What is an Edge Router?

An edge router is the device that connects an external network to an internal network. A customer edge router is a router at the edge of an organization or residence that connects to the internet. A provider edge router is a service provider’s router that connects customers to its networks and the wider internet. An edge router is an important piece of equipment that provides added network security, packet filtering, and protocol translation services.

Edge routers serve a key role in modern network architecture as the gateway between an organization’s network and the outside world. Because of their location, edge routers are a chokepoint for network traffic and are therefore important for overall network security, performance, and reliability.

Provide edge security

Edge routers are one of the first lines of defense against external threats because they sit at a network’s edge. You can configure edge routers to enforce security policies against inbound network traffic, remote access requests, filter out traffic from problematic IP ranges, and support secure connections, such as Virtual Private Network (VPN) connections.

Traffic optimization and routing

Edge routers make intelligent decisions about how data flows between networks. They direct traffic along the most efficient paths, balancing network loads and minimizing latency.

Built for scalability and redundancy

Modern edge routers are typically designed for redundancy and can scale to meet dynamic bandwidth needs. The goal of this design is to help ensure continuous connectivity under all circumstances. In distributed and hybrid cloud environments, you can use edge routers to integrate on-premises infrastructure and private cloud services.

The network connection between an organization and an internet service provider is mediated by two key routers sitting at the boundary: the customer edge (CE) router and the provider edge (PE) router.

It is important to understand these two routers’ roles in designing secure connections, especially in hybrid cloud environments where your on-premises infrastructure connects to a cloud, such as AWS.

Customer edge router

A customer edge (CE) router is located on your premises and is typically managed by your IT team. It is the last device your traffic passes through before it leaves your network. These are sometimes known as subscriber edge routers.

Provider edge router

The provider edge (PE) router resides at the edge of a service provider’s network. That could be an ISP, telecom company, or cloud provider like AWS. This massive edge router connects to one or more customer edge routers. The PE acts as the entry point for traffic into the provider’s backbone network and is responsible for routing traffic between multiple customers and larger core networks.

Edge routers play a role in several critical functions to make sure that traffic flows securely between private and external networks.

Routing and forwarding

Edge routers use IP routing protocols, such as the border gateway protocol (BGP), to determine the best path for data entering or leaving your network. For example, when you send data to a cloud application, the edge router consults its routing table and forwards the data packet to the next hop in the external network towards its destination.

Traffic filtering and inspection

Edge routers enforce security policies using access control lists (ACLs) to block unauthorized traffic based on IP addresses, ports, or protocols. Many edge routers also integrate with firewalls, intrusion detection systems, and deep packet inspection tools to detect malicious activity.

Protocol conversion and Network Address Translation (NAT)

Protocol conversion is the process of converting network traffic from one type of communication protocol to another, such as HTTP to HTTPS, as it enters or leaves your network. Network Address Translation is a technology that allows you to route traffic between all the private, internal network addresses on your network to one external IP address. Edge routers will often handle NAT and sometimes protocol conversions.

Supporting high availability and Quality of Service (QoS) efforts

Modern edge routers are built for resiliency, to make sure that the right traffic is prioritized. You can implement Quality of Service (QoS) policies on edge routers to prioritize what your organization considers important. Priority traffic can include voice calls or video conferencing, over less critical traffic, to make sure that what you care about continues to operate as intended, even during peak usage.

While the role of both edge routers and core routers is to move data across networks, they serve different real-world functions due to their position in network architecture.

Core routers: The high-speed backbone of internal networks

A core router operates deep within a large-scale network, such as within a data center or a major telecom provider’s network. Its primary role is to forward massive volumes of traffic between other routers. Core routers are optimized for speed and throughput, not security or policy.

Edge routers: Network gatekeepers

Because an edge router sits at a network boundary and is typically the first point of entry and exit for traffic, it is critical for many functions.

• Enforcing security: Edge routers filter traffic with access control lists (ACLs), integrate with firewalls, and support secure connections, like virtual private networks.

• Traffic routing: Edge routers direct traffic between internal and external systems.

• Network translation: They perform Network Address Translation so multiple internal hardware devices can share one public IP address.

• Edge management services: They support DHCP, DNS, wireless management, and other connectivity functions in branch or campus environments.

A core router is more concerned with typical high-speed network forward routing activities, whereas an edge router has multiple purposes.

Edge routers and firewalls are often deployed together at enterprise network boundaries, but they serve distinct functions. An edge router is primarily responsible for connectivity, connecting your internal systems to external networks. A firewall’s role is primarily security. It acts as a gatekeeper, inspecting incoming and outgoing traffic according to predefined rules for what to block or allow.

In practice, these roles are often combined. However, for stronger protection, most organizations place a dedicated firewall behind the edge router. This layered setup lets the router focus on routing traffic efficiently while the firewall handles deeper inspection, filtering, and threat detection to create a more robust defense at the network boundary.

AWS offers a range of edge routing services and high-speed networking services for your low-latency AWS applications. Discover our range of edge networking solutions and other low-latency services:

• AWS Cloud WAN helps you build, manage, and monitor global wide area networks, including routing capabilities.

• AWS Direct Connect is a network service that creates a dedicated network connection between your premises and AWS.

• AWS Transit Gateway helps you connect Amazon VPCs, AWS accounts, and on-premises networks to a single gateway, acting as a scalable cloud router.

• Amazon Virtual Private Cloud (Amazon VPC) gives you full control over your private virtual networking environment, including resource placement, connectivity, and security.

Get started with edge routing on AWS by creating a free account today.