Lesson
Access Points, Modems, ONTs and Firewalls
Learning objective
Explain where common edge devices fit and distinguish access, conversion, routing, and security roles.
The edge of a network often looks like one plastic box, but that box may perform several independent jobs. A useful troubleshooting habit is to name the role that should act before blaming the physical device.
One box, many jobs
A home gateway may contain a wireless access point, Ethernet switch, router, firewall, DHCP service, and sometimes a modem or optical-network terminal. These roles can share one enclosure, but they answer different questions.
Think of a railway station containing platforms, ticket checks, route signs, and a connection to another railway company. Sharing one building does not make every job the same. The analogy stops at the fact that packets are processed electronically rather than carried by people.
Access points bridge wireless
An access point gives Wi-Fi clients access to a local network. In its basic role it bridges wireless traffic to a wired LAN. It handles wireless association and link-layer delivery; it does not automatically become the Internet router or security policy boundary.
The client interface might be labelled Wi-Fi, while the access point's wired side might be LAN, Ethernet, or an uplink port. Both sides can belong to the same IP network.
Modems and ONTs convert signals
A cable or DSL modem adapts customer network data to the provider's access technology. An ONT terminates the optical access link and presents a customer-facing handoff, commonly Ethernet. Their essential lesson role is conversion and provider termination—not choosing a destination route or applying user security policy.
Bridge mode exposes that separation clearly: the modem or ONT supplies the handoff while another device performs routing and firewall functions.
Routers and firewalls set boundaries
A router selects paths between IP networks. A firewall evaluates traffic crossing a security boundary and may permit or deny it using configured policy and session information. One home gateway often performs both roles, but routing and security remain different decisions.
This lesson does not teach firewall rule design, state tables, NAT, or VPN configuration. Those belong to later service and Network Security pathways.
Compare edge devices
| Role | Main decision | Typical interfaces | Not automatically responsible for |
|---|---|---|---|
| Access point | Bridge a wireless client onto the LAN | Wi-Fi radio and wired uplink | Internet routing |
| Modem | Adapt data to cable or DSL access signalling | Customer Ethernet and provider medium | Firewall policy |
| ONT | Terminate the optical access link | Fibre and customer Ethernet | Choosing the host's route |
| Router | Select the next IP network | LAN and WAN | Wireless association |
| Firewall | Permit or deny boundary-crossing traffic | Trusted and untrusted boundaries | Converting optical signals |
Interactive edge-device journey
Choose a common layout and follow the packet through every interface. At each stage, the highlighted device explains what it does and the packet opens to show what remains inside.
Follow traffic across the network edge
Select a layout, then watch each device perform only its own role.
- LaptopClient Wi-Fi
- Wi-Fi access pointWireless ↔ LAN bridge
- Router + firewallLAN ↔ WAN boundary
- ONTCustomer ↔ provider handoff
- ISP networkProvider edge
Stage 1 of 6
The host creates application data
The laptop creates data for a remote service and passes it down to the network stack.
Inside the packet: Application data → IP packet → local-link frame
Laptop
Interface: Client Wi-Fi
This step does not change the packet's end-to-end IP addresses.
Identify device roles
Use I know this—proceed to advanced to move directly to the first troubleshooting scenario below.
For each symptom, name the role before the box:
- A laptop cannot associate with the SSID: begin with the client radio and access-point role.
- Wi-Fi association works but the host has no usable route: inspect addressing, DHCP evidence, and the router-facing path.
- The ONT reports loss of optical signal: investigate the fibre access circuit and provider handoff before changing firewall policy.
- A bridged modem works with one router but not after adding another: confirm which device owns the WAN address and avoid accidental double routing.
Diagnose edge failures
Follow the boundary in order: client link → access point → LAN → router → firewall decision → modem or ONT → provider handoff. Record the last working interface and the first failing interface.
Do not reset every device at once. A Wi-Fi failure, missing route, denied session, optical loss alarm, and provider outage belong to different fault domains even when the same enclosure exposes their status lights.
Interview scenario
A laptop joins Wi-Fi and reaches the gateway, but an Internet connection fails. How would you narrow the fault domain?
Show answer and reasoning
The access-point path and local gateway are already working. Confirm the router has a usable WAN route, then distinguish a firewall denial from a modem or ONT link problem and an upstream provider failure. Use interface status, routing evidence, firewall session or deny evidence, and provider-link indicators in that order.
Knowledge check and summary
Remember: identify the role, follow labelled interfaces, and locate the first boundary where expected evidence disappears.