DEV Community: syntaxbender

Cudy TR1200 Review: An Affordable, Feature-Packed Travel Router

syntaxbender — Sun, 04 Oct 2026 23:36:53 +0000

Overview

I was looking for a travel router that I could use while working away from home to securely connect to my work network, route devices such as my phone and laptop through a secure network tunnel, reduce my footprint on the local network, and keep my devices isolated from other clients on that network. After considering features such as OpenWrt and VPN support, I decided to go with the Cudy TR1200.

The Cudy TR1200 stands out with its affordable price while offering all of the operating modes I would expect from a travel router, including Router/AP, WISP/Extender, and Client modes. It also supports features such as Cudy Mesh with multiple Cudy routers, captive portal, native router-level VPN support, DNS over TLS, Samba/SMB file sharing over USB 2.0, the ability to reconfigure the WAN port as a LAN port when needed, and a physical VPN switch. Overall, it covers not only the basic requirements of a travel router but also many features I would normally expect from more advanced models.

Hardware and Technical Specifications

Category	Specification	Value
Model	Model Version	TR1200 1.0
Hardware	CPU	580 MHz Single-Core, MIPS24KEC
	Flash / ROM	16 MB (128 Mbit) NOR
	DDR / RAM	128 MB (1 Gbit) DDR3
Wireless	5 GHz Wi-Fi Speed	867 Mbps
	2.4 GHz Wi-Fi Speed	300 Mbps
Interfaces	Ethernet Ports	2× 10/100 Mbps RJ45
	Ethernet Layout	1× WAN, 1× LAN
	USB	1× USB-A 2.0
	LED	System
	Physical Controls	Reset Button, Configurable DIP Switch
VPN Throughput	WireGuard Client	49 Mbps Upload / 43 Mbps Download
	WireGuard Server	43.6 Mbps Upload / 48 Mbps Download
Power	Power Input	USB-C
	Power Options	USB-C, PD
	Input Rating	5V ⎓ 2A
	Maximum Power Consumption	8 W
	Idle Power Consumption	3 W

Design and Physical Layout

One of the main reasons I chose the TR1200 was that I wanted a small and lightweight NAT/VPN router that I could simply throw into my bag alongside my Mac and forget that it was there. At approximately 100 grams and 4.65 × 3.15 × 1.08 inches, the TR1200 strikes a good balance between portability and functionality.

There are two foldable external antennas, one on each side of the device. On the rear, there is one USB-A 2.0 port, one 10/100 Mbps LAN port, one 10/100 Mbps WAN port, and a USB-C power input. Storage devices connected to the USB port can be shared over the network using Samba/SMB. In supported operating modes, the WAN port can also be reconfigured and used as an additional LAN port.

Cudy rates the maximum power consumption at 8 W under load, including the USB port, while idle consumption is listed at approximately 3 W. The router can be powered using 5V/2A or USB Power Delivery. Since it uses USB-C for power, I can run it from a compatible laptop or phone charger, or even a power bank, without carrying a dedicated power adapter.

The device also includes a reset button and a configurable physical switch. Using the stock firmware, I can configure this switch to enable or disable the VPN. Since integrated VPN functionality has effectively become a standard feature in travel routers, being able to control it with a physical switch is a nice addition at this price point.

On the front of the router, a single System LED indicates different operating states. Instead of using several separate activity LEDs, Cudy uses a single indicator for the overall router status, which I also find to be a nice design choice.

System LED	State	Meaning
🔴 Red	Blinking	System is booting
🔴 Red	Solid	System is running but there is no internet connection
⚪ White	Blinking	Internet/upstream connection is being established
⚪ White	Solid	Internet connection established
Off	—	Device is powered off

Management and Initial Setup

The router can be managed either through the cloud-based Cudy App or through the web interface available on the router's local network. I did not want to install another Android application just to configure the router, so I continued with the web interface.

For the initial setup, I connected an Ethernet cable from my upstream internet router to the WAN port on the TR1200. I then connected the TR1200's LAN port to my laptop using another Ethernet cable.

By default, the TR1200 uses the 192.168.10.0/24 subnet with 192.168.10.1 as its gateway address. The web interface is also available at 192.168.10.1.

After connecting the cables and opening this address in my browser, I was first prompted to create an administrator password. Once that was done, the router redirected me to the Quick Setup wizard. There are five different setup options available. Since I wanted to create a separate LAN behind NAT, I continued with Wireless Router mode.

The following screens allowed me to configure the timezone and WAN settings. The WAN configuration page provides options such as PPPoE, Static, and Dynamic (DHCP). Since DHCP was already enabled on my upstream router and it could automatically assign an IP address to the TR1200 over Ethernet, I selected Dynamic (DHCP).

When configuring the WAN side, it is important to make sure that the upstream and downstream router subnets use different IP ranges. Overlapping WAN and LAN subnets can introduce routing ambiguity and cause connectivity problems.

After completing the WAN configuration, I moved on to the wireless settings. Here, I configured separate SSIDs, passwords, and wireless encryption settings for the 2.4 GHz and 5 GHz bands.

Once the setup was complete, the router rebooted. The System LED turned solid white, and I also confirmed through the web interface that the upstream connection had been successfully established.

Performance Tests and Limitations

There were two major limitations I was already aware of when purchasing the TR1200.

First, both the WAN and LAN ports are rated at 100 Mbps in the official product documentation, and real-world throughput remains somewhat below that value. I also observed occasional fluctuations in wired performance.

The second limitation is WireGuard performance. According to Cudy's published figures, WireGuard throughput falls into roughly the 43–49 Mbps range.

Despite these limitations, considering the router's price and intended use case, I still find the performance sufficient for everyday use and think the TR1200 fits well into the price-to-performance segment.

I spent a weekend exploring the limits of the device and ran four different test scenarios across two router modes. For the tests, I used two separate PCs and an older OpenWrt router with Gigabit Ethernet and 2.4 GHz Wi-Fi as the upstream WAN network.

