How Does a Home Network Actually Work? From LAN/WAN to WISP, VLAN, and VPN

syntaxbender — Fri, 04 Sep 2026 22:35:50 +0000

How Does a Home Network Actually Work? From LAN/WAN to WISP, VLAN, and VPN

A home network can be pictured in its simplest form like this:

                         Internet
                            │
                         ISP Network
                            │
                       Home Router
                            │
              ┌─────────────┼─────────────┐
              │             │             │
           Laptop         Phone          NAS

The home router connects two different worlds: the external network reached through the ISP, and the local network where devices such as laptops, phones, TVs, and NAS systems live.

Behind this seemingly simple topology, concepts such as LAN, WAN, subnets, DHCP, routing, NAT, firewalls, bridging, and VLANs all work together.

1. The Home Network, the ISP, and the Internet Side

LAN and WAN

LAN — Local Area Network refers to the local side of a router. Devices such as laptops, phones, smart TVs, printers, and NAS systems usually live on this side.

Suppose the router's LAN address is:

192.168.1.1/24

Devices on the network might have addresses such as:

Laptop   192.168.1.20
Phone    192.168.1.30
NAS      192.168.1.50

All of them belong to the same local IP network:

192.168.1.0/24

In practical terms, the LAN is the side of the router where the local devices managed by that router reside.

WAN — Wide Area Network, on the other hand, refers to the side where the router connects to an upstream network outside its own LAN.

In a typical home network:

Internet / ISP
      │
     WAN
      │
   Router
      │
     LAN
      │
Home Devices

LAN and WAN do not describe different types of Ethernet cables or fundamentally different physical connections.

The same ordinary Ethernet connection can serve as a LAN connection in one topology and a WAN connection in another.

Consider two routers connected together:

Internet
   │
Upstream Router
LAN: 192.168.1.1
   │
   │ Ethernet
   ▼
Downstream Router
WAN: 192.168.1.50
LAN: 192.168.10.1

The 192.168.1.0/24 network is:

the LAN of the upstream router,
but the WAN-side network of the downstream router.

So LAN and WAN are relative concepts. Their meaning depends on the router from whose perspective the topology is being viewed.

Upstream and Downstream

In networking, the direction toward the Internet or a higher-level network is generally called upstream.

The direction toward end-user devices is generally called downstream.

For example:

Internet
   │
Upstream Router
   │
Downstream Router
   │
Laptop

The router closer to the Internet is upstream relative to the router behind it.

This terminology becomes particularly useful when several routers are connected in sequence.

What Does the ISP Do?

An ISP — Internet Service Provider connects the home network to the wider Internet.

At a very high level:

Home Devices
     │
Home Router
     │
ISP Network
     │
Internet

The ISP provides connectivity between the subscriber's network and its own infrastructure, and from there to other networks on the Internet.

Depending on the connection type and ISP architecture, the router or modem/router receives an IP configuration on its ISP-facing side.

If the router receives an address such as:

203.x.x.x

and that address is globally routable, it can be a public IP address.

The topology may then look like:

Internet
   │
Public IP
   │
Home Router
   │
Private LAN
192.168.1.0/24

But a WAN address is not necessarily a public address.

Public IPs, Private IPs, and CGNAT

IPv4 defines several address ranges for private networks:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

For example:

192.168.1.0/24

is a private subnet.

A laptop using:

192.168.1.20

does not appear on the global Internet as 192.168.1.20.

That address only has meaning inside the relevant private network.

A common home setup looks like this:

Laptop
192.168.1.20
      │
   Home Router
      │
Public IP
203.x.x.x
      │
   Internet

The router translates traffic from private local addresses to its Internet-facing address.

However, many ISPs use CGNAT — Carrier-Grade NAT.

In that case, even the home router may not receive its own public IPv4 address.

A simplified topology might look like this:

Home LAN
192.168.1.0/24
      │
Home Router
WAN: 100.64.x.x
      │
ISP CGNAT
      │
ISP Public IP
      │
Internet

Address translation may therefore happen at two different levels:

192.168.1.20
      │
Home Router NAT
      ▼
100.64.x.x
      │
ISP CGNAT
      ▼
Public IP

The public address is owned or managed by the ISP's CGNAT infrastructure and may be shared by multiple subscribers.

This leads to an important distinction:

A WAN address and a public IP address are not the same thing.

WAN describes the role of an interface: it is the router's upstream-facing side.

