Avoid ISP Routers (2024)

https://routersecurity.org/ISProuters.php

316 204 1 year ago

Terr_• 1 year ago

Oh, absolutely. Even on just that last issue of cost, buying my own cable-modem paid for itself long ago, compared to the "rental" cost from my ISP.

On that note, it's better to buy a router separately from the modem. All-in-one devices are harder to diagnose and you can't reuse the router with a different connection type.

dboreham• 1 year ago

Except as soon as you report some QoS issue and a tech comes out, they'll tell you that it's your off brand router and you need to rent one from them.

al_borland2• 1 year ago

They tried this with me once. I told him to get a modem from the truck and try it. The issue remained, so the excuse was busted.

That said, I have run into issues where the ISP will upgrade the speeds and it will be beyond what the modem or router can handle, and as a result the speeds dropped dramatically. In those cases, I did need to hardware, but was still able to get my own.

jandrese• 1 year ago

You have to be careful with that too. I had a tech come out to fix what ultimately ended up being a faulty ONT and doing the same thing, hooking his test modem up to the line to make sure it wasn't my router causing the packet loss. Next month my bill was double because Verizon claimed I had a second line attached, apparently the tech's router registered as a second device. Thankfully tech support was able to reverse that charge, but it was annoying.

egberts15• 1 year ago

Not too many Fiber-PON routers out there that we can drop Linux OS into.

daneel_w• 1 year ago

Thankfully you don't need to. You can run your own, and treat the ISP modem/router as if it were the Internet.

issafram2• 1 year ago

Yup, most have a "bridge" mode. That's the first thing that I did when I got AT&T Fiber

somat• 1 year ago

Most of the time I have seen fiber set up as a dedicate bridge device GPON to ethernet, the Optical Network Terminator(ONT). And honestly, I am fine with this. copper ethernet is much easer to deal. This makes a nice clear demarcation point, the copper past the ONT is yours, everything upstream of that is theirs.

Having said that It would be nice to have control over the ONT as well. there are PON sfp optics, that may be the easiest way to set up your own fiber capable router. I have heard it is tricky to to talk the isp into allowing your modules, you probably need to know a guy that works there.

tguvot• 1 year ago

https://pon.wiki/

egberts15• 1 year ago

Smallest packet latency that Ive been able to do with Verizon is to reconfigure the ONT into bridge mode.

https://egbert.net/blog/articles/ports-used-in-verizon-netwo...

jeroenhd2• 1 year ago

There are stores like fs.com where you can buy affordable tranceivers for use in anything that'll take SFP+. The biggest hurdle is extracting the specifications you need from your ISP and configuring your own router for their weird quirks, and probably probably convince them to accept your serial number (or spoof a device of theirs if you can find the S/N).

There are also ONT/media converter boxes that'll spit out ethernet if you plug in a fiber and set the appropriate DIP switches. I found one hanging in my apartment when I moved in. I've also seen people sell them on second hand marketplaces (probably not realizing that they're technically property of the ISP). Buying newer ones that spit out more than 1gbps as a consumer can be a challenge, though.

There's a nice variety of small Linux router boxes available online that are relatively low power but still offer good connectivity through SFP(+) ports. Getting Linux running on those is easy, the challenge is in figuring out how to active the connection.

bubblethink• 1 year ago

You need an SFP module that you plug into your standard router. https://github.com/Anime4000/RTL960x

pyuser5833• 1 year ago

The part about a cockroach colony is a bit unfair.

Insects love electronics, with the heat and noise they generate. And when electronics sit in storage for a long time, the critters can crawl in from neighboring items.

This is just as likely to happen with a non-ISP router.

Ok, in all fairness I don’t have any stats to back up that claim. But nobody else does either.

That open source router you love so much may have been sitting in storage even longer.

I have mixed feelings about ISP routers, and ISPs in general.

But insect infestation is a serious issue in consumer electronics and has nothing to do with ISPs.

Dylan168072• 1 year ago

the critters can crawl in from neighboring items

When it's shrink wrapped?

And why would a used device be on the shelf next to the new router I was buying?

You can argue this is "just as likely" with used devices, maybe. But if I'm buying a router it's not going to be used.

madduci• 1 year ago

I agree with the take, unfortunately the new construction with Fiber to the home, this becomes less and less feasible, since ISPs expect to have routers with the fiber cable input as WAN port.

This is the case of Iliad in Italy.

In Germany you have FTTH installations where Telekom puts a mini Fiber Gateway in your home and an extra router dials with the credentials to access the internet. In this setup, you can use OpenWRT or other routers, rather than the Fritz!Box or the Speedport routers.

pyuser5833• 1 year ago

Yeah I’ve seen the buggers inside shrink wrap. Only dead ones though.

thowawatp302• 1 year ago

If you can’t actually refute this then why say anything in the first place?

baobun2• 1 year ago

It is not unfair.

The linked article is about a live cockroach colony in the package when it was delivered from their ISP. If that went unnoticed, what would you think about their supply-chain security?

If you get insect-infested packages from wherever you get your electronics, you should switch suppliers. It is not normal.

pyuser5833• 1 year ago

I’ve learned from experience to check for insects in all packages.

Letters too.

They’re usually not there. And there more often dead than alive.

But from time to time, the critters to crawl out.

joecool10292• 1 year ago

I once got a Sprint magic box full of cockroaches (not a router but a sort of femtocell that used another tower for backhaul). Thankfully UPS threw it out in the snow and I didn't discover it for a few days so the roaches froze to death.

So yes, ISP routers and associated equip I do not recommend!

jeroenhd2• 1 year ago

My ISP sent over a Fritz!box (though they offered a "bring your own" option as well). It came preconfigured for my ISP.

I turned off remote access and TR-069 through a toggle in the settings, then changed the admin password. Really, that's all you need to do to take control of one of these routers.

There are good reasons to dislike the AVM routers, but their software is actually pretty solid in terms of customisation and network security. It's not a bad device, and the large scales ISPs can order them at they can be had for a significant discount as a rental compared to buying your own in a store.

protocolture• 1 year ago

Thats one end of the spectrum.

