Excuse me, but how does it work in practice? I have currently optic fiber connection going to ISP-provided router - Sagemcom F@st 5670 (Crap. I know.). The ISP will not accept replacing that with a different device (GPON ONT). The device does have a web interface for some basic management, but I can't really inspect the network traffic there. The previous ISP it was the same just different device - Huawei EchoLife HG8245H. The previous ISP was on ADSL with of-the-shelf SOHO router such as D-link Dir-615. In all cases I assume that the device gets on the WAN interface a public (or CGNAT IP) address assigned by ISP and will accept only packets with destination IP address matching that WAN interface IP address. Are you saying that it is not the case and there are routers (provided by ISPs), that will accept packets coming to WAN interface and not having packet destination IP address matching the WAN interface IP address? I find that hard to believe unless we talk about some small community ISP run by amateurs.