Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avoid ISP Routers (2024)

routersecurity.org

Post reply on HN
Print view View original

11–20 of 210 posts

Re: Avoid ISP Routers (2024)

#11

Post by somat »

egberts1 wrote: post #4

Not too many Fiber-PON routers out there that we can drop Linux OS into.

Most of the time I have seen fiber set up as a dedicate bridge device GPON to ethernet, the Optical Network Terminator(ONT). And honestly, I am fine with this. copper ethernet is much easer to deal. This makes a nice clear demarcation point, the copper past the ONT is yours, everything upstream of that is theirs.

Having said that It would be nice to have control over the ONT as well. there are PON sfp optics, that may be the easiest way to set up your own fiber capable router. I have heard it is tricky to to talk the isp into allowing your modules, you probably need to know a guy that works there.

Re: Avoid ISP Routers (2024)

#12

Post by al_borland »

dboreham wrote: post #3

Except as soon as you report some QoS issue and a tech comes out, they'll tell you that it's your off brand router and you need to rent one from them.

They tried this with me once. I told him to get a modem from the truck and try it. The issue remained, so the excuse was busted.

That said, I have run into issues where the ISP will upgrade the speeds and it will be beyond what the modem or router can handle, and as a result the speeds dropped dramatically. In those cases, I did need to hardware, but was still able to get my own.

Re: Avoid ISP Routers (2024)

#13

Post by RajT88 »

ISP's thanks to a bill cannot charge rental fees anymore:

https://www.pcmag.com/news/isps-cant-charge-you-for-using-yo...

Unless they come up with a BS security excuse, like cert based auth to their network, which means they claim they cannot offer people to BYOE. I bought an old DSL modem off eBay some years back and tried to get AT&T to waive the rental fee (honestly thinking I was in the clear).

They were not having it. I filed an FCC complaint and in a few days got a call from the office of the CEO saying the equipment was still technically theirs and "gray market" and they could sue me if they wanted. I did get that rental fee waived.

I got off AT&T as soon as humanly possible after that. I used to think they were less shady than Comcast, but now I know otherwise. Comcast, for all their egregious nonsense, at least lets you BYOE.

Re: Avoid ISP Routers (2024)

#14

Post by tguvot »

somat wrote: post #11
egberts1 wrote: post #4

Not too many Fiber-PON routers out there that we can drop Linux OS into.

Most of the time I have seen fiber set up as a dedicate bridge device GPON to ethernet, the Optical Network Terminator(ONT). And honestly, I am fine with this. copper ethernet is much easer to deal. This makes a nice clear demarcation point, the copper past the ONT is yours, everything upstream of that is theirs. Having said that It would be nice to have control over the ONT as well. there are PON sfp optics, that ma…

https://pon.wiki/

Re: Avoid ISP Routers (2024)

#15

Post by jeroenhd »

egberts1 wrote: post #4

Not too many Fiber-PON routers out there that we can drop Linux OS into.

There are stores like fs.com where you can buy affordable tranceivers for use in anything that'll take SFP+. The biggest hurdle is extracting the specifications you need from your ISP and configuring your own router for their weird quirks, and probably probably convince them to accept your serial number (or spoof a device of theirs if you can find the S/N).

There are also ONT/media converter boxes that'll spit out ethernet if you plug in a fiber and set the appropriate DIP switches. I found one hanging in my apartment when I moved in. I've also seen people sell them on second hand marketplaces (probably not realizing that they're technically property of the ISP). Buying newer ones that spit out more than 1gbps as a consumer can be a challenge, though.

There's a nice variety of small Linux router boxes available online that are relatively low power but still offer good connectivity through SFP(+) ports. Getting Linux running on those is easy, the challenge is in figuring out how to active the connection.

Re: Avoid ISP Routers (2024)

#16

Post by zamadatix »

issafram wrote: post #7
daneel_w wrote: post #5

Earlier quoted context omitted.

Thankfully you don't need to. You can run your own, and treat the ISP modem/router as if it were the Internet.

Yup, most have a "bridge" mode. That's the first thing that I did when I got AT&T Fiber

The bridge mode for AT&T's fiber plans is notoriously shitty at just being a dumb bridge... but it does at least pass the IP through so you can port forward like a normal person would (the built in port forward is so ass backwards). My connection became significantly better (marginally better in max throughput, significantly better in connections/s, QoS, and jitter) when I went from "bridge" mode to replacing the ONT with an unofficial device with a "real" bridge config.

The other thing you can run into is, even in bridge mode, there is a relatively low session limit. The exact number depends on the model you get but some were as low as 4,000 (which sounds like a lot until you start loading background apps on devices and connecting to webpages which are actually dozens of connections per in many cases). The newer boxes aren't as bad... but it was still worthwhile for the effort.

Re: Avoid ISP Routers (2024)

#17

Post by IgorPartola »

Any desktop computer + Intel dual GB NIC + opnsense and you have an amazingly powerful router. Add in a Raspberry Pi running the Omada controller software and some Omada access points and you have an inexpensive and very robust WiFi network. Don’t forget to turn on auto updates for opnsense.

Re: Avoid ISP Routers (2024)

#18

Post by protocolture »

jeroenhd wrote: post #8

My ISP sent over a Fritz!box (though they offered a "bring your own" option as well). It came preconfigured for my ISP. I turned off remote access and TR-069 through a toggle in the settings, then changed the admin password. Really, that's all you need to do to take control of one of these routers. There are good reasons to dislike the AVM routers, but their software is actually pretty solid in terms of customisation…

Thats one end of the spectrum.

One of my employers once ordered a pallet of Huawei routers. They turned up with a custom firmware provided by a different ISP. It was completely locked down, and only configurable via TR-069 and some proprietary Huawei ONT magic.

I also had a customer once that deployed a series of routers that were cloud managed only via the ISP. Not even TR-069 but they just did DHCP and phoned home via a proprietary protocol. Magic my customer said, he can just reboot customer routers remotely. The company that manufactured that router went bust 8 months later, leaving a bunch of preconfigured routers without a cloud portal and no path forward. Surprised I havent seen a DNS hijack published for them yet.

Re: Avoid ISP Routers (2024)

#19

Post by tills13 »

I run my own homelab and have a Ubiquiti gateway (UDM). I would have loved to have the fibre connection come directly into my box uninterrupted but the ISP's modem is required to associate the connection with my account (or something to that effect). Deeply disappointing.

Re: Avoid ISP Routers (2024)

#20

Post by alyandon »

zamadatix wrote: post #16
issafram wrote: post #7

Earlier quoted context omitted.

Yup, most have a "bridge" mode. That's the first thing that I did when I got AT&T Fiber

The bridge mode for AT&T's fiber plans is notoriously shitty at just being a dumb bridge... but it does at least pass the IP through so you can port forward like a normal person would (the built in port forward is so ass backwards). My connection became significantly better (marginally better in max throughput, significantly better in connections/s, QoS, and jitter) when I went from "bridge" mode to replacing the ONT…

I just got AT&T fiber installed and the gateway has 8192 conntrack slots. Two steam clients scanning for Counter-Strike 2 servers at the same time can chew through that many connections.

I joined the 8311 discord and will be doing a full bypass as soon as feasible.

Post reply on HN