Avoid ISP Routers (2024)

I wish. I own my own modem and router, but Comcast won’t let me use them unless I pay a whole bunch of extra fees or accept a stupidly low monthly data cap. I’ve got my router downstream of theirs which is a bit annoying, especially considering their modem-router combo overheats and needs to be rebooted via unplugging power at least once a month.

Sadly I have no other options here in San Francisco. My house is not wired for phone service so I cannot get DSL. The various fiber services that are becoming more available in San Francisco are generally only available downtown or large apartment buildings. My freestanding house can’t get any of that. AT&T‘s new fiber doesn’t connect to me either. And webpass doesn’t have a good line of sight from my location to any of their microwave towers so I can’t get that. It is Comcast or nothing. It always amazes me that San Francisco is supposedly the tech capital of the world but internet connectivity here is worse than rural China. (And that’s not an exaggeration, I’ve spent plenty of time in rural China and in the mountains there, both the cellular and hardline service is infinitely better than San Francisco, aside from the firewall issues of course)

…I guess that turned into a bit of a personal rant but holy crap how is it 2025 and this is still a problem in a major tech city?

Yes. Avoid their name servers, too - I was surprised how many weird connectivity issues went away years ago when I manually configured DNS.

The part about a cockroach colony is a bit unfair.

Insects love electronics, with the heat and noise they generate. And when electronics sit in storage for a long time, the critters can crawl in from neighboring items.

This is just as likely to happen with a non-ISP router.

Ok, in all fairness I don’t have any stats to back up that claim. But nobody else does either.

That open source router you love so much may have been sitting in storage even longer.

I have mixed feelings about ISP routers, and ISPs in general.

But insect infestation is a serious issue in consumer electronics and has nothing to do with ISPs.

Some of the comments here about ISP behaviour are crazy. Australia has had our fair share of fucking up the national internet infrastructure but at least I can pick pretty much any ISP and use any router I like. Haven't used an ISP supplied router in something like 15 years.

> It may well be cheaper in the long run to buy your own hardware

That's why my ISP forces me to rent theirs!

Something something market dominance in one market something something force dominance in another market …

In the end, I just treat the network like any other: assume the network is compromised, and security is/should be done by the endpoints.

OPNsense DECISO router on 2 Gbps symmetric Google Fiber for $100/mo. works great. Anywhere without GF, I'd look for co-op municipal fiber consortiums before megacorps.

Oh, absolutely. Even on just that last issue of cost, buying my own cable-modem paid for itself long ago, compared to the "rental" cost from my ISP.

On that note, it's better to buy a router separately from the modem. All-in-one devices are harder to diagnose and you can't reuse the router with a different connection type.

I run my own homelab and have a Ubiquiti gateway (UDM). I would have loved to have the fibre connection come directly into my box uninterrupted but the ISP's modem is required to associate the connection with my account (or something to that effect). Deeply disappointing.

My ISP sent over a Fritz!box (though they offered a "bring your own" option as well). It came preconfigured for my ISP.

I turned off remote access and TR-069 through a toggle in the settings, then changed the admin password. Really, that's all you need to do to take control of one of these routers.

There are good reasons to dislike the AVM routers, but their software is actually pretty solid in terms of customisation and network security. It's not a bad device, and the large scales ISPs can order them at they can be had for a significant discount as a rental compared to buying your own in a store.

AT&T Fiber's routers have, in the past, had a tendency to overheat, offered false promises like "DMZ Plus" mode and have had a host of issues that led to a black market of people selling stolen AT&T certificate files [0] on the internet so you could bypass them, because they use 802.1x between their "Router/gateway" combination device and their ONT, when they're separate devices. The AT&T XGS-PON network is mostly coupled now, which has led to another group of people now creating compatible SFP+ modules to replace the entire GPON stack because of this.

I could be wrong, but I think AT&T Fiber is the only US ISP that doesn't even allow you to directly connect to their network. If you use any of their provided routers, they only offer "DMZ Plus" mode that still leaves their router/gateway managing state tables, which is vulnerable to hardware and software issues from the ISP. This leads people down the path of programming SFP+ modules and spending a lot more time than they should have learning about ISP networking, just to have a safer router/modem.

[0]: Due to security issues in the router/gateway firmware, various people have published guides and/or run actual businesses shucking routers/gateways from AT&T by exploiting them, grabbing the certs and private keys, and then re-selling them to people who need them. These don't get you free access to the internet or anything, they just let you authenticate to the network with your own device.

Always treat hardware you get from someone else as not just untrusted but hostile until proven beyond any reasonable doubt otherwise.

Put an OpenBSD machine to act as a router/firewall between supplied devices and your own network to keep things clean.

> Backup: an ISP will give one device. Should it fail at an inopportune time, you will be off-line until you get them to issue a replacement. When you own your own hardware, you can buy a second modem and/or a router for emergency backup.

This is nicer than it seems because "I've already tried a completely different modem" is a good way to short circuit ISP troubleshooting scripts IME.