Test Methodology

For each test case, I ran two different iperf3 tests between a server and a client.

I generated a 50 Mbit/s UDP load between the server and client for 60 seconds and monitored packet loss and jitter.

iperf3 -c xxx.xxx.xxx.xxx -u -b 50M -t 60 -i 2

I opened four parallel TCP streams between the server and client and generated traffic for 60 seconds. I used the individual throughput values of the four streams together with their aggregate throughput to observe the total TCP throughput achievable across the tested path.

iperf3 -c xxx.xxx.xxx.xxx -P 4 -t 60 -i 2

Test Environment

Upstream OpenWrt WAN Router

Wi-Fi 4 (802.11n), 2x2:2 MIMO, 40 MHz, 64-QAM, 300 Mbps PHY
10/100/1000 Mbps Gigabit Ethernet

upstream WAN network internal LAN Gigabit tests - link

PC1

Wi-Fi 6 (802.11ax), 2x2:2 MIMO, MU-MIMO, OFDMA, HE80, 1024-QAM
10/100/1000 Mbps Gigabit Ethernet

PC2

Wi-Fi 6 (802.11ax), 2x2:2 MIMO, MU-MIMO, OFDMA, HE160, 1024-QAM
10/100/1000 Mbps Gigabit Ethernet

Test Results

Case 1 — Wireless Router Mode: Ethernet LAN Client → Ethernet WAN Server

For the first test, I connected the TR1200 to the upstream WAN network through its WAN Ethernet port. I connected PC1 to the TR1200's LAN port and PC2 to an Ethernet LAN port on the upstream network. I then started the iperf3 server on PC2.

This setup allowed me to test the Ethernet throughput and stability of the LAN-to-WAN path through the Cudy TR1200.

The LAN-to-WAN Ethernet tests made the practical bandwidth limits of the connection fairly clear. While pushing throughput toward the 90 Mbit/s range, I also observed intermittent packet loss during the UDP test.

Out of all four scenarios, this produced by far the worst results. I originally expected the wireless connection to exhibit more packet loss or throughput fluctuations, but instead I encountered significantly higher packet loss and much more noticeable throughput variation in this wired scenario.

To rule out problems with the lab environment, I repeated the test using several combinations of routers, PCs, and Ethernet cables, but none of these changes had a meaningful impact on the results.

Once I install OpenWrt on the TR1200, I plan to repeat this scenario. If I continue to see the same behavior, I will cover the possible causes and, if possible, solutions in a separate blog post.

TCP Throughput Test:

[ ID] Interval           Transfer     Bitrate         Retr

[  5]   0.00-60.00  sec   147 MBytes  20.5 Mbits/sec  206             sender
[  5]   0.00-60.02  sec   147 MBytes  20.5 Mbits/sec                  receiver
[  7]   0.00-60.00  sec   150 MBytes  21.0 Mbits/sec  179             sender
[  7]   0.00-60.02  sec   150 MBytes  21.0 Mbits/sec                  receiver
[  9]   0.00-60.00  sec   150 MBytes  21.0 Mbits/sec  190             sender
[  9]   0.00-60.02  sec   150 MBytes  21.0 Mbits/sec                  receiver
[ 11]   0.00-60.00  sec   153 MBytes  21.4 Mbits/sec  212             sender
[ 11]   0.00-60.02  sec   153 MBytes  21.3 Mbits/sec                  receiver
[SUM]   0.00-60.00  sec   601 MBytes  84.0 Mbits/sec  787             sender
[SUM]   0.00-60.02  sec   599 MBytes  83.8 Mbits/sec                  receiver

iperf Done.

Packet Loss Test:

[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams

[  5]   0.00-60.00  sec   358 MBytes  50.0 Mbits/sec  0.000 ms  0/278186 (0%)  sender
[  5]   0.00-60.00  sec   356 MBytes  49.7 Mbits/sec  0.257 ms  1443/278186 (0.52%)  receiver

iperf Done.

Detailed test results - link

Case 2 — Wireless Router Mode: Wireless LAN Client → Ethernet WAN Server

For this test, I changed the previous setup by connecting to the TR1200's LAN over Wi-Fi instead of Ethernet and then repeated the same tests.

Compared with the previous scenario, UDP packet loss on the wireless LAN connection dropped significantly, although I also observed a reduction in throughput.

TCP Throughput Test:

[ ID] Interval           Transfer     Bitrate         Retr

[  5]   0.00-60.00  sec   121 MBytes  16.9 Mbits/sec   63             sender
[  5]   0.00-60.01  sec   120 MBytes  16.8 Mbits/sec                  receiver
[  7]   0.00-60.00  sec   121 MBytes  17.0 Mbits/sec   63             sender
[  7]   0.00-60.01  sec   121 MBytes  16.9 Mbits/sec                  receiver
[  9]   0.00-60.00  sec   121 MBytes  16.9 Mbits/sec   65             sender
[  9]   0.00-60.01  sec   121 MBytes  16.9 Mbits/sec                  receiver
[ 11]   0.00-60.00  sec   123 MBytes  17.2 Mbits/sec   64             sender
[ 11]   0.00-60.01  sec   123 MBytes  17.1 Mbits/sec                  receiver
[SUM]   0.00-60.00  sec   486 MBytes  67.9 Mbits/sec  255             sender
[SUM]   0.00-60.01  sec   485 MBytes  67.8 Mbits/sec                  receiver

iperf Done.

Packet Loss Test:

[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams

[  5]   0.00-60.00  sec   358 MBytes  50.0 Mbits/sec  0.000 ms  0/278186 (0%)  sender
[  5]   0.00-60.00  sec   358 MBytes  50.0 Mbits/sec  0.168 ms  27/278186 (0.0097%)  receiver

iperf Done.

Case 3 — WISP Mode: Ethernet LAN Server ↔ Ethernet LAN Client

For this scenario, I switched the TR1200 to WISP mode and connected it wirelessly to the upstream WAN network instead of using a wired WAN connection.

