Network Security

The Router Your ISP Gave You — Who Actually Controls It

The box your ISP installed combines modem, router, and Wi-Fi access point — and your ISP can often access it remotely without telling you. Here's what that means and what to do about it.

By AdsBlocks Team·October 16, 2026

The Router Your ISP Gave You — Who Actually Controls It

The Box in the Corner

When your internet provider installs service, they leave a box — sometimes one device, sometimes two. It blinks quietly and you forget about it. But that box is a computer running software, connected to both your home network and the internet, and in most cases your ISP maintains administrative access to it.

Understanding this arrangement matters for your home network security.

What Your ISP Can Do With Remote Access

ISPs maintain remote access to their equipment primarily for legitimate purposes:

Diagnosing connectivity problems without a service call

Pushing firmware updates automatically

Rebooting the device remotely when it becomes unresponsive

Reconfiguring settings when your service plan changes

What this access actually means in practice:

They can see the DNS queries made from your router (which sites all devices in your home visit)

They can see the MAC addresses and hostnames of every device connected to your network

They can push software updates that change how the device behaves

In many cases, they can change your Wi-Fi password, DNS settings, or firewall configuration

The Security Implications

The ISP's remote access is generally well-secured. But "well-secured" introduces its own considerations:

If the ISP's management systems are breached, the attacker potentially has access to millions of home routers simultaneously

The ISP themselves is not a neutral party — they are an advertising company (in the case of many major US ISPs) that benefits from seeing your traffic patterns

Law enforcement can access this data through subpoena with varying degrees of notification to you

What You Can Do About It

Use a Personal Router Behind the ISP Device

This is the most practical approach. Place your own router — a Netgear, ASUS, or a device running DD-WRT, OpenWRT, or pfSense — between the ISP box and your devices.

Set the ISP box to "bridge mode" or "DMZ mode" so it passes traffic through to your router without acting as a firewall or NAT device. Your router is then the one managing your home network, and the ISP box handles only the internet connection.

Your router is entirely under your control. You can:

Choose your DNS provider (Cloudflare, NextDNS, your own)

Set up your own firewall rules

Configure VPN at the router level to encrypt all outgoing traffic

Segment your network into separate VLANs for IoT, trusted devices, and guests

At Minimum: Change the Default Admin Credentials

If you're using the ISP's device directly, log into the admin interface and change the default admin password. Default credentials are widely published and your ISP's router is a known attack target.

Enable DNS over HTTPS

If your ISP device supports it, or if you're using your own router, enable DNS over HTTPS (DoH) or DNS over TLS (DoT). This encrypts your DNS queries so they can't be read by anyone in the middle — including your ISP.

ISP DNS: What They Can See Without Remote Access

Even without accessing the router itself, your ISP can see every DNS query from any device on your network that uses their default DNS servers. DNS queries reveal which websites you visit, which apps you use, and roughly when you're home and active.

Switching to a privacy-focused DNS provider (Cloudflare 1.1.1.1, Quad9, or NextDNS) removes this visibility. Do this in your router settings so it applies to every device on your network.

Bottom Line

The ISP router is their equipment under their control. For better network security and privacy, use your own router in bridge mode with a privacy-focused DNS provider. At minimum, change the default admin credentials and understand that your ISP has visibility into your DNS traffic.

Protect Yourself Today

The #1-rated antivirus covers all the threats mentioned in this article.

Get TotalAV — $1.99/month →