it wants to communicate with:
192.168.10.50
Enter fullscreen mode Exit fullscreen mode
the destination is inside the same subnet, so the laptop can reach it directly.
But if the destination is:
8.8.8.8
Enter fullscreen mode Exit fullscreen mode
the laptop determines that 8.8.8.8 is not part of 192.168.10.0/24.
It therefore sends the packet to:
192.168.10.1
Enter fullscreen mode Exit fullscreen mode
which is the router interface serving as its default gateway.
A useful definition is:
A default gateway is the next-hop router a host uses when the destination is outside its own subnet.
DHCP Server and DHCP Client
Devices do not normally need to have all of their network settings entered manually.
Home networks usually use DHCP — Dynamic Host Configuration Protocol.
A DHCP server can provide a laptop with information such as:
IP address: 192.168.10.20
Subnet mask: 255.255.255.0
Default gateway: 192.168.10.1
DNS server: 192.168.10.1
Enter fullscreen mode Exit fullscreen mode
The router is acting as the DHCP Server, while the laptop is acting as a DHCP Client.
A router can even act as both a DHCP client and a DHCP server at the same time, on different interfaces.
Consider this topology:
Upstream Router
DHCP Server
│
▼
Downstream Router
WAN = DHCP Client
│
▼
LAN = DHCP Server
│
▼
Laptop = DHCP Client
Enter fullscreen mode Exit fullscreen mode
The upstream router might assign the downstream router:
IP: 192.168.1.50
Gateway: 192.168.1.1
Enter fullscreen mode Exit fullscreen mode
on its WAN interface.
The downstream router might then assign the laptop:
IP: 192.168.10.20
Gateway: 192.168.10.1
Enter fullscreen mode Exit fullscreen mode
on its LAN.
This creates two independently configured IP networks.
3. How Does Traffic Move Between Different Networks?
Routers and Routing
The fundamental job of a router is to forward packets between different Layer 3 networks.
Suppose a downstream router has these interfaces:
WAN: 192.168.1.50/24
LAN: 192.168.10.1/24
Enter fullscreen mode Exit fullscreen mode
It is connected to two different subnets:
192.168.1.0/24
│
Downstream Router
│
192.168.10.0/24
Enter fullscreen mode Exit fullscreen mode
The router examines the destination IP address of a packet and consults its routing table to determine where that packet should go.
Suppose:
Laptop
192.168.10.20
Enter fullscreen mode Exit fullscreen mode
wants to send a packet to:
8.8.8.8
Enter fullscreen mode Exit fullscreen mode
Because the destination is outside the laptop’s subnet, the laptop sends the packet to its gateway:
192.168.10.1
Enter fullscreen mode Exit fullscreen mode
The downstream router may have a default route such as:
0.0.0.0/0 via 192.168.1.1
Enter fullscreen mode Exit fullscreen mode
It therefore forwards the packet to the upstream router.
The path becomes:
Laptop
192.168.10.20
│
▼
Downstream Router
│
▼
Upstream Router
│
▼
Internet
Enter fullscreen mode Exit fullscreen mode
That process is routing.
NAT and Double NAT
NAT — Network Address Translation modifies IP addressing information as packets pass through a device.
Consumer routers commonly use source NAT together with port translation.
Suppose a laptop creates a connection from:
192.168.10.20:53000
Enter fullscreen mode Exit fullscreen mode
When the packet leaves the downstream router’s WAN interface, it might become:
192.168.1.50:61000
Enter fullscreen mode Exit fullscreen mode
Conceptually:
192.168.10.20
│
│ NAT
▼
192.168.1.50
Enter fullscreen mode Exit fullscreen mode
Routing and NAT are related, but they solve different problems:
Routing → Which path should the packet take?
NAT → Should the packet's address or port be rewritten?
Enter fullscreen mode Exit fullscreen mode
NAT does not create the distinction between two subnets.
These:
192.168.1.0/24
192.168.10.0/24
Enter fullscreen mode Exit fullscreen mode
are already two different Layer 3 networks.
The router performs routing between them.
NAT may additionally rewrite addresses as traffic crosses between those networks.
If both the downstream router and the upstream router perform NAT, the topology contains double NAT:
Laptop
192.168.10.20
│
│ NAT #1
▼
Downstream Router
192.168.1.50
│
│ NAT #2
▼
Upstream Router
203.x.x.x
│
▼
Internet
Enter fullscreen mode Exit fullscreen mode
Normal outbound traffic such as web browsing, video streaming, and downloads usually works without issue through double NAT.
