Hiding my intranet from my ISP

Question

Supposing I can't get rid of my ISPs router, what options do I have to hide everything behind it? So far I'm still trying to figure out all my options and trying to learn a little bit in the way (I don't have any professional background in the networking department)

1. Another router in between to block the ISP from snooping past it?
2. A hardware firewall?
3. ...? : )

What kind of technology/configuration would I need on the chosen solution? Since I don't have any prof. background, It's a little harder to know how to search the solution, that being said, any "slang" or technology name helps me search a little bit about it!

Thanks!

Answer 1

I agree with @MrStatic in his answer that a second router plugged into your ISP router is the easiest solution.

However, note that you do pay a price for running a router behind a router. Just do a search for "double NAT issue" on google and you'll find several examples.

So, if you just want to keep your internal client-to-client traffic from passing through the router you could just attach a separate switch and/or access point to the router and make sure your devices connect to those rather than directly to the ISP router in order to prevent clients from talking to each other through the ISP router. The ISP router could still see what devices were on the network through DHCP requests, broadcasted packets, etc. But, it would not have access to client-to-client traffic since that would never have to go to the router.

What are your motives for hiding your intranet from your ISP router? I'd be more concerned about them watching my internet traffic (which can only be hidden by using bandwidth sucking VPN solutions).

Answer 2

This depends on what you're trying to hide.

Even without an ISP-provided router, your ISP can see all your traffic coming in and going out. Certain parts of this can be obscured by certain technologies, but they can still perform timing correlation attacks ("this person requested some unknown site at the same time as this site reported a DoS attack"), do deep-packet analysis, etc. However, these things are generally not something a local ISP will have the resources of inclination to dig into, so a combination of Tor and HTTPS are generally sufficient.

Are you looking to prevent your ISP from knowing which devices are on your LAN, or how many there are? Are you trying to prevent them from inspecting the actual traffic between your devices? In that case a simple switch will probably suffice - although honestly I doubt a consumer router has sufficient processing power to do any sophisticated analysis like that.

Answer 3

If you simply placed a router between you and your ISP's router you would accomplish what you are looking to do.

Just make sure to use separate subnets between the two.