Networking Devices Explained: Routers, Switches, Firewalls, and More

Computer Networking for Beginners series — Part 3. This post continues Part 1: A Complete Guide to How Networks Work and Part 2: What Is the OSI Model?. Each post in the series takes one topic and covers it in depth. This one is about the devices that make networks work.

In Part 1, you met the basic building blocks of a network, and in Part 2, you learned the seven layers of the OSI model. This post brings the two together. You’ll learn what each common networking device actually does, which OSI layer it works at, and where you’ll find it — from the router in your living room to the racks of equipment in a data center.

Knowing these devices helps you understand how your own network is put together, troubleshoot problems faster, and make sense of the hardware you see in offices, server rooms, and certification exams like CompTIA Network+.

Networking Devices at a Glance

Here’s a quick reference before we look at each device in detail:

Hubs and Repeaters: Where It All Started

A repeater receives a signal and sends it out again at full strength, so it can travel farther. A hub is a repeater with several ports: anything that arrives on one port is copied out to every other port.

Both work at Layer 1, so they don’t understand addresses at all — just signals. Because a hub sends every frame to every device, the network gets crowded, devices have to take turns, and any device can see everyone else’s traffic. Switches replaced hubs for exactly these reasons, but you’ll still see hubs in certification exams as the example of how not to build a modern network.

Switches

A switch connects devices within the same local network and is the core of almost every LAN. It works at Layer 2, the data link layer, and makes its decisions using MAC addresses.

How a Switch Works

A switch keeps a MAC address table (also called a CAM table) that records which device is connected to which port. It builds the table automatically by noting the source MAC address of every frame it receives:

1. A frame arrives on port 3 from MAC address 3C:22:FB:9A:41:7E. The switch records: “that device is on port 3.”
2. The switch looks up the frame’s destination MAC address in its table.
3. If it knows the port, it sends the frame only to that port. If it doesn’t know it yet, it sends the frame out of all ports (called flooding), then learns the correct port as soon as the device replies.

Because traffic goes only where it needs to, devices can send and receive at the same time without slowing each other down, and they don’t see each other’s traffic the way they would on a hub.

Switches do this at full speed on every port because the forwarding is handled in hardware, by specialized chips called ASICs (application-specific integrated circuits), rather than by general-purpose software.

Unmanaged and Managed Switches

• An unmanaged switch is plug-and-play: no settings, no configuration. The small switch you’d buy to add ports to a home network is unmanaged.
• A managed switch can be configured and monitored. Businesses use managed switches for features like:
  • VLANs (virtual LANs), which split one physical switch into several separate networks — for example, keeping guest devices, phones, and office computers apart.
  • Port security, which limits which devices can connect to a port.
  • Monitoring of traffic and errors on each port.

Power over Ethernet (PoE)

Many enterprise switches support Power over Ethernet (PoE): they send electrical power through the same Ethernet cable as the data. That means devices like wireless access points, security cameras, and desk phones need just one cable and no nearby power outlet. The PoE standards have grown over time, from about 15 watts per port in the original standard to up to about 90 watts in the newest one, enough for devices like small displays and pan-tilt cameras.

Layer 3 Switches

A Layer 3 switch (or multilayer switch) can also route traffic between VLANs and subnets using IP addresses — a job that otherwise belongs to a router. Inside data centers and large office networks, Layer 3 switches handle most of the routing between internal networks, because they do it at hardware speed.

Routers

A router connects different networks together and decides where each packet should go next. It works at Layer 3, the network layer, and makes its decisions using IP addresses.

How a Router Works

Every router keeps a routing table: a list of networks it knows about and which direction to send traffic for each one. When a packet arrives, the router:

1. Reads the packet’s destination IP address.
2. Finds the best match in its routing table.
3. Forwards the packet out of the matching interface, toward the next router on the path — one hop closer to its destination.

If no specific route matches, the router uses its default route — usually “send it to the internet provider.”