Whether the IP assigned to that interface is public, private, or shared depends on the surrounding network architecture.

2. How Is a Local IP Network Defined?

Subnets

A subnet defines the boundary of a Layer 3 IP network.

For example:

192.168.1.0/24

is a subnet.

The /24 prefix means that the first 24 bits represent the network portion of the IPv4 address.

Its subnet mask is:

255.255.255.0

For this network:

Network address:   192.168.1.0
Host addresses:    192.168.1.1 - 192.168.1.254
Broadcast address: 192.168.1.255

Devices such as:

Laptop   192.168.1.20/24
NAS      192.168.1.50/24

belong to the same subnet.

But:

192.168.10.20/24

belongs to a different subnet.

Two hosts on the same subnet can normally communicate without sending the traffic through a router.

For example:

Laptop: 192.168.1.20
NAS:    192.168.1.50

are part of the same Layer 3 network.

But:

Laptop: 192.168.1.20
Server: 192.168.10.50

are on different subnets, so communication between them requires routing.

Default Gateway

When a host wants to reach an IP address outside its own subnet, it normally sends the packet to its default gateway.

Suppose a laptop has:

IP:      192.168.10.20
Gateway: 192.168.10.1

If it wants to communicate with:

192.168.10.50

the destination is inside the same subnet, so the laptop can reach it directly.

But if the destination is:

8.8.8.8

the laptop determines that 8.8.8.8 is not part of 192.168.10.0/24.

It therefore sends the packet to:

192.168.10.1

which is the router interface serving as its default gateway.

A useful definition is:

A default gateway is the next-hop router a host uses when the destination is outside its own subnet.

DHCP Server and DHCP Client

Devices do not normally need to have all of their network settings entered manually.

Home networks usually use DHCP — Dynamic Host Configuration Protocol.

A DHCP server can provide a laptop with information such as:

IP address:      192.168.10.20
Subnet mask:     255.255.255.0
Default gateway: 192.168.10.1
DNS server:      192.168.10.1

The router is acting as the DHCP Server, while the laptop is acting as a DHCP Client.

A router can even act as both a DHCP client and a DHCP server at the same time, on different interfaces.

Consider this topology:

Upstream Router
DHCP Server
      │
      ▼
Downstream Router
WAN = DHCP Client
      │
      ▼
LAN = DHCP Server
      │
      ▼
Laptop = DHCP Client

The upstream router might assign the downstream router:

IP:      192.168.1.50
Gateway: 192.168.1.1

on its WAN interface.

The downstream router might then assign the laptop:

IP:      192.168.10.20
Gateway: 192.168.10.1

on its LAN.

This creates two independently configured IP networks.

3. How Does Traffic Move Between Different Networks?

Routers and Routing

The fundamental job of a router is to forward packets between different Layer 3 networks.

Suppose a downstream router has these interfaces:

WAN: 192.168.1.50/24
LAN: 192.168.10.1/24

It is connected to two different subnets:

192.168.1.0/24
       │
Downstream Router
       │
192.168.10.0/24

The router examines the destination IP address of a packet and consults its routing table to determine where that packet should go.

Suppose:

Laptop
192.168.10.20

wants to send a packet to:

8.8.8.8

Because the destination is outside the laptop's subnet, the laptop sends the packet to its gateway:

192.168.10.1

The downstream router may have a default route such as:

0.0.0.0/0 via 192.168.1.1

It therefore forwards the packet to the upstream router.

The path becomes:

Laptop
192.168.10.20
     │
     ▼
Downstream Router
     │
     ▼
Upstream Router
     │
     ▼
Internet

That process is routing.

NAT and Double NAT

NAT — Network Address Translation modifies IP addressing information as packets pass through a device.

Consumer routers commonly use source NAT together with port translation.

Suppose a laptop creates a connection from:

192.168.10.20:53000

When the packet leaves the downstream router's WAN interface, it might become:

192.168.1.50:61000

Conceptually:

192.168.10.20
      │
      │ NAT
      ▼
192.168.1.50

Routing and NAT are related, but they solve different problems:

Routing → Which path should the packet take?
NAT     → Should the packet's address or port be rewritten?

NAT does not create the distinction between two subnets.

These:

192.168.1.0/24
192.168.10.0/24

are already two different Layer 3 networks.

The router performs routing between them.

NAT may additionally rewrite addresses as traffic crosses between those networks.

