Every Dutch house has a meterkast — a cabinet, usually near the front door, where the public electricity grid, the water main, the gas line, and often the sewer connection all cross into private space at once. Each utility gets a meter at that crossing. The meter marks where public responsibility ends and yours begins. Break something on the street side and the utility company fixes it. Break something on the house side and it’s your plumber, your electrician, your bill.

The internationally recognised term for this crossing point is a demarcation point — a “demarc” — used across telecom, electric, water, and gas industries for precisely this boundary. Not every country consolidates it the way the Netherlands does. The US and UK typically scatter it: an electrical panel in one location, a water meter in a curbside pit somewhere else, a gas meter bolted to an outside wall a third place entirely. The meterkast’s trick is putting every demarc for every utility in one cabinet. Same concept, tidier execution.

Your router is a meterkast for your internet connection, and it is not a metaphor stretched to fit — it is the identical pattern, doing the identical job.

Every Utility Has a Public Side and a Private Side

Look at what actually crosses the meterkast wall:

  • Electricity: the grid delivers current at a standard voltage, metered, billed by consumption. Inside the house, your own wiring, your own breakers, your own outlets — a private topology the utility company has no visibility into and no say over.
  • Water: the main delivers pressure and volume, metered at the crossing. Inside, your own pipes, your own taps, your own layout.
  • Gas: same shape — metered at the demarc, private distribution beyond it.
  • Riool (sewer): the one utility running the other direction — private waste crosses out to the public system, still metered, still demarcated at the same boundary.

Each of these is a Gutenberg/Semantic split. The public side is standardised, metered, indifferent to what’s on the other end — the grid doesn’t know or care whether your private wiring feeds a kettle or a server rack. The private side is yours to configure however you like, invisible to the utility, renumbered and rearranged at will without anyone outside needing to know.

NAT Does the Same Job for the Internet Connection

The public internet delivers one thing to your house: a single routable IP address, metered in the sense that your ISP knows exactly how much traffic crossed it. That’s the electricity meter. That’s the water meter. One demarc, one number, one billing relationship.

Everything behind your router — 192.168.1.1, 192.168.1.53, every laptop, phone, and Raspberry Pi on your network — is the private side of the meterkast. Internally routable, internally meaningful, completely invisible from outside. Nobody on the public internet can enumerate your devices any more than the water company can see your internal pipe layout. Rearrange your home network, add a device, retire one — the public side never notices, exactly the way rewiring a room doesn’t require a call to the grid operator.

The earlier post on IPv6 covered this from the protocol side: NAT looked like an ugly stopgap, turned out to be load-bearing, delivered privacy, an implicit firewall, and renumbering stability that nobody planned for. The meterkast makes it obvious why those benefits weren’t a surprise. They’re the same benefits every other utility demarc has always provided. Your home’s plumbing has never been globally addressable, and nobody has ever proposed that it should be, because “every tap in the world gets its own routable identifier” is exactly as absurd for pipes as it is for devices. The router just extended a century-old pattern to the newest utility running into the house.

The Meter Is the Feedback Loop

There’s a reason every demarc has a meter and not just a pipe or a wire. The meter is the confirmation signal — the same last-known-good pattern that shows up everywhere else in this series. It tells both sides how much crossed the boundary, which is the minimum information needed to catch a leak, a fault, or a dispute before it becomes expensive. Your router logs traffic for the same reason — not identical purpose, but the same underlying need: a legible record at the one place where public and private meet.

The meterkast, in other words, was never just a cabinet. It’s the physical ancestor of every clean Gutenberg/Semantic boundary this series keeps finding in software — public standardised on one side, private and freely reconfigurable on the other, with a meter marking exactly where the responsibility, and the visibility, changes hands.

Commodities Don’t Need a Semantic Layer at the Crossing

The reason a simple meter is enough at every one of these demarcs — no negotiation, no content inspection, just a count — is that electricity, water, gas, and internet access are all commodities at the point of crossing. The meter doesn’t care which appliance the electrons end up powering. The water meter doesn’t care whether the water fills a kettle or a bath. Quantity is the only thing that needs to be agreed on at a commodity boundary; the meaning of what crosses is entirely the private side’s business.

Internet access is the same kind of good, and it’s worth naming because keeping it that way is not automatic — it’s a policy choice, usually called net neutrality. Your ISP, behaving like the electricity company, shouldn’t care which packets cross the wire, only how many. The moment an ISP starts caring which packets — throttling one service, prioritising another it has a commercial stake in — it stops behaving like a commodity utility and starts imposing a semantic opinion at a boundary that was only ever supposed to have a meter on it. That’s the same Def-Push failure the series keeps finding elsewhere, just relocated to the meterkast itself.

DHCP is the automated electrician, running continuously.

When your laptop joins the LAN, DHCP is the protocol standing right at the private side of the demarc, doing in milliseconds what an electrician does once at install time: here is your address, here is your lease, here is how long before we renegotiate. It hands out 192.168.1.x, tells the device its gateway (the router, sitting exactly at the demarc), and tells it where to send DNS queries. The laptop now knows two things without a human configuring either: how to be found on the private side, and — via the gateway address — how to route anything bound for the public side straight to the one box that knows how to cross the meterkast.