Routers are what connect different types of networks: they route traffic between subnets inside an organization (see What Is a Subnet?), and between local area networks (LANs) and wide area networks (WANs), like a company’s office network and the internet or its other branch offices. Large networks and internet providers use routing protocols like OSPF and BGP so routers can share routes with each other automatically.

Your Home “Router”

The box most people call a router is really several devices in one:

• A router, connecting your home network to your internet provider.
• A switch, providing a few Ethernet ports.
• A wireless access point, providing Wi-Fi.
• A firewall, blocking unrequested incoming connections.
• A DHCP server, giving every device an IP address.
• NAT, letting all your devices share one public IP address (see What Is an IP Address?).

Modems

A modem (modulator-demodulator) converts the signal used by your internet provider’s line — cable, DSL, or cellular — into Ethernet your router can use. For fiber internet, the same job is done by an ONT (optical network terminal). A modem connects you to your provider; the router connects your devices to each other and to that connection. Many providers supply a single box that does both.

Firewalls

A firewall controls which traffic is allowed in and out of a network, based on a set of rules. It’s a network’s first line of defense.

How Firewalls Have Evolved

• Packet-filtering firewalls check each packet’s IP addresses, ports, and protocol against the rules — for example, “allow incoming traffic to the web server on port 443; block everything else.” They work at Layers 3 and 4.
• Stateful firewalls also keep track of connections. If a device inside the network starts a conversation, the firewall automatically allows the replies back in, while still blocking connections that nobody inside requested. Your home router’s firewall works this way.
• Next-generation firewalls (NGFW) look much deeper, up to Layer 7. They can identify specific applications no matter which port they use (telling apart, say, a video call from a file-sharing app), and they often combine several jobs in one device: VPN encryption for remote workers and branch offices, NAT, intrusion prevention, and web filtering.

Network and Host-Based Firewalls

A network firewall is a device that protects an entire network, usually placed where it connects to the internet. A host-based firewall is software running on a single computer — like the firewalls built into Windows, macOS, and Linux (such as ufw). Using both is a good practice: if something gets past the network firewall, each computer still has its own protection.

IDS and IPS

A firewall decides what traffic is allowed. But allowed traffic can still carry an attack — for example, a request to your website on port 443 that tries to exploit a vulnerability. That’s where intrusion detection and prevention systems come in. Both examine traffic closely, up to the contents of the packets, looking for signs of attacks.

• An IDS (Intrusion Detection System) detects and alerts. It watches a copy of the network traffic and notifies administrators when it sees something suspicious, but it doesn’t stop the traffic.
• An IPS (Intrusion Prevention System) detects and blocks. It sits directly in the path of the traffic (inline), so it can drop malicious packets before they reach their target.

They spot attacks in two main ways:

• Signature-based detection compares traffic to a database of known attack patterns, like an antivirus program for the network. It’s accurate for known threats but can’t recognize brand-new ones.
• Anomaly-based detection learns what normal traffic looks like and flags anything unusual. It can catch new attacks, but it also produces more false positives — legitimate traffic mistaken for an attack.

The trade-off between them: an IDS can never accidentally block legitimate traffic, but it only tells you about an attack after it’s happened. An IPS stops attacks automatically, but a false positive can block something important. Today, IPS features are often built into next-generation firewalls.

Load Balancers

A popular website can’t run on a single server: it would be overwhelmed by visitors, and if that one server failed, the site would go down. A load balancer sits in front of a group of servers and distributes incoming traffic among them, so no single server gets overloaded.

Load balancers keep sites fast and available:

• Health checks: the load balancer regularly tests each server and stops sending traffic to any server that isn’t responding, so visitors never notice when one fails.
• Scaling: you can add more servers behind the load balancer as traffic grows, or take one out for maintenance, without any downtime.

They choose a server using a load-balancing algorithm, such as:

• Round robin — each new request goes to the next server in the list.
• Least connections — each request goes to the server that’s currently handling the fewest connections.

