Naughty ISP

Morpheus77 · 15 Jan 2013 at 12:20

OK so my ISP is upgrading their ADSL service to VSDL and supplying all subscribers with a VDSL router. Up to there no probs.

The issue is the new router will be pre-configured, the ISP will retain the administrator account and the subscriber will just have a user account on it, only capable of setting up wifi and a few other settings, but not much else.

I don't like the result of that, which is they are basically inside my LAN!

I guess a solution would be, rather than set up my wifi using their router and using the ethernet ports on it, to plant my own firewall in between their router and the rest of my LAN.

Any suggestions?

bremen1874 · 15 Jan 2013 at 12:37

Yes, you could add another router as you describe. The only downside would be double NATing which could cause problems with some applications.

Presumably you have to use the provided router?

ChrisD. · 15 Jan 2013 at 12:49

Which ISP?

Morpheus77 · 15 Jan 2013 at 13:16

Gibtelecom

CaNsA · 15 Jan 2013 at 13:17

Use your own modem, spoof the mac address?

Would that work?

Morpheus77 · 15 Jan 2013 at 15:43

bremen1874 said:
Yes, you could add another router as you describe. The only downside would be double NATing which could cause problems with some applications.

Presumably you have to use the provided router?

Yup I have to use the supplied router. The worst thing for me is the account you get into it doesn't allow you to change the SSID of your WiFi, or even hide it, so at this point I am quite intent to just disable WiFi (which is allowed) and set up my own WiFi on a separate device.

Morpheus77 · 15 Jan 2013 at 15:46

Does anyone know any particular WiFi capable firewalls/routers I could buy for this purpose? Something affordable of course.

Edit: Would something like this work? http://www.cisco.com/en/US/prod/collateral/routers/ps9923/ps10852/DS_C78-590161-00.html

bremen1874 · 15 Jan 2013 at 16:44

Morpheus77 said:
Edit: Would something like this work? http://www.cisco.com/en/US/prod/collateral/routers/ps9923/ps10852/DS_C78-590161-00.html

It has the necessary ports so it should do.

You just need to make sure any secondary router is configured to use a different subnet to the first. Connect the WAN port to the existing router and let it pick up it's IP by DHCP.

PistolPete · 15 Jan 2013 at 21:16

Morpheus77 said:
I don't like the result of that, which is they are basically inside my LAN!

How do you figure that?

It's no different to having a managed service that 90% of companies here in the UK have - the Telco/ISP keeps control of the border router onto their network and can access the WAN side and you configure the LAN side.

I think you are over worrying / over complicating this.

Steveocee · 15 Jan 2013 at 22:07

Really shouldn't be an issue unless there is some weird config you currently have that is the only way your setup will work?

Locky · 15 Jan 2013 at 22:22

Doesn't sound much different to the way BT run things with locked down hardware

Steveocee · 16 Jan 2013 at 08:06

If your only query is the wireless then you are doing the correct thing by turning off the router built in wifi and then adding a wireless AP in.

Relax anbd enjoy a managed router service (plus if it goes wrong its not your job to fix it)

Morpheus77 · 17 Jan 2013 at 15:20

If they manage the router it means they can get into it and see what devices are connected. Whether I have an Apple phone or a Samsung phone on my WiFi, whether I have any shared folders that aren't password protected, whether I have set up a little intranet page, etc.

I am not saying they will, I am saying they can, why should they be able to? They are an Internet provider, they have no business inside my LAN.

Steveocee · 17 Jan 2013 at 16:31

Morpheus77 said:
If they manage the router it means they can get into it and see what devices are connected. Whether I have an Apple phone or a Samsung phone on my WiFi, whether I have any shared folders that aren't password protected, whether I have set up a little intranet page, etc.

I am not saying they will, I am saying they can, why should they be able to? They are an Internet provider, they have no business inside my LAN.

They could remote into the router, they may be able to see what phone you have if the device name is set up to show the name of the device (also if the router supports a client list like this)
I wouldn't have thought they would be able to access shared folders on your LAN by simply accessing the router.

PistolPete · 18 Jan 2013 at 00:40

Morpheus77 said:
If they manage the router it means they can get into it and see what devices are connected. Whether I have an Apple phone or a Samsung phone on my WiFi, whether I have any shared folders that aren't password protected, whether I have set up a little intranet page, etc.

I am not saying they will, I am saying they can, why should they be able to? They are an Internet provider, they have no business inside my LAN.

So they can see what devices are connected - and what?? Even if you had your own router in they are your ISP and all your WAN traffic goes via them so they could probably see nost of the devices you use if they could be bothered to look at the traffic. And how would they be able to see and intranet page or any SMB shares from the router??

Morpheus77 · 18 Jan 2013 at 08:32

PistolPete said:
And how would they be able to see and intranet page or any SMB shares from the router??

Let's put it this way, if you wanted your intranet page to be served to the outside, where would you configure that?

They could see the actual page/shares from their computer after tinkering with the router, and it's up to me to check my logs regularly, etc. to see whether someone has done that.

El_Watcher · 18 Jan 2013 at 12:35

Steveocee said:
I wouldn't have thought they would be able to access shared folders on your LAN by simply accessing the router.

I think in theory they could, by adding a port forward to allow something like Remote Desktop, so they could then remote into his PC, but the chances of this being likely are minimal. I think they probably have better things to do.

Rroff · 18 Jan 2013 at 12:40

Noticed a lot of ISPs doing it with VDSL

starting to annoy me - the modems BT use for infinity are locked down tho the provided router (I use my own) isn't in the same way yours is.

First thing I did was slap an Asus n66u in place of the ISP provided router tho still need to use the VDSL modem :|

Gammawolf · 18 Jan 2013 at 13:40

Rroff said:
Noticed a lot of ISPs doing it with VDSL starting to annoy me - the modems BT use for infinity are locked down tho the provided router (I use my own) isn't in the same way yours is.

First thing I did was slap an Asus n66u in place of the ISP provided router tho still need to use the VDSL modem :|

You always need a modem for any xDSL product otherwise you can't make a connection. BT openreach provide a locked down modem which is hackable, or you could just buy your own modem and do whatever, i don't really see where the down side is. You can do what ever you like on a BT vdsl line...

Morpheus77 · 18 Jan 2013 at 14:32

El_Watcher said:
I think in theory they could, by adding a port forward to allow something like Remote Desktop, so they could then remote into his PC, but the chances of this being likely are minimal. I think they probably have better things to do.

And I have better things to do than trespassing into your house, but you still wouldn't give me a key.