Since the physical WAN port was no longer needed for the uplink, I reconfigured it as a LAN port through the TR1200's interface. This allowed me to connect two Ethernet clients directly to the router's two physical Ethernet ports.

Rather than testing traffic across the WAN, I ran the tests entirely within the local Ethernet LAN to measure the TR1200's internal LAN forwarding capacity.

The UDP test completed with zero packet loss, while the TCP test reached an average throughput of approximately 94 Mbit/s. These results are very close to the values expected from the Ethernet interfaces and represent an ideal result for this setup.

Packet Loss Test:

[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams

[  5]   0.00-60.00  sec   358 MBytes  50.0 Mbits/sec  0.000 ms  0/258975 (0%)  sender
[  5]   0.00-60.00  sec   358 MBytes  50.0 Mbits/sec  0.242 ms  0/258972 (0%)  receiver

iperf Done.

TCP Throughput Test:

[ ID] Interval           Transfer     Bitrate         Retr

[  5]   0.00-60.00  sec   169 MBytes  23.6 Mbits/sec    0             sender
[  5]   0.00-60.01  sec   168 MBytes  23.5 Mbits/sec                  receiver
[  7]   0.00-60.00  sec   169 MBytes  23.6 Mbits/sec    4             sender
[  7]   0.00-60.01  sec   168 MBytes  23.5 Mbits/sec                  receiver
[  9]   0.00-60.00  sec   169 MBytes  23.6 Mbits/sec    3             sender
[  9]   0.00-60.01  sec   168 MBytes  23.5 Mbits/sec                  receiver
[ 11]   0.00-60.00  sec   168 MBytes  23.5 Mbits/sec    1             sender
[ 11]   0.00-60.01  sec   168 MBytes  23.5 Mbits/sec                  receiver
[SUM]   0.00-60.00  sec   674 MBytes  94.3 Mbits/sec    8             sender
[SUM]   0.00-60.01  sec   673 MBytes  94.1 Mbits/sec                  receiver

iperf Done.

Case 4 — WISP Mode: Wireless LAN Server ↔ Wireless LAN Client

Finally, I tested the bandwidth limits of the wireless LAN while the TR1200 was operating in WISP mode.

During the 50 Mbit/s UDP test, I observed no packet loss. In the 5 GHz wireless LAN TCP test, throughput reached approximately 151 Mbit/s. This scenario produced the best overall results of the four tests.

Packet Loss Test:

[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams

[  5]   0.00-60.00  sec   358 MBytes  50.0 Mbits/sec  0.000 ms  0/258975 (0%)  sender
[  5]   0.00-60.05  sec   358 MBytes  50.0 Mbits/sec  0.258 ms  0/258975 (0%)  receiver

iperf Done.

TCP Throughput Test:

[ ID] Interval           Transfer     Bitrate         Retr

[  5]   0.00-60.00  sec   256 MBytes  35.8 Mbits/sec   49             sender
[  5]   0.00-60.05  sec   254 MBytes  35.4 Mbits/sec                  receiver
[  7]   0.00-60.00  sec   275 MBytes  38.5 Mbits/sec   51             sender
[  7]   0.00-60.05  sec   273 MBytes  38.2 Mbits/sec                  receiver
[  9]   0.00-60.00  sec   278 MBytes  38.8 Mbits/sec   94             sender
[  9]   0.00-60.05  sec   274 MBytes  38.3 Mbits/sec                  receiver
[ 11]   0.00-60.00  sec   283 MBytes  39.6 Mbits/sec   93             sender
[ 11]   0.00-60.05  sec   280 MBytes  39.2 Mbits/sec                  receiver
[SUM]   0.00-60.00  sec  1.07 GBytes   153 Mbits/sec  287             sender
[SUM]   0.00-60.05  sec  1.06 GBytes   151 Mbits/sec                  receiver

iperf Done.

Overall Assessment

On the TR1200, I observed acceptable jitter levels alongside occasional periods of packet loss and throughput fluctuation, with the problems sometimes becoming more noticeable at roughly 30-second intervals.

I suspect this behavior may be related to the stability of the stock firmware and the router's single-core processor. During testing, I tried different PCs and Ethernet cables in an attempt to isolate the source of the packet loss, but these changes had no meaningful effect on the results.

For workloads such as online meetings or long-lived socket-based connections, I would expect these intermittent issues to occasionally result in noticeable interruptions.

That said, considering the price of the device and the fact that it is designed as a compact travel router, I still believe these limitations remain within an acceptable range.

I also plan to install OpenWrt on the TR1200 soon, and I am interested to see whether these issues improve with a different firmware stack.

Pros:

Small and lightweight for a travel router
Built-in VPN support in the stock Cudy firmware
Ability to distribute a WAN connection over wired or wireless interfaces using NAT or bridge modes
5 GHz wireless performance is sufficient for everyday office workloads
Very low power consumption, averaging around 1–2 W in my setup while operating in WISP mode with an upstream WAN connection and Wi-Fi enabled

Cons:

Periodic packet loss observed on both Ethernet and wireless connections
In my LAN-to-WAN tests, the wired scenario showed higher packet loss than the wireless scenario
According to Cudy's published figures, WireGuard client throughput is limited to approximately 43–49 Mbps

Subnet Calculation and Network Design: From Fundamentals to Practice

syntaxbender — Thu, 10 Sep 2026 00:03:46 +0000

Subnetting can look like little more than IP address math at first glance. In practice, though, the goal is not simply to calculate how many addresses exist inside a CIDR block.

The real purpose is to divide an available address space into logical network segments based on actual requirements.

Suppose we start with:

192.168.0.0/16

If we want to separate employees, management devices, printers, and IoT devices into different network segments, subnetting gives us a structured way to do that.

This article explains why subnetting is used, how IPv4 and CIDR calculations work, and how to design subnets based on real network requirements.