One of my employers once ordered a pallet of Huawei routers. They turned up with a custom firmware provided by a different ISP. It was completely locked down, and only configurable via TR-069 and some proprietary Huawei ONT magic.

I also had a customer once that deployed a series of routers that were cloud managed only via the ISP. Not even TR-069 but they just did DHCP and phoned home via a proprietary protocol. Magic my customer said, he can just reboot customer routers remotely. The company that manufactured that router went bust 8 months later, leaving a bunch of preconfigured routers without a cloud portal and no path forward. Surprised I havent seen a DNS hijack published for them yet.

blibble• 1 year ago

as a note I've had a fritzbox turn those settings back on itself without my doing anything

the thing went in the bin the next day

Tijdreiziger• 1 year ago

AVM/Fritz is kind of a ‘premium’ option, though. Most ISPs provide hardware from e.g. Sagemcom or Zyxel (with locked-down firmware).

Shank2• 1 year ago

Really, that's all you need to do to take control of one of these routers.

All major ISPs in the US do not do this, e.g., AT&T, Verizon, Comcast, Frontier, etc. You might be right for some ISPs that are nicer, but this advice is completely ineffective for most US consumers.

fph• 1 year ago

Can you upgrade the firmware when a Linux kernel bug gets fixed? If the answer is no, then it's not 100% your router.

mixermachine5• 1 year ago

There are some hacking tools for Fritzboxes out there but Avm themselves are pretty good at supporting their hardware for a long time. The 7490 was released in April 2013 and just received another security update (January 2025).

Quite a long support time.

To me they seem to be the best standard solution that can also be setup by a "beginner" user.

imagetic• 1 year ago

At home I go from the modem to a Firewalla and then break out to the WiFi. Our needs at home are pretty simple though.

https://firewalla.com

I have been quite happy with the experience.

genewitch3• 1 year ago

i hope so at $100-$125/port

WarOnPrivacy6• 1 year ago

i hope so at $100-$125/port

Ooof. pfSense on retired hardware is cheap, like free. Using them since 1.2.something. Mid 00's.

al_borland2• 1 year ago

I have my own, because the idea of paying $5/month at the time seemed silly. It does seem like more and more, ISPs are trying to make it harder to bring your own modem, which feels like a cash grab.

Even 10 years ago with Comcast I’d have to call them and challenge their gaslighting to get it working. The model I had was listed on their website, but they would tell me it wasn’t supported. About once a year they would kill it and I had to call to get it working again, where they would again tell me it wasn’t supported, but with persistence on my part, they’d eventually register it and get it working again. I haven’t had as many issue with this recently with Comcast, but I figure it’s only a matter of time.

RajT88• 1 year ago

ISP's thanks to a bill cannot charge rental fees anymore:

https://www.pcmag.com/news/isps-cant-charge-you-for-using-yo...

Unless they come up with a BS security excuse, like cert based auth to their network, which means they claim they cannot offer people to BYOE. I bought an old DSL modem off eBay some years back and tried to get AT&T to waive the rental fee (honestly thinking I was in the clear).

They were not having it. I filed an FCC complaint and in a few days got a call from the office of the CEO saying the equipment was still technically theirs and "gray market" and they could sue me if they wanted. I did get that rental fee waived.

I got off AT&T as soon as humanly possible after that. I used to think they were less shady than Comcast, but now I know otherwise. Comcast, for all their egregious nonsense, at least lets you BYOE.

tombert2• 1 year ago

I still have to the use the Verizon Fios ONT, and as far as I know there's no way to avoid that, but at least Verizon hasn't given me any shit for providing my own router. I still get the advertised speeds and it makes me happy to own my own stuff.

egberts15• 1 year ago

But you can bridge the Verizon directly into your own router.

This is how I did it:

https://egbert.net/blog/tags/verizon.html

IgorPartola2• 1 year ago

Any desktop computer + Intel dual GB NIC + opnsense and you have an amazingly powerful router. Add in a Raspberry Pi running the Omada controller software and some Omada access points and you have an inexpensive and very robust WiFi network. Don’t forget to turn on auto updates for opnsense.

bityard• 1 year ago

I run OPNSense inside Proxmox on a cheap fanless Intel N100 box. VM-level snapshots and backups are heavenly. Can't believe I avoided it for so long.

tehlike• 1 year ago

Same. I pass through a QSFP+ nic that I bought for 15$ or something and I have been very happy with the VLAN set up.

Now if i can find a soundproof server rack so i can put my noisy servers without noise seeping through the house.

darkteflon• 1 year ago

I recently switched to opnsense on bare metal on an N105 with dual 2.5g NIC, after having been quite happy for many years running a bunch of Asus routers on Merlin.

My main goals were to improve throughput and security. Opnsense seems to work well OOTB, but being a dilettante in these matters I must admit to having a nagging anxiety that I may have misconfigured something important.

Any recommendations for a reliable way to check that?

gh02t2• 1 year ago

Checking your own IP on Shodan to see if any unexpected services are detected is a good starting point.

IgorPartola2• 1 year ago

Do you have a particularly complex setup or a typical home LAN with Wi-Fi? If the latter, chances are you did not do anything bad as the defaults are sane and safe. Look over Firewall -> Rules to make sure you aren’t opening any ports that shouldn’t be. Put your phone on a cell network and try to log into your box using your public IPv4 and IPv6 address. Try to run nmap against the same from a remote server (you can get a cheap or free one from Vultr for example). If you have IPv6, try to for example access ssh running on a computer inside your network from the outside, or even just nmap that address.

briHass• 1 year ago

I moved away from the x86 box to Mikrotik after a late night spent debugging NIC issues in BSD/Debian (Proxmox VM)

They have inexpensive devices (Hex wired router will handle up to about 1 Gbps), and they receive software updates for longer than any hw manufacturer I can think of.

