Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Avoid ISP Routers (2024)

routersecurity.org

Post reply on HN
Print view View original

51–60 of 210 posts

Re: Avoid ISP Routers (2024)

#51

Post by dp-hackernews »

jamestimmins wrote: post #41
trimbo wrote: post #37

Earlier quoted context omitted.

I live in SF and Comcast doesn't charge me to have my own router. I pay $130 for 1.4gbit and unlimited data. It's expensive but I also have no other choices. Sonic stops only one block over and we haven't been able to convince them to wire up my block.

I'm so jealous of SF internet options. In LA I pay $105 for "supposedly" 2-300mbit, but this week I've been seeing 30. I keep looking for alternatives but haven't found any in my area.

I'm guessing a 5G mobile option is too expensive. In the UK I have a 3Mobile (Smarty unlimited data) 5G connection, using an MC801, for £20/m and I get around 1gb/100mb with it - until the tower hits a busy period, then it drops to about ~500mb/20mb

Re: Avoid ISP Routers (2024)

#53

Post by phantom784 »

veilrap wrote: post #30
OkGoDoIt wrote: post #21

I wish. I own my own modem and router, but Comcast won’t let me use them unless I pay a whole bunch of extra fees or accept a stupidly low monthly data cap. I’ve got my router downstream of theirs which is a bit annoying, especially considering their modem-router combo overheats and needs to be rebooted via unplugging power at least once a month. Sadly I have no other options here in San Francisco. My house is not wi…

I'm surprised by this, is Comcast super regional with it's restrictions? I have a Comcast 1gig plan in the Bay Area, and last I checked I get a small ($5?) discount for using my own modem. I've been on the plan for a least a few years now... so alternatively maybe I'm grandfathered in or something? Or maybe some Comcast sales person was lying to you about your options?

We we offered $10/month to use their modem + unlimited, or $30/month to use your own modem unlimited.

We actually don't use that much data though, so just went with the data cap and our own modem, and never went over.

This was in the Seattle area.

Re: Avoid ISP Routers (2024)

#54

Post by tempestn »

14 wrote: post #39

Sadly I am not able to outright get ride of my ISP router. I am here in Canada on Shaw, well it recently was taken over by Rogers, and we can not just use our own. We can put the modem into bridge mode and connect to it but not get ride of it completely. I am not sure if bridge mode would stop much of the security concerns but my gut says no.

Once in bridge mode it's no longer acting as a router, so it should mostly be fine. The firewall on your actual router will be present between the modem/internet and your machines.

Re: Avoid ISP Routers (2024)

#55

Post by Shank »

jeroenhd wrote: post #8

My ISP sent over a Fritz!box (though they offered a "bring your own" option as well). It came preconfigured for my ISP. I turned off remote access and TR-069 through a toggle in the settings, then changed the admin password. Really, that's all you need to do to take control of one of these routers. There are good reasons to dislike the AVM routers, but their software is actually pretty solid in terms of customisation…

> Really, that's all you need to do to take control of one of these routers.

All major ISPs in the US do not do this, e.g., AT&T, Verizon, Comcast, Frontier, etc. You might be right for some ISPs that are nicer, but this advice is completely ineffective for most US consumers.

Re: Avoid ISP Routers (2024)

#56

Post by bityard »

IgorPartola wrote: post #17

Any desktop computer + Intel dual GB NIC + opnsense and you have an amazingly powerful router. Add in a Raspberry Pi running the Omada controller software and some Omada access points and you have an inexpensive and very robust WiFi network. Don’t forget to turn on auto updates for opnsense.

I run OPNSense inside Proxmox on a cheap fanless Intel N100 box. VM-level snapshots and backups are heavenly. Can't believe I avoided it for so long.

Re: Avoid ISP Routers (2024)

#57

Post by kevin_nisbet »

My ISP does this as well, provides Huawei modems with hardcoded backdoor passwords that can easily be found online. So yup, I've got a dedicated firewall between my networks and the modem. With slow updates and backdoors, I'd include any ISP modem and networks as part of my personal threat model.

Re: Avoid ISP Routers (2024)

#58

Post by daemin »

anal_reactor wrote: post #34
OkGoDoIt wrote: post #21

I wish. I own my own modem and router, but Comcast won’t let me use them unless I pay a whole bunch of extra fees or accept a stupidly low monthly data cap. I’ve got my router downstream of theirs which is a bit annoying, especially considering their modem-router combo overheats and needs to be rebooted via unplugging power at least once a month. Sadly I have no other options here in San Francisco. My house is not wi…

In EU the second poorest country has the fastest internet. The richest country cannot provide cellular signal to all of its area.

It kindof depends when a country did its investment into Internet infrastructure. More western countries did it first and are now stuck with older technologies that limit speed and capacity, where as the less modern countries put that investment in later and therefore have newer technologies like fibre.

Once an investment has been made it's hard to justify making another large investment, or if one is being made it becomes very political and captured by vested interests.

Re: Avoid ISP Routers (2024)

#59

Post by Shank »

AT&T Fiber's routers have, in the past, had a tendency to overheat, offered false promises like "DMZ Plus" mode and have had a host of issues that led to a black market of people selling stolen AT&T certificate files [0] on the internet so you could bypass them, because they use 802.1x between their "Router/gateway" combination device and their ONT, when they're separate devices. The AT&T XGS-PON network is mostly coupled now, which has led to another group of people now creating compatible SFP+ modules to replace the entire GPON stack because of this.

I could be wrong, but I think AT&T Fiber is the only US ISP that doesn't even allow you to directly connect to their network. If you use any of their provided routers, they only offer "DMZ Plus" mode that still leaves their router/gateway managing state tables, which is vulnerable to hardware and software issues from the ISP. This leads people down the path of programming SFP+ modules and spending a lot more time than they should have learning about ISP networking, just to have a safer router/modem.

[0]: Due to security issues in the router/gateway firmware, various people have published guides and/or run actual businesses shucking routers/gateways from AT&T by exploiting them, grabbing the certs and private keys, and then re-selling them to people who need them. These don't get you free access to the internet or anything, they just let you authenticate to the network with your own device.

Post reply on HN