The router your ISP gave you

It's on a shelf near where the line comes into the building, usually behind something. White plastic, a row of yellow ports and one that isn't, a sticker underneath with a Wi-Fi password nobody has changed. It came with the service and has never been touched since.

That box is doing five separate jobs at once, and it does about two of them well. Worth knowing which before you decide what to replace.

The five jobs

Terminating the circuit. On the ISP's side it speaks DOCSIS, or takes fiber directly, or it's an ONT with a router bolted on. This part it does properly, and it's often provisioned into the carrier's network in a way you cannot reproduce with your own hardware. Assume you keep this function whatever else changes.

NAT and DHCP. Handing out addresses and translating them on the way out. Nothing sophisticated about the job, and the box does it correctly.

A firewall. Default-deny for unsolicited inbound traffic, which is genuinely most of the security value at the edge, and it's on out of the box. What it has no opinion about is traffic inside your network — every device can reach every other device, forever.

Wi-Fi. One set of radios in one location, and that location was chosen by where the coax or fiber enters the building — typically a corner, a closet, or the floor behind a filing cabinet. The chipset is usually adequate; the placement is the problem, and no firmware fixes a wall.

DNS. It forwards your lookups to the ISP's resolvers. No filtering, no per-network policy, and no log you can read.

The six it isn't

Segmentation. The guest SSID, if there is one, is generally the same subnet with a different password. No usable VLAN support, so the payment terminal and the thermostat live together.

Logs you can use. You cannot answer "what happened at 2pm on Tuesday" from this box. Most keep a rolling few hundred lines and clear them on reboot.

A config you can save. There is no export. If it dies, recovery is somebody reconstructing the port forwards and reservations from memory.

Anything routed on policy. No dual-WAN, no failover, no site-to-site tunnel, no per-device rules, no useful shaping.

Firmware you control. Most carry a management agent that talks to the carrier's provisioning server. Updates arrive when the ISP decides, settings can change under you, and you cannot turn that channel off — it's how they support the device.

Connection capacity. The invisible one. Every active flow takes an entry in a translation table, and cheap hardware has a small table. Fill it and new connections fail while existing ones keep running, so the network goes strange rather than down — pages hanging while a video plays on. It bites first at sites with cameras or a lot of small IoT devices, and it gets blamed on bandwidth, which it isn't.

The move is bridge mode, not the trash

Here's the part people get wrong when they decide to upgrade. They buy a good router, plug it into a LAN port on the ISP box, and stop. Now two routers are doing NAT in series.

Double NAT breaks inbound anything — port forwards, site-to-site VPN, remote access — because the outer box translates first and knows nothing about your rules. Worse, it keeps the ISP box in the traffic path, so its small translation table is still the ceiling for the whole site. You bought better hardware and left the bottleneck upstream of it. Putting your router in the outer box's DMZ hides the symptom without removing either problem.

What you want is the ISP box demoted to a modem: terminating the circuit, passing the public address through untouched, with its routing, NAT, firewall and Wi-Fi switched off. Ask the carrier by name, and note the name differs — cable operators generally call it bridge mode; some fiber and DSL providers call it IP passthrough, which keeps the box routing but hands your public address to one device behind it. A few plans won't do either, and that is worth learning before you buy hardware, because it changes the design.

Two things catch people during the swap. Some carriers bind the public address to the MAC of whichever device first requested it, so a new router gets nothing until the old lease expires — or until you copy the address across, which on RouterOS is /interface ethernet set ether1 mac-address=AA:BB:CC:DD:EE:FF. And if the radios can't be disabled independently, that box is still transmitting Wi-Fi into your channel plan from inside a cabinet. Turn them off if you can; if you can't, account for them when you pick channels.

What to do

Log in and read what is actually configured — port forwards, reservations, the Wi-Fi channel, whether UPnP is opening ports you don't know about.
Call the ISP and ask, in these words, whether the account supports bridge mode or IP passthrough.
If it does, put your own router behind it and turn off every ISP-box function you can.
If it doesn't, design around the double NAT deliberately rather than pretend it isn't there.
Either way, export the config of whatever ends up being your router, and keep that file somewhere other than the router.

If the box on that shelf is the whole network plan, NetCare is the version where it isn't.