The main gateway router in my household has become something that needs to work reliably, not something I can (or want to) tinker with all that much. The MT devices are infinitely flexible, but rock solid and cheap.

tills133• 1 year ago

I run my own homelab and have a Ubiquiti gateway (UDM). I would have loved to have the fibre connection come directly into my box uninterrupted but the ISP's modem is required to associate the connection with my account (or something to that effect). Deeply disappointing.

newdee• 1 year ago

More and more I see articles and videos about programmable SFP modules which can be used to directly connect devices like UDM to GPON/XG(S)-PON networks, completely bypassing the ISP provided ONT.

You may well find something that fits your situation with a little searching.

tills133• 1 year ago

I have looked into it but I'm a little nervous to touch the hackjob fibre install they did and they cut the cable WAY short. I even asked the tech to leave cables as long as possible but

FWIW their box isn't bad once you put it in bridge mode. I have 10gig on my lan and 3gig to the edge and the connection is impressively stable at 3gig. I get 1 ping sometimes when playing Fortnite -- I'm on Vancouver Island. Comical if not inaccurate.

My only real issue with having their box is it sucks maybe 30watts ... Removing it would give me an extra 20 or so minutes on my UPS.

Havoc• 1 year ago

That’s pretty normal for fiber. They usually want their own device at the end of it

WarOnPrivacy6• 1 year ago

That’s pretty normal for fiber. They usually want their own device at the end of it.

US? Not Verizon/Frontier or the shared fiber networks. I'll need their ONT, if that's what you mean but it's always my router.

AT&T is another matter. I avoid them whenever possible.

tills133• 1 year ago

Funnily or tragically enough I opted for the 3gig service from my provider and they require their modem however the same provider on the 1gig service supports using your own ont so long as you use their gpon / SFP whatever.

OptionOfT2• 1 year ago

But your UDM doesn't understand fiber, so you'll need the ONT.

Or are you talking about something like a Dream Machine Pro Max where the you'd plug in the fiber into the SFP module?

OkGoDoIt• 1 year ago

I wish. I own my own modem and router, but Comcast won’t let me use them unless I pay a whole bunch of extra fees or accept a stupidly low monthly data cap. I’ve got my router downstream of theirs which is a bit annoying, especially considering their modem-router combo overheats and needs to be rebooted via unplugging power at least once a month.

Sadly I have no other options here in San Francisco. My house is not wired for phone service so I cannot get DSL. The various fiber services that are becoming more available in San Francisco are generally only available downtown or large apartment buildings. My freestanding house can’t get any of that. AT&T‘s new fiber doesn’t connect to me either. And webpass doesn’t have a good line of sight from my location to any of their microwave towers so I can’t get that. It is Comcast or nothing. It always amazes me that San Francisco is supposedly the tech capital of the world but internet connectivity here is worse than rural China. (And that’s not an exaggeration, I’ve spent plenty of time in rural China and in the mountains there, both the cellular and hardline service is infinitely better than San Francisco, aside from the firewall issues of course)

…I guess that turned into a bit of a personal rant but holy crap how is it 2025 and this is still a problem in a major tech city?

veilrap• 1 year ago

I'm surprised by this, is Comcast super regional with it's restrictions? I have a Comcast 1gig plan in the Bay Area, and last I checked I get a small ($5?) discount for using my own modem. I've been on the plan for a least a few years now... so alternatively maybe I'm grandfathered in or something? Or maybe some Comcast sales person was lying to you about your options?

1123581321• 1 year ago

It's not regional. The rental is $15-25/mo these days. You might be grandfathered in.

If you choose the $25/mo option, you don't have have to pay to waive the monthly data cap.

xyst2• 1 year ago

You probably live in a zip code where ISP choice is an option l. Thus not getting bent like parent comment

phantom784• 1 year ago

We we offered $10/month to use their modem + unlimited, or $30/month to use your own modem unlimited.

We actually don't use that much data though, so just went with the data cap and our own modem, and never went over.

This was in the Seattle area.

clintonb• 1 year ago

Competition matters. Comcast/Xfinity was my only "choice" in Cambridge, MA. It cost about $70 per month for 100Mbps service.

My building in Oakland, CA has multiple options, including fiber. The Comcast folks setup tables at least once per quarter to help customers/residents. The cost was much cheaper. I now have gigabit fiber from Wave, and pay less than I did back in MA.

hackernudes2• 1 year ago

My experience in the Bay Area - if you rent the gateway from Comcast ($25/mo) then you have no data cap. If you use your own modem and want to remove the data cap it costs $30/mo, more than renting the gateway. The data cap is 1.2TB per month in my area.

I think that is what the commenter meant: "...unless I pay a whole bunch of extra fees or accept a stupidly low monthly data cap"

(edit: I initially thought it was $15/mo for the gateway + no data cap but just checked and it is $25/mo. They are called "Xfinity Gateway" vs "xFi Complete").

baby_souffle• 1 year ago

I have a Comcast 1gig plan in the Bay Area, and last I checked I get a small ($5?) discount for using my own modem.

Are you sure it's a _discount_? They charged me _more_ for "unlimited" data and own modem. This change isn't new (at least a few years) but a quick google found recent: https://forums.xfinity.com/conversations/customer-service/wh...

throwaway69123• 1 year ago

cant you just put their crap infront of yours?

loloquwowndueo• 1 year ago

It’s what he does.

I’ve got my router downstream of theirs

anal_reactor3• 1 year ago

In EU the second poorest country has the fastest internet. The richest country cannot provide cellular signal to all of its area.

daemin• 1 year ago

It kindof depends when a country did its investment into Internet infrastructure. More western countries did it first and are now stuck with older technologies that limit speed and capacity, where as the less modern countries put that investment in later and therefore have newer technologies like fibre.

Once an investment has been made it's hard to justify making another large investment, or if one is being made it becomes very political and captured by vested interests.

pimeys3• 1 year ago

Hey, we finally get fiber in the "richest" country. Telekom just wants to build it to our apartment, for free.

They just need a permission from our landlord, who said no way and blocked the fiber installation. We are stuck with Vodafone only...

I guess it is a better investment for them to smoke us out, renovate this place and rent it with three times more...

trimbo2• 1 year ago

I live in SF and Comcast doesn't charge me to have my own router.

