# Your Home Network, Explained

> What that box on your shelf actually is - the modem connects you to your ISP, the router shares that connection with all your devices, NAT lets them share one public IP, and a few settings keep the whole thing safe.


---

# Your Home Network, Explained

There's a box (maybe two) blinking on a shelf in your home, and every device you own depends on it. Most
people have no idea what it does - they only meet it when the internet dies and someone says "have you
tried restarting the router?" You don't need to fear it. By the end of this guide you'll know what each
box is, why all your gadgets have those funny `192.168.x.x` addresses, and the handful of settings that
keep strangers off your network. Nothing here is magic, and none of it is hard once you can see the shape
of it.

## How to read this
- **Just want it to make sense?** Read in order - each phase builds on the last. Three short reads and the
  whole box stops being mysterious.
- **Here to fix or secure something fast?** Phase 3 has the practical security checklist, and there's a
  troubleshooting nudge at the very end.

## The phases
1. **[The Router (and the Modem)](01-the-router-and-the-modem.md)** - the two boxes and what each one
   actually does: the modem connects you to your ISP; the router shares that one connection with all your
   devices.
2. **[NAT & Private IPs](02-nat-and-private-ips.md)** - why your devices all start with `192.168`, how
   they share a single public address, and why you can reach the internet but the internet can't reach
   straight into your laptop.
3. **[Wi-Fi & Keeping It Safe](03-wifi-and-keeping-it-safe.md)** - SSIDs, 2.4 vs 5 GHz, the router's
   firewall, and the few security settings that genuinely matter.

> Deeper material - port forwarding, running your own server, VPNs, mesh systems, and IPv6 - is left for
> follow-up guides. This one is about understanding the box you already have.

Related reading: [IP, DNS, and Ports](/guides/ip-dns-and-ports) · [How the Internet Works](/guides/how-the-internet-works) · [The TCP/IP Model](/guides/tcp-ip-model)


---

# The Router (and the Modem)

Picture the box (or boxes) that your home internet runs through. People use "the router," "the modem," and
"the Wi-Fi" as if they're the same thing. They're not - and the moment you can tell them apart, half the
confusion about home networking falls away. There are two jobs being done here, and sometimes one box does
both. Let's name the jobs first, then look at the boxes.

## The two jobs, in one picture

Here's the whole setup, from your couch to the wider internet:

```mermaid
flowchart LR
  laptop[laptop] -->|Wi-Fi/cable| router
  phone[phone] -->|Wi-Fi/cable| router
  tv[TV] -->|Wi-Fi/cable| router
  router[ROUTER<br/>shares one connection<br/>among devices]
  router --> modem[MODEM<br/>connects you to the ISP]
  modem --> isp[ISP<br/>your internet company]
  isp --> net((internet<br/>everything else))
```

The **modem** is the box that talks to your **ISP** (your internet company - Comcast, BT, your local
provider). The **router** is the box that takes that one connection and shares it among everything in your
home. Read on for what each one really does.

📝 **Terminology.** *ISP* = Internet Service Provider - the company you pay for internet. They own the wire
(or fiber, or coax cable) that runs from the street to your home.

## The modem - your bridge to the ISP

**What it actually is.** The modem is a translator. The signal your ISP sends down the line - over coax
cable, a phone line, or fiber - isn't something your laptop can read directly. The modem converts that
signal into plain network data your devices understand, and converts your devices' data back into
something the line can carry. That's its entire job: one connection in from the ISP, one connection out to
your network.

📝 **Terminology.** *Modem* is short for *modulator–demodulator* - it modulates (encodes) your data onto
the line and demodulates (decodes) what comes back. The name is the job.

**What it does in real life.** The modem is the single point where your home meets the wider internet. If
the modem is offline, nothing in your home can reach the internet, no matter how healthy your Wi-Fi looks.
This is why "is the modem's light solid?" is the first question a support agent asks.

**The gotcha.** ⚠️ A modem alone connects exactly *one* device. Plug a laptop straight into a bare modem
and that laptop gets online - but nothing else does, and there's no Wi-Fi. The modem doesn't share. To get
many devices online and to get wireless, you need the second box: the router.

## The router - the manager of your home network

**What it actually is.** The router is the manager of everything inside your home. It takes the single
internet connection coming from the modem and shares it among all your devices - wired and wireless. It
hands each device a local address, keeps track of who asked for what, and makes sure replies from the
internet get back to the right device. It also (in almost every home router) broadcasts the Wi-Fi.

📝 **Terminology.** The network the router creates inside your home is your *LAN* - Local Area Network. The
big network on the other side of the modem is the internet, sometimes called the *WAN* (Wide Area
Network). The router sits exactly on the border between them.

