Skip to content
Knowledge Hub/Article
Article

What Is a Router? How It Differs From a Modem and Switch

We explain how a router forwards packets with its routing table, what OSPF and BGP do, how it differs from a modem and a switch, and how to secure it.

Oğuzhan Gerçek··9 min read
What Is a Router? How It Differs From a Modem and Switch

Short answer: A router is a network device that connects different networks and forwards each packet toward its next hop based on the destination IP address. It decides using its routing table: the most specific matching route wins, and if no route matches, the packet takes the default route. A modem converts the signal on the provider's line into a digital connection; the router distributes that connection to the devices on the network. A switch, by contrast, connects devices within the same network. At home these jobs can be combined in a single box; in an enterprise, edge, core and branch routers play separate roles.

What is a router, and what does it do?

In NIST's glossary, a definition adapted from RFC 4949 describes a router as a computer that is a gateway between two networks at OSI layer 3 and that relays and directs data packets through that inter-network; the most common form operates on IP packets. According to Cloudflare, a router connects two or more networks and allows multiple devices to use the same internet connection. Home and office networks usually reach the internet through a router as well (LAN article).

RFC 1812 (June 1995), which sets out the requirements for IPv4 routers, draws the line between a router and other packet-switching devices this way: a router examines the IP header as part of forwarding. There is a short definition of router in our glossary, and of network in its network entry.

How does a router work? Routing tables and the default gateway

A router's decisions come from its routing table. According to Cloudflare, the table records the paths packets should take to every destination the router is responsible for; each route pairs a destination network (a prefix) with a way out.

More than one route can match a packet. Under RFC 4632 (August 2006), forwarding in the internet is done on a longest-match basis, so the most specific route wins; the prefix 0.0.0.0/0 serves as the default route. In AWS's example, traffic for 172.31.0.0/16 goes to a peering connection, while all other traffic follows the 0.0.0.0/0 route to the internet gateway.

Devices, for their part, send packets bound for other networks to their default gateway. As Microsoft defines it, this is the router specified on a host that links the host's subnet to other networks. The host uses its subnet mask to check whether the destination is local; if it is not, the packet goes to that router.

Static and dynamic routing: OSPF and BGP

According to Cloudflare, in static routing a network administrator sets up the routing table by hand, which essentially sets the routes in stone; in dynamic routing the table updates automatically. Dynamic routing needs more computing power, so smaller networks may rely on static routes, but for medium-sized and large networks dynamic routing is much more efficient. Routing protocols carry routes between routers:

  • OSPF: According to RFC 2328 (April 1998), a link-state protocol designed to run inside a single autonomous system (AS). Every router keeps an identical database describing the topology, calculates its routing table from it by building a shortest-path tree, and recalculates routes quickly when the topology changes.
  • BGP: According to RFC 4271 (January 2006), BGP runs between autonomous systems, and its primary job is exchanging network reachability information with other BGP systems. In the RFC's classic definition, an autonomous system is a set of routers under a single technical administration.

Modem vs router: what is the difference?

Some internet service providers combine the two in a single device, but as Cloudflare stresses, a modem and a router are not the same thing. A modem connects to the internet by converting signals from the provider into a digital signal that connected devices can interpret; a router forms networks and manages the flow of data within and between them. According to Cloudflare, a single device can plug straight into a modem, but it takes a router to get several devices online at the same time.

The box at home can go one step further: according to Cisco, a Wi-Fi router combines the networking functions of a wireless access point and a router.

Router vs switch

In Cloudflare's comparison, a switch forwards packets between groups of devices on the same network, while a router forwards data between different networks. A layer 2 switch decides by destination MAC address, a router by destination IP address. Layer 3 switches, which can forward by destination IP address too, blur that line. We explain how switches work and the main types in our switch article, and how to split a network into logical segments in our VLAN article.

Other jobs a router takes on: NAT, DHCP, firewalling and VPN

Besides routing, a router can take on other work:

  • NAT: Lets devices with private addresses reach the internet through a single public address; in the model of RFC 3022 (January 2001), address translation is done by the routers at the border of the internal network (NAT article).
  • DHCP: Small office and home routers can hand out IP addresses and DNS settings to devices over DHCP; under RFC 2131 (March 1997), the relay agent that passes DHCP messages between clients and servers can also be a router (DHCP article).
  • Packet filtering: According to NIST SP 800-41 Rev. 1 (September 2009), the most common example of a pure packet filtering device is a router that uses access control lists (ACLs). We cover stateful inspection in our firewall article.
  • VPN: According to NIST SP 800-77 Rev. 1 (June 2020), a VPN gateway may be a dedicated device or part of another network device such as a firewall or router (VPN article).

Enterprise router types: edge, core, branch and virtual

In Cloudflare's classification, a core router carries traffic within a large network, while an edge router talks to both core routers and external networks and uses BGP to exchange data with them. Branches have an edge device too: according to Cisco's SD-WAN design guide, a WAN Edge router sits at a site such as a branch office and provides connectivity among the sites (SD-WAN article). According to Cloudflare, a virtual router is software that does the job of a hardware router; in the cloud, as AWS puts it, the route table serves as the traffic controller for a virtual private cloud (VPC).

Relying on a single default gateway is a risk in itself: under RFC 9568 (April 2024), losing the default router is a catastrophic event that isolates all the end hosts behind it. VRRP is designed to remove that single point of failure: the active router holds the virtual router's address, and if it becomes unavailable, a backup takes over forwarding. We handle edge and branch design in our network & traffic engineering service and day-to-day operations in our infrastructure management service.

Router security: default passwords, updates and end-of-life devices

According to a joint advisory the UK's NCSC published on April 23, 2026, the covert networks China-nexus actors use to disguise the origin of their activity are mainly made up of compromised small office/home office (SOHO) routers. In another NCSC advisory, dated April 7, 2026, APT28 changed the DHCP and DNS settings of the routers it compromised, opening the devices behind them to adversary-in-the-middle attacks that harvest passwords (DNS article). The official guidance comes down to four points:

  • Change default passwords: The NSA and CISA's joint advisory of October 2023 lists default configurations among the 10 most common misconfigurations; factory credentials for network devices can be found with a simple web search.
  • Update: The FBI's May 2025 alert calls for applying security patches and firmware updates immediately (patch management article).
  • Turn off remote management: According to the FBI, some end-of-life routers with remote administration turned on were compromised by a new variant of TheMoon malware. In the NCSC's words, management interfaces must never be exposed to the internet.
  • Replace unsupported devices: In the FBI's definition, an end-of-life router is one the manufacturer no longer sells or actively supports; routers dated 2010 or earlier likely no longer receive software updates.

Router and firewall policy fall under our network security service.

Frequently asked questions

What is a router, and what does it do? A router chooses paths for traffic between networks and lets multiple devices share the same internet connection.

What is the difference between a modem and a router? A modem turns the provider's line into a digital connection; a router distributes that connection to the devices on the network. They can share a box, but they do different jobs.

What is the difference between a router and a switch? A switch connects devices on the same network by MAC address; a router chooses paths between different networks by IP address.

What is a default gateway? The router a device sends packets to when they are bound for destinations outside its own subnet. Its address is set in the device's IP configuration.

Why is an old router risky? An end-of-life router no longer gets security patches. Once compromised, it can help an attacker hide their tracks or hand out malicious DNS settings to the devices on the network.

Sources