Bridge mode or straight replacement?

Question

Let's assume the ISP is malicious. They have remote access to their own gateway/router. No way to remove that remote access. But ISP allows using a different gateway/router. Security-wise, what is safest between:

1. Replacing the ISP-provided gateway/router (untrusted) by a trusted gateway/router.
2. Keeping the untrusted ISP-provided gateway/router, used only as a modem (bridge mode) and placing a trusted router behind it

I can see arguments for saying both solutions are equally secure, but I might be overlooking something.

Answer 1

Short answer: Get another ISP.

Of course, you shouldn't trust your ISP with granting them uncontrolled access to your business network in any case, but that may depend on your security requirements. Usually, you put your own router/firewall between your ISP's router and your network. Whether the ISP's CPE is in routed mode, bridged mode or even present at all doesn't really matter securitywise (it does matter for functionality, performance and management though).

While your ISP is always located in between your network and any other service you use on the Internet (whether you use their router or not), as long as your communication is properly encrypted (TLS, IPsec) they can't do anything more than disrupt your traffic.

However, connecting the ISP router to your network directly requires a high level of trust. Direct connection enables access to non-public services, manipulations on the data link layer and potentially a large array of snooping and spoofing techniques. You should decide on this level of service (see IaaS, SECaaS) very consciously, do not take it lightly.

In any case, you might want to set up secure DNS (DNSSEC) if you don't trust your ISP with insecure DNS. Note that protocols above the transport layer are explicitly off-topic here, so you might want to ask about this on Server Fault.

Answer 2

Theoretically you should be able to pass data right through the ISP's router if it were set in bridge mode and you were operating your own network address translation. But, a compromised bridged modem is conveniently situated between your private intranet and the World Wide Web. This is a perfect spot to either capture your data packets, or spoof their/somebody's data packets as if they were originating from your network. Bedside's the fact that the bridged equipment should technically be incapable performing the tasks that compromise you as a client, I've seen intuitive network engineers harness tons of aftermarket features that allow it to perform more like enterprise grade telco equipment from stock or generic equipment they lease to you. Likewise, the low probability that your ISP is reluctant enough to allow themselves to be put in a state of illegality -- you are going to have a difficult time auditing how data is actually being routed because the network path is beyond your accessibility. So therefore its safer that you provide your own modem and router that are safely/sufficiently configured in your customer premise.

Sure, if you were violated at those points of exploitation, these actions by whatever perpetrator (assuming it's your ISP) are illegal.

I knew you would expect the worst, so stay alert. Be proactive and protect your party by preventatively maintaining yourself from having those problems in the first place.