With all the gov’t attacks on privacy these days I’ve been thinking about getting my own router. I’ve never done it and am pretty new to network stuff overall. I certainly welcome any recommendations for routers but I mainly have a stupid question:
Is it as simple as just swapping out the isp router? I’ve disconnected anything I had exposed to the internet and use LAN only right now so none of my old port forwarding rules are needed.
What is your current fiber/dsl config? Is the ISP router acting as modem or do you rely on external ONT (Optical Network Terminal, means to translate light into electricity)? So that you know what to search online to replace the ISP router. If your ISP is very kind you could get completely rid of it, by connecting directly to the ONT. Or your ISP could provide a bridge mode to the router which means that the ISP router is only doing its modem role. Or your coule put it in DMZ or open the rules to let all traffic go to your router, this way works every time but is doing double NAT, basically nesting a LAN inside the existing LAN of the ISP router
The main gotcha is whether your ISP’s device can be put into “bridge mode”, which basically tells it to just act like a modem and pass the traffic along to your new router without doing anything to it. This makes everything just work, so if you self-host any services or do online gaming there won’t be issues. Otherwise, you’ll have to configure your ISP’s device to be as dumb and permissive as possible - disable DHCP so it’s not trying to give your devices IP addresses (this is your new router’s job now), and ideally put your new router into a DMZ (demilitarized zone, basically a part of your LAN that isn’t managed) so that again your new router can do all of the fancy routing and firewall stuff.
Ok, looks like my isp router doesn’t have bridge mode but using DMZ apparently works. Honestly it’s the basics that I’m not getting. The setup seems pretty general, I guess I have to keep my isp router as a modem and connect the new router to the WAN on the isp modem/router. That makes sens but there’s another wire from the isp modem/router that goes to an ethernet box. Wouldn’t that bypass my new router? Would I have to swap the ethernet wire to the new one?
Ring them and ask for the stup info, mine just emailed me the details for my new modem.
Lol this never even occurred to me. Seems like the simplest way to start, thanks!
Re modem type, there is one for every budget but start with what you need ie wifi 5,6,7 or VPN capability, IPV6 etc. and look up openwrt and see what works at your budget then.
@imminent_nebula@lemmy.ca wait, do you have 2 devices from your ISP? what kind(s) are they (make/model) - they’re all a bit different - and what kind of service do you have (cable, fiber, 5g)? Normally in this config (for a cable setup, for example), you’d have:
cable modem LAN Router | ISP | -> | [cable jack] [ethernet jack] | -> | [WAN jack] [LAN jacks] |If there’s a WAN port that isn’t actually used to connect that device to the ISP’s network, it’s possible it can be used to pass the traffic through (the alternative is that device might be used on more than one kind of network that does use the WAN port). But typically when you can’t use the device like a bridge, you’d have the ethernet jack from that device going to… maybe the WAN port or maybe a LAN port on your new router (depends on what it supports out-of-the-box or whether you’d be flashing it with something like OpenWRT)
wait, do you have 2 devices from your ISP? what kind(s) are they (make/model)
No just the one. It’s a Bell Home Hub 3000. There’s a blue cable that plugs into LAN4, a telephone cable that plugs into TEL1 (both of these come from the junction box where the router/modem is), and white cable that plugs into a plug that’s closed off marked sfp, which then runs through the wall to a spot in the living room where I have an ethernet box that has a few devices connected by wired ethernet.
I get that connecting a new router o the WAN port will run all wireless connections through the new router, but the white ethernet cable would still come out of the isp modem/router. I don’t understand how the wired ethernet would come from the new router.
ok, so you have fiber-to-the-home, that SFP connector (the white cable) is a fiber optic line. So in a perfect world you have white cable -> sfp, then bell WAN port -> new router WAN port, then your new router will do its own wifi (disable the bell’s), and plug the blue ethernet into one of the new router’s LAN ports so that the new router is managing the ethernet for your home devices. That’s in an ideal world. In reality, depending on how that Bell device is set up and what kind of new router you get it might be WAN->WAN but it might also be WAN->LAN or even LAN->LAN
OK that makes sense, thank you. WAN from bell to new router would cover the WiFi, then the blue cable into the new router, which would pass the signal back through the WAN line to the bell router and out the fiber line? Or would I need another cable to go LAN to LAN from new router to bell to get the signal to the fiber line? Does WAN go in both directions?