**What it does in real life.** Every device you own connects to the router, not to the modem. Your phone,
laptop, smart TV, and the speaker in the kitchen all talk to the router; the router talks to the modem; the
modem talks to the ISP. When your TV streams a show, the request walks out that chain and the video walks
back in along the same path.

**A real example.** On most home networks you can ask your own machine which box is its router. Here's what
that looks like:

```console
$ ipconfig getoption en0 router
192.168.1.1
```
*What just happened:* Your laptop reported the address of its router - `192.168.1.1` here. That's the box
your device sends everything to when it wants to reach the outside world. This address is called the
**default gateway** ("the way out"), and it's almost always the address you'd type into a browser to open
the router's own settings page. (On Windows the command is `ipconfig`; look for the "Default Gateway" line.
On Linux, `ip route` shows it after the word `default`.)

📝 **Terminology.** *Default gateway* = the device your computer hands traffic to when the destination isn't
on your local network. For a home network, that's your router.

**The gotcha.** ⚠️ Many ISPs now ship a single box that's a modem *and* a router combined - a "gateway."
That's convenient, but it's why people mix the two jobs up: they've only ever seen one box. The jobs are
still separate inside it. When you're troubleshooting, ask yourself which job is failing - "can't reach the
ISP" (modem job) is a different problem from "my devices can't talk to each other or get addresses" (router
job).

**Why this saves you later.** When the internet goes down, you can reason instead of panic. No internet on
*any* device, modem light dark? That points at the modem or the ISP. Internet works on a cable but Wi-Fi
won't connect? That's the router's wireless side. The classic "restart the router" advice works because it
makes the router rebuild its picture of your network from scratch - and now you know what that picture is.

## Recap

1. **The modem** translates your ISP's signal into network data and is the single bridge between your home
   and the internet. On its own it connects only one device.
2. **The router** shares that one connection among all your devices, hands out local addresses, and
   broadcasts your Wi-Fi. It's the manager of your home network (your **LAN**).
3. The **default gateway** is your device's name for the router - the box it sends traffic to on the way
   out.
4. Many ISPs combine both into one **gateway** box, but the two jobs are still distinct - which matters the
   moment something breaks.

Next we'll open up the router's cleverest trick: how it lets a dozen devices share a single internet
address without ever getting their wires crossed.


---

# NAT & Private IPs

If you've ever checked the IP address on your laptop and your phone, you may have noticed something odd:
they both start with `192.168`. Check a website's claim of "your IP address" and you get something
completely different - and your laptop and phone show the *same* one there. That's not a bug. It's one of
the most quietly important tricks in all of home networking, and once you see it, a lot of "why can't I…"
questions answer themselves. The trick has a name: **NAT**.

> ⏭️ If terms like "IP address" or "port" are fuzzy, [IP, DNS, and Ports](/guides/ip-dns-and-ports) grounds
> them properly. You can follow this phase without it, but it'll land harder with that foundation.

## Two kinds of address

**What it actually is.** There are two worlds of addresses, and your router lives on the border between
them.

- **Public IP** - *one* address, given to your whole home by your ISP. This is your home's address on the
  open internet, the way a street address identifies your building to the postal service. Every device in
  your home shares it.
- **Private IP** - an address that only means something *inside* your home. Your router hands one to each
  device: `192.168.1.20` for your laptop, `192.168.1.21` for your phone, and so on. These are like room
  numbers inside the building - useful internally, meaningless to the outside world.

📝 **Terminology.** Ranges like `192.168.x.x` (and also `10.x.x.x` and `172.16–31.x.x`) are reserved as
*private* address ranges. They're deliberately not routable on the public internet - millions of homes use
the exact same `192.168.1.x` numbers at the same time, and that's fine, because those addresses never leave
the building. (source: [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918))

**A real example.** Ask your laptop for its own address:

```console
$ ipconfig getifaddr en0
192.168.1.20
```
*What just happened:* Your laptop reported its **private** IP - the room number the router assigned it. Your
phone, asked the same question, would report a different one in the same range, like `192.168.1.21`. Neither
of these is the address the wider internet sees.

📝 **Terminology.** The router hands out these private addresses automatically using *DHCP* (Dynamic Host
Configuration Protocol) - the "front desk" service that assigns a free room number to each device as it
joins. It's why you don't have to configure addresses by hand; you connect, and an address appears.

## NAT - the router's translation desk

**What it actually is.** **NAT** stands for *Network Address Translation*. It's the router's job of
translating between the inside world (your many private addresses) and the outside world (your one public
address). Every time a device reaches out to the internet, the router swaps the private "from" address for
the public one, remembers it did so, and swaps it back on the reply.

**Why people get this wrong.** People assume each device needs its own internet address to get online. For a
long time the internet didn't have enough addresses to go around - and NAT is a large part of how we coped.
Your home gets one public address, and NAT quietly multiplexes all your devices through it.

