On most business circuits the carrier installs and owns the equipment that terminates its service, such as a fiber ONT, a network interface device, a cable modem or a carrier-managed router. Behind it, you run your own firewall or router, which handles your security, Wi-Fi, VPNs and failover. The usual best setup is a clean handoff from the carrier's device to yours, with your firewall doing the routing and the carrier's box doing as little as possible. A carrier-managed router can be the right call when you have no IT support and want one party responsible for the whole connection.
The industry term for all of it is customer premises equipment, or CPE: anything at your site that is part of the service. Some of it belongs to the carrier, some to you, and the line between the two decides who fixes what, who pays when it breaks and what you hand back when the contract ends.
What the carrier typically installs
| Device | Where you see it | What it does |
|---|---|---|
| ONT (optical network terminal) | Shared fiber and some dedicated fiber | Converts the fiber signal to an Ethernet port |
| NID or Ethernet access device | Dedicated fiber and Ethernet services | Terminates the circuit, lets the carrier test it remotely and marks the demarc |
| Cable modem or gateway | Coax business service | Converts the coax signal; gateways also route and may run Wi-Fi |
| Carrier router | Many dedicated circuits, and some managed services | Routes your IP addresses toward the carrier's network |
| Cellular router | Wireless primary or backup services | Connects to the mobile network and hands off Ethernet |
Some circuits have two carrier devices, such as a NID and a router. Either way, the last carrier port before your equipment is usually the demarc, the point where the carrier's responsibility ends. Our guide to demarcs and inside wiring explains why its location matters.
Handoff types
The handoff is the physical and logical connection between the carrier's device and yours. Ask for it in writing before install day.
- Copper Ethernet (RJ45). The most common handoff up to 1 Gbps. Your firewall plugs in with a standard patch cable.
- Fiber (SFP or SFP+). Common at higher speeds and for 10G. Your device needs a matching optic and fiber patch cable.
- Routed handoff. The carrier assigns a small point-to-point network between its router and yours, and routes your static IP block to your firewall. Clean and flexible.
- Directly on the LAN side. Your static IPs sit on the same network as the carrier's device, and you configure one of them on your firewall. Simpler, but less tidy if you use several addresses.
- DHCP. Common on broadband: your router gets an address automatically, and it may change.
If you have static IPs, ask exactly how they will be delivered: which address goes on your firewall, what the gateway is, and whether the block is routed to you. Our guide to static IPs and BGP explains block sizes.
Managed router or your own: the trade-offs
| Carrier-managed router | Your own firewall or router | |
|---|---|---|
| Who configures it | The carrier, often through a ticket | You or your IT provider |
| Who monitors it | Often the carrier | You, unless you pay for monitoring |
| Changes | Slower, limited to what the carrier offers | Immediate and flexible |
| Security features | Usually basic, unless you buy a managed security service | Whatever your firewall and its subscriptions provide |
| Failover between carriers | Usually limited to that carrier's services | Can switch between any two providers |
| Responsibility when it fails | The carrier's | Yours |
A managed router suits a small office with no IT staff, a single circuit and simple needs: it is one less device to own, and one party is responsible from the street to the router. Your own firewall suits businesses that need VPNs, content filtering, multiple circuits, SD-WAN or detailed security controls, which in practice is most businesses with more than a handful of staff. Our small business firewall guide covers sizing and support.
The two are not exclusive. Many dedicated circuits come with a carrier router you do not touch, with your own firewall behind it. The carrier router handles routing to the carrier's network, and your firewall handles everything else.
Broadband gateways, bridge mode and double NAT
Coax and some shared fiber services come with a gateway that is a modem, router, firewall and Wi-Fi access point in one. Put your own firewall behind it without changing anything and you get two devices translating addresses, known as double NAT. Most everyday browsing works through it, but it commonly causes trouble with VPNs, voice calls, video calls, remote camera access and anything that needs inbound connections.
