Self Hosting for Privacy - Importance of Owning your own Modem/Router?

Submitted ⁨⁨2⁩ ⁨weeks⁩ ago⁩ by ⁨bmebenji@lemmy.blahaj.zone⁩ to ⁨selfhosted@lemmy.world⁩

Hi there, I’m looking to get into self-hosting for privacy reasons and I wanted to ask y’all: how inadvisable is it to utilize an ISP-owned router/modem? I feel like they’re able to track everything I do online with their more than likely integrated spyware.

source

Comments

Sort:hotnew top

IsoKiero@sopuli.xyz ⁨2⁩ ⁨weeks⁩ ago
ISP can see your traffic anyways regardless if their router is at your end or not. In here any kind of ‘user behavior monitoring’ or whatever they call it is illegal, but the routers ISPs generally give out are as cheap as you can get so they are generally not too reliable and they tend to have pretty limited features.

Also, depending on ISP, they might roll out updates on your device which may or may not reset the configuration. That’s usually (at least around here) made with ISPs account on the router and if you disable/remove that their automation can’t access your router anymore.

So, as a rule of thumb, your own router is likely better for any kind of self hosting or other tinkering, but there’s exceptions too.

source
- Cobrachicken@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  Honest answer, why tf would s/o vote this down?
  
  source
  - irmadlad@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    I’ve often wondered about down votes as well. It’s not the points, as I care nothing about that. However, if you’re going to down vote something, have the balls to explain why. Maybe the down voter knows something that we all can learn from. It just seems like a common courtesy to do so.
    
    source
    -> View More Comments
- Bazoogle@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  The ISP wouldn’t see your self hosted traffic. Not to mention many people don’t encrypt it if it’s on their own local network. And ISP tracking is becoming less successful with QUIC, Encrypted Client Hello, and DNS over HTTPS or DNS over TLS.
  
  source
  - IsoKiero@sopuli.xyz ⁨2⁩ ⁨weeks⁩ ago
    ISP obviously don’t see the traffic inside your own network, regardless of the router used. But as soon as you open any kind of connection over the internet, incoming or outgoing, your ISP has to have some information about it to route the traffic. DNS over TLS doesn’t hide that your browser opens connections to servers, they can see if you use wireguard to access your services (not which ones, just in general that there’s traffic coming and going) and even if you use VPN for everything they can still see the encrypted VPN traffic and, at least technically, apply pattern recognitions on that to figure out what you’re doing. And if you use VPN then your VPN provider can do the same than your last-mile internet provider, so you’ll just move the goal by doing that.
    
    Last-mile ISP is going to be a middleman on your network usage no matter what you use and they’ll always have at least some information about your usage patterns.
    
    source
- hornedfiend@piefed.social ⁨2⁩ ⁨weeks⁩ ago
  This is the sensible comment.
  
  source
ultranaut@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Regardless of whether your ISP is leveraging their ownership of your router to violate your privacy, they are using it to exploit you financially. Owning your own equipment is always going to save you money compared to what an ISP will charge you in rent.

source
- chisel@piefed.social ⁨2⁩ ⁨weeks⁩ ago
  Well, AT&T for example requires that you use their provided modem+router combo, which they provide for free (unless you include their plans being generally more expensive than their competitors as an extra fee). They do try to sell you on range extenders for, what I assume to be, the shit router they give you.
  
  Their router gives you less control than you’d get with your own router, helps with lock-in because it makes it harder to change providers, and allows AT&T full root access to your network, so I wouldn’t recommend it for self-hosters. However, it is the cheapest option since you’re requited to use it anyway. Besides, of course, using a different ISP, which saves me tooons of money over AT&T.
  
  source
  - BromSwolligans@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    AT&T fiber does allow IP passthrough mode though so if you want to run your own hardware you can.
    
    source
    -> View More Comments
haroldfinch@feddit.nl ⁨2⁩ ⁨weeks⁩ ago
Recently, a major ISP in the Netherlands was determined to be streaming metadata from within their customer’s networks to Lifemote, a Turkish AI company.

