Own Your Router & Flash Custom Firmware
Replaces: ISP-provided router (firmware controlled by ISP), stock router firmware (unmaintained, vulnerable)
Replace your ISP-provided router with one you control, then flash OpenWrt for ongoing security updates.
Sources
Phase
Home Network — router access, 30-90 min
General
Step 1 — Replace ISP router with your own:
1. Buy a router (or a mini PC for OPNsense/pfSense): $50-150 for a consumer router, $150-300 for x86 mini PC
2. Call your ISP and ask to put your modem into "bridge mode" (disables its router/Wi-Fi, passes through to your router). If they don't offer bridge mode, ask for a pure modem (no router)
3. Connect your router to the modem, configure it from scratch
4. You now control: firmware, DNS, Wi-Fi sensing, telemetry, update schedule
If your ISP claims you "must" use their router: in most cases this is false. US ISPs are required to let you use your own equipment. Some ISPs (e.g. fiber providers) may require their ONT, but you can still put it in bridge mode.
Step 2 — Flash custom firmware (optional but recommended):
1. Check if your router is supported: openwrt.org/toh/start
2. Flash OpenWrt (follow device-specific guide carefully — can brick router)
3. Configure: set admin password, disable UPnP/WPS (same as router-hardening), install LuCI web interface
4. Add packages: adblock (DNS blocking), wireguard/VPN, firewall rules, VLAN support
5. Benefits: security updates for years, full control, packages for anything your router hardware can run
OPNsense is the x86 upgrade: runs on dedicated hardware (old PC, mini PC, or purpose-built box). BSD-based, built-in intrusion detection (Suricata), VPN, DNS filtering, VLAN support — replaces consumer router entirely.
Even with your own router, HTTPS doesn't hide DNS queries or traffic metadata from the ISP. Pair with encrypted DNS (DoH) and/or VPN for full protection.
Deployment
Own router (consumer or x86 mini PC) in bridge mode + OpenWrt
Alternatives: OPNsense on x86 mini PC (more powerful, BSD-based, intrusion detection), pfSense (commercial, BSD-based)
Prerequisites
Harden the router you have first — know what settings matter before replacing hardware and flashing firmware.
Related Cards
Research Findings
ISP routers give the ISP firmware-level control over your network. Key surveillance vectors: (1) DNS queries — even with HTTPS, the router sees which domains you resolve. (2) Traffic metadata — timing and volume of connections reveal activity patterns. (3) Wi-Fi sensing — routers can detect human presence, movement, and breathing through walls using Wi-Fi signal reflection. 30M+ US homes already have this capability. Verizon Fios routers ship with human presence detection. Cognitive Systems partners with 160+ ISPs. (4) Cross-product data mining — FTC found ISPs combining data across TV, smart home, search, email to build demographic profiles including race, ethnicity, sexual orientation, political affiliation. (5) Net neutrality repeal (2017) removed restrictions on ISP data collection and throttling. Comcast throttled Netflix to extract payment; Verizon throttled a fire department during the Mendocino wildfire and tried to upsell them. Regulatory protections that once existed are gone. Buying your own router means the ISP controls only the modem, not your network's firmware. Bridge mode passes through the raw connection without the ISP's router layer. Stock router firmware stops getting updates after 2-3 years — OpenWrt provides ongoing security updates. Privacy Guides recommends OpenWrt and OPNsense. Flashing carries bricking risk but is well-documented per device.