I pay $130 for 1.4gbit and unlimited data. It's expensive but I also have no other choices. Sonic stops only one block over and we haven't been able to convince them to wire up my block.

jamestimmins• 1 year ago

I'm so jealous of SF internet options.

In LA I pay $105 for "supposedly" 2-300mbit, but this week I've been seeing 30.

I keep looking for alternatives but haven't found any in my area.

doctorpangloss• 1 year ago

You do have a choice, it's Astound, and you're about to save like $1,000.

1oooqooq2• 1 year ago

he said modem... he also have own router dowstream.

kimixa• 1 year ago

I live in San Jose and Comcast shouldn't charge me for my own router, but every couple of months the "equipment hire" charge appears on my bill again and I have to go through the song and dance of calling them again and getting it removed.

I also pay a little more than $130 for gigabit with a 1tb limit.

I wish I had options.

xyst2• 1 year ago

The crappiness of national ISPs is a feature, not a bug. ISPs have lobbied at state and federal levels to get their way. In many states, they have lobbied _for_ the ban of municipal ISPs.

Then between major ISPs they have under the table agreements to avoid competing in certain areas. This impacts all types of residential areas - suburban, urban, and rural. I believe it’s much worse in rural areas.

Why bother with providing good customer service or improving? They know you have no other choice.

Cellular networks functioning as ISPs have provided _some_ relief in this aspect but comes with its own drawbacks (congestion can get bad and you get throttled, and latency tends to be shitty all around).

The ideal municipal ISP I have seen is in Chattanooga TN. They (EPB) offer _residential_ customers symmetrical access starting at 1000 Mbps, up to 25,000Mbps. [1]

The 1gig plan is cheaper than GFi er and 2.5G plan is competitive.

Plus this money is kept within the ecosystem of this area. Creates high paying jobs. Profits reinvested into network rather than stock buybacks or some C-level executive that “super commutes” in a private jet.

[1] https://epb.com/fi-speed-internet/?#choose-your-plan

1oooqooq2• 1 year ago

remember when verizon got a few Billions to deliver affordable rural access then pocketed the money and delivered nothing?

you ougth remember because it happened three times.

s1mon• 1 year ago

We used to be stuck with Comcast, but we had no trouble using our own modem and router.

We moved from lower Nob Hill to Russian Hill and were finally able to get fiber from Sonic. We went from ~300Mbps down to 1G (more like 750Mbps) and from $137/month to $50/month. Oh and it’s symmetric, very much unlike cable. So happy to get rid of Comcast.

iknowstuff• 1 year ago

Just accept that xFi, the $30 additional fee or whatever it is, is just part of the price. If you’re not a normie you should probably just pay it and get a decent experience. Comcast is a monopolist but there are worse experiences out there than 1.4Gbit down/50Mbps up.

mayneack• 1 year ago

Interestingly, in my part of Los Angeles, the single family homes all got fiber well before the apartment retrofit. It took me joining the hoa board and a year to jump through the hoops for Frontier fios retrofit.

from-nibly• 1 year ago

…I guess that turned into a bit of a personal rant but holy crap how is it 2025 and this is still a problem in a major tech city?

Regulation created by ISPs to create monopolies for themselves.

beached_whale• 1 year ago

Leave their's in place but treat it as untrusted. Place your router between your home network and theirs. It works well.

stickfigure• 1 year ago

Check out MonkeyBrains? It's wireless broadband and they have LoS to many parts of SF. I used them back when I lived there (admittedly some time ago) and I had no complaints. Very much a small ISP with personalized service.

It won't be fiber speeds though.

blerb795• 1 year ago

It can be fiber speeds! I had symmetric gigabit with MonkeyBrains for 3 years. It just depend on the size of their install; I was in a relatively large apartment complex so they invested more in bigger(?) antennas.

m463• 1 year ago

if you want static ip addresses, you need comcast business and must use their router. blast.

genewitch3• 1 year ago

starlink has the opposite for ipv6, if you want to assign your own ipv6 addresses, you have to bypass the starlink wifi-router. ipv4 is still cgnat, but having a real-life routable IP (v6) address is nice.

esbeesbeesbe• 1 year ago

Since you’re in SF, have you tried Monkeybrains?

Edit for disclosure: I’m a former employee, but I have no present affiliation with the company.

evantahler• 1 year ago

Monkey brains is great if you can get it! Cheap and reliable and you can use any router you want.

biglost• 1 year ago

Manwhile i live in a rural area 10kms away of a little town in the south of Chile with FTTH with 1gbit symetrical with Static ip address really unlimited (no CAP of anytype) with one deco for my tv for 24 usd a month with an installation that cost me 30 usd. Should i add i hace to use rainwater because no potable wáter Is available?

polonbike• 1 year ago

Same here (except Chile). It's weird/sad/expected because of Comcast & others that the US are still not reliably connected everywhere. From the country that brought us the internet!? In my (European) country, you have to live in a swamp far away from everything to not have FTTH legibility, in the same ballpark prices as the comment above. Static IP as a (free) opt-in.

Semaphor• 1 year ago

needs to be rebooted via unplugging power at least once a month.

This (or a memory leak, anyway, something) is why I have my ISPs modem (I luckily can disable the router part; I think that might actually be EU mandated) on a smart plug. When my internet fails, I check to see if the modem is reachable, if it’s not, I go to Home Assistant, turn it off for 10 seconds and then turn it on again.

I guess I could automate it, but every 1-1.5 month is not enough to make me bother.

sleepydog• 1 year ago

I got a monthly discount (small, between 5 and 10$) for using my own cable modem in Sunnyvale. I was using Comcast business, though.

microtonal4• 1 year ago

This is why the market needs some regulation. Here in The Netherlands, ISPs are required to offer free (as in freedom) modem/router choice. Not only can you replace the router, you can even use your own XGS-PON/AON/etc. SFP(+) module.

For a while I had fiber running through an XGS-PON SFP module in my own Fritz!Box. Now I use the provider's ONT (which is just a fiber <-> ethernet media converter) hooked up to a Unifi Cloud Gateway Max.