Here’s a report in Dutch: tweakers.net/…/odido-router-stuurde-analyticsdata…

This is just the latest one to get caught doing it, but determine how comfortable you are having your internal network exposed to a 3rd party.

I’ve used personal/non-ISP modems and routers for 25 years because I’m not comfortable with it it. At all… But hey, you do you.

source
- SirHaxalot@nord.pub ⁨2⁩ ⁨weeks⁩ ago
  While I would say sending MAC Addresses and Wi-Fi names is very far from tracking everything you do on the internet, this highlight another very important point: The routers that provided by ISPs are usually very cheap and crappy, and this in itself security implications.
  
  Like this example of pulling a script from an unverified HTTP source and executing it as root 🤯.. Not to mention that firewalling and port forward configuration options may be pretty simplified and limited.
  
  source
Semi_Hemi_Demigod@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
This is why I got a mini PC with five Ethernet ports and configured it as a router/pihole.

Everything goes through a WireGuard VPN, and I have DNS that’s private.

And I know it’s secure because I wrote the iptables myself.

source
mko@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago
I router provided by an ISP is not your hardware, thus any network behind it is by definition not controlled by you. There have been numerous cases where they have backdoors or known admin passwords. In cases where there is a wire type transition (for example incoming over coax or fiber) it might be necessary to use it though. Same if it is necessary due to your contract.

In my cases I always turn off the wireless antennas and switch it to bridge more, then place my own router/firewall device behind it.

source
- partofthevoice@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
  As I’ve grown older, I’ve realized that I care a lot less about whether I own the device or the ISP. I’ll happily root the fucking thing. What are they going to do, send me to a competitor? I have 3 different networks I can connect from at any moment (including hotspots), so I’m not worried about a minor lapse due to ISP temper tantrums.
  
  source
  - mko@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago
    We all go our own ways. Over the later years I’ve added features and with it the inevitable complexity. Self-hosting my own data has made my care more about what goes on in my network. I am not quite at the stage of adding VLAN’s but it will probably come.
    
    source
irmadlad@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Owning your own modem/router gives you full access to security features. It gives you opportunity to install custom firmware. If you can spring for the $$, I think it would be advisable. That way, the only thing you need from your ISP is the cable/delivery device piping internet into your house.

source
versionc@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
I would get a router that supports an open source firmware or operating system like OpenWRT. Which one depends entirely on your use case. Getting a router from your ISP is fine if you’re allowed to and capable of flashing it, and if you trust them (I’m lucky that I have an ISP with a track recoding of fighting for their users’ privacy and integrity).

source
- melfie@lemy.lol ⁨2⁩ ⁨weeks⁩ ago
  In addition to not trusting the privacy of stock firmware, OpenWRT provides a lot of useful features for self-hosting like local DNS for your services and a feature-rich firewall to, for example, block devices you don’t trust from phoning home.
  
  source

Decronym@lemmy.decronym.xyz ⁨2⁩ ⁨weeks⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
CGNAT	Carrier-Grade NAT
DNS	Domain Name Service/System
HA	Home Assistant automation software
~	High Availability
HTTP	Hypertext Transfer Protocol, the Web
HTTPS	HTTP over SSL
IP	Internet Protocol
NAS	Network-Attached Storage
NAT	Network Address Translation
PiHole	Network-wide ad-blocker (DNS sinkhole)
RPi	Raspberry Pi brand of SBC
SBC	Single-Board Computer
SSD	Solid State Drive mass storage
SSH	Secure Shell for remote terminal access
SSL	Secure Sockets Layer, for transparent encryption
TLS	Transport Layer Security, supersedes SSL
VPN	Virtual Private Network

[Thread #172 for this comm, first seen 16th Mar 2026, 17:50] [FAQ] [Full list] [Contact] [Source code]

source

hendrik@palaver.p3x.de ⁨2⁩ ⁨weeks⁩ ago
Even if you control your router/modem, they still control the other end, it connects to. So i think it depends a bit where you’re going with this. If you’re worried about them doing packet inspection, or logging IP numbers you connect to, I don’t think there’s a big difference. They could do it anywhere.

A router interfaces with your local network, though. So in theory a router can be used to connect to your internal devices and computers and maybe they have an open network share without password protection or something like that. But we’re talking violating your constitutional rights here. It’s highly illegal in most jurisdictions to enter your home and go through your stuff.

I’ll buy my own router because I can then configure it to my liking. And my ISP charges way too much for renting one. And what I also do is not use my ISP’s DNS service. That’d just send every domain name I open to their logfiles. Instead I use one from OpenNIC

source
- irmadlad@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  
  Instead I use one from OpenNIC
  
  Fast? How would it compare to the evil Cloudflare?
  
  source
  - hendrik@palaver.p3x.de ⁨2⁩ ⁨weeks⁩ ago
    I did one DNS query and it took 22 msec with the nearest OpenNIC server and 24 msec with Cloudflare’s 1.1.1.1 So dunno… roughly same responsiveness? For a proper answer we’d need to do more measurements, though.
    
    source
    -> View More Comments
Nighed@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
Depends entirely on the ISP

source
SirHaxalot@nord.pub ⁨2⁩ ⁨weeks⁩ ago
It’s extremely unlikely that they are going to do any kind of deep traffic inspection in the router/modem itself. Inspecting network traffic is very intensive though and gives very little value since almost all traffic is encrypted/HTTPS today, with all major browsers even showing scare warnings if’s regular unencrypted HTTP. Potentially they could track DNS queries, but you can mitigate this with DNS over TLS or DNS over HTTPS (For best privacy I would recommend Mullvad: https://mullvad.net/en/help/dns-over-https-and-dns-over-tls)

And of course, make sure that anything you are self-hosting is encrypted and using proper HTTPS certificates. I would recommend setting up a reverse proxy like Nginx or Traefik that you expose. Then you can route to different internal services over the same port based on hostname. Also make sure you have a good certificate from Letsencrypt

source
- comrade_twisty@feddit.org ⁨2⁩ ⁨weeks⁩ ago
  Many German providers have hardcoded DNS servers in their rental routers though and they block everything from torrent directories to iptv sites.
  
  source
  - Ooops@feddit.org ⁨2⁩ ⁨weeks⁩ ago
    The only thing they can realistically harcode is the DNS server their router’s DHCP provides.
    
    Just configure devices to not use that setting, also use DoH or DoT (which you should do anyway, not just to circumvent your router’s settings).
    
    source
    -> View More Comments
cenzorrll@piefed.ca ⁨2⁩ ⁨weeks⁩ ago
You’re ISP probably provides some overpriced really crap hardware that they probably have a back door to, that I’m also not about to screw around with. I’ve always had a router behind their modem/router combo for many reasons, the first being that I have had a 100 ft Ethernet cable since 2005 that let’s me put my router where I want, I can place my wifi where it works best, not just within 6-10 feet of wherever someone 20 years ago decided to drill a hole. Second is because a ddwrt router is so much better than anything you’ll get from your provider, and you can find pretty good compatible ones on eBay or at your local thrift store for cheap.

I’ve always begrudgingly purchased rather than rented from my provider because after a year or so it is usually paid for. So far I’ve purchased four modems over almost 20 years so it’s worked out for me. As for the device itself, I don’t trust it, but I’ll still set some firewall rules just because. I have my router behind it where I do the real stuff. If I’m ever given a device that I need to connect for some sort of monitoring, like my solar panels or something like that, it can connect to my ISPs crap and do whatever sketchy shit it’s gonna do.

source
- scrubbles@poptalk.scrubbles.tech ⁨2⁩ ⁨weeks⁩ ago
  Each of these points makes it worth it. Price is always overlooked. Renting is same as a subscription. If you buy your modem it’s more expensive, but at the end you still have a modem. Renting at the end you have nothing.
  
  source
cmnybo@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago
Most ISPs have remote access to their modems. You should use your own if possible. If you can’t, then put it in bridge mode and connect your own router to it.

source
- i_am_not_a_robot@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago
  In the US, most IPSs have remote access to your modem as well, even if you purchased it yourself from a store unaffiliated with your ISP.
  
  source
imetators@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
Router provided by my ISP is just garbage. The settings are so scrace, I might as well just connect my PC directly (if I could, cause cable is DOCSIS). Had to buy 10yo DOCSIS router that actually is usable.