1. What Is Subnetting Used for in Network Design?

The main purpose of subnetting is to divide devices into logical network segments.

A company network might contain:

Employee workstations
Management devices
Printers
IoT devices
Servers

Technically, all of these devices could exist inside one large IP network.

That does not necessarily mean they should.

As the network grows, placing everything inside the same network can make routing, security, troubleshooting, and access control harder to manage.

Subnetting allows us to create a structure such as:

Employees     → 192.168.0.0/22
IoT           → 192.168.4.0/23
Management    → 192.168.6.0/25
Printers      → 192.168.6.128/26

A router or firewall can then determine how traffic is allowed to move between these networks.

For example:

Employees  → Printers      ALLOW
Employees  → Management    DENY
IoT        → Management    DENY
Management → All           ALLOW

This is why subnetting is not only about dividing IP addresses. It also helps create security and routing boundaries inside a network.

Subnets and VLANs Are Not the Same Thing

A subnet describes an IP network at Layer 3.

A VLAN separates devices at Layer 2.

In real environments, they are often used together:

VLAN 10 → Employees  → 192.168.0.0/22
VLAN 20 → IoT        → 192.168.4.0/23
VLAN 30 → Management → 192.168.6.0/25

The VLAN defines the Layer 2 broadcast domain, while the subnet defines the corresponding Layer 3 IP address space.

What Makes a Subnet Public or Private?

A subnet does not become public or private simply because it uses /24, /22, or any other prefix length.

In cloud environments, the distinction is usually determined by routing.

A public subnet might look like:

Public Subnet
      ↓
Internet Gateway
      ↓
Internet

A private subnet may instead use:

Private Subnet
      ↓
NAT Gateway
      ↓
Internet

So the public/private distinction is primarily a routing design decision, not a CIDR calculation.

2. The Foundation of Subnetting: IPv4 and CIDR

Before subnet calculations make sense, it helps to understand how an IPv4 address is structured.

Why Is IPv4 32 Bits?

An IPv4 address contains four octets.

For example:

192.168.1.10

Each octet contains 8 bits:

8 + 8 + 8 + 8 = 32 bits

That is why an IPv4 address is 32 bits long.

For example, the decimal value:

is represented in binary as:

11000000

The bit positions inside one octet have the following values:

128  64  32  16  8  4  2  1
2⁷   2⁶  2⁵  2⁴  2³ 2² 2¹ 2⁰

If all bits are set to 1:

11111111

their values add up to:

128 + 64 + 32 + 16 + 8 + 4 + 2 + 1
= 255

This is why each IPv4 octet can contain a value between:

0 - 255

What Does CIDR Mean?

In CIDR notation, the number after the slash tells us how many bits belong to the network portion of the address.

For example:

192.168.1.0/24

means:

24 bits → network
8 bits  → host

because:

32 - 24 = 8

host bits remain.

The subnet mask in binary is:

11111111.11111111.11111111.00000000

Its decimal form is:

255.255.255.0

How Do We Calculate the Number of IP Addresses?

Once we know the number of host bits, the total number of addresses can be calculated with:

2^(number of host bits)

For a /24:

32 - 24 = 8 host bits

2^8 = 256 addresses

In a traditional IPv4 subnet, the first address is reserved as the network address and the last as the broadcast address.

That leaves:

256 - 2 = 254

usable host addresses.

So:

/24
Total addresses = 256
Usable hosts    = 254

Example: /22

For a /22:

32 - 22 = 10 host bits

Therefore:

2^10 = 1024

total addresses exist.

In a traditional host subnet:

1024 - 2 = 1022

usable host addresses remain.

The binary subnet mask is:

11111111.11111111.11111100.00000000

The decimal equivalent is:

255.255.252.0

So:

/22 = 255.255.252.0

3. Designing Subnets Around Real Requirements

Now suppose we have the following address space:

192.168.0.0/16

And our network requires:

Group	Required Hosts
Employees	700
IoT	300
Management	120
Printers	50

Instead of assigning an arbitrary /24 to every group, we can choose the smallest suitable subnet for each requirement.

This approach is known as VLSM — Variable Length Subnet Masking.

700 Employees

We need at least 700 usable addresses.

A /23 provides:

32 - 23 = 9

2^9 = 512

512 addresses are not enough.

The next option is /22:

32 - 22 = 10

2^10 = 1024

Traditionally:

1024 - 2 = 1022 usable addresses

So:

Employees → /22

300 IoT Devices

A /24 provides:

2^8 = 256

which is not enough.

A /23 provides:

2^9 = 512

which is sufficient.

Therefore:

IoT → /23

120 Management Devices

A /25 gives us:

32 - 25 = 7

2^7 = 128

Traditionally:

128 - 2 = 126

usable host addresses.

So:

Management → /25

50 Printers

A /26 gives us:

32 - 26 = 6

2^6 = 64

Traditionally:

64 - 2 = 62

usable addresses.

Therefore:

Printers → /26

At this point, our requirements are:

Employees     /22
IoT           /23
Management    /25
Printers      /26

4. Placing the Subnets Inside the Parent CIDR Block

Now we can place these networks inside:

192.168.0.0/16

A common approach is to allocate the largest subnet first.

Finding the Boundary of a /22

The subnet mask for /22 is:

255.255.252.0

The changing octet is the third octet.

We can calculate the block size with:

256 - subnet mask value

So:

256 - 252 = 4

This means /22 networks increment by 4 in the third octet:

192.168.0.0/22
192.168.4.0/22
192.168.8.0/22
192.168.12.0/22
...

If the first /22 is assigned to employees:

Employees
192.168.0.0/22

the address range is:

192.168.0.0
-
192.168.3.255

The next available address is:

192.168.4.0

Placing the /23

The subnet mask for /23 is:

255.255.254.0

Block size:

256 - 254 = 2

So /23 networks advance by 2 in the third octet.

We can assign:

192.168.4.0/23

to the IoT network.

