What is WAN?
Wide Area Network
A WAN (Wide Area Network) is a network that spans a large distance, such as between cities or countries, and on a router it means the side that faces the internet or another site, as opposed to the LAN side.
The two senses are related. Historically, a WAN was a company's own long-distance network: leased lines, Frame Relay or MPLS circuits joining offices in different places, usually rented from a telecoms carrier. Today most sites reach each other over the internet instead, with a VPN such as WireGuard on top, so the word is used mostly for the router's internet-facing side. A small office router has a WAN interface, connected to the ISP, and one or more LAN interfaces or VLANs for the office.
The WAN interface is where most of a router's edge work happens. It carries the address the ISP assigned, fixed or by DHCP; it's where the default route points; outgoing traffic from private LAN addresses is translated there with NAT; and the firewall treats it as untrusted, so connections from the internet are dropped unless a rule or a port forward allows them. Routers with two internet connections have two WAN interfaces and need health checks to decide which to use.
Common WAN problems are a missing default route, NAT on the wrong interface, an MTU that's too large for the ISP's link, and firewall rules that block replies. The Debian as an office router lesson configures a WAN interface with systemd-networkd and protects it with nftables.
Lessons that use WAN
- Debian as an office router: interfaces, VLANs and a firewallTeaches this term · Intermediate · 45 min
Turn a fresh Debian 13 install into an office router: systemd-networkd for the WAN and three VLANs on one trunk, IP forwarding, an nftables policy between VLANs with NAT, protecting the router itself, and a configuration that survives a reboot.
- Setting up VyOS with NATBeginner · 45 min
A VyOS router with a NAT interface for a private LAN and a public interface for a routed public subnet: plain routing, source NAT, port forwarding and the forward firewall that NAT isn't. Every output comes from a real VyOS lab.
- Zone-based firewall on VyOSIntermediate · 35 min
Rebuild the NAT lesson's router with a zone-based firewall: WAN, LAN, a DMZ and the router itself, with one ruleset per direction. Includes the missing-return-traffic mistake, post-NAT matching, and a full test matrix.
- Traffic shaping with CAKE on DebianIntermediate · 40 min
Measure bufferbloat on an office line, then fix it on a Debian 13 router with CAKE: shaping uploads on the WAN and downloads through an IFB, fair shares between hosts, making it permanent with systemd-networkd, and tuning it for your line.
- Two Debian routers: VRRP and connection syncIntermediate · 45 min
Pair two Debian 13 routers so the office survives one failing: keepalived VRRP for the gateway and public addresses, conntrackd so open connections survive, NAT to a shared address, health checks, and split brain, all measured in a lab.
- IPv6 on the Debian routerIntermediate · 40 min
Add IPv6 to a Debian router with systemd-networkd: ask the ISP for a /56 by DHCPv6 prefix delegation, give each VLAN a /64 and announce it with router advertisements, firewall it with nftables (including the ICMPv6 IPv6 can't work without), and see what happens when the ISP changes the prefix.
- Office gateway: DHCP, DNS and VRRP on VyOSBeginner · 40 min
Two VyOS routers serving one office LAN: VRRP for a gateway that survives a router failure, DHCP with split pools and a printer reservation, and DNS forwarding. Then a real failover, the DNS outage it exposed, and the fix.
- Packets That Never Come BackIntermediate · 75 min
Advanced packet capture with tcpdump, and how to find where packets die on a VyOS network: missing NAT and return routes, asymmetric routing through a stateful firewall, and MTU black holes, all diagnosed on a real VyOS router.