Edit:
and plug the blue ethernet into one of the new router’s LAN ports so that the new router is managing the ethernet for your home devices
Wouldn’t that just completely bypass the Bell modem/router though?
The only thing the Bell modem should be doing is providing your ISPs service to your new router, thus one cable from the ISP to the Bell modem, and one cable from the Bell modem to your new router. Everything else would be plugged into the new router’s LAN ports or connected via wifi to the new router. Internal traffic (from, say, your laptop to your networked printer), would only ever go through your new router. Anything that needed to go to the internet would go wired/wifi -> your new router -> the bell modem -> the internet
That’s where it broke down for me. It all makes sense except for the wired ethernet in the SFP port on the bell modem/router. The routers I’ve been looking at that were suggested like TP-Link with openWRT capabilities only have Wan and Lan, there’s no SFP.
If you want to get really fancy, get a router with an SFP port and put an XGSPON module with 8311 firmware in it. It’s a fiber gateway on an SFP module that lies to your ISP so it looks like the provided gateway/router combo. That way, you bypass their box entirely.
Removed by mod
Oof. Looks like I’ve got more homework to do. I’m tired lol. Thanks for the write up, I’ll look into this more.
Seriously spend $80 on a supported router like TP-Link and use OpenWRT.
It’s not super complicated there are good guides and it will vastly improve your defenses
Man I need to get off my ass and do that. I almost did last year but then some news dropped about firmware backdoors discovered in some routers, and I got scared lol.
To anyone else like me who wants to do it, there is a big list of supported hw by OpenWRT here. Also you can click around, they have listings for other mfgs.
That’s weird; the “firmware backdoor” thing ought to have incentivized you to go for OpenWRT even more, not scared you off. OpenWRT is the solution to untrustworthy manufacturer-provided firmware!
This is great thank you
I’m setting up a self hosted Nextcloud and now I’m realizing I should probably do this while I’m at it.
When you say supported router do you mean one that supports OpenWRT?
Yes
And you should set up your home router first IMO. OpenWRT makes it easy to set up VPN, guest network, per-device controls, even NAS (internet-facing or purely LAN)
I had Claude help me with configuration, troubleshooting and optimization – highly recommend.
Once your home network is relatively secure you will have a solid base for additional services
Ok cool. So if I understand, the isp router is used as a modem, so instead of devices connecting to the isp modem/router, the new router sits between the connection so the isp modem/router goes to the new router, which connects to devices?
So the main cable goes into the isp router on LAN4, I connect from WAN to my new router, and I assume I also need to swap the cable that goes from the isp router to my ethernet junction from the isp router to my new one, so ethernet also goes through the new one?
Correct. The box your ISP gives you almost certainly has both a modem and a wifi router. You put this box in “bridge” mode, which means it’s only serving as a modem/pipe connector. It just hands all the traffic over to your OpenWRT router.
Internet <->Modem(bridge)<->wifi router(OpenWRT)
People who never handled phone tech support calls have entered the chat.
Probably you can just go to the local second hand store, see if they have a router that’s supported by the software packages openwrt or freshtomato and pick that up.
Install your custom firmware on your new router and away you go!
The main factor for being able to do a drop in replacement is if you get any other service from your isp like tv or phone. If you do, and the boxes for those plug into the extant router you will probably need to call them and get someone to set that up.
Otherwise it’s drop in.
You can verify it’s a drop in by plugging your computer directly into the wire your routers wan port is using. Don’t do this for very long. Make sure you call the isp and return their router, they’re likely renting it to you and might get three dollars off your bill.
Ok, looks like my isp router doesn’t have bridge mode but using DMZ apparently works. Honestly it’s the basics that I’m not getting. The setup seems pretty general, I guess I have to keep my isp router as a modem and connect the new router to the WAN on the isp modem/router. That makes sens but there’s another wire from the isp modem/router that goes to an ethernet box. Wouldn’t that bypass my new router? Would I have to swap the ethernet wire to the new one?
What kind of service do you have? Possible answers are cable, dsl and fiber.
What services do you get from your isp? Possible answers are internet, phone, tv, security and maybe more.
