Hacker News new | past | comments | ask | show | jobs | submit login
Avoid ISP Routers (routersecurity.org)
27 points by ementally 9 months ago | hide | past | favorite | 26 comments



If you're on HN, you obviously want an OpenWRT router or better but most people are probably better off with equipment managed by their provider so they have someone to whom they can complain about wifi issues, etc.

Also, funny to see Bogleheads forum as source for tech advice. It comes up times and again in many forums that they are populated largely by computer janitors.


> most people are probably better off with equipment managed by their provider so they have someone to whom they can complain about wifi issues, etc

I strongly disagree. The degree of troubleshooting ability this grants the often almost useless tech support at major providers is not sufficient to justify the many downsides and resulting risks.

There have been numerous documented cases involving ISPs configuring these devices in horrifically insecure ways, and that hardly seems to justify the ability to remotely reboot the device and look at basic troubleshooting stats.

It’s 2024, and I think it’s far more important to continue pushing tech literacy than allow such a critical aspect of modern life to be controlled by demonstrably hostile entities for dubious benefits.


How are non technical people, like our parents, ... going to install their own router? And then they might have to manage it, like a manual update or asjustment now and then or whatever.

Most people simply don’t have the knowledge.

It would be like everyone buying car parts themselves and repairing their own cars when they break…


> How are non technical people, like our parents, ... going to install their own router? And then they might have to manage it, like a manual update or asjustment now and then or whatever.

Buy an eero, plug it in, use the phone app for initial setup (like setting wifi password, nothing "technical"), and then use it while doing no maintenance because settings don't need to change and software auto-updates.

> It would be like everyone buying car parts themselves and repairing their own cars when they break…

Yes, it would be like people replacing windshield wipers and topping off their own oil: You could hire it out, but it's a waste of money to do so.


> How are non technical people, like our parents, ... going to install their own router?

The way they already are doing this. You’re presenting this as if it’s some mythical impossible thing, but there’s usually someone in the household who can get these device set up, and an increasing amount of extremely accessible content online to help people who are willing to spend a few minutes learning.

A modern router will update itself, and after the initial configuration process is almost maintenance-free with the exception of the occasional reboot and/or checking of cables, both of which are still required if the ISP owns the router.

Furthermore, modern routers generally have extremely simplified setup processes, and minimal knowledge is necessary.

With some limited guidance, all of the non-technical parental figures in my family have managed this without major issues, and I’ll happily take a few questions every 6-12 months if it means they can avoid trying to mitigate the class of other issues inherent to delegating this to the ISP.

> It would be like everyone buying car parts themselves and repairing their own cars when they break…

This is not an effective analogy. The degree of skill required and the actual steps involved in managing one’s router look absolutely nothing like becoming an at-home mechanic.

99% of router issues are solved by turning it off and on again (If only cars were so simple). The remaining issues are often beyond the purview of the ISP anyway, leaving one to wonder what actual benefit there is in granting administrative access to entities that have repeatedly proven they do not have their user’s best interests in mind.

> And then they might have to manage it, like a manual update or asjustment now and then or whatever

No modern router should require manual updates. Using the ISP’s router does not guarantee automatic updates or properly/securely managed devices either.

And again, this is where I’d rather get a call from my dad very occasionally asking about some setting than find out later that their network has been pwned because the ISP router left a default admin credential in place that is now being widely exploited (true story).

The hurdles you’re erecting do not represent the actuality of the problem space, and I think it’s more important to push a baseline level of tech literacy vs. trying to wash our hands of the issue, which I think is actively harmful because many ISPs have proven they are often not an improvement over even poorly self-managed options.


I agree. I'm in the fortunate situation where I'm using an ISP-provided router but have admin access. There really wasn't any config that I needed to change but changed the DNS server (as ISP ones are a common point of failure) and not much else. Plus I use another mesh router behind it anyway (as well as DNS-over-https in my browser).


Buying your own high-end home router is a decent choice between giving your ISP root access on your home LAN and deploying custom firmware.


The "purchase your own router" argument goes out the window on a GPON or XGSPON network where the ISP provides the interface to the single strand of fiber, unless your ISP supports putting the ONT in what is effectively a layer 2 bridge mode, and then you provide your own router.


Most allow some sort of bridge mode, and allow you to turn off the WiFi. Its not ideal, but it works well enough.

