Let's assume the ISP is malicious. They have remote access to their own gateway/router. No way to remove that remote access. But ISP allows using a different gateway/router. Security-wise, what is safest between:

  1. Replacing the ISP-provided gateway/router (untrusted) by a trusted gateway/router.
  2. Keeping the untrusted ISP-provided gateway/router, used only as a modem (bridge mode) and placing a trusted router behind it

I can see arguments for saying both solutions are equally secure, but I might be overlooking something.

  • Keep in mind that the ISP has access to the next router anyway, the one your router is connected to. Does it matter whether the next router past the one you bought is a malicious router in the phone exchange, or a malicious router at your house? (assuming it's not so malicious that it snoops on wifi or emits death beams) Commented Mar 3, 2021 at 10:25
  • I see. I was wondering if there could be special about the modem, and whether there was increased security risk in using their modem rather than replacing with mine. It seems from your comment that it's not the case. Thanks
    – DevShark
    Commented Mar 3, 2021 at 11:05
  • I just remembered that questions about home networking are off-topic on this site. Commented Mar 3, 2021 at 11:20
  • It’s ok it’s for small business
    – DevShark
    Commented Mar 3, 2021 at 11:23

2 Answers 2


Short answer: Get another ISP.

Of course, you shouldn't trust your ISP with granting them uncontrolled access to your business network in any case, but that may depend on your security requirements. Usually, you put your own router/firewall between your ISP's router and your network. Whether the ISP's CPE is in routed mode, bridged mode or even present at all doesn't really matter securitywise (it does matter for functionality, performance and management though).

While your ISP is always located in between your network and any other service you use on the Internet (whether you use their router or not), as long as your communication is properly encrypted (TLS, IPsec) they can't do anything more than disrupt your traffic.

However, connecting the ISP router to your network directly requires a high level of trust. Direct connection enables access to non-public services, manipulations on the data link layer and potentially a large array of snooping and spoofing techniques. You should decide on this level of service (see IaaS, SECaaS) very consciously, do not take it lightly.

In any case, you might want to set up secure DNS (DNSSEC) if you don't trust your ISP with insecure DNS. Note that protocols above the transport layer are explicitly off-topic here, so you might want to ask about this on Server Fault.

  • Well, the point is for me to not trust any ISP. I am trying to get the internal network as secure as possible.
    – DevShark
    Commented Mar 3, 2021 at 10:54
  • "as secure as possible" mandates your own router and firewall. Whether you use ISP hardware in bridge mode or not doesn't matter security-wise. It might matter for functionality, performance or reliability though.
    – Zac67
    Commented Mar 3, 2021 at 10:57
  • That makes sense, I will definitely use my own router and firewall. I just want to make sure I fully understand your second sentence. Did you mean : 1) "It does not affect security which option I choose between A) using ISP hardware in bridge mode and B) Not using ISP hardware" or 2) "It does not affect security which option I choose between A) using ISP hardware in bridge mode B) using ISP hardware in non bridge mode" ?
    – DevShark
    Commented Mar 3, 2021 at 11:02
  • Yes, should read "whether you use ISP hardware in routing mode, in bridge mode or at all doesn't matter".
    – Zac67
    Commented Mar 3, 2021 at 11:04
  • I see. You are basically saying the only thing that matters is for me to put my own router behind the ISP's hardware. As long as I do that, it does not matter how I use the ISP's hardware. Correct?
    – DevShark
    Commented Mar 3, 2021 at 11:06

Theoretically you should be able to pass data right through the ISP's router if it were set in bridge mode and you were operating your own network address translation. But, a compromised bridged modem is conveniently situated between your private intranet and the World Wide Web. This is a perfect spot to either capture your data packets, or spoof their/somebody's data packets as if they were originating from your network. Bedside's the fact that the bridged equipment should technically be incapable performing the tasks that compromise you as a client, I've seen intuitive network engineers harness tons of aftermarket features that allow it to perform more like enterprise grade telco equipment from stock or generic equipment they lease to you. Likewise, the low probability that your ISP is reluctant enough to allow themselves to be put in a state of illegality -- you are going to have a difficult time auditing how data is actually being routed because the network path is beyond your accessibility. So therefore its safer that you provide your own modem and router that are safely/sufficiently configured in your customer premise.

Sure, if you were violated at those points of exploitation, these actions by whatever perpetrator (assuming it's your ISP) are illegal.

I knew you would expect the worst, so stay alert. Be proactive and protect your party by preventatively maintaining yourself from having those problems in the first place.

  • Today, nearly everything uses encryption (TLS, IPsec), so a man-in-the-middle-attack should be futile. Connecting a third-party device into your network is a completely different story.
    – Zac67
    Commented Mar 4, 2021 at 7:48
  • @Stereomac thanks for your answer. It differs from the answer above. Can you please give an example of a specific security threat that would be increased by that setup? I felt the other comment’s argument about the ISO having several routers after the one they provide was a good argument to say bridge mode does not decrease security.
    – DevShark
    Commented Mar 4, 2021 at 8:02
  • @stereomac a specific question in addition : why would it be easier to spoof my packets from the briddged modem than from the next ISP router after the modem?
    – DevShark
    Commented Mar 4, 2021 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.