Most diagrams I come across are as follows:

ISP > router > firewall

However, wouldn't you want a firewall before the router to protect the router? E.g ISP > firewall > router


The reason the router is in front of the firewall is that in many/most networks, the transmission media between the ISP and the customer is not supported by the firewall, so a router is necessary.

More recently, many carriers provide a Ethernet handoff to their customers, so having a router in front of the Firewall is not always necessary.


With the rise in everything-is-ethernet, it is increasingly common for the ISP hand off to go directly to a firewall.

However, depending on your networking needs and firewall capabilities, a router may be needed / desired to handle typical "routing" loads -- routing protocols, QoS, rate limits, multi-protocol support (eg. DHCPv6, PPP, VLANs), link authentication (802.1x, MACSec, etc.)

In my office, there are two ISPs (with their associated devices) going directly into my group of firewalls. One handles multi-homing perfectly, the other not so well, and the third is only connected to one ISP. On multiple occasions, I've used the ISP router to filter traffic before reaching the firewalls.

(If I were multi-homed using my own address space, I would have to use a head-end router because none of my firewalls can run BGP.)

  • You can often put the BGP speaker behind the firewall. – Ron Trunk May 28 '20 at 1:54
  • So does this mean if I went ISP > Router (ISP's router) > Firewall, I wouldn't need another router after it, I could go straight to the switch? Or would you put another router, e.g. ISP > Router (ISP's router) > Firewall > Router (mine) > Switch – The_Bear Jun 23 '20 at 16:51
  • Depends on your internal networking needs. If you have a simple, flat network, then a router isn't needed. If you have a more complex, segmented internal network, you'll most likely want a dedicated router -- firewalls make poor routers. – Ricky Jun 24 '20 at 0:35

Note: this apply mostly to small networks. In big company this is a bit more complex.

You are mostly right but it depends on which router we are talking about.

In some corporate settings (common in Europe, not so in US) the ISP place its own router on site. This is the CPE - Customer-premises equipment

So the business firewall is connected directly behind the CPE, which is usually (but not always) a router, then you can have one or several routers behind this firewall.

Note also that very often the firewall is a function on the main router(s).

  • 1
    An ISP-owned CPE may be common in Europe, but no so much in the US. – Ron Trunk May 27 '20 at 12:34
  • It is indeed common here, but I will edit to replace the "most" – JFL May 27 '20 at 13:15
  • So would I be wrong placing the firewall where I have currently placed it? – The_Bear May 27 '20 at 14:50
  • It will be fine if the router is yours – Ron Trunk May 27 '20 at 17:46
  • Having worked for / with many US ISPs, there's almost always a CPE -- NID, smartjack, etc. for the ISP to test to. The only occasional difference is where this "CPE" sits. (eg. is it in the customer space.) On paper, it's a matter of managed service, or not. DSL, cable, PON will almost always involve some form of ISP modem/router combo, even if you don't use the router part. IME, it's rare to receive service as a pure drop / outlet. – Ricky May 28 '20 at 0:07

ISP (CPE) > firewall > router > LAN

As Ron has pointed out, the firewall may not support the WAN link protocol or authentication scheme. Also, if "router" implies SNAT, the firewall doesn't see specific user IPs, just the public IP (pool) which practically defies logging.

ISP (CPE) > router > firewall > LAN

Now the firewall can distinguish end users accessing the Internet, log properly and use granular policies.

  • Why would you NAT before the FW? (eons ago, the former was a way around Cisco's per-user licensing as it counted users by mac; today it's per xlate, so pre-NAT'ing might get around it.) So, if you aren't doing something dumb with NAT, it doesn't matter which side hosts the router. – Ricky May 28 '20 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.