The usual fixes:
- Bridge mode, where the gateway stops routing and passes the public address straight to your firewall.
- IP passthrough, where the gateway passes a public address to one device behind it.
- Static IP configuration, where your firewall takes one of your static addresses and the gateway simply routes to it.
Not every gateway supports every option, and some carriers configure static IPs on their gateway in a particular way. Ask before install. Also turn off the gateway's own Wi-Fi if your own access points cover the office, so you are not running two competing networks. We explain address translation more fully in public vs private IP addresses and NAT.
Who owns what
- Carrier equipment remains the carrier's property in most agreements. You are usually responsible for keeping it powered, secure and undamaged, and for returning it when the service ends. Unreturned equipment can carry a fee; check your agreement for the amount and the return process.
- Do not move, unplug or reset carrier equipment without talking to the carrier. Moving a NID can break the circuit, and a factory reset can erase settings they will need to rebuild.
- Power belongs to you. The carrier's box plugs into your outlet. If it is not on a battery backup, a brief power cut takes the circuit down with it.
- Your firewall, switches and access points are yours to buy, configure, patch and replace.
- Rented equipment such as a carrier firewall or Wi-Fi bundle is usually billed monthly; compare its total over the term against buying your own.
When you change carriers
Switching providers is when ownership questions come to the surface. The old carrier's equipment has to be returned, the new carrier's goes in, and your firewall needs new WAN settings. A tidy sequence: install the new circuit and connect it to a second WAN port on your firewall, move services across, confirm everything works, then cancel the old service and return its equipment with a receipt. Keeping your own firewall in the middle is what makes this easy, because your internal network, Wi-Fi and VPN settings stay the same while only the outside connection changes. With a carrier-managed router as your only device, everything behind it may need reconfiguring at once.
Setting up the edge properly
- Put carrier devices and your firewall in the same secure, ventilated spot, on a battery backup.
- Label the carrier device with the carrier name, circuit ID and support number.
- Label your firewall's WAN port and the cable that connects to the carrier.
- Record the handoff details: IP address, gateway, subnet mask, DNS servers and any VLAN tag.
- If you have two circuits, give each its own WAN port on your firewall and test failover.
- Store the configuration of your firewall somewhere you can reach when the internet is down.
If you would rather not run the edge yourself, a managed network service can cover the firewall, switches and Wi-Fi behind the carrier's equipment.
A worked example
Hypothetical: the office, circuits and problems are invented to show a common pattern.
A 12-person insurance agency has a coax business line with a carrier gateway, and its IT contractor installs a new firewall behind it to run a VPN for staff working from home. The VPN connects, then drops every few minutes, and staff calls on the hosted phone system sometimes have one-way audio.
The cause is double NAT: the gateway and the firewall are both translating addresses. The agency already pays for a static IP, so the contractor asks the carrier to configure the gateway to route that address to the firewall, turns off the gateway's Wi-Fi, and moves the VPN to the static address. Both problems stop. When the agency later adds a fiber circuit as its primary, it asks for a routed handoff from the start and keeps the coax line, now cleanly configured, as the backup on the firewall's second WAN port. Our guide to backup internet covers that arrangement.
Questions to ask the carrier
- What equipment will you install, and which of it is yours, ours or rented?
- What is the handoff: copper or fiber, speed, and connector or optic type?
- How are our static IPs delivered, and what goes on our firewall?
- Does your gateway support bridge mode or IP passthrough?
- Is the router managed by you, and how do we request changes?
- Does the SLA cover the router, or only the circuit up to the NID?
- What has to be returned when the service ends, and what happens if it is not?
Getting it right from the quote
We price circuits from several Tier 1 carriers and get the equipment and handoff details on every quote, so there are no surprises on install day. The carrier pays FiberX, so nothing is marked up, and our lowest-price promise applies. Quotes are free, you usually hear back the same day, and Phil Morales is your one point of contact. Send us your address, call 478-758-8091 or text (347) 870-0965.