You have a bell home hub 3000, but you said you also have an Ethernet box. What is that? Does it have a model number?
Fiber and only internet service. I’m not sure if ethernet box is the right term. The ethernet cable goes from the modem through the walls to the other side of the house. The end of that cable is connected to a D-Link box that has 6 more connections for multiple devices.
It doesn’t have to be the right term. When you get a chance post the model number of that d-link box. It’s probably either a switch or hub.
Okay, so your fiber service comes into the house, then to your ISPs media converter (fiber box), then to your bell home hub router using an Ethernet wire from the fiber box and a d-link thingy is in there somewhere.
What you want is fiber box -> new router wan port and d-link -> new router lan port
DGS-108, it’s a switch. It’s just so I can wire in without having to run cables all the way to the router/modem.
Okay. Plug your new routers wan port into the Ethernet from the isp fiber box, plug your new routers lan port to the Ethernet wire that goes to your d-link, unplug power from your bell home box and it ought to work. You may need to factory reset your new router.
You’re doing a good job helping, TrollAccount69! No notes.
Bridge mode would be something you would have to talk to your ISP about more than likely. The router from your ISP is also the modem so the ethernet reaching out to the WAN needs to go to the ISP modem, than the ethernet coming out of the modem going to your LAN needs to go to your firewall.
The thing is, your typical router from isp is not only a router, it is also a modem, a firewall, and an access point. The modem part is most problematic, you usually can’t replace isp modem. Which means in most cases your isp router device has to stay (even if you use it only as amodem). Then you can of course place your own device between the isp router and your home network. It should be at least a router and a firewall. A good choice is openWRT as other people mentioned. You can flash it on supported routers. Or, you can buy cheap old office computers (there are models with more then one NICs) and run openWRT on that. It’s Linux after all. You can add a wifi pcie card or use another device as access point. Another option is something like OPNsense, which is firewall first. Disadvantage is that it is openBSD (not Linux) and support for wifi is not good so with it, you probably need an extra ap.
Yeah I hadn’t realized this. I was hoping I could just swap out a new router for the current isp unit. It’s beginning to make sense though, I just have to turn the Bell modem/router to act as just a modem. Gonna take some time and research more into it before I make any decisions. Thanks for taking the time.
Good thing is that you can just connect your custom router to the isp router and create a subnet with which you can experiment until you are confident and then you just switch your devices to the subnet (or multiple subnets).
Oh cool, so I could just connect the WAN without changing anything on the isp modem/router and the new router would be it’s own subnet network, kind of like a guest network? Then when things look good I could just switch the isp modem/router to ‘bridge’ or DMZ settings and shunt everything through the new one?
The wan being the connection from the isp router. But yes. You likely won’t get rid of isp router, but if you create your own subnet(s) and the only device connected to your isp router would be your router, everything would be safe (firewalled) from everything on the outer network (and of course internet).
not trying to nitpick but opnsense is freebsd
Yes, true, i was probably still stuck on the open sense in my mind. Thanks for the correction!
When I went searching out options like you I found many things and I was sure I was going to want to use OPNsense, it was what I felt the most used by youtube people and I thought it was a fork of a proprietary pfsense. When I did a little more research I found out why OPNsense was used by so many Youtubers, OPNsense is proprietary-ish software for certain firewalls. The next thing I found was openWRT, once I found it I went searching for the best hardware for it and found the Flint 2. After I got that I flashed it with a vanialla install of openWRT.
My original plan was to self-host an email server, so I had gotten 2 static IP addresses. They were free so why not I thought. Turns out hosting your own email server is not that easy, so I went to the company hosting my domain. This is all besides the point.
After getting my static IPs and my Flint 2 setup (I did it backwards you should really have a firewall before the static IP it was not to far apart but it would have been easier to do it the right way), I could do things I could only dream of in the past. I could have a VPN into my LAN (using wireguard) so when I was out and about I can still use my pihole setup to block trackers, ads, and some spying eyes. I have vLANs galore and if it does not need to be attached to the internet it is not, or it is in my IoT vLAN that does not have WAN access.
In short do not think it is simple, it is not. The ISP router does so much more than routing it is also a sad excuse of a firewall and it is a modem.
The Flint 2 with openwrt is amazing. I second it.