If both the downstream router and the upstream router perform NAT, the topology contains double NAT:

Laptop
192.168.10.20
      │
      │ NAT #1
      ▼
Downstream Router
192.168.1.50
      │
      │ NAT #2
      ▼
Upstream Router
203.x.x.x
      │
      ▼
Internet

Normal outbound traffic such as web browsing, video streaming, and downloads usually works without issue through double NAT.

However, inbound connections, port forwarding, peer-to-peer applications, and some gaming scenarios can become more complicated.

Firewalls and Port Forwarding

Routing determines where traffic can go, but knowing a route does not automatically mean traffic is allowed to cross it.

A firewall determines which traffic may pass between interfaces or networks.

A simple policy might look like:

LAN → Internet       ALLOW
Internet → LAN       DENY
Guest → NAS          DENY
Personal → NAS       ALLOW

This gives us another useful distinction:

Routing determines the path.
The firewall determines whether traffic is allowed to use that path.

Sometimes a service inside the private network needs to accept incoming connections from the WAN side.

This is where port forwarding is commonly used.

For example:

Router WAN
192.168.1.50:443
       │
       │ Port Forward / DNAT
       ▼
NAS
192.168.10.50:443

The router takes connections addressed to a particular WAN port and forwards them to a specific internal host and port.

This is commonly implemented using Destination NAT — DNAT.

4. Communication Inside the Local Network

Switches, MAC Addresses, and ARP

Routers operate between Layer 3 networks.

A switch, by contrast, connects devices inside the same Layer 2 network.

For example:

             Router
               │
             Switch
        ┌──────┼──────┐
        │      │      │
     Laptop   NAS     TV

A switch forwards Ethernet frames primarily according to MAC addresses.

An IP address is a Layer 3 address:

192.168.1.50

A MAC address is a Layer 2 address:

aa:bb:cc:dd:ee:ff

In IPv4 networks, ARP — Address Resolution Protocol is used to discover which MAC address corresponds to a local IPv4 address.

For example, the laptop may effectively ask:

Which device owns 192.168.1.50?

The NAS may respond:

192.168.1.50
→ aa:bb:cc:dd:ee:ff

The basic relationship is:

IP     → Layer 3 address
MAC    → Layer 2 address
ARP    → Resolves a local IPv4 address to a MAC address
Switch → Forwards frames using MAC addresses
Router → Routes packets between IP networks

Bridging

A bridge connects multiple Layer 2 interfaces so that they behave as parts of the same Layer 2 network.

A typical wireless access point provides a good example:

Ethernet
   │
   ├── Bridge
   │
Wi-Fi

A laptop connected through Ethernet might have:

192.168.1.20

while a phone connected through Wi-Fi might have:

192.168.1.30

Both may still belong to:

192.168.1.0/24

No new routed subnet needs to exist between Ethernet and Wi-Fi.

A useful distinction is:

A router connects different Layer 3 networks.
A bridge extends the same Layer 2 network across multiple interfaces.

5. Common Router Operating Modes

Once the difference between routing and bridging is clear, common router operating modes become much easier to understand.

Wireless Router Mode vs. Access Point Mode

In Wireless Router Mode, a device typically receives its upstream connection over Ethernet and creates a separate downstream LAN.

For example:

Upstream Router
LAN: 192.168.1.1
      │
      │ Ethernet
      ▼
Downstream Router
WAN: 192.168.1.50
      │
 Routing / NAT
      │
LAN: 192.168.10.1
      │
Downstream Clients

There are two separate Layer 3 networks:

Upstream subnet:   192.168.1.0/24
Downstream subnet: 192.168.10.0/24

The downstream device is truly acting as a router.

In Access Point Mode, the goal is different.

The device takes an existing Ethernet LAN and makes it available over Wi-Fi without creating another routed subnet.

Upstream Router
192.168.1.1
      │
   Ethernet
      │
Access Point
      )))
      │
Phone
192.168.1.30

The phone may receive its IP directly from the upstream router's DHCP server and remain part of:

192.168.1.0/24

The logical structure is approximately:

Ethernet ↔ Bridge ↔ Wi-Fi

WISP, Wireless Extender, and Client Mode

WISP mode turns another Wi-Fi network into the router's upstream or WAN connection.