Plenty of folks here that have their UDM or OpnSense box hooked up directly to fiber with a Zaram XGS-PON module.

Also, I am sorry you have to deal with caps. Data has been unlimited here ever since we switched from 56k6 to ADSL. (I also have unlimited 5G for 25 Euro per month.)

tecleandor• 1 year ago

Any recommended XGS-PON modules?

One of my connections here is 10G but I haven't tested any modules...

stjo• 1 year ago

You could also solve this with competition. If there were 10 ISPs it would be disadvantageous to give your customers reasons to leave you. Why aren’t there more ISPs? Maybe too many regulations. It is trivial to lay cable, except of course all the permits.

Vilian• 1 year ago

Same in Brasil

account42• 1 year ago

Here in Germany ISPs are also required to let you use your own router for free.

So instead of making you pay for that option they increase the base price and the provide discounts if you use the provided router. In the end you still end up paying more with your own router than with the provided one. And will probably have a worse support experience if there are ever any issues.

Do the laws in the Netherlands have teeth against such shenanigans?

spikej• 1 year ago

I had a similar problem with having to deal with an ISP provided modem, and solved it in the stupidest way possible: xmas light timer to reboot it in the middle of the night. It's set to go off for 30 min then come back on. Sadly, I've had this up and running for years...

scrose• 1 year ago

I just moved to Oakland and pay $50/month for 10 Gbps fiber with Sonic. I thought that was just the norm here after staying in a few SFH BnBs in the area that all had the same. I’m kinda surprised SF doesn’t have better connectivity. Is the issue just a matter of different regulations increasing cost of installations between the bay?

zzo38computer• 1 year ago

I have my own router, but use the ISP's modem. The modem is also able to act as a wired router and Wi-Fi router, but I set it to "bridge mode" to disable the wired NAT so that I could use my own router instead. (When they replaced the modem, I did tell them to enable bridge mode, and they did that, so that is not a problem.)

colonial• 1 year ago

Have you considered Starlink? You might give up some speed, but it is a fantastic bypass for monopolist bullshit. All the providers in my hometown wanted to charge my parents five figures to run something that wasn't 20-down copper, so they bolted a Starlink dish to the roof and got ~250 symmetrical (IIRC) pretty much constantly.

LargoLasskhyfv• 1 year ago

Starlink?

honestSysAdmin• 1 year ago

Always treat hardware you get from someone else as not just untrusted but hostile until proven beyond any reasonable doubt otherwise.

Put an OpenBSD machine to act as a router/firewall between supplied devices and your own network to keep things clean.

denkmoon• 1 year ago

Some of the comments here about ISP behaviour are crazy. Australia has had our fair share of fucking up the national internet infrastructure but at least I can pick pretty much any ISP and use any router I like. Haven't used an ISP supplied router in something like 15 years.

porknubbins• 1 year ago

All over the US I have always been able to use my own cable modem and router. OPs situation is unusual, I am guessing its some bundle they have for a discount but if they were paying standard (ie ripoff) rates they could use their own equipment.

Terretta• 1 year ago

This thread made me realize dslreports.com has "closed".

Used to be you could find out there what works and what doesn't down to the chipset variations. My experience was same as yours, as long as I matched provider capabilities, it worked.

magnetowasright• 1 year ago

I've never had an issue with using my own hardware here. It's definitely one of the only good things about australian internet.

Regionally is a total crapshoot as to ISP choice, in my experience. Even in the massive regional cities it's often appalling. People living in rural or remote areas might as well not exist. If I moved somewhere that only telstra serviced I'd seriously consider just not having internet at all. It's roughly equivalent in internet access as paying telstra but it sure is cheaper!

dbetteridge• 1 year ago

I mean technically in Australia these days the nbn box is the "modem" for all intents and purposes, if you have fttp.

You don't actually need a secondary modem and can plug your pc directly into it, takes a lot of the pain out of it and reduces the need for ISP supplied modems.

WarOnPrivacy6• 1 year ago

Some of the comments here about ISP behaviour are crazy.

It depends on the ISP. Over 25 years of IT support I've had to fight with about 30% of them to bring in my own device.

Most notable screwery was with Verizon DSL. They'd lease a new public IP every time we tried an incoming connection. As fast as I could record the new IP in the remote config and reconnect - my IP would change. I was able to push it past six changes/min.

AdmiralAsshat• 1 year ago

Verizon's FiOS routers have been decent. I used theirs when I last moved, and it automatically setup a separate IoT network, in addition to the normal and guest networks.

I've been meaning to buy and setup a mesh, but they sent me an extender for free, and they haven't charged a modem rental fee either like Cox/Comcast did, so I've been living with "free" for awhile until I see a good mesh router on sale.

bc569a80a344f9c3• 1 year ago

Conversely, by using their router and modem you move the demarc to the Ethernet port on the inside of the router, which makes getting support significantly easier. I care about that more than control. And I know damn well they ain’t got time to spy on me. Just because appeals to authority are fun, I spent decades as a network engineer and then architect.

yjftsjthsd-h• 1 year ago

And I know damn well they ain’t got time to spy on me.

What do you mean, "time"? It's automated.

WarOnPrivacy6• 1 year ago

move the demarc to the Ethernet port on the inside of the router, which makes getting support significantly easier. I care about that more than control.
I spent decades as a network engineer and then architect.

As an engineer, you've no interest in hosting your own services?

bob1029• 1 year ago

I'm in the same boat as OP.

I used to run my own DIY router setup for about a decade until I realized it wasn't adding much value anymore.

Anything that needs to be visible publicly I just throw on a VM in the cloud these days. Keeps my home network "normie proof" and calm. Anyone visiting can find the modem, locate the password and get online without forcing a 45 minute IT change order circus in my own home.

bc569a80a344f9c3• 1 year ago

Not at this point. Because it’s not _my_ service. This home network is also used by my wife, by visitors, and by my kids if I had any. Earlier in my career I was using home labs to learn and that was fine. Nowadays I really don’t want any more weekends where I had intended to do nothing or something not related to technology and find myself having to fix something that’s broken for others.