I have AT&T and they allow this, I have all traffic pointed to a custom Debian router with AdGuard, Firewalld, and OpenVPN. My phone and laptop then have OpenVPN and all traffic goes through my home network.

Its absolutly great. I see no ads and can watch streaming while I travel.


Yeah there was a bridge mode on the combo ONT + router we got during the previous food install, ~7 years ago. Worked fine.

The new place I recently moved to had an ONT unit in the house. Verizon sent us a router (cr1000a, godforsakenly DNS server but otherwise pretty good) but just unplugging it and plugging in our own world fine.


I'm double NAT here. Broadband refused to play ball with a DIY router, so the ISP one hands out a DHCP lease to a single machine and everything is on the other side. I'm told double NAT is very bad but overall it seems to work in practice.


I don’t want to self advertise but that has been made economical and self attainable since 2018 and we’ve got several communities around the world for guidance if you search for it. You’ll find the discord, telegram, forums, and blogs.


Yeah AT&T, being the #1 fiber provider in the USA, does not allow customers to supply their own fiber modem. You can put it in a sort of passthrough mode and use your own router though. But AT&T owns everything up to the ONT - and what exactly the "passthrough"/"bridge" mode does is not exactly fully verifiable.


> what exactly the "passthrough"/"bridge" mode does is not exactly fully verifiable.

How much does this matter? If your own router gets WAN IP addresses, it can route and firewall everything behind it.


AT&T's IP passthrough isn't a true layer 2 bridge. It's a NAT hack that allows the same public IP(v4) address to be used by the ONT/router and your router.

As such, you're limited to the resources of the ONT/router. For example, the number of hardware-accelerated flows is limited (~8000 I believe? I can't find a source right now).


They don’t allow it, but you can work around it fairly easily. You have to order a programmable fiber sfp from AliExpress. ATT doesn’t enforce 802.1x auth of the hardware in my area any more so all I had to do was clone my modems serial number to the sfp.


Thank you. I have a bone to chew with AT&T about not following the spirit of the Television Viewer Protection Act (TVPA), the law prohibits TV and broadband providers from charging rental or lease fees for modems when "the provider has not provided the equipment to the consumer; or the consumer has returned the equipment to the provider."

If you can provide a link to one that works for 5Gbps (symmetric, obviously) service I’d be much obliged.



Great in concept, especially if you know what you’re doing. In my non-North American locale, I ordered a fiber hookup, and specifically asked to use my own router.

Supposedly they will give you an ONT in SFP module for free, and then rent you a media converter ~3 USD/month, and then the rest is up to you (assuming it supports PPPoE). Some friends have done this a while ago successfully.

Reality on install day: technician grabbed the white-label ONT/router combo from the truck and refused anything else :( And unrelated, he found a “defect” in the existing fiber drop (clear as day with the visible-light tester), so I had to pay for pulling a new drop from the street :(


Apart from all these legitimate reasons not to use an ISP router or modem, I find that they just... suck. The signal strength on mine is awful.


Mine's still wifi 4.. short of breaking it they won't replace it.


And their local DNS servers crash with heavy usage.


The Verizon cr1000a router we got had pretty decent performance & wifi. I was generally surprised.

But man, it has a local DNS server & the response time is pitiful. It is wild how much faster the internet felt when I went around and manually configured systems to use a public or my own local resolver. I'm agog that Verizon would savage their Internet experience so brazenly with such critically deficient tech. DNS is this router's one bad apple.that spoils that basket.

There's also no way to configure anything else in the router. You can pick a resolver in the web gui, but it's only picking what the internal DNS server asks; DHCP always is the slow internal server.

There's other good reasons I wanted to get on openwrt again (i broadly don't trust the information security of this router) but this was an interesting & very surprising lesson.


My ISP default router (it's free from them, in their defense) has zero capability of changing the dns servers. That alone was a good reason to drop 250 euros on a WRT3200ACM and get OpenWRT running on it.


ATT Fiber ONT and bridge passthrough, like I did with Verizon Fiber, Comcast cable, ATT ADSL and Frontier ADSL in my last places of residence.

Takes a bit of wrangling, and a bit of downtime during initial setups but its YOURS!

This is the part where ISC DHCP client really, really shines for me here (and systemd still can't).

Disclaimer: I coded Efficient PPPoE from RFC-scratch for many ISP's modems.


how do you go about switching out an apartment a router/modem combo with managed wifi at apartment complexes?

I've been told by different places it often can't be done, but I never pushed the issue. Always wondered if it was true




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: