I have some networking questions about isolating networks and why it's bad to run DHCP and DNS on a router and should be run on a server.

Question 1:

What is the purpose of the WAN interface and how does it separate a local virtual environment from the public internet? And how is it similar to a cable modem?

Question 2:

DNS and DHCP are typically running on a server; why is it not a good idea to run these services on a router?

  • Shouldn't you be doing your own homework? – rnxrx Feb 19 '17 at 23:29
  • @mrx It's not homework? I have some basic questions and would like some help since I cannot find them on the internet. – Wesley Feb 19 '17 at 23:32
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 16 '17 at 22:03

WAN is a very subjective term. Routers have interfaces. Some types of router interfaces are more likely to be used as or called WAN interfaces. For example, PPP, HDLC, Frame relay, etc. are rarely used internally in a company, and are generally considered WAN protocols. On the other hand, ethernet, token ring, Wi-Fi, etc. are generally used on an internal LAN. Each of those protocols could actually be used on a WAN or a LAN.

In general, a WAN is a network connecting geographically separate locations.

DNS and DHCP are not actually router functions. Many router vendors include such server software in their router software. The problem is that the router versions of the servers are limited compared to a dedicated server, and you may not want to use router resources (RAM and CPU) to do these functions on a busy router. The real point of a router is to route packets as quickly and efficiently as possible, and running servers can interfere with the primary routing function.

| improve this answer | |
  • But how does it separate a local environment from the public internet? – Wesley Feb 20 '17 at 0:10
  • That question doesn't really make sense. Routers route between networks. A router could have any number of interfaces in different networks, none or all of which could be public networks, or there could some combination of public and private networks. For example, a company could have a block of public addresses, and its WAN router has nothing but public addresses on it, and the separation doesn't happen until farther in its network. ISPs often have routers that have nothing but public addressing. – Ron Maupin Feb 20 '17 at 0:14
  • @ShaolinGOD, the only difference between public and private addresses is that ISPs, by mutual agreement, will not advertise private addresses on the public Internet. The choice of private addressing was purely arbitrary, and was codified in an RFC, but there is no difference between public and private addresses that is built into IP. – Ron Maupin Feb 20 '17 at 0:16
  • I'm using pfsense with two network adapters, one with NAT for the VM network and the other is Bridged for the internet. I just don't understand how it isolates the network. – Wesley Feb 20 '17 at 0:17
  • I don't understand what you mean by isolate. Routers route between networks. You can have router ACLs or a firewall to prevent traffic from one network going into another network, but a router will, by default, automatically route between any connected networks, the opposite of isolation. – Ron Maupin Feb 20 '17 at 0:19

What is the purpose of the WAN interface and how does it separate a local virtual environment from the public internet? And how is it similar to a cable modem?

WAN interface is a vague term but it has a couple widely used meanings.

@RonMaupin has given a great description of what WAN interfaces mean to enterprises. In addition to his description, I would also add BGP as another important WAN edge protocol.

However, WAN interfaces often have a slightly different meaning for SOHO and Small Business networking devices. The WAN interface is often a routed interface with a few additional features preconfigured. The features are bulleted below. The remaining ports on such a device are often switched interfaces. The purpose is to accept an ethernet handoff from a device such as a cable modem or DSL modem and provide internet access to the switched ports/interfaces.

  • The WAN interface is most likely a routed interface as opposed to a switched interface.
  • The WAN interface is expecting an ethernet, layer-3 handoff.
  • The interface is configured to accept a DHCP address (a static address can usually be set).
  • The WAN interface is configured as an "Outside" interface in respect to Network Address Port Translation(NAPT). https://tools.ietf.org/html/rfc2663#section-4.1.2
  • The WAN interface is configured as the default route.

There are other purposes and uses for this configuration, but it is safe to say Internet Access is the most common goal.

DNS and DHCP are typically running on a server; why is it not a good idea to run these services on a router?

While DNS and DHCP services are often available on a router, they are often taxing on the networking device, limited in features, limited in management capabilities and are not suitable in medium to large scale deployments. @RonMaupin addresses the first point very well, but I also want to draw attention to the other two points.

| improve this answer | |

Lets break down the term WAN. It means WIDE AREA NETWORK. It isn't similar to a cable modem. Cable Modems use a large cable as a physical connection that gets processed in the device as a WAN, much like an ethernet connection would, but on the network of the Internet provider. Now lets go further. Any network is a set of 2 or more connected devices. With only 2 devices connected directly, it's easy to know where to send information back and forth, only one place to go to or get it from. When you have an unknown number of potential connections and an unknown type of information, you need to find ways of separating and sorting everything, then a way to queue everything in proper order, and a way to send back a response of some sort to prevent or bypass errors. Routers do this by assigning each physical ROUTE a number, and then different sets of data also get numbers called ports. The numbers are IP addresses, sets of 8bit numbers that represent binary ones and zeroes, that enables extremely large, though not infinite, networks to be set up. WAN is a type of network for your outside internet connection. It doesn't separate anything, it connects the router to the internet on one route. However, that route's address is controlled by the Service Provider's networking, and very similarly to the way your INTERNAL NETWORK is set up, even if the actual signal comes in over different wiring (it's still a physical route). WAN separates nothing, it connects the router to the internet. There is programming in the router that accepts messages from one of the ip addresses in your internal network, then checks a local list of addresses for a match, and when it doesn't find one, it sends the message out over the WAN to an OUTSIDE DNS that will check other DNS lists and send the message to the destination on the internet--presumably to the computer hosting the website. There is something called NAT or NETWORK ADDRESS TRANSLATION that can run which allows your router to HIDE your computer's address from the internet, and send the message as if it came from the router itself, which in a way, does isolate you from internet dangers, however, it still advertises port numbers and other data that firewalls are now scrambling as a defense mechanism. DNS is DOMAIN NAME SERVER. A machine that keeps a list of machines and how to reach them is a DOMAIN NAME SERVER. Without one of these, a network is only internal and will be very slow, as it has to attempt to check every route for matching data before it can actually send the message through. In the programming, networks can actually be separated from one another by being MASKED. Because BINARY is all 1 or 0, machines can see one another when the addresses and the mask pattern align properly. Using this, you can set up multiple networks in the same physical area, using the same dumb (no OS) switches, provided the devices all get their address and subnet manually set. However, if you have a smart switch, you can set up some physical ports for each network you want to run, and they will pass data through. DHCP is the Dynamic Host\Client Protocol. It's programming that will create the numbering system and send it to every machine connected to it. Running this on a router is common now in homes, but running it on routers in small businesses is also common. Larger corporate networks are usually handled by several servers, one or more for DHCP--which means there could be multiple networks running simultaneously, self contained, and somewhat fault tolerant--one or more DNS--each network needs some way to know the fastest route to each connected device--and one or more GATEWAYS--which are just the connection to the internet. GATEWAYS usually run NAT, but don't have to. Most Corporate networks have a firewall as well. This can be a large server type that acts like a router, or built in mathematics on the GATEWAY\Modem, or any combination. Stronger firewalls are more costly. WAN DOESN'T separate you from anything. It's just on a different LOGICAL or mathematical network than your internal network. Much like this, some internal mesh networks actually use a similar networking style called STATIC ROUTES, built into the routing table or DNS lists, that allow separated networks to access one another much more securely. By seeing the master network as a WAN or outer network, they allow data to pass only to specific services or devices on other networks, but they cannot see each other in any other way, and are otherwise isolated from one another. Most Operating systems have their own DNS list called a HOSTS file, which can allow you to specify this pathway, but most routers will have a method of adding these kinds pathways so that they can be "CASCADED", allowing multiple NAT and firewall impelmentations for heightened security. This also allows some networks to use something called VPN or VIRTUAL PRIVATE NETWORKING. By setting up two of these servers in different geographical locations, setting one up to contain the internal DNS and routing of the internal network and allowing it to pass out a few addresses outside of the other set handed down by the main internal network (on the same masking but outside of the normal set handed out by the first DHCP), then setting the other up to send a message to that router on a specific port number to be forwarded directly through to the VPN server behind it, one VPN server is the HOST, the other the CLIENT or SATELITE, and the two offices can share connected systems and resources. By combining all of this, network technicians build vastly complicated networks that allow fault tolerance, and continuing function so corporate assets maintain value. By doing the same, hobbyist Home users can hide their presence on the internet with VPN services, and even run several different networks for home security and other fun things that all run on the internet of things (which is just physical things that are connected to the internet), while keeping each network separate and maintaining the speed and usefulness of their main computer networks.

| improve this answer | |
  • 1
    I'm sorry, but there are so many incorrect statements here I don't even know where to begin. – Teun Vink Jun 16 '19 at 12:20
  • 1
    I agreed with @Teun Vink there are many misleading points in answer – infra Jun 16 '19 at 14:31
  • 1
    Seriously, this answer is fatally flawed. Network Engineering is a site for questions and answers about professionally managed networks in a business environment, and answers like this really do not belong here. – Ron Maupin Jun 16 '19 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.