I’m fortunate enough to have fun at work, that may well be part of it.

anticensor2• 1 year ago

What if I want demarcation right inside the router?

bc569a80a344f9c3• 1 year ago

Telecom models don’t allow for this. Demarcs are ports. One side owns the port, the other side owns the cable that plugs into it.

wyager• 1 year ago

Agreed with the article, but to add to:

The ability to update the firmware may also be locked down. You should have full control over firmware updates.

Bizarrely, for DOCSIS modems, even if you buy your own modem, the ISP has control over firmware! They can (and do) push any arbitrary firmware to your modem. The manufacturers go along with this for some reason.

So make sure to separate your modem and router too.

natas2• 1 year ago

Yes it's key to separate both, but regardless they know DNS queries + can see all http traffic and TLS handshakes will reveal (in plaintext) the name of sites connected to. So basically... they know very well where you go, they just don't always know (sometimes they do) what is being transferred there.

142• 1 year ago

Sadly I am not able to outright get ride of my ISP router. I am here in Canada on Shaw, well it recently was taken over by Rogers, and we can not just use our own. We can put the modem into bridge mode and connect to it but not get ride of it completely. I am not sure if bridge mode would stop much of the security concerns but my gut says no.

tempestn3• 1 year ago

Once in bridge mode it's no longer acting as a router, so it should mostly be fine. The firewall on your actual router will be present between the modem/internet and your machines.

142• 1 year ago

Great thank you for the information. I've held off on getting a half decent router as there is so much to know. I've always wanted to get one I can put my own firmware and the benefits they have but just not sure the best route. I also have lots of people in the house so want something that can handle many connections at once like 10 devices says. The isp router only has 4 Ethernet ports which a couple more would be handy so that is also a wish list. Anyways thank you I will look into it a bit more.

kisamoto• 1 year ago

*Avoid ISP Routers wherever possible.

Sometimes they just don't allow you to use it. In the past I've had ISP router that had a heavily restricted custom firmware on it and a "hidden" username password setup for authorizing with the ISP. I couldn't use my own.

In that situation I had to aim to use it as the modem and have a second router it unloaded to. Not ideal.

Now I can freely pick hardware with my current ISP. Just need to find the time/money to upgrade to fibre everywhere to capitalize on the 10Gb/s.

redwoolf• 1 year ago

Can anyone suggest a good modem for DSL Fiber? I have CenturyLink/Quantum.

bediger4000• 1 year ago

I use a Dell R530 rack mount server. I had to configure PPP over Ethernet, and a Vlan of 201, but I've not been forced to the "quantum" BS. I've heard you just do DHCP, No PPPoE for that.

throwaheyy• 1 year ago

I have quantum fiber and am using a Dynalink WRX36 running OpenWrt. Needed the vlan 201 configuration but works well.

OpenWrt is pretty amazing, my router downloads torrents, blocks ads, runs a VPN client (enabled per-device) for watching geo-blocked streaming, serves content from a USB drive to my TV, among other things.

https://openwrt.org/toh/dynalink/dl-wrx36

perching_aix• 1 year ago

Bit difficult to reconcile with reality in case you e.g. have to use the ISP's router or even just their SFP modules, which are really like a router in your router in a sense, and are common in fiber installations to my knowledge, as using a different one can cause issues for other subscribers on the same passive connection.

tempestn3• 1 year ago

Owning your own router also helps avoid lock-in. I just switched ISPs and it was relatively painless since I could just plug my router into the new box, maintaining all my config. (At least in theory; since all ISPs are terrible, they misconfigured their own modem, so I had to figure out how to log in and switch it to bridge mode. But after that, painless...)

nejsjsjsbsb• 1 year ago

What about: I use the ISP router for support convenience then I turn off its wifi and daisy chain a second router I set up?

topspin• 1 year ago

This is my solution, although my ISP box has no WiFi, thankfully. Their box is a totally locked down, "business" service bridge. Behind that is my MikroTik RB5009UPr+S+in, doing packet filtering, NAT, VLAN, PoE to access points, etc. I don't really care about the ISP box.

kevin_nisbet• 1 year ago

My ISP does this as well, provides Huawei modems with hardcoded backdoor passwords that can easily be found online. So yup, I've got a dedicated firewall between my networks and the modem. With slow updates and backdoors, I'd include any ISP modem and networks as part of my personal threat model.

Shank2• 1 year ago

AT&T Fiber's routers have, in the past, had a tendency to overheat, offered false promises like "DMZ Plus" mode and have had a host of issues that led to a black market of people selling stolen AT&T certificate files [0] on the internet so you could bypass them, because they use 802.1x between their "Router/gateway" combination device and their ONT, when they're separate devices. The AT&T XGS-PON network is mostly coupled now, which has led to another group of people now creating compatible SFP+ modules to replace the entire GPON stack because of this.

I could be wrong, but I think AT&T Fiber is the only US ISP that doesn't even allow you to directly connect to their network. If you use any of their provided routers, they only offer "DMZ Plus" mode that still leaves their router/gateway managing state tables, which is vulnerable to hardware and software issues from the ISP. This leads people down the path of programming SFP+ modules and spending a lot more time than they should have learning about ISP networking, just to have a safer router/modem.

[0]: Due to security issues in the router/gateway firmware, various people have published guides and/or run actual businesses shucking routers/gateways from AT&T by exploiting them, grabbing the certs and private keys, and then re-selling them to people who need them. These don't get you free access to the internet or anything, they just let you authenticate to the network with your own device.

inyorgroove• 1 year ago

As someone who has done this I take issue with characterizing the certificates as stolen. I exploited a security vulnerability in the device's web UI to extract them, from a piece of equipment I paid for. Its my equipment the provider required me to buy it for service, I can do with it as I please.

I would be in agreement with it if we were using all this to steal service, we just don't want to use their unstable and unacceptable equipment.

smitelli• 1 year ago

Having recently cancelled AT&T fiber service, their router (Arris BGW210-700) was definitely still AT&T property and they seemed to have every intention of collecting it from me. They had been charging $10/mo "equipment rental" fees for the entire time.

