Quick Answer: The WAN port terminates the internet service; the LAN ports distribute it. On a typical router the WAN socket, often labelled Internet, faces the modem or ONT, holds the public address and sits outside NAT and the firewall. The LAN ports, usually four, are the private side: they hand out addresses by DHCP on something like 192.168.1.0/24 and switch between themselves at wire speed. Put the modem into a LAN port and nothing routes. Put a computer into the WAN port and it sits outside the firewall with no route in.
The router label decides the topology: the WAN port terminates the ISP handover, the LAN ports distribute it. Most calls that end with a cable moved one socket to the left are this mistake, and the fix takes ten seconds once you know which side of the router you are standing on. Both sockets take the same RJ45 plug, so only the label and the firmware separate them.
What the WAN port terminates
Address, NAT and the firewall
The WAN interface holds the address the provider gives you, whether that is a public IPv4 address, a shared one or a delegated IPv6 prefix. Everything behind it is translated to that address, so the firewall rules that protect the LAN are applied at this boundary. Opening a port is a rule here, not a setting on the LAN.
The handover device
The WAN port expects a modem, an ONT or a building handover, not a computer. Where the provider supplies a combined modem and router, its LAN port feeds your router’s WAN port, and you then have two translation layers unless that device is put into bridge mode.
What the LAN ports do
DHCP and the private subnet
The router runs a DHCP server on the LAN side and issues addresses from a private range, usually 192.168.0.0/24 or 192.168.1.0/24. Gateway and DNS both point back at the router, which is why a device set to a manual address outside that range loses internet while its link light stays green.
Switching between LAN ports
Traffic between two LAN ports stays inside the switch chip, so a computer to NAS transfer runs at wire speed: about 940 Mbit/s of payload on 1000BASE-T. On a 2,5GBASE-T port the same transfer reaches 2500 Mbit/s if the cabling supports it. A printer on the LAN side behaves the same way, which is why an Ethernet cable for a printer reaches a queue far faster than a wireless link.
Telling the sockets apart
Four clues, in order of reliability: the label, the colour, the port count and the position. A single socket standing apart from a block of four is almost always WAN. Many routers print Internet or WAN above it, or colour it blue against yellow LAN ports. Trust the label over the colour, because palettes change between hardware revisions. Patch leads from our Cat 6 Ethernet cable range are enough for either side.
The four sockets on a typical router
| Socket | Usual label | Address side | What connects |
|---|
| WAN | Internet, WAN | Public, from the provider | Modem, ONT, handover |
| LAN 1 to LAN 3 | LAN, Ethernet | Private, 192.168.x.x | Switch, access point, PC |
| LAN 4 | IPTV, LAN | Private, tagged VLAN | Television set-top box |
| USB | USB | None | Storage or print sharing |
| Console | Console, AUX | None | Serial management lead |
Two WAN ports, mesh nodes and switches
A dual WAN router has two sockets facing the provider, for failover or load balancing. A mesh satellite or access point often has a single port that behaves as a LAN port even when the casing says WAN, because that socket only acts as WAN when the unit is the router. Plugging a switch into the WAN socket of a satellite breaks the backhaul. Where a laptop has no Ethernet socket at all, a USB-C Gigabit Ethernet adaptor joins the LAN side exactly like a built-in port.
Practical scenarios
- Situation: A new fibre ONT and your own router. Patch from the ONT LAN port to the router WAN port, set the WAN to DHCP unless the provider issued PPPoE credentials, and leave the LAN alone.
- Situation: A printer that must stay reachable. Give it a DHCP reservation on the LAN side, not a static address in the WAN subnet, and label the lead at both ends.
- Situation: A switch that appears to kill the internet. Check which socket it uses: a switch on the WAN port gets one address and no route to the LAN devices.
- Situation: Two routers in one building. Run the second as an access point with its WAN port unused, or you create a second subnet and double translation.
FAQ
Can a LAN port be used as a WAN port?
On some routers, yes: the firmware offers a setting that reassigns a LAN port to the WAN role. On others the WAN port is a separate interface with its own MAC address and cannot be recreated. Check the manual before assuming either way.
Why does a device show a connection but no internet?
The link is up but the addressing or the route is wrong. A device with a manual address outside the LAN subnet keeps its link light, cannot reach the gateway and reports no internet. The same symptom appears when the modem lead sits in a LAN port: local traffic flows, nothing routes.
Does the WAN port need a different cable?
No. Both sides take the same twisted-pair lead, and Cat 6 is ample for any domestic or small-office connection. What differs is the route: the WAN lead often runs to a cupboard or an external box, so use a solid-copper lead for a permanent run rather than a stranded patch lead.
