pppoe

What's more, the router connects to the ISP using PPPoE, so the username for the account is visible in the PPPoE config.

The docs say: > native PPPoE library has been added to sd-network, systemd's library of light-weight networking protocols.

It's a good lightweight solution for many users, but it doesn't even support essential features like pppoe connections.

It's capable of routing 1M PPS and the latest beta build does this with PPPoE as well.

This library will be used in a future version of networkd to enable PPPoE communication without an external pppd daemon.

Networkd is a daemon which manages the network configuration and PPPoE makes sense in that context.

It seems that its attack surface remains the same as for a dumb PPPoE translator.

The NIC used is also important if you need the router to do PPPoE.

Turns out I was on a home network connection with PPPoE which slightly decreases the maximum MTU.

If you see 1492 for your MTU, you are maybe using Point to Point Protocol over Ethernet (PPPoE) which chomps another 8 bytes.

Do they insist that a /32 subnet mask on their PPPoE connection is invalid and that the gateway can't be outside the subnet?

There are some broadband IPs and some pppoe (!) IPs in there too, which might explain why it's not a very heavy attack.

If you buy your own router (or "make" your own, people who have a small Linux machine on 24/7 for various things just set that up to talk PPPoE directly and skip the router altogether, neatly avoiding the limits of many "consumer grade" units (shoddy IPv6 support for instance) without shelling out for a much better device) only then do you truly have control of security at that point in the topology.