If your router is fine in settings, maybe changing it won’t be necessary. As for ISP spying on you - probably possible but certainly is not likely.

source
- speculate7383@lemmy.today ⁨2⁩ ⁨weeks⁩ ago
  
  Had to buy 10yo DOCSIS router that actually is usable
  
  Alternatively, you don’t have to be restricted to a 10-year-old router just because of DOCSIS.
  
  You could change the router to bridge mode , effectively making it just an external modem for any ethernet-to-ethernet router of your choosing.
  
  source
  - imetators@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
    The router that comes with my ISP contract is garbo and I highly doubt it has bridge function. With my used 60euro worth fritzbox, I keep the customization options and reliability. It has been 1.5 years and it hasnt failed me a single time while the other constantly had issues with stuff connecting to it.
    
    source
Alvaro@lemmy.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
It’s pretty simple if you don’t own the router you don’t own the Wi-Fi. You can treat your home Wi-Fi a little bit like a public Wi-Fi and just make sure all of your devices are secure using encrypted DNS and encrypted traffic and overall not open on any unsecured ports and you should be fine.

source
- Ooops@feddit.org ⁨2⁩ ⁨weeks⁩ ago
  
  make sure all of your devices are secure using encrypted DNS and encrypted traffic
  
  Which is so easy it really should be the default nowadays yet sadly isn’t.
  
  source
magic_smoke@lemmy.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
Your router is an important security device that you should own and control your self if you want any semblence of ownership over your network.

Your modem is remotely controlled by the ISP even if you own it, and is mostly there to demodulate from the medium installed by your ISP (usually cable, or fiber but those are called ont’s not modems) to a standard cat. 6 Ethernet connection you can plug into most routers.

The main benefit of owning your own modem is not having one with a router built in and not having to pay an equipment fee.

source
MuttMutt@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Most ISP’s in the US are always looking for a government handout. When the government decides to tie that handout with a backdoor attached you will never know about it. If they control the router you don’t get a choice.

Not to mention they buy the cheapest POS they can get to do the job. Then when the wifi sucks they will rent you some mesh nodes. And you can only hope they update them if there is a flaw.

I run OpnSense and have for about 10 years now. I’ve considered using a gPON sfp module so I can get rid of the ONT.

source
glitching@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
I’ve gave up on mine for a non-privacy related reason: they often reboot the thing remotely, for updating or whatnot. not a big deal per se, the problem - my local network stops working, and that I will not abide. so once I stopped using it, the rest (pihole, unbond, etc) came on its own and now I’m not going back.

source
devtoolkit_api@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago
Owning your own router is important, but I would prioritize it differently depending on your threat model:

High priority (do first):

Use your own router running OpenWrt or pfSense — ISP routers often have remote management backdoors

DNS-level privacy (Pi-hole + encrypted DNS upstream)

VPN on the router level for devices that cannot run their own

Medium priority:

Your own modem matters less for privacy and more for reliability/speed. ISP modems work fine for most people.

The bigger privacy win is what runs BEHIND the modem: your DNS, firewall rules, and network segmentation.

The real wins for self-hosting privacy:

Self-host your DNS (Pi-hole/AdGuard Home)

Self-host your email (hard but high impact)

Self-host your dev/productivity tools so sensitive data never hits third-party servers

Use E2EE messaging (Matrix/XMPP self-hosted)

Start with the router and DNS — those are the highest ROI changes.
source
Treczoks@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
When there were ISP-owned routers, I just set a private router on the inside. As long as their box does their job, mine did work for me.

source