However, inbound connections, port forwarding, peer-to-peer applications, and some gaming scenarios can become more complicated.
Firewalls and Port Forwarding
Routing determines where traffic can go, but knowing a route does not automatically mean traffic is allowed to cross it.
A firewall determines which traffic may pass between interfaces or networks.
A simple policy might look like:
LAN → Internet ALLOW
Internet → LAN DENY
Guest → NAS DENY
Personal → NAS ALLOW
Enter fullscreen mode Exit fullscreen mode
This gives us another useful distinction:
Routing determines the path.
The firewall determines whether traffic is allowed to use that path.
Sometimes a service inside the private network needs to accept incoming connections from the WAN side.
This is where port forwarding is commonly used.
For example:
Router WAN
192.168.1.50:443
│
│ Port Forward / DNAT
▼
NAS
192.168.10.50:443
Enter fullscreen mode Exit fullscreen mode
The router takes connections addressed to a particular WAN port and forwards them to a specific internal host and port.
This is commonly implemented using Destination NAT — DNAT.
4. Communication Inside the Local Network
Switches, MAC Addresses, and ARP
Routers operate between Layer 3 networks.
A switch, by contrast, connects devices inside the same Layer 2 network.
For example:
Router
│
Switch
┌──────┼──────┐
│ │ │
Laptop NAS TV
Enter fullscreen mode Exit fullscreen mode
A switch forwards Ethernet frames primarily according to MAC addresses.
An IP address is a Layer 3 address:
192.168.1.50
Enter fullscreen mode Exit fullscreen mode
A MAC address is a Layer 2 address:
aa:bb:cc:dd:ee:ff
Enter fullscreen mode Exit fullscreen mode
In IPv4 networks, ARP — Address Resolution Protocol is used to discover which MAC address corresponds to a local IPv4 address.
For example, the laptop may effectively ask:
Which device owns
192.168.1.50?
The NAS may respond:
192.168.1.50
→ aa:bb:cc:dd:ee:ff
Enter fullscreen mode Exit fullscreen mode
The basic relationship is:
IP → Layer 3 address
MAC → Layer 2 address
ARP → Resolves a local IPv4 address to a MAC address
Switch → Forwards frames using MAC addresses
Router → Routes packets between IP networks
Enter fullscreen mode Exit fullscreen mode
Bridging
A bridge connects multiple Layer 2 interfaces so that they behave as parts of the same Layer 2 network.
A typical wireless access point provides a good example:
Ethernet
│
├── Bridge
│
Wi-Fi
Enter fullscreen mode Exit fullscreen mode
A laptop connected through Ethernet might have:
192.168.1.20
Enter fullscreen mode Exit fullscreen mode
while a phone connected through Wi-Fi might have:
192.168.1.30
Enter fullscreen mode Exit fullscreen mode
Both may still belong to:
192.168.1.0/24
Enter fullscreen mode Exit fullscreen mode
No new routed subnet needs to exist between Ethernet and Wi-Fi.
A useful distinction is:
A router connects different Layer 3 networks.
A bridge extends the same Layer 2 network across multiple interfaces.
5. Common Router Operating Modes
Once the difference between routing and bridging is clear, common router operating modes become much easier to understand.
Wireless Router Mode vs. Access Point Mode
In Wireless Router Mode, a device typically receives its upstream connection over Ethernet and creates a separate downstream LAN.
For example:
Upstream Router
LAN: 192.168.1.1
│
│ Ethernet
▼
Downstream Router
WAN: 192.168.1.50
│
Routing / NAT
│
LAN: 192.168.10.1
│
Downstream Clients
Enter fullscreen mode Exit fullscreen mode
There are two separate Layer 3 networks:
Upstream subnet: 192.168.1.0/24
Downstream subnet: 192.168.10.0/24
Enter fullscreen mode Exit fullscreen mode
The downstream device is truly acting as a router.
In Access Point Mode, the goal is different.
The device takes an existing Ethernet LAN and makes it available over Wi-Fi without creating another routed subnet.