Its range is:

192.168.4.0
-
192.168.5.255

The next available address becomes:

192.168.6.0

Placing the /25

For management:

192.168.6.0/25

Its range is:

192.168.6.0
-
192.168.6.127

The next available address is:

192.168.6.128

Placing the /26

For printers:

192.168.6.128/26

Its range is:

192.168.6.128
-
192.168.6.191

Our final design becomes:

Group	Subnet	Total Addresses	Usable Hosts
Employees	`192.168.0.0/22`	1024	1022
IoT	`192.168.4.0/23`	512	510
Management	`192.168.6.0/25`	128	126
Printers	`192.168.6.128/26`	64	62

5. Determining Which Subnet an IP Belongs To

Suppose we have:

192.168.5.100/23

and want to determine its network address.

The subnet mask for /23 is:

255.255.254.0

In binary:

11111111.11111111.11111110.00000000

The third octet of the IP address is:

which is:

00000101

The third octet of the subnet mask is:

which is:

11111110

Now perform a bitwise AND:

00000101
11111110
--------
00000100

00000100 is:

in decimal.

So the network address is:

192.168.4.0

and the subnet is:

192.168.4.0/23

Therefore:

192.168.5.100/23

belongs to:

192.168.4.0/23

6. Calculate Instead of Memorizing

There is no need to memorize every subnet table.

A few simple relationships are enough.

Number of Host Bits

32 - CIDR prefix

For example:

/22

32 - 22 = 10 host bits

Total Number of Addresses

2^(number of host bits)

For example:

2^10 = 1024

Traditional Usable Host Count

2^(number of host bits) - 2

For example:

1024 - 2 = 1022

Keep in mind that the -2 rule does not apply in the same way to special cases such as /31 and /32.

Block Size

To find subnet boundaries, use the changing octet of the subnet mask:

256 - subnet mask value

For a /22:

255.255.252.0

256 - 252 = 4

So the subnet boundaries are:

For a /23:

255.255.254.0

256 - 254 = 2

The subnet boundaries are:

0
2
4
6
8
...

Once this relationship becomes familiar, there is little reason to memorize /22, /23, or /24 subnet tables.

7. The Bigger Picture

Subnetting becomes unnecessarily abstract when it is taught only as binary arithmetic.

In practice, the reasoning process is much simpler:

How many devices do I have?
        ↓
How many IP addresses do I need?
        ↓
How many host bits are required?
        ↓
Which CIDR prefix provides enough addresses?
        ↓
Where are the subnet boundaries?
        ↓
Where should this subnet be placed inside the parent CIDR?
        ↓
Which networks should be allowed to communicate?

For example:

700 hosts
↓
At least 700 addresses are required
↓
2^9 = 512  → not enough
2^10 = 1024 → enough
↓
10 host bits
↓
32 - 10 = /22
↓
255.255.252.0
↓
block size = 4

The result could be:

192.168.0.0/22

The real goal of subnetting is not to memorize values such as /22 or /24.

It is to understand how to move from a real network requirement to the correct CIDR prefix, identify the correct network boundaries, and allocate address space without overlaps or unnecessary waste.

Once that logic becomes familiar, topics such as VPC design, Kubernetes networking, VLAN architecture, firewall rules, and cloud network design become much easier to reason about.

How Does a Home Network Actually Work? From LAN/WAN to WISP, VLAN, and VPN

syntaxbender — Fri, 04 Sep 2026 22:35:50 +0000

How Does a Home Network Actually Work? From LAN/WAN to WISP, VLAN, and VPN

A home network can be pictured in its simplest form like this:

                         Internet
                            │
                         ISP Network
                            │
                       Home Router
                            │
              ┌─────────────┼─────────────┐
              │             │             │
           Laptop         Phone          NAS

The home router connects two different worlds: the external network reached through the ISP, and the local network where devices such as laptops, phones, TVs, and NAS systems live.

Behind this seemingly simple topology, concepts such as LAN, WAN, subnets, DHCP, routing, NAT, firewalls, bridging, and VLANs all work together.

1. The Home Network, the ISP, and the Internet Side

LAN and WAN

LAN — Local Area Network refers to the local side of a router. Devices such as laptops, phones, smart TVs, printers, and NAS systems usually live on this side.

Suppose the router's LAN address is:

192.168.1.1/24

Devices on the network might have addresses such as:

Laptop   192.168.1.20
Phone    192.168.1.30
NAS      192.168.1.50

All of them belong to the same local IP network:

192.168.1.0/24

In practical terms, the LAN is the side of the router where the local devices managed by that router reside.

WAN — Wide Area Network, on the other hand, refers to the side where the router connects to an upstream network outside its own LAN.

In a typical home network:

Internet / ISP
      │
     WAN
      │
   Router
      │
     LAN
      │
Home Devices

LAN and WAN do not describe different types of Ethernet cables or fundamentally different physical connections.

The same ordinary Ethernet connection can serve as a LAN connection in one topology and a WAN connection in another.

Consider two routers connected together:

Internet
   │
Upstream Router
LAN: 192.168.1.1
   │
   │ Ethernet
   ▼
Downstream Router
WAN: 192.168.1.50
LAN: 192.168.10.1

The 192.168.1.0/24 network is:

the LAN of the upstream router,
but the WAN-side network of the downstream router.

So LAN and WAN are relative concepts. Their meaning depends on the router from whose perspective the topology is being viewed.

Upstream and Downstream

In networking, the direction toward the Internet or a higher-level network is generally called upstream.

The direction toward end-user devices is generally called downstream.

For example:

Internet
   │
Upstream Router
   │
Downstream Router
   │
Laptop

The router closer to the Internet is upstream relative to the router behind it.

This terminology becomes particularly useful when several routers are connected in sequence.

What Does the ISP Do?

An ISP — Internet Service Provider connects the home network to the wider Internet.

At a very high level:

Home Devices
     │
Home Router
     │
ISP Network
     │
Internet

The ISP provides connectivity between the subscriber's network and its own infrastructure, and from there to other networks on the Internet.