When the prepaid shipping box never arrived, I called them and inquired. The representative told me that, since it was 5+ years old, they didn't want it and I should throw it out as e-waste. I still have it in a closet somewhere.

Might be a regional difference, but in my case I never felt that the box was mine.

x3n0ph3n3• 1 year ago

My ISP requires me to use their router, but I just put my own behind it.

mrweasel• 1 year ago

A friend of mine discovered a weird loophole at some Danish ISPs. Most of the ISPs doesn't allow you to use your own router, but they can open up your "port" to accept any router. Calling in, saying that you have a Cisco router than you can't get working, just playing dumb about the being locked to the ISP provided router, they'll then assume that you know what you're doing because "Cisco" and unlock your account.

deathanatos• 1 year ago

It may well be cheaper in the long run to buy your own hardware

That's why my ISP forces me to rent theirs!

Something something market dominance in one market something something force dominance in another market …

In the end, I just treat the network like any other: assume the network is compromised, and security is/should be done by the endpoints.

jitl2• 1 year ago

Often hard to use your own stuff with fiber systems. I get AT&T fiber which is pretty good service but no way to use your own “modem” (optical network terminal). I think their gateway suffers from some kind of buffer issue which affects me even w/ “ip pass through” to my own Synology router.

gh02t2• 1 year ago

There are ways now (as in, very recent) to bypass the ONT for AT&T, people have developed custom GPON SFP module firmware that lets you connect directly. There are also multiple ways to bypass the gateway authentication, be it extracting the certificates or doing Ethernet proxying of the authentication frames.

jitl2• 1 year ago

That’s cool to hear! Sounds like it will need a weekend project some time

WarOnPrivacy6• 1 year ago

Often hard to use your own stuff with fiber systems.

This is the 2nd time I've heard this in this thread and it baffles me. Setting up a fiber connection is how I know I won't have to fight for control at the edge.

I get AT&T fiber...

Okay, okay. AT&T excepting but that goes without saying. Wherever they are you want to be elsewhere.

poink• 1 year ago

Backup: an ISP will give one device. Should it fail at an inopportune time, you will be off-line until you get them to issue a replacement. When you own your own hardware, you can buy a second modem and/or a router for emergency backup.

This is nicer than it seems because "I've already tried a completely different modem" is a good way to short circuit ISP troubleshooting scripts IME.

megous• 1 year ago

Yep, I just run my own Linux build on any SBC with at least a single gigabit port, currently that's Quartz64-A. I've never been happier with my home router and flexibility of configuration/what I can do with it, than just running a regular fully fledged Linux distro on it.

dang• 1 year ago

Avoid ISP Routers - https://news.ycombinator.com/item?id=41092571 - July 2024 (26 comments)

JohnMakin• 1 year ago

if you live in “the hood” the lan is nuts and you can get by by just treating your local network as completely untrusted, which I personally believe is good practice anyway.

xor-eax-eax• 1 year ago

OPNsense DECISO router on 2 Gbps symmetric Google Fiber for $100/mo. works great. Anywhere without GF, I'd look for co-op municipal fiber consortiums before megacorps.

jmcgough• 1 year ago

Yes. Avoid their name servers, too - I was surprised how many weird connectivity issues went away years ago when I manually configured DNS.

alex1138• 1 year ago

The average consumer who uses teh internetz probably isn't all that savvy

So when an ISP borders (and often more than that) on criminal practices or being malicious - which is a lot of them - they're laid prone to all the upstream garbage

(Defaults matter)

heffer• 1 year ago

In similar news: The German regulator (BNetzA) just re-confirmed two weeks ago [0] that passive optical networks are not exempt from § 73 (1) of the TKG (Telecommunication law) which mandates that the interface between provider and customer is required to be a passive interface (i.e. mandating an ONT is already in violation of that). And that is fine. The different PON standards are reasonably well standardized and can operate in these standard modes for most equipment manufacturers. The NSP may lose some proprietary features, but the past has shown that equipment manufacturers have adapted for the German market accordingly. The law does allow exemptions, mainly if required for access technology reasons, but clearly states that even in that case the device that connects the end-user devices to the service (i.e. router) cannot be mandated by the ISP. They can provide one, but they cannot prevent you from connecting your own.

I do sometimes miss living in Germany.

[0]: Press release in German: https://www.bundesnetzagentur.de/SharedDocs/Pressemitteilung...

martijnvds• 1 year ago

I think there are similar rules (or there will soon be) in all of Europe.

Diti• 1 year ago

Yes¹, but most European countries do not honor these yet².

____

[1] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32...

[2] https://umap.openstreetmap.fr/en/map/router-freedom-tracker-...

jiehong• 1 year ago

But internet in Germany is famously spotty and not great, at least compared to our neighbours the French or the Polish.

mixermachine5• 1 year ago

It's getting better. The situation is not ideal but very slow connections with <100 MBit/s are rare now.

bustling-noose• 1 year ago

The median consumer for an ISP is someone who pays for a service and asks for the wifi password printed on the back. Thats about it. Maybe they change the password through the app (TR-069) if they want to change it later. Having something like this working 24x7 while also being able to afford to run a cable to the home is quite challenging. I hate pretty much most ISPs for having a good service but terrible equipment. But I know most of my friends and relatives really don't care. They just want to use it for work or browsing / binging and thats about it. With fiber this is more messed up because now they are being sold gigabit plans when in reality a 100-200mbps connection would be enough if the home was wired correctly and all devices received a good wifi connection with a good router connected to some APs / mesh with maybe something like SQM.

Getting rid of a GPON router can be challenging now that everyone is moving to fiber.

-For one, you could get banned for having a problematic transceiver. -You might be able to spoof the SN and even MAC and PLOAM password but even then there is a GPON ONU and OLT incompatibility problem. Nokia OLT for example can be notorious while some OLTs only work with their own brand ONUs. -Finding the correct VLAN is also tricky and sometimes different VLANs are used for different services like POTS which means your GPON bridge needs to be able to do correct pass through after registering instead of registering on just one VLAN.