Upstream Router
192.168.1.1
│
Ethernet
│
Access Point
)))
│
Phone
192.168.1.30
Enter fullscreen mode Exit fullscreen mode
The phone may receive its IP directly from the upstream router’s DHCP server and remain part of:
192.168.1.0/24
Enter fullscreen mode Exit fullscreen mode
The logical structure is approximately:
Ethernet ↔ Bridge ↔ Wi-Fi
Enter fullscreen mode Exit fullscreen mode
WISP, Wireless Extender, and Client Mode
WISP mode turns another Wi-Fi network into the router’s upstream or WAN connection.
For example:
Upstream Wi-Fi
192.168.1.0/24
)))
▼
Downstream Router
WAN: 192.168.1.50
│
Routing / NAT
│
LAN: 192.168.10.1
)))
Downstream Wi-Fi
Enter fullscreen mode Exit fullscreen mode
The fundamental difference between Wireless Router mode and WISP mode is the medium used for the upstream connection:
Wireless Router → Upstream/WAN over Ethernet
WISP → Upstream/WAN over Wi-Fi
Enter fullscreen mode Exit fullscreen mode
Both can create a separate routed network on the downstream side.
A Wireless Extender or Repeater focuses on extending the coverage of an existing Wi-Fi network.
Upstream Access Point
)))
Extender
)))
Client
Enter fullscreen mode Exit fullscreen mode
Its main goal is generally to make the existing wireless network reachable over a larger area rather than to create a separate routed private network.
The exact Layer 2 and Layer 3 behavior depends on the implementation used by the vendor.
In Client Mode, the device itself acts as a Wi-Fi client and can provide connectivity to an Ethernet-only device.
Upstream Wi-Fi
)))
▼
Client Bridge
│
Ethernet
│
TV
Enter fullscreen mode Exit fullscreen mode
This can give a device with Ethernet but no Wi-Fi interface access to a wireless network.
6. Splitting One Physical Infrastructure into Multiple Logical Networks
VLANs and Their Relationship to Subnets
A VLAN — Virtual LAN allows a single physical Ethernet and switching infrastructure to contain multiple logically separate Layer 2 networks.
For example:
VLAN 10 → Personal
VLAN 20 → IoT
VLAN 30 → Guest
Enter fullscreen mode Exit fullscreen mode
Each VLAN is commonly mapped to a different Layer 3 subnet:
VLAN 10 → 192.168.10.0/24
VLAN 20 → 192.168.20.0/24
VLAN 30 → 192.168.30.0/24
Enter fullscreen mode Exit fullscreen mode
The concepts operate at different layers:
A VLAN provides Layer 2 segmentation.
A subnet defines a Layer 3 IP network.
This means personal devices and IoT devices can use the same physical switching infrastructure while still being placed into separate logical networks.
802.1Q Tagging and Trunks
To carry several VLANs across the same physical Ethernet link, Ethernet frames can be marked with IEEE 802.1Q VLAN tags.
For example:
Router
│
│ VLAN 10
│ VLAN 20
│ VLAN 30
│
▼
Managed Switch
Enter fullscreen mode Exit fullscreen mode
One physical Ethernet cable can therefore transport traffic belonging to several different logical Layer 2 networks.
A link carrying multiple VLANs in this way is commonly called a trunk.
Inter-VLAN Routing
Different VLANs are separated at Layer 2.
If hosts in different VLANs need to communicate, a router or Layer 3 switch must route traffic between their corresponding subnets.
Suppose:
Laptop
VLAN 10
192.168.10.20
Enter fullscreen mode Exit fullscreen mode
and:
TV
VLAN 20
192.168.20.30
Enter fullscreen mode Exit fullscreen mode
need to communicate.
The traffic must pass through a Layer 3 device:
VLAN 10
│
Router
│
VLAN 20
Enter fullscreen mode Exit fullscreen mode
This is called inter-VLAN routing.
A firewall can then control which kinds of inter-VLAN communication are allowed.
For example:
Personal VLAN → IoT VLAN ALLOW
Guest VLAN → Personal DENY
Enter fullscreen mode Exit fullscreen mode
So VLANs, subnets, routing, and firewalls can be combined to create meaningful security boundaries inside a home or office network.
7. Network Services and Traffic Types
DNS
DNS — Domain Name System translates human-readable names into IP addresses.
For example:
example.com
│
│ DNS
▼
93.x.x.x
Enter fullscreen mode Exit fullscreen mode
Once the IP address has been resolved, the routing system determines how packets should reach that address.
A useful distinction is:
DNS answers, “What IP address belongs to this name?”
Routing answers, “Which path should I use to reach that IP address?”