**What it does in real life.** Here's the trick in one picture. Your laptop and phone both reach out; the
router rewrites their "from" address to the single public IP, and keeps a little table so it knows which
reply belongs to whom:

```mermaid
flowchart LR
  laptop[laptop<br/>192.168.1.20] --> nat
  phone[phone<br/>192.168.1.21] --> nat
  nat[ROUTER / NAT<br/>rewrites from to 203.0.113.7<br/>and remembers who asked<br/>via a translation table]
  nat -->|one public IP| net((internet<br/>203.0.113.7))
  net -.->|reply comes back; table routes it<br/>to the right device| nat
```

*The address `203.0.113.7` above is a documentation-only example IP - your real public IP will be
different.*

**A real example.** When a reply comes back from a website, it arrives at your public IP. The router checks
its translation table, sees which device started that conversation, rewrites the "to" address back to that
device's private IP, and forwards it inside. From your laptop's point of view it talked to the website
directly. It never knew a translation happened.

**The gotcha.** ⚠️ Because translation only works for conversations your devices *start*, an outsider can't
reach in and pick a device inside your home to connect to. There's no entry in the router's table for a
conversation nobody began, so the router has nowhere to send the incoming knock - it drops it. This is great
for safety (more on that in Phase 3), but it's also why "I can reach the internet, but my friend can't reach
the game server running on my PC" happens. Letting the outside in *on purpose* needs a deliberate setting
called port forwarding - a topic for a follow-up guide.

## Why you can get out but the internet can't get in

This is the part worth holding onto, because it explains a real asymmetry you'll bump into often:

- **Outbound works by default.** Your devices start conversations all day - loading pages, streaming,
  syncing. The router happily translates each one and tracks the reply. Out is easy.
- **Inbound is closed by default.** Nobody outside can start a conversation *into* a specific device,
  because the router has no translation entry telling it where such traffic should go. In is closed unless
  you open it on purpose.

That one-way default is doing quiet security work for you every single day. It's not a firewall (that's a
separate layer we'll meet next), but it has a similar effect: the inside of your home isn't directly
reachable from the open internet.

**Why this saves you later.** "Why does the website see a different IP than my laptop shows?" - because the
website sees your *public* IP and your laptop knows its *private* one. "Why do all my devices have the same
public IP?" - NAT shares one among them. "Why can't this app accept incoming connections?" - inbound is
closed by default. Three common puzzles, one mental model.

## Recap

1. Your devices have **private** IPs (`192.168.x.x`) that mean something only inside your home; your whole
   home shares **one public** IP on the open internet.
2. **DHCP** is the router service that hands each device its private address automatically.
3. **NAT** translates between the many private addresses and the one public address, using a table to route
   each reply back to the device that started the conversation.
4. Because translation only exists for conversations your devices start, **outbound works by default and
   inbound is closed** - which is quietly protecting you.

Now let's look at the part of the box you actually interact with - the Wi-Fi - and the small set of settings
that keep your network yours.

Watch it animated: [NAT and private IPs](/explainers/NAT.dc.html)


---

# Wi-Fi & Keeping It Safe

The Wi-Fi is the part of the box you actually touch - the name you pick from a list, the password you type once and forget. It's also the part most people get a little wrong, usually in ways that either slow them down or leave the door unlocked. This phase demystifies what you're picking when you pick a network, then walks through the small set of security settings that genuinely matter.

## The SSID - the name of your network

The **SSID** is the name your Wi-Fi broadcasts - the thing you see in the list of available networks. "Home_5G", "NETGEAR47", "PrettyFlyForAWiFi": all SSIDs. Your router announces it so devices can find and join the right network.

📝 **Terminology.** *SSID* = Service Set Identifier. A fancy name for "the network's name."

⚠️ **Gotcha.** Default SSIDs often reveal your router's brand or model (like "NETGEAR47" or "TP-Link_AB12") - a small hint to anyone nosing around about what hardware you're running. Renaming your network to something that isn't your name, your address, or your hardware model is a tiny, free privacy win.

## Bands and channels - 2.4 GHz vs 5 GHz

Wi-Fi rides on radio waves, and home routers broadcast on two main **bands** - two different radio frequencies, each with its own trade-off:

- **2.4 GHz** - travels *farther* and passes through walls better, but is *slower* and far more crowded (microwaves, baby monitors, and your neighbors' routers all share it).
- **5 GHz** - much *faster* with less interference, but has *shorter* range and is more easily blocked by walls and floors.

```text
   2.4 GHz   ████████████████████████  far reach, slower, crowded
                                         → good for the far bedroom, smart-home gadgets

   5 GHz     ██████████                 short reach, faster, cleaner
                                         → good for the laptop near the router, video calls, streaming
```

📝 **Terminology.** Within each band there are *channels* - narrower lanes on the same road. Neighbors on the same channel interfere with each other, like two conversations on the same walkie-talkie frequency.

