Architecture

What the wizard actually builds, from four LAN segments and two upstream links to the routing that decides which traffic goes where.

Last updated Aug 17, 2026View as Markdown

Overview

There are two architectures worth understanding here, and they are unrelated. One is the wizard: a browser app that generates a file. The other is the network design that the generated file puts on your router, and that is the one that matters after the wizard is closed.

The wizard

Nasnet Connect is a Qwik application that runs entirely in the browser. You answer questions, it assembles RouterOS commands, and you download a .rsc file. It does not connect to your router, does not hold your credentials, and has no account system. The config is built client-side and handed to you.

   You                Wizard (browser)         Router
    │                       │                     │
    │  answers              │                     │
    ├──────────────────────>│                     │
    │                       │ generates .rsc      │
    │  download             │                     │
    │<──────────────────────┤                     │
    │                                             │
    │  you apply it yourself, over WinBox/SSH     │
    ├────────────────────────────────────────────>│

That last step being manual is the whole security model: nothing can be pushed to your router by anyone, because nothing has access to it.

The network it builds

The generated configuration splits your LAN into four segments, each with its own routing policy, sitting behind a firewall and NAT in front of up to two upstream links.

Network IP range Purpose
Split LAN 192.168.10.0/24 Smart routing, where the destination decides which link is used
Domestic LAN 192.168.20.0/24 Domestic link only
Foreign LAN 192.168.30.0/24 Foreign link only
VPN LAN 192.168.40.0/24 Everything tunnelled through the VPN

The practical effect is that which network a device joins decides how its traffic leaves the house. A device on the Domestic LAN never touches the foreign link; a device on the VPN LAN cannot leak around the tunnel; and a device on the Split LAN gets whichever path suits the destination.

                          INTERNET
                              ▲
              ┌───────────────┼───────────────┐
        DOMESTIC WAN     FOREIGN WAN     VPN CLIENT
              └───────────────┼───────────────┘
                              │
                        FIREWALL rules
                              │
                        NAT / masquerade
                              │
        ┌──────────┬──────────┼──────────┬──────────┐
     Split LAN  Domestic   Foreign     VPN LAN

Both WANs are optional in the sense that the wizard adapts, so telling it you have only one link removes the steps that would not apply. Where both exist, it configures failover between them.

DNS

Each path gets its own resolvers, which is what stops a domestic query from being answered over the foreign link and vice versa:

Path Resolvers
Domestic traffic Local DNS servers
Foreign traffic Global resolvers
VPN traffic The tunnel’s own DNS

What else the config carries

  • VPN services. WireGuard and OpenVPN servers for remote access, plus a VPN client on the router for masking the upstream IP.
  • Wireless. Multiple SSIDs mapped onto the LAN segments, band steering across 2.4 and 5 GHz, and isolation between segments.
  • Gaming. A port-forwarding database of known games and routing rules that keep game traffic on a low-latency path.
  • Maintenance. Scheduled updates, scheduled reboots, NTP, DDNS and certificate handling.