How to improve security of a ISP-provided wifi router

Question

I have this concern that having my devices directly connect to the wifi router provided by my ISP could lead to security issues. For example if the router gets hacked and the DNS servers are modified to point to some hacked server somewhere.

Also the ISP-provided router does not have options such as guest mode which I would like to use for some things such as the smart TV.

Besides that what I would like to do is to separate some devices such as the network printer so that they are not directly accessible from the ISP-provided router (in the event it gets hacked).

So what I was thinking is to add one more wifi router (e.g. this Trendnet TEW-828DRU AC3200), which would have its own wifi network and would connect to the ISP-provided router using a LAN cable.

The questions I would like to ask about this are:

1. The ISP-provided router has NAT modes such as "Routed with NAT", "Routed without NAT", and "Bridged". What difference (if any) would each of these have on the security?
2. Would an additional router like this actually increase the security or would it require anything else (such as a hardware firewall, a switch, a separate VLAN for the devices I esp. want to protect, etc)?

Answer 1

The general advice is buy your own gear, always. Anything with the ISPs software on it likely can receive automatic firmware upgrades/config changes which can be from annoying (losing advanced configs, etc) to dangerous (some don't even have code signing!).

1. If you buy your own router + APs you'll want to use bridge mode. This essentially just opens the floodgates of the internet directly to your router (the new one), putting it in charge of firewall and port forwarding configs. You can technically plug your new one into the old one without changing anything but then you get into something called Double NAT which is not recommended because performance and various other weirdness. It's not less safe (maybe more secure through obscureness however). This isn't a security option in it of itself.

2. You don't need a second device to do VLANs if you buy a good enough router/one which supports DD/OpenWRT. Hardware firewalls aren't necessary either since the vast majority of the time when you have a pretty flat structured network with no special intercommunications rules you can just stick with the "isolate networks" option. You can, of course, get a hardware firewall however it'd be overkill for what you want because nearly every consumer AP+Router supports a guest network which is more or less what you need OOTB.