Depending on the connection type and ISP architecture, the router or modem/router receives an IP configuration on its ISP-facing side.

If the router receives an address such as:

203.x.x.x

and that address is globally routable, it can be a public IP address.

The topology may then look like:

Internet
   │
Public IP
   │
Home Router
   │
Private LAN
192.168.1.0/24

But a WAN address is not necessarily a public address.

Public IPs, Private IPs, and CGNAT

IPv4 defines several address ranges for private networks:

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

For example:

192.168.1.0/24

is a private subnet.

A laptop using:

192.168.1.20

does not appear on the global Internet as 192.168.1.20.

That address only has meaning inside the relevant private network.

A common home setup looks like this:

Laptop
192.168.1.20
      │
   Home Router
      │
Public IP
203.x.x.x
      │
   Internet

The router translates traffic from private local addresses to its Internet-facing address.

However, many ISPs use CGNAT — Carrier-Grade NAT.

In that case, even the home router may not receive its own public IPv4 address.

A simplified topology might look like this:

Home LAN
192.168.1.0/24
      │
Home Router
WAN: 100.64.x.x
      │
ISP CGNAT
      │
ISP Public IP
      │
Internet

Address translation may therefore happen at two different levels:

192.168.1.20
      │
Home Router NAT
      ▼
100.64.x.x
      │
ISP CGNAT
      ▼
Public IP

The public address is owned or managed by the ISP's CGNAT infrastructure and may be shared by multiple subscribers.

This leads to an important distinction:

A WAN address and a public IP address are not the same thing.

WAN describes the role of an interface: it is the router's upstream-facing side.

Whether the IP assigned to that interface is public, private, or shared depends on the surrounding network architecture.

2. How Is a Local IP Network Defined?

Subnets

A subnet defines the boundary of a Layer 3 IP network.

For example:

192.168.1.0/24

is a subnet.

The /24 prefix means that the first 24 bits represent the network portion of the IPv4 address.

Its subnet mask is:

255.255.255.0

For this network:

Network address:   192.168.1.0
Host addresses:    192.168.1.1 - 192.168.1.254
Broadcast address: 192.168.1.255

Devices such as:

Laptop   192.168.1.20/24
NAS      192.168.1.50/24

belong to the same subnet.

But:

192.168.10.20/24

belongs to a different subnet.

Two hosts on the same subnet can normally communicate without sending the traffic through a router.

For example:

Laptop: 192.168.1.20
NAS:    192.168.1.50

are part of the same Layer 3 network.

But:

Laptop: 192.168.1.20
Server: 192.168.10.50

are on different subnets, so communication between them requires routing.

Default Gateway

When a host wants to reach an IP address outside its own subnet, it normally sends the packet to its default gateway.

Suppose a laptop has:

IP:      192.168.10.20
Gateway: 192.168.10.1

If it wants to communicate with:

192.168.10.50

the destination is inside the same subnet, so the laptop can reach it directly.

But if the destination is:

8.8.8.8

the laptop determines that 8.8.8.8 is not part of 192.168.10.0/24.

It therefore sends the packet to:

192.168.10.1

which is the router interface serving as its default gateway.

A useful definition is:

A default gateway is the next-hop router a host uses when the destination is outside its own subnet.

DHCP Server and DHCP Client

Devices do not normally need to have all of their network settings entered manually.

Home networks usually use DHCP — Dynamic Host Configuration Protocol.

A DHCP server can provide a laptop with information such as:

IP address:      192.168.10.20
Subnet mask:     255.255.255.0
Default gateway: 192.168.10.1
DNS server:      192.168.10.1

The router is acting as the DHCP Server, while the laptop is acting as a DHCP Client.

A router can even act as both a DHCP client and a DHCP server at the same time, on different interfaces.

Consider this topology:

Upstream Router
DHCP Server
      │
      ▼
Downstream Router
WAN = DHCP Client
      │
      ▼
LAN = DHCP Server
      │
      ▼
Laptop = DHCP Client

The upstream router might assign the downstream router:

IP:      192.168.1.50
Gateway: 192.168.1.1

on its WAN interface.

The downstream router might then assign the laptop:

IP:      192.168.10.20
Gateway: 192.168.10.1

on its LAN.

This creates two independently configured IP networks.

3. How Does Traffic Move Between Different Networks?

Routers and Routing

The fundamental job of a router is to forward packets between different Layer 3 networks.

Suppose a downstream router has these interfaces:

WAN: 192.168.1.50/24
LAN: 192.168.10.1/24

It is connected to two different subnets:

192.168.1.0/24
       │
Downstream Router
       │
192.168.10.0/24

The router examines the destination IP address of a packet and consults its routing table to determine where that packet should go.

Suppose:

Laptop
192.168.10.20

wants to send a packet to:

8.8.8.8

Because the destination is outside the laptop's subnet, the laptop sends the packet to its gateway:

192.168.10.1

The downstream router may have a default route such as:

0.0.0.0/0 via 192.168.1.1

It therefore forwards the packet to the upstream router.

The path becomes:

Laptop
192.168.10.20
     │
     ▼
Downstream Router
     │
     ▼
Upstream Router
     │
     ▼
Internet

That process is routing.

NAT and Double NAT

NAT — Network Address Translation modifies IP addressing information as packets pass through a device.

Consumer routers commonly use source NAT together with port translation.

Suppose a laptop creates a connection from:

192.168.10.20:53000

When the packet leaves the downstream router's WAN interface, it might become:

192.168.1.50:61000

Conceptually:

192.168.10.20
      │
      │ NAT
      ▼
192.168.1.50

Routing and NAT are related, but they solve different problems:

Routing → Which path should the packet take?
NAT     → Should the packet's address or port be rewritten?

NAT does not create the distinction between two subnets.

These:

192.168.1.0/24
192.168.10.0/24

are already two different Layer 3 networks.

The router performs routing between them.

NAT may additionally rewrite addresses as traffic crosses between those networks.