Layer 4 load balancers make decisions using IP addresses and ports. Layer 7 load balancers understand HTTP, so they can make smarter decisions — for example, sending requests for /images/ to one group of servers and requests for /api/ to another.

Load balancers can also take work off the servers behind them:

• TCP offloading: the load balancer handles the work of managing thousands of client connections.
• SSL/TLS decryption (offloading): the load balancer decrypts HTTPS traffic, so the servers behind it don’t have to spend processing power on encryption.
• Caching: the load balancer stores copies of content that’s requested often, and sends it directly without asking a server.

Proxies

A proxy (or proxy server) is an intermediary: instead of talking to a server directly, a client talks to the proxy, and the proxy makes the request on the client’s behalf. There are two main kinds, depending on which side it works for.

Forward Proxies

A forward proxy works on behalf of users. Businesses and schools route their users’ web traffic through a forward proxy so they can:

• Filter URLs — block websites that are dangerous or against policy.
• Scan content — check downloads for malware before they reach users’ computers.
• Cache popular content to save bandwidth.
• Log web activity, as required by some organizations.

Because the proxy makes the requests, websites see the proxy’s IP address, not the user’s.

Reverse Proxies

A reverse proxy works on behalf of servers. It sits in front of one or more web servers, receives requests from the internet, and passes them to the right server behind it. Reverse proxies handle jobs like HTTPS encryption, caching, and hiding the details of the servers behind them. Load balancers are a type of reverse proxy. If you’ve set up a website with Nginx in front of an application, you’ve already used one — see the deployment steps in Python Flask: A Complete Guide to Building and Deploying Web Applications.

Proxy or VPN? A proxy usually handles traffic for specific applications, like a web browser. A VPN encrypts all of a device’s network traffic and connects it to another network. To set up your own VPN, see How to Set Up Tailscale.

Network Storage: NAS and SAN

Networks don’t only move data; they also store it. There are two main approaches.

NAS (Network Attached Storage)

A NAS is a storage device with its own operating system that connects to the regular network and shares files and folders with other devices, using file-sharing protocols like SMB (common on Windows and macOS) and NFS (common on Linux). Users see it as a shared network drive.

NAS devices are simple to set up and popular in homes and small offices for backups, shared documents, and media libraries. You can even turn a Linux computer into a basic NAS by sharing folders with Samba — see Samba Server: How to Install and Configure on Ubuntu.

SAN (Storage Area Network)

A SAN is a separate, high-speed network dedicated to storage. Instead of sharing files, it provides blocks of storage — raw chunks of disk space — that servers use as if they were their own local hard drives. A server formats and manages that storage itself. SANs often use dedicated technologies like Fibre Channel, or iSCSI, which carries storage traffic over regular Ethernet.

Block-level access is more efficient for demanding workloads like databases and virtual machines, which is why SANs are common in enterprise data centers. They’re also more complex and expensive than a NAS.

Wireless Infrastructure

Wireless Access Points

A wireless access point (WAP or AP) connects Wi-Fi devices to a wired network. It converts between radio signals and Ethernet, working mainly at Layers 1 and 2. At home, the access point is built into your router. In offices, schools, hotels, and warehouses, many separate access points are mounted on ceilings and walls to cover the whole building — often powered by PoE from a switch.

Wireless LAN Controllers

When a building has dozens or hundreds of access points, configuring each one by hand isn’t practical. A wireless LAN controller (WLC) manages them all from one place:

• Centralized configuration: Wi-Fi network names, passwords, and security settings are set once and pushed to every access point.
• Monitoring: administrators can see every access point, every connected device, and problems like interference, from a single dashboard.
• Radio management: the controller adjusts each access point’s channel and power so neighboring access points don’t interfere with each other.
• Seamless roaming: as people walk through the building, their devices move from one access point to the next without dropping video calls or connections.