For example:

Upstream Wi-Fi
192.168.1.0/24
       )))
       ▼
Downstream Router
WAN: 192.168.1.50
       │
 Routing / NAT
       │
LAN: 192.168.10.1
       )))
Downstream Wi-Fi

The fundamental difference between Wireless Router mode and WISP mode is the medium used for the upstream connection:

Wireless Router → Upstream/WAN over Ethernet
WISP            → Upstream/WAN over Wi-Fi

Both can create a separate routed network on the downstream side.

A Wireless Extender or Repeater focuses on extending the coverage of an existing Wi-Fi network.

Upstream Access Point
        )))
      Extender
        )))
       Client

Its main goal is generally to make the existing wireless network reachable over a larger area rather than to create a separate routed private network.

The exact Layer 2 and Layer 3 behavior depends on the implementation used by the vendor.

In Client Mode, the device itself acts as a Wi-Fi client and can provide connectivity to an Ethernet-only device.

Upstream Wi-Fi
      )))
      ▼
Client Bridge
      │
   Ethernet
      │
      TV

This can give a device with Ethernet but no Wi-Fi interface access to a wireless network.

6. Splitting One Physical Infrastructure into Multiple Logical Networks

VLANs and Their Relationship to Subnets

A VLAN — Virtual LAN allows a single physical Ethernet and switching infrastructure to contain multiple logically separate Layer 2 networks.

For example:

VLAN 10 → Personal
VLAN 20 → IoT
VLAN 30 → Guest

Each VLAN is commonly mapped to a different Layer 3 subnet:

VLAN 10 → 192.168.10.0/24
VLAN 20 → 192.168.20.0/24
VLAN 30 → 192.168.30.0/24

The concepts operate at different layers:

A VLAN provides Layer 2 segmentation.
A subnet defines a Layer 3 IP network.

This means personal devices and IoT devices can use the same physical switching infrastructure while still being placed into separate logical networks.

802.1Q Tagging and Trunks

To carry several VLANs across the same physical Ethernet link, Ethernet frames can be marked with IEEE 802.1Q VLAN tags.

For example:

Router
   │
   │ VLAN 10
   │ VLAN 20
   │ VLAN 30
   │
   ▼
Managed Switch

One physical Ethernet cable can therefore transport traffic belonging to several different logical Layer 2 networks.

A link carrying multiple VLANs in this way is commonly called a trunk.

Inter-VLAN Routing

Different VLANs are separated at Layer 2.

If hosts in different VLANs need to communicate, a router or Layer 3 switch must route traffic between their corresponding subnets.

Suppose:

Laptop
VLAN 10
192.168.10.20

and:

TV
VLAN 20
192.168.20.30

need to communicate.

The traffic must pass through a Layer 3 device:

VLAN 10
   │
 Router
   │
VLAN 20

This is called inter-VLAN routing.

A firewall can then control which kinds of inter-VLAN communication are allowed.

For example:

Personal VLAN → IoT VLAN   ALLOW
Guest VLAN    → Personal   DENY

So VLANs, subnets, routing, and firewalls can be combined to create meaningful security boundaries inside a home or office network.

7. Network Services and Traffic Types

DNS

DNS — Domain Name System translates human-readable names into IP addresses.

For example:

example.com
     │
     │ DNS
     ▼
93.x.x.x

Once the IP address has been resolved, the routing system determines how packets should reach that address.

A useful distinction is:

DNS answers, “What IP address belongs to this name?”
Routing answers, “Which path should I use to reach that IP address?”

Unicast, Broadcast, and Multicast

Network traffic can be delivered in several different ways.

Unicast traffic is sent from one source to one specific destination:

Laptop → Web Server

Broadcast traffic is sent to every host in the same Layer 2 broadcast domain:

Laptop → Everyone on the local network

ARP requests are a classic IPv4 example.

Routers normally do not forward Layer 2 broadcasts into other subnets.

Multicast traffic is sent to a specific group of interested receivers:

IPTV Stream
     │
     ├── TV 1
     ├── TV 2
     └── TV 3

Instead of sending an entirely separate copy of the stream for each receiver, multicast allows receivers to join a common multicast group.

IGMP and IGMP Snooping

In IPv4 networks, IGMP — Internet Group Management Protocol manages host membership in multicast groups.

An IPTV client might request membership in a group such as:

239.1.1.50

IGMP does not carry the video stream itself.

It communicates information about which hosts want to join or leave multicast groups.

A switch can use IGMP Snooping to observe these membership messages.