If both the downstream router and the upstream router perform NAT, the topology contains double NAT:

Laptop
192.168.10.20
      │
      │ NAT #1
      ▼
Downstream Router
192.168.1.50
      │
      │ NAT #2
      ▼
Upstream Router
203.x.x.x
      │
      ▼
Internet

Normal outbound traffic such as web browsing, video streaming, and downloads usually works without issue through double NAT.

However, inbound connections, port forwarding, peer-to-peer applications, and some gaming scenarios can become more complicated.

Firewalls and Port Forwarding

Routing determines where traffic can go, but knowing a route does not automatically mean traffic is allowed to cross it.

A firewall determines which traffic may pass between interfaces or networks.

A simple policy might look like:

LAN → Internet       ALLOW
Internet → LAN       DENY
Guest → NAS          DENY
Personal → NAS       ALLOW

This gives us another useful distinction:

Routing determines the path.
The firewall determines whether traffic is allowed to use that path.

Sometimes a service inside the private network needs to accept incoming connections from the WAN side.

This is where port forwarding is commonly used.

For example:

Router WAN
192.168.1.50:443
       │
       │ Port Forward / DNAT
       ▼
NAS
192.168.10.50:443

The router takes connections addressed to a particular WAN port and forwards them to a specific internal host and port.

This is commonly implemented using Destination NAT — DNAT.

4. Communication Inside the Local Network

Switches, MAC Addresses, and ARP

Routers operate between Layer 3 networks.

A switch, by contrast, connects devices inside the same Layer 2 network.

For example:

             Router
               │
             Switch
        ┌──────┼──────┐
        │      │      │
     Laptop   NAS     TV

A switch forwards Ethernet frames primarily according to MAC addresses.

An IP address is a Layer 3 address:

192.168.1.50

A MAC address is a Layer 2 address:

aa:bb:cc:dd:ee:ff

In IPv4 networks, ARP — Address Resolution Protocol is used to discover which MAC address corresponds to a local IPv4 address.

For example, the laptop may effectively ask:

Which device owns 192.168.1.50?

The NAS may respond:

192.168.1.50
→ aa:bb:cc:dd:ee:ff

The basic relationship is:

IP     → Layer 3 address
MAC    → Layer 2 address
ARP    → Resolves a local IPv4 address to a MAC address
Switch → Forwards frames using MAC addresses
Router → Routes packets between IP networks

Bridging

A bridge connects multiple Layer 2 interfaces so that they behave as parts of the same Layer 2 network.

A typical wireless access point provides a good example:

Ethernet
   │
   ├── Bridge
   │
Wi-Fi

A laptop connected through Ethernet might have:

192.168.1.20

while a phone connected through Wi-Fi might have:

192.168.1.30

Both may still belong to:

192.168.1.0/24

No new routed subnet needs to exist between Ethernet and Wi-Fi.

A useful distinction is:

A router connects different Layer 3 networks.
A bridge extends the same Layer 2 network across multiple interfaces.

5. Common Router Operating Modes

Once the difference between routing and bridging is clear, common router operating modes become much easier to understand.

Wireless Router Mode vs. Access Point Mode

In Wireless Router Mode, a device typically receives its upstream connection over Ethernet and creates a separate downstream LAN.

For example:

Upstream Router
LAN: 192.168.1.1
      │
      │ Ethernet
      ▼
Downstream Router
WAN: 192.168.1.50
      │
 Routing / NAT
      │
LAN: 192.168.10.1
      │
Downstream Clients

There are two separate Layer 3 networks:

Upstream subnet:   192.168.1.0/24
Downstream subnet: 192.168.10.0/24

The downstream device is truly acting as a router.

In Access Point Mode, the goal is different.

The device takes an existing Ethernet LAN and makes it available over Wi-Fi without creating another routed subnet.

Upstream Router
192.168.1.1
      │
   Ethernet
      │
Access Point
      )))
      │
Phone
192.168.1.30

The phone may receive its IP directly from the upstream router's DHCP server and remain part of:

192.168.1.0/24

The logical structure is approximately:

Ethernet ↔ Bridge ↔ Wi-Fi

WISP, Wireless Extender, and Client Mode

WISP mode turns another Wi-Fi network into the router's upstream or WAN connection.

For example:

Upstream Wi-Fi
192.168.1.0/24
       )))
       ▼
Downstream Router
WAN: 192.168.1.50
       │
 Routing / NAT
       │
LAN: 192.168.10.1
       )))
Downstream Wi-Fi

The fundamental difference between Wireless Router mode and WISP mode is the medium used for the upstream connection:

Wireless Router → Upstream/WAN over Ethernet
WISP            → Upstream/WAN over Wi-Fi

Both can create a separate routed network on the downstream side.

A Wireless Extender or Repeater focuses on extending the coverage of an existing Wi-Fi network.

Upstream Access Point
        )))
      Extender
        )))
       Client

Its main goal is generally to make the existing wireless network reachable over a larger area rather than to create a separate routed private network.

The exact Layer 2 and Layer 3 behavior depends on the implementation used by the vendor.

In Client Mode, the device itself acts as a Wi-Fi client and can provide connectivity to an Ethernet-only device.

Upstream Wi-Fi
      )))
      ▼
Client Bridge
      │
   Ethernet
      │
      TV

This can give a device with Ethernet but no Wi-Fi interface access to a wireless network.

6. Splitting One Physical Infrastructure into Multiple Logical Networks

VLANs and Their Relationship to Subnets

A VLAN — Virtual LAN allows a single physical Ethernet and switching infrastructure to contain multiple logically separate Layer 2 networks.

For example:

VLAN 10 → Personal
VLAN 20 → IoT
VLAN 30 → Guest

Each VLAN is commonly mapped to a different Layer 3 subnet:

VLAN 10 → 192.168.10.0/24
VLAN 20 → 192.168.20.0/24
VLAN 30 → 192.168.30.0/24

The concepts operate at different layers:

A VLAN provides Layer 2 segmentation.
A subnet defines a Layer 3 IP network.