Many modern systems are cloud-managed instead, providing the same central management from a web dashboard without a physical controller.

Mesh Wi-Fi

In homes, mesh Wi-Fi systems use the same idea on a small scale: several units work together as one network, with one acting as the main router and the others extending coverage, so you can move around the house on a single Wi-Fi network.

How the Devices Work Together

Here’s how many of these devices take part when you visit a website hosted in a data center:

Your laptop
  → Wireless access point (in your home router)
  → Router + firewall + NAT (your home router)
  → Modem → your internet provider's routers → the internet
  → Data center edge router
  → Next-generation firewall with IPS
  → Load balancer (decrypts HTTPS, picks a healthy web server)
  → Switch
  → Web server ──(SAN)──→ Storage

1. Your laptop sends the request over Wi-Fi to your home router’s access point.
2. Your home router applies NAT, its firewall allows the outgoing connection, and it forwards the packets to your modem and internet provider.
3. Routers across the internet forward the packets, hop by hop, to the data center.
4. The data center’s firewall checks the traffic against its rules, and its IPS inspects it for attacks.
5. The load balancer decrypts the HTTPS request and sends it to a healthy web server.
6. A switch delivers it to that server, which reads its data from SAN storage and sends the page back the same way.

Home, Business, and Data Center Networks

The same types of devices appear everywhere, just at different scales:

Commonly Confused Devices

• Hub vs. switch: a hub sends everything to every port; a switch sends traffic only to the right port, using MAC addresses.
• Switch vs. router: a switch connects devices within a network (Layer 2, MAC addresses); a router connects different networks (Layer 3, IP addresses).
• Modem vs. router: a modem connects you to your internet provider; a router connects your devices to each other and to that connection.
• Firewall vs. IDS/IPS: a firewall allows or blocks traffic based on rules; an IDS/IPS inspects allowed traffic for signs of attacks.
• IDS vs. IPS: an IDS alerts; an IPS blocks.
• Load balancer vs. reverse proxy: a load balancer is a reverse proxy whose main job is spreading traffic across several servers.
• Proxy vs. VPN: a proxy handles specific applications’ requests; a VPN encrypts all of a device’s traffic.
• NAS vs. SAN: a NAS shares files over the regular network; a SAN provides block storage over a dedicated network.
• Access point vs. wireless LAN controller: an access point connects Wi-Fi devices; a controller manages many access points.

What’s Next in This Series

Now that you know the devices that make networks work, the upcoming posts in the Computer Networking for Beginners series will look more closely at how they communicate — topics like IP addressing and subnetting, DNS, and setting up and securing your own network. In the meantime, take a look at your own home router’s admin page (usually at your default gateway address, like 192.168.1.1) and see how many of the devices from this post are hiding inside that one box.

Conclusion

Every network is built from a small set of devices, each with a clear job. Switches connect devices within a network using MAC addresses, and routers connect networks using IP addresses. Firewalls decide what traffic is allowed, and IDS/IPS systems watch that traffic for attacks. Load balancers and proxies sit between clients and servers to spread traffic, filter content, and take work off the servers. NAS and SAN devices store data for the network, and access points and wireless LAN controllers bring Wi-Fi to everything from a single room to an entire campus.

Once you know what each device does and which OSI layer it works at, any network diagram becomes much easier to read — and any network problem becomes much easier to track down.

Next in the Computer Networking for Beginners series: Networking Concepts Explained: CDNs, VPNs, QoS, and TTL, four concepts that make networks faster, more secure, and more reliable.

Computer Networking for Beginners series: Part 1: A Complete Guide to How Networks Work · Part 2: What Is the OSI Model? · Part 3: Networking Devices Explained · Part 4: CDNs, VPNs, QoS, and TTL · Part 5: Cloud Networking Explained · Part 6: Internet Protocol Explained · Part 7: Well-Known Port Numbers · Part 8: Protocols for Troubleshooting, Tunneling, and Security