Unicast, Broadcast, and Multicast
Network traffic can be delivered in several different ways.
Unicast traffic is sent from one source to one specific destination:
Laptop → Web Server
Enter fullscreen mode Exit fullscreen mode
Broadcast traffic is sent to every host in the same Layer 2 broadcast domain:
Laptop → Everyone on the local network
Enter fullscreen mode Exit fullscreen mode
ARP requests are a classic IPv4 example.
Routers normally do not forward Layer 2 broadcasts into other subnets.
Multicast traffic is sent to a specific group of interested receivers:
IPTV Stream
│
├── TV 1
├── TV 2
└── TV 3
Enter fullscreen mode Exit fullscreen mode
Instead of sending an entirely separate copy of the stream for each receiver, multicast allows receivers to join a common multicast group.
IGMP and IGMP Snooping
In IPv4 networks, IGMP — Internet Group Management Protocol manages host membership in multicast groups.
An IPTV client might request membership in a group such as:
239.1.1.50
Enter fullscreen mode Exit fullscreen mode
IGMP does not carry the video stream itself.
It communicates information about which hosts want to join or leave multicast groups.
A switch can use IGMP Snooping to observe these membership messages.
Instead of flooding multicast traffic to every switch port, it can forward the stream only toward ports where interested receivers exist.
For example:
Multicast Stream
│
Switch
┌────┼────┐
│ │ │
TV NAS Laptop
Enter fullscreen mode Exit fullscreen mode
If only the TV has joined the multicast group, the switch can avoid sending that stream unnecessarily toward the NAS and laptop.
8. Features Built on Top of Routing
VPN
A VPN — Virtual Private Network can create a virtual network interface or tunnel on a router or host.
For example:
Laptop
│
Router
│
VPN Tunnel
│
Remote VPN Gateway
Enter fullscreen mode Exit fullscreen mode
The router’s routing table can determine whether traffic should leave through the ordinary WAN interface or through the VPN tunnel.
For example:
Normal Internet Traffic → WAN
Corporate Subnet → VPN Tunnel
Enter fullscreen mode Exit fullscreen mode
A VPN therefore involves more than encryption alone.
It is also closely tied to routing because the system must decide which destinations should use the tunnel.
A router may operate as a VPN client, establishing a tunnel to another VPN endpoint and routing selected LAN traffic through it.
It may also operate as a VPN server, allowing remote clients to establish tunnels back into the local network.
QoS
QoS — Quality of Service controls how traffic is queued and prioritized when the available network capacity becomes constrained.
For example:
Video Call → High Priority
Web Browsing → Normal Priority
Download → Low Priority
Enter fullscreen mode Exit fullscreen mode
QoS does not change IP addresses or subnet boundaries.
It affects how packets compete for limited bandwidth and which traffic should receive preferential treatment during congestion.
Putting the Entire Topology Together
The concepts can now be combined into one larger example:
INTERNET
│
ISP Network
│
Public IP or CGNAT
│
UPSTREAM ROUTER
LAN: 192.168.1.1/24
│
192.168.1.0/24
│
DHCP Server
│
▼
DOWNSTREAM ROUTER
WAN: 192.168.1.50/24
GW: 192.168.1.1
│
Routing / NAT / Firewall
│
LAN: 192.168.10.1/24
│
192.168.10.0/24
│
DHCP Server
│
┌────────────────┼────────────────┐
│ │ │
Laptop Phone NAS
192.168.10.20 192.168.10.30 192.168.10.50
Enter fullscreen mode Exit fullscreen mode
The relationships between the core concepts can be summarized like this:
The ISP connects the home network to the Internet. LAN and WAN describe the downstream and upstream roles of router interfaces. A subnet defines a Layer 3 IP network boundary. DHCP provides hosts with IP configuration such as an address, subnet mask, gateway, and DNS server. A host uses its gateway when the destination is outside its own subnet. Routers perform routing between different subnets. NAT can rewrite addresses as traffic crosses those boundaries. Firewalls control which routed traffic is allowed to pass. Switches and bridges connect devices within Layer 2 networks, while VLANs allow the same physical infrastructure to be divided into multiple logical Layer 2 networks.
Once this model is clear, features such as Wireless Router mode, Access Point mode, WISP, VLANs, VPNs, multicast handling, and firewall rules stop looking like unrelated router options. They become different applications of the same underlying network architecture.
Written by ChatGPT, steered by a human, fueled by caffeine.