# Architecture

> What the wizard actually builds, from four LAN segments and two upstream links to the routing that decides which traffic goes where.

Source: https://joinnasnet.com/en/guides/nasnet-connect/architecture/
Last updated: 2026-08-17

---

## Overview

There are two architectures worth understanding here, and they are unrelated.
One is the wizard: a browser app that generates a file. The other is the network
design that the generated file puts on your router, and that is the one that
matters after the wizard is closed.

## The wizard

Nasnet Connect is a Qwik application that runs entirely in the browser. You
answer questions, it assembles RouterOS commands, and you download a `.rsc`
file. It does not connect to your router, does not hold your credentials, and
has no account system. The config is built client-side and handed to you.

```
   You                Wizard (browser)         Router
    │                       │                     │
    │  answers              │                     │
    ├──────────────────────>│                     │
    │                       │ generates .rsc      │
    │  download             │                     │
    │<──────────────────────┤                     │
    │                                             │
    │  you apply it yourself, over WinBox/SSH     │
    ├────────────────────────────────────────────>│
```

That last step being manual is the whole security model: nothing can be pushed
to your router by anyone, because nothing has access to it.

## The network it builds

The generated configuration splits your LAN into four segments, each with its
own routing policy, sitting behind a firewall and NAT in front of up to two
upstream links.

| Network | IP range | Purpose |
| ------- | -------- | ------- |
| Split LAN | `192.168.10.0/24` | Smart routing, where the destination decides which link is used |
| Domestic LAN | `192.168.20.0/24` | Domestic link only |
| Foreign LAN | `192.168.30.0/24` | Foreign link only |
| VPN LAN | `192.168.40.0/24` | Everything tunnelled through the VPN |

The practical effect is that *which network a device joins* decides how its
traffic leaves the house. A device on the Domestic LAN never touches the foreign
link; a device on the VPN LAN cannot leak around the tunnel; and a device on the
Split LAN gets whichever path suits the destination.

## Upstream links

```
                          INTERNET
                              ▲
              ┌───────────────┼───────────────┐
        DOMESTIC WAN     FOREIGN WAN     VPN CLIENT
              └───────────────┼───────────────┘
                              │
                        FIREWALL rules
                              │
                        NAT / masquerade
                              │
        ┌──────────┬──────────┼──────────┬──────────┐
     Split LAN  Domestic   Foreign     VPN LAN
```

Both WANs are optional in the sense that the wizard adapts, so telling it you
have only one link removes the steps that would not apply. Where both exist, it
configures failover between them.

## DNS

Each path gets its own resolvers, which is what stops a domestic query from
being answered over the foreign link and vice versa:

| Path | Resolvers |
| ---- | --------- |
| Domestic traffic | Local DNS servers |
| Foreign traffic | Global resolvers |
| VPN traffic | The tunnel's own DNS |

## What else the config carries

- **VPN services.** WireGuard and OpenVPN servers for remote access, plus a
  VPN client on the router for masking the upstream IP.
- **Wireless.** Multiple SSIDs mapped onto the LAN segments, band steering
  across 2.4 and 5 GHz, and isolation between segments.
- **Gaming.** A port-forwarding database of known games and routing rules that
  keep game traffic on a low-latency path.
- **Maintenance.** Scheduled updates, scheduled reboots, NTP, DDNS and
  certificate handling.

## Related

- [System requirements](/en/guides/nasnet-connect/system-requirements/)
- [LAN](/en/guides/nasnet-connect/lan/)
- [WAN](/en/guides/nasnet-connect/wan/)