This is the automated version of the electrician’s one-time provisioning, run fresh every time a device shows up, because unlike household circuits — wired once, rarely touched again — devices on a network join and leave constantly, and each one needs its private-side identity negotiated on arrival rather than fixed at construction time. DHCP is the resolver operating on the private side of the boundary, NAT is the translator operating at the boundary itself, and the gateway address DHCP hands out is the one piece of information that quietly tells every device on your network exactly where the meterkast is.

The strongest proof the meterkast pattern actually works is what happens when you switch internet providers. Cancel one ISP, sign up with another, and the only thing that changes is the box at the demarc — a new router, sometimes a new modem, plugged into the same wall socket the old one used. Every device behind it — the laptop, the phone, the Raspberry Pi at 192.168.1.53 — keeps its private address, keeps talking to everything else on the network exactly as before, and needs zero reconfiguration. The private side didn’t just fail to notice a new device being added, as the section above described. It failed to notice its entire relationship with the outside world being replaced.

This works because the public IP was never anything your devices depended on directly. It’s the ISP’s number, assigned to the router, changeable at will, because NAT already interposed a full translation layer between “the internet” and “your stuff.” Swapping ISPs is swapping which on-ramp your traffic uses to reach the same highway — the highway doesn’t care which on-ramp you took, and your driveway doesn’t change shape depending on which road it eventually connects to.

Try the equivalent with water, gas, or electricity in a market without full liberalisation and it’s rarely this clean — the physical pipe or wire is often tied to one provider, or switching means paperwork, an engineer visit, sometimes new metering hardware. Internet access, alone among the classic utilities, got the demarc and the full decoupling right from day one: the provider is a service you subscribe to, not a physical asset welded to your house. WiFi inherits the same property one hop further in — swap your router’s WiFi radio for a mesh system, and every phone in the house just reconnects to the same SSID, no idea the physical hardware underneath changed at all.

Add a device to your home network and nothing outside is told. No registry gets updated. No external directory gets a new entry. Your ISP doesn’t know you bought a smart plug. The manufacturer’s cloud service might know, if the device phones home — but the network layer itself, the actual demarc, stays silent. The new device gets a private address, starts talking to whatever it talks to on your side of the router, and the public side is completely unaware anything changed. Mostly harmless.

This is the opposite of what LDAP or Active Directory would do with the same event. Those systems exist to be told — a new device, a new user, a new resource means a directory entry gets created, replicated, and made queryable by everyone with access to the graph. The meterkast pattern refuses that obligation entirely. Your private side is allowed to change constantly, add and remove things daily, without any of it becoming anyone else’s business. The LDAP mistake was building a system that wanted to know everything happening on both sides of a boundary that was only ever supposed to have a meter on it.

The asymmetry runs one direction, and it’s the correct direction. You go to the mall. The mall does not come to you. You initiate the outbound connection when you want something from the public side — a webpage, a package, a purchase — and the public side responds to that request. It doesn’t get to initiate contact with you just because it feels like it. The postman only delivers to the front door, never past it into your kitchen, even though the postman knows your address perfectly well. Unsolicited inbound is dropped by default — the same implicit firewall the IPv6 post already named, now visible as the same rule your actual front door enforces.

A stranger at the meterkast can read your electricity meter. They cannot open your fuse box and start rewiring your kitchen. The public side gets exactly the information it needs to bill you and nothing more. Everything past the meter — including whether you just added a new smart bulb — stays private by default, not because anyone configured it that way this week, but because that’s what a demarc has always meant.

Brand’s Missing Axis

Stewart Brand’s shearing layers — Site, Structure, Skin, Services, Space Plan, Stuff — order a building by how fast each layer changes, Site slowest, Stuff fastest. It’s tempting to place the meterkast on that scale, but it doesn’t actually fit anywhere, and the reason why is worth stating plainly.

Site, in Brand’s own account, is “the geographical setting, the urban location, and the legally defined lot” — a boundary that exists on a map, but a passive one. It just sits there, aging slower than everything built on it. Brand’s six layers all assume a single owner across the whole stack: you, or your landlord, control Site through Stuff, and the only question the model answers is how often each layer gets touched. There is no layer, and no gap between layers, for “this pipe becomes the water company’s pipe three metres before it reaches my wall.” Brand’s Site has no fence — no interface where two different parties meet, no place where responsibility changes hands, no technical front door that meters, gates, or enforces an asymmetry. It’s a container, not a seam.

The meterkast isn’t a seventh shearing layer squeezed in at the slow end. It’s a different axis entirely — not pace, but jurisdiction. Brand mapped how fast things change inside a building nobody else has a claim on. The meterkast marks where a claim changes hands. Those are orthogonal questions, and the six S’s simply have no answer to the second one, because Brand was never trying to ask it.

That gap didn’t stay confined to buildings. Gartner borrowed Brand’s model for enterprise IT and inherited the same blind spot, plus a second one cloud computing exposed that Brand never had to worry about at all — the assumption that the slow layer has to stay slow because copying it is expensive. It doesn’t anymore.

This post is part of the Gutenberg/Semantic series. Related: Why IPv6’s Def-Push Failed: NAT Was Not a Hack on NAT’s emergent, unplanned benefits, It Is Always DNS on last known good as a confirmation loop, and Don’t Erase the White Line. Don’t Pour Concrete Either. on marking a boundary in proportion to what it carries.