13 d up · CPU 17% · RAM 44% · Storage 20% All systems operational 99.79% uptime (30 days) View status →
Guides

Your own router behind your provider: what you need to know

With your own router you decide your firewall, your vpn, your network layout and what is reachable from outside. The modem or router from your provider is usually too limited for that. This article explains what to look out for, whoever your provider is. There are separate guides for KPN, Ziggo, Odido and Delta and Freedom.

What kind of connection do you have?

That decides what is possible. With fibre, most providers let you connect your own router straight to the fibre modem or media converter. With cable (coax, such as Ziggo) the provider’s modem stays, but you can often put it in bridge mode so it only passes the signal on. With DSL you need your own modem, or you keep the provider’s modem.

Public IPv4 address or CGNAT?

This is the most important thing to know if you want to make something reachable from outside, such as a server, a vpn or Home Assistant. More and more providers share one IPv4 address between several customers. This is called CGNAT or DS-Lite. You then have no public IPv4 address of your own, and opening ports does not work.

Here is how to check:

  1. Look at the WAN address in your router.
  2. Ask for your public address in your terminal: curl https://geekstation.nl/ip. More commands are at Tools in your terminal.
  3. If the two are the same, you have a public IPv4 address. If they differ, or the WAN address starts with 100.64 up to 100.127, you are behind CGNAT.

With CGNAT, some providers let you request a public address, sometimes for a fee. An alternative is a vpn such as WireGuard or Tailscale, where you do not need to open ports.

IPv6

Almost all Dutch providers give you IPv6. Every device then gets its own public address. That is handy, but it also means your firewall must block incoming traffic, so your devices are not reachable from the internet by default. Check that on your own router. Work out addresses and ranges with the IPv6 Calculator.

Opening ports

  1. Give the device a fixed IP address or a fixed lease.
  2. Create a port forward in your router from the port to that address.
  3. Check from outside, not from your own network: curl https://geekstation.nl/poort/443.

Only open what is really needed, and put anything with a login screen behind a reverse proxy with https. Which port belongs to which service is in the ports cheat sheet.

What can go wrong

  • TV or telephony stops working. With some providers, TV and telephony run over separate networks (VLANs). You have to set those up separately in your own router.
  • No connection after switching. Some providers tie the connection to the MAC address of your device. Restart the modem or fibre modem, or call the provider.
  • Slow connection. Check the MTU. With PPPoE it is often 1492.

Providers change their settings. Treat this article as an explanation, and ask your provider for the current details if in doubt. Want to divide your network afterwards? Read VLAN for your smart home.