Instead of flooding multicast traffic to every switch port, it can forward the stream only toward ports where interested receivers exist.

For example:

Multicast Stream
       │
     Switch
   ┌────┼────┐
   │    │    │
  TV   NAS  Laptop

If only the TV has joined the multicast group, the switch can avoid sending that stream unnecessarily toward the NAS and laptop.

8. Features Built on Top of Routing

VPN

A VPN — Virtual Private Network can create a virtual network interface or tunnel on a router or host.

For example:

Laptop
   │
 Router
   │
VPN Tunnel
   │
Remote VPN Gateway

The router's routing table can determine whether traffic should leave through the ordinary WAN interface or through the VPN tunnel.

For example:

Normal Internet Traffic → WAN
Corporate Subnet        → VPN Tunnel

A VPN therefore involves more than encryption alone.

It is also closely tied to routing because the system must decide which destinations should use the tunnel.

A router may operate as a VPN client, establishing a tunnel to another VPN endpoint and routing selected LAN traffic through it.

It may also operate as a VPN server, allowing remote clients to establish tunnels back into the local network.

QoS

QoS — Quality of Service controls how traffic is queued and prioritized when the available network capacity becomes constrained.

For example:

Video Call   → High Priority
Web Browsing → Normal Priority
Download     → Low Priority

QoS does not change IP addresses or subnet boundaries.

It affects how packets compete for limited bandwidth and which traffic should receive preferential treatment during congestion.

Putting the Entire Topology Together

The concepts can now be combined into one larger example:

                              INTERNET
                                  │
                              ISP Network
                                  │
                        Public IP or CGNAT
                                  │
                           UPSTREAM ROUTER
                        LAN: 192.168.1.1/24
                                  │
                         192.168.1.0/24
                                  │
                           DHCP Server
                                  │
                                  ▼
                         DOWNSTREAM ROUTER
                       WAN: 192.168.1.50/24
                       GW:  192.168.1.1
                                  │
                      Routing / NAT / Firewall
                                  │
                       LAN: 192.168.10.1/24
                                  │
                         192.168.10.0/24
                                  │
                           DHCP Server
                                  │
                 ┌────────────────┼────────────────┐
                 │                │                │
              Laptop           Phone             NAS
          192.168.10.20    192.168.10.30    192.168.10.50

The relationships between the core concepts can be summarized like this:

The ISP connects the home network to the Internet. LAN and WAN describe the downstream and upstream roles of router interfaces. A subnet defines a Layer 3 IP network boundary. DHCP provides hosts with IP configuration such as an address, subnet mask, gateway, and DNS server. A host uses its gateway when the destination is outside its own subnet. Routers perform routing between different subnets. NAT can rewrite addresses as traffic crosses those boundaries. Firewalls control which routed traffic is allowed to pass. Switches and bridges connect devices within Layer 2 networks, while VLANs allow the same physical infrastructure to be divided into multiple logical Layer 2 networks.

Once this model is clear, features such as Wireless Router mode, Access Point mode, WISP, VLANs, VPNs, multicast handling, and firewall rules stop looking like unrelated router options. They become different applications of the same underlying network architecture.

Written by ChatGPT, steered by a human, fueled by caffeine.

DEV Community: syntaxbender

How Does a Home Network Actually Work? From LAN/WAN to WISP, VLAN, and VPN

How Does a Home Network Actually Work? From LAN/WAN to WISP, VLAN, and VPN

1. The Home Network, the ISP, and the Internet Side

LAN and WAN

Upstream and Downstream

What Does the ISP Do?

Public IPs, Private IPs, and CGNAT

2. How Is a Local IP Network Defined?

Subnets

Default Gateway

DHCP Server and DHCP Client

3. How Does Traffic Move Between Different Networks?

Routers and Routing

NAT and Double NAT

Firewalls and Port Forwarding

4. Communication Inside the Local Network

Switches, MAC Addresses, and ARP

Bridging

5. Common Router Operating Modes

Wireless Router Mode vs. Access Point Mode

WISP, Wireless Extender, and Client Mode

6. Splitting One Physical Infrastructure into Multiple Logical Networks

VLANs and Their Relationship to Subnets

802.1Q Tagging and Trunks

Inter-VLAN Routing

7. Network Services and Traffic Types

DNS

Unicast, Broadcast, and Multicast

IGMP and IGMP Snooping

8. Features Built on Top of Routing

VPN

QoS

Putting the Entire Topology Together