This means personal devices and IoT devices can use the same physical switching infrastructure while still being placed into separate logical networks.

802.1Q Tagging and Trunks

To carry several VLANs across the same physical Ethernet link, Ethernet frames can be marked with IEEE 802.1Q VLAN tags.

For example:

Router
   │
   │ VLAN 10
   │ VLAN 20
   │ VLAN 30
   │
   ▼
Managed Switch

One physical Ethernet cable can therefore transport traffic belonging to several different logical Layer 2 networks.

A link carrying multiple VLANs in this way is commonly called a trunk.

Inter-VLAN Routing

Different VLANs are separated at Layer 2.

If hosts in different VLANs need to communicate, a router or Layer 3 switch must route traffic between their corresponding subnets.

Suppose:

Laptop
VLAN 10
192.168.10.20

and:

TV
VLAN 20
192.168.20.30

need to communicate.

The traffic must pass through a Layer 3 device:

VLAN 10
   │
 Router
   │
VLAN 20

This is called inter-VLAN routing.

A firewall can then control which kinds of inter-VLAN communication are allowed.

For example:

Personal VLAN → IoT VLAN   ALLOW
Guest VLAN    → Personal   DENY

So VLANs, subnets, routing, and firewalls can be combined to create meaningful security boundaries inside a home or office network.

7. Network Services and Traffic Types

DNS

DNS — Domain Name System translates human-readable names into IP addresses.

For example:

example.com
     │
     │ DNS
     ▼
93.x.x.x

Once the IP address has been resolved, the routing system determines how packets should reach that address.

A useful distinction is:

DNS answers, “What IP address belongs to this name?”
Routing answers, “Which path should I use to reach that IP address?”

Unicast, Broadcast, and Multicast

Network traffic can be delivered in several different ways.

Unicast traffic is sent from one source to one specific destination:

Laptop → Web Server

Broadcast traffic is sent to every host in the same Layer 2 broadcast domain:

Laptop → Everyone on the local network

ARP requests are a classic IPv4 example.

Routers normally do not forward Layer 2 broadcasts into other subnets.

Multicast traffic is sent to a specific group of interested receivers:

IPTV Stream
     │
     ├── TV 1
     ├── TV 2
     └── TV 3

Instead of sending an entirely separate copy of the stream for each receiver, multicast allows receivers to join a common multicast group.

IGMP and IGMP Snooping

In IPv4 networks, IGMP — Internet Group Management Protocol manages host membership in multicast groups.

An IPTV client might request membership in a group such as:

239.1.1.50

IGMP does not carry the video stream itself.

It communicates information about which hosts want to join or leave multicast groups.

A switch can use IGMP Snooping to observe these membership messages.

Instead of flooding multicast traffic to every switch port, it can forward the stream only toward ports where interested receivers exist.

For example:

Multicast Stream
       │
     Switch
   ┌────┼────┐
   │    │    │
  TV   NAS  Laptop

If only the TV has joined the multicast group, the switch can avoid sending that stream unnecessarily toward the NAS and laptop.

8. Features Built on Top of Routing

VPN

A VPN — Virtual Private Network can create a virtual network interface or tunnel on a router or host.

For example:

Laptop
   │
 Router
   │
VPN Tunnel
   │
Remote VPN Gateway

The router's routing table can determine whether traffic should leave through the ordinary WAN interface or through the VPN tunnel.

For example:

Normal Internet Traffic → WAN
Corporate Subnet        → VPN Tunnel

A VPN therefore involves more than encryption alone.

It is also closely tied to routing because the system must decide which destinations should use the tunnel.

A router may operate as a VPN client, establishing a tunnel to another VPN endpoint and routing selected LAN traffic through it.

It may also operate as a VPN server, allowing remote clients to establish tunnels back into the local network.

QoS

QoS — Quality of Service controls how traffic is queued and prioritized when the available network capacity becomes constrained.

For example:

Video Call   → High Priority
Web Browsing → Normal Priority
Download     → Low Priority

QoS does not change IP addresses or subnet boundaries.

It affects how packets compete for limited bandwidth and which traffic should receive preferential treatment during congestion.

Putting the Entire Topology Together

The concepts can now be combined into one larger example:

                              INTERNET
                                  │
                              ISP Network
                                  │
                        Public IP or CGNAT
                                  │
                           UPSTREAM ROUTER
                        LAN: 192.168.1.1/24
                                  │
                         192.168.1.0/24
                                  │
                           DHCP Server
                                  │
                                  ▼
                         DOWNSTREAM ROUTER
                       WAN: 192.168.1.50/24
                       GW:  192.168.1.1
                                  │
                      Routing / NAT / Firewall
                                  │
                       LAN: 192.168.10.1/24
                                  │
                         192.168.10.0/24
                                  │
                           DHCP Server
                                  │
                 ┌────────────────┼────────────────┐
                 │                │                │
              Laptop           Phone             NAS
          192.168.10.20    192.168.10.30    192.168.10.50

The relationships between the core concepts can be summarized like this:

The ISP connects the home network to the Internet. LAN and WAN describe the downstream and upstream roles of router interfaces. A subnet defines a Layer 3 IP network boundary. DHCP provides hosts with IP configuration such as an address, subnet mask, gateway, and DNS server. A host uses its gateway when the destination is outside its own subnet. Routers perform routing between different subnets. NAT can rewrite addresses as traffic crosses those boundaries. Firewalls control which routed traffic is allowed to pass. Switches and bridges connect devices within Layer 2 networks, while VLANs allow the same physical infrastructure to be divided into multiple logical Layer 2 networks.

Once this model is clear, features such as Wireless Router mode, Access Point mode, WISP, VLANs, VPNs, multicast handling, and firewall rules stop looking like unrelated router options. They become different applications of the same underlying network architecture.

Written by ChatGPT, steered by a human, fueled by caffeine.