ISPs should just provide a GPON SFP bridge to consumers with the router it plugs into that has a TR-069 configured so that the ISP can also swap routers as and when they get upgraded while keeping the SFP bridge constant as the cost of router would then decrease without having to need a GPON ONU to be built. Not to mention the software gets less complicated without GPON on the router end.

https://hack-gpon.org

natas2• 1 year ago

Xfinity (Comcast) is uploading their own firmware to my netgear which I have purchased on amazon. So one may (rightfully) assume that they have their own backdoors there too; otherwise why would they bother doing that.

nine_k2• 1 year ago

But how do they do that? Doesn't this require basically root access to the router? If you give it to your ISP, then the router is ISP's as much as yours, until they cut your root access off %)

saagarjha• 1 year ago

I'm guessing they mean modem

b8• 1 year ago

Cox only allows their whitelisted routers. Otherwise, I would use a Nokia Modem/router combo. ATT may be installing fiber soonTM.

hakfoo• 1 year ago

What's the ISP's motivations towards preventing BYOD?

If they're desperate for the $10 per month box rental, I'm sure they could just levy a $10 per month BYOD "support fee" to make equal, but it sounds like in some places they're charging way more as a penalty.

I know some of them were very aggressive about using home routers to provide coverage for roaming Wi-Fi, but that doesn't seem as big a push as it was. I suspect this corresponds with a lot of them getting into the MVNO business lately.

Do they result in a disproportionate volume of support inquiries, or maybe ones that they can't just dispatch by trying to send a remote-reboot signal down the line? I could see addressing that by moving towards a fee-for-service-call model if you need to call the "custom configurations" hotline.

newsre4der• 1 year ago

If you have a LAN cable, or fiber for WAN it can be done, but with cable modems it's not always possible to use your own device. I got a device which hasn't been updated since 2019 . :(

pimeys3• 1 year ago

We have a cable connection, and the cable modem can either act as a router or a bridge. We set it up as bridge, and connected an opnSense router to it.

ndsipa_pomu• 1 year ago

Here in the UK, I'm using VirginMedia, but have been running my own router for ages. Unfortunately I still have to keep their router powered and connected to access the internet, but it has a "modem" mode where it just provides a dumb connection to one port and disabled WiFi.

My current router is a NanoPi r6c which is a marvelous piece of hardware - stick in an nvm drive and it's more than happy running a bunch of containers. (It's running FriendlyWRT at the moment though I think the next release of openWRT will support it).

account-5• 1 year ago

This is all well and good but unless you have networking experience and know what makes a good router you're still stuck.

What router should I be using in place of the ISP one? Can I trust it's manufacturer? How can I make sure it definitely is a one to one replacement and I don't need to use my isp router as a bridge?

baobun2• 1 year ago

Considering the audience: Get whatever x86 (arm if you have a more enthusiastic vibe and don't mind some independent research) hardware, install your Linux/BSD distro of choice (it doesnt need to be a "router" distro in case youre already handy with some other base system. setting up from vanilla can be easier than getting into idiosyncracies of openwrt/pfsense/etc) and configure it yourself. It will be valuable and useful even if your ISP requires their own gateway in the middle. Get 2 of whatever it is so you have a spare/staging ready if it becomes necessary later.

Intel NICs are generally preferred over Realtek if available.

hirako2000• 1 year ago

One cannot trust manufacturers, it's common practice to put backdoors. That's why you simply get an OpenWRT compatible router and flash it.

It does not require networking experience, just a bit of curiosity and following a bunch of well documented steps.

Knowledge is required to build a decent setup. It doesn't end there for a proper environment, you also want a VPN, this can be configured at the router level. Oh, what about an ad blocker, blacklisting all known ads serving hosts perhaps?

Given the time we spent hooked online, worth gaining what really is vital knowledge for a decent internet access, or the internet will gain most of your precious attention.

djhworld• 1 year ago

My ISP here in the UK is pretty good, they have fibre going into a little box on the wall which has an ethernet port on the bottom, I've got a Ubiquiti Dream Machine Pro connected to that on the WAN port and it's worked solidly for years.

aboardRat4• 1 year ago

Things are hardware locked where I live. It is possible to root some of the ISP devices, but not all

chaz62• 1 year ago

As someone who just switched from an IPoE internet service to PPPoE, just make sure your device can cope. I have been using a trusty Ubiquiti Edgerouter Lite 3 for many years without issue. Unfortunately, the Cavium cpu does not support hardware offload for both ipv6 vlan and ipv6 pppoe at the same time.

If you do go down the general-purpose cpu (x64/arm) route and your ISP uses PPPoE, you may need to tweak so that the rx queue is handled by multiple cpu cores as they will default to the first core by default.

bdavbdav2• 1 year ago

I was so pleased to switch to IPoE even on my UDM SE. The speeds are much more consistent now. Sky in the UK have been fantastic for FTTP.

OptionOfT2• 1 year ago

I had to fight with Cox (Fiber to the home) to be able to use my own router, if I wanted unlimited data for free.

To my understanding this is partially for them to push their crowdsourced WiFi, and maybe an easier way to sell you an all-in-one security/internet/TV package.

When I explained that I would just their device as a passthrough, and that it would be a waste to have the device here, she removed it from my account.

Now, what I don't know is HOW they check whether I'm using their device. MAC? Easily copied. Them sending some commands that only their devices can respond to? Yea, that's a bigger problem.

bdavbdav2• 1 year ago

I’m quite happy with the openreach setup in the UK - using a very simple ONT and whatever you want going into it router wise. They’re very close to just being a media converter, and the ONT SFPs are basically the same thing in a different form factor. I understand why they’re controlled given the topology of gPON.

If you’re worried about security of the device on the WAN side, then you’ve got bigger issues.

Bluescreenbuddy• 1 year ago

Comcast charges me $119 for 1.2gbps with a cap. If I want to remove the cap it's an additional $30. Highway robbery with these assholes

Avoid ISP Routers (2024)

Related Stories