The four functions inside your router
When you talk about “the ISP router” you’re almost never talking about a single thing. Inside that device there are four distinct functions, and knowing which one you’re replacing is what decides whether the installation ends up correct:
| Function | What it’s for | Does your neutral router do it |
|---|---|---|
| ONT or modem | Converts the fibre light into an electrical signal | No |
| Router | Routes, assigns IPs, applies NAT and firewall | Yes |
| Switch | Connects several devices over cable | Yes |
| WiFi access point | Broadcasts the wireless network | Yes |
Your neutral router does the last three. The only one it can’t do is the ONT, because that needs a laser and the electronics of the central office’s optical interface.
ONT: the light-to-electricity translator
Fibre carries pulses of light. No home network device understands them. The ONT, which stands for optical network transceiver, is the box that receives that fibre, turns the light into electrical data over an Ethernet port and gives you a connection.
If you have a separate ONT, you already have the hard part solved. If your device has an integrated ONT, you’ll see a port labelled PON or FIBRA instead of the Ethernet port.
HGU: the technical name for the ISP device
HGU stands for Home Gateway Unit. It’s simply the name ISPs use for their router, and it means nothing special technically. When a manufacturer integrates the ONT into the router, that all-in-one device is called an HGU.
The most common HGUs in Spain are Movistar and O2’s HGU Smart WiFi, Orange and Jazztel’s Livebox, and Vodafone’s devices, which are usually two separate boxes.
Recognising which you have is easy: look at the ports. If there’s a fibre port, it’s an all-in-one device. If there are only Ethernet ports, the ONT is a separate box.
Neutral router: the one that does all the work
When the neutral router works in bridge mode, it’s the one that has to separate the internet VLAN and re-tag it onto the local network: that’s exactly the 802.1Q tagging explained in the OpenWrt VLAN documentation.
The neutral router has no ONT. It connects to the ONT or to the HGU and takes care of routing, assigning IPs, managing WiFi and applying rules. It’s the device you want to choose, because it’s the one that decides how your network behaves.
It normally runs OpenWrt, Merlin or another open firmware. That gives you access to QoS, VLAN, WireGuard, link aggregation, detailed logs and updates that consumer routers don’t offer. If you’re looking for a basic guide, start with replacing your ISP router.
The three possible installations
| Device type | Installation | Comment |
|---|---|---|
| Separate ONT and router | ONT and neutral router | The cleanest |
| All in one | ONT and ISP router in bridge, then yours | The usual case |
| All in one with TV | The same, plus the HGU powering the decoder | The HGU stays on |
The third deserves a warning: if you have the ISP’s TV service, the decoder still needs the HGU powered on. You can leave it in the hallway, but don’t unplug it.
How to connect each case
Case 1: separate ONT and router
Fibre to the ONT. From the ONT, an Ethernet cable to the WAN of your neutral router. In the router, the VLAN and the connection type of your line. Done.
It’s the simplest layout and the one with the fewest problems.
Case 2: HGU all in one
Log into the HGU configuration and enable bridge mode, also called ONT mode or monopuesto. The HGU stops routing and handing out DHCP, and delivers the signal through a LAN port. From there, a cable to the WAN of your neutral router.
Then, in your router, you set VLAN and PPPoE according to the table for your ISP.
Mind Movistar’s pseudo-bridge: if the HGU delivers the VLAN already untagged, in your router you only set PPPoE without setting the VLAN.
Case 3: TV
The ISP’s TV service needs its own VLAN, and often has to leave through a specific port on the HGU. The topology ends up with two branches:
ONT or HGU to your neutral router ONT or HGU to the HGU, to power the decoder
That’s what most people with Orange and Movistar end up with without realising it.
About fitting your own ONT
You can buy a GPON ONT very cheaply and connect it to the fibre, replacing the whole HGU. It works, but you need to be careful:
- You need the GPON or IdONT key of your line so the ONT can register with the central office.
- Telefónica has announced restrictions on connecting ONTs that aren’t certified for its network. If your device isn’t certified, check with your ISP first, because you could end up without service.
- Movistar has authorised specific ONTs for its 10 Gbps network, so the list exists and it’s worth checking it before you buy.
If you don’t even want that paperwork, connecting your router to the existing HGU in bridge mode avoids the problem completely. For most people that’s the reasonable option.
Typical mistakes
- Confusing the PON port with an Ethernet port and powering it as if it were LAN.
- Putting the HGU in bridge mode and not configuring the VLAN on the neutral router.
- Unplugging the HGU with the TV active, leaving the decoder with no signal.
- Powering the neutral router from the HGU instead of from its own power adapter.
- Choosing a compatible ONT on price alone, ignoring that the GPON key is tied to the line number, not to the device.
Quick checklist
- You know whether your device has an integrated ONT.
- The fibre reaches the ONT, not the neutral router.
- The cable from the ONT or from the HGU in bridge mode goes to the WAN of your router.
- VLAN and PPPoE configured according to your line.
- The TV decoder stays powered if you use it.
- You’ve noted down the HGU’s original settings.
Sources and next step
The exact VLAN and PPPoE values are in setting up your fiber router. To choose hardware with some judgement, see WiFi 6 or WiFi 7. And if the problem isn’t the connection but the coverage inside the home, start with a repeater or a mesh system.