Many modern routers carry one network name and quietly put each device on whichever band suits it ("band steering"), so you don't have to think about it. On older or split setups you'll see two names, like "Home" and "Home_5G," and you choose. Rule of thumb: **close and needs speed → 5 GHz; far away or just needs to stay connected → 2.4 GHz.**

⚠️ **Gotcha.** If a smart-home gadget refuses to connect during setup, it's often because it only speaks 2.4 GHz and your phone is sitting on 5 GHz. Putting your phone on the 2.4 GHz network during setup usually fixes it - this trips up almost everybody the first time.

As for channels: leave them on "Auto" unless you have a specific reason. Routers pick a reasonable channel on their own.

## The firewall - the router's bouncer

Your router includes a **firewall** - a layer that inspects incoming traffic and blocks anything that wasn't invited. Phase 2 showed that NAT already makes inbound connections fail by default; the firewall is a deliberate, configurable layer on top of that, keeping unsolicited traffic out.

For almost every home, the firewall does its job out of the box and needs no attention. It's worth knowing it exists for two reasons: it's *why* random machines on the internet can't poke at your devices, and it's the thing you'd carefully adjust if you ever deliberately opened a port (a follow-up-guide topic, not something to do casually).

## The security settings that actually matter

You don't need to become a network administrator - just get a small number of things right. Here's the checklist, in priority order:

| Setting | Do this | Why it matters |
|---|---|---|
| **Admin password** | Change the router's *admin* login from the factory default | The default is the front door key, and it's public knowledge |
| **Wi-Fi encryption** | Use **WPA2** at minimum, **WPA3** if offered | Encrypts your traffic so neighbors can't read it or join freely |
| **Wi-Fi password** | Set a long, unique passphrase | A weak Wi-Fi password is an open network with extra steps |
| **Guest network** | Turn it on for visitors and smart gadgets | Keeps other people's phones (and chatty IoT devices) off your main network |
| **Firmware updates** | Enable auto-updates if available | Patches security holes you'll never hear about otherwise |

### The one gotcha that bites hardest

⚠️ **Default admin credentials are the single most common way home networks get taken over.** Routers ship with a factory username and password - often `admin` / `admin` or `admin` / `password` - printed in manuals anyone can find online. The admin login is *not* the same as your Wi-Fi password: it's the master key to the router's settings, where someone could redirect your traffic, open your network up, or lock you out. If you change *one* thing after reading this guide, change the admin password - two minutes, biggest hole closed.

📝 **Terminology.** *WPA2 / WPA3* (Wi-Fi Protected Access) are the encryption standards that scramble your wireless traffic. WPA3 is the newer, stronger one; WPA2 is still solid and widely supported. Anything older - WEP, or "open"/no-password - should be avoided. (Source: [Wi-Fi Alliance - WPA3](https://www.wi-fi.org/discover-wi-fi/security).)

**Why a guest network is worth the two clicks.** A guest network is a separate Wi-Fi that can reach the internet but is walled off from your main devices. Put visitors on it so you're not handing out your real password, and put your smart bulbs, cameras, and plugs on it too - those cheap devices are the ones most likely to have security holes, and a guest network keeps a compromised gadget from being a doorway to your laptop.

Most "my network got hacked" stories trace back to one of two things: a default admin password nobody changed, or weak/old Wi-Fi encryption. Get the table above right and you've closed the doors that actually get used.

## Recap

1. The **SSID** is your network's name; rename it off the factory default so it doesn't advertise your hardware.
2. **2.4 GHz** goes far but slow; **5 GHz** is fast but short-range - close-and-fast vs far-and-reliable. Smart gadgets often need 2.4 GHz to set up.
3. The router's **firewall** blocks uninvited inbound traffic and works out of the box; it's the deliberate layer on top of NAT's default protection.
4. The security that matters: **change the admin password** (the big one), use **WPA2/WPA3**, set a strong Wi-Fi passphrase, turn on a **guest network**, and let **firmware auto-update**.

## When something's still wrong

If your network is set up and safe but a device still won't load pages, the problem is usually one layer deeper - names not resolving, the wrong port, or a connection that never completes. That's the ground covered in [IP, DNS, and Ports](/guides/ip-dns-and-ports): start there and you'll know which layer to poke at instead of restarting the router for the third time.

You now know what the box on your shelf is, what it's doing every second, and how to keep it yours. That's the whole machine, named.

Related: [IP, DNS, and Ports](/guides/ip-dns-and-ports) · [How the Internet Works](/guides/how-the-internet-works) · [The TCP/IP Model](/guides/tcp-ip-model)