It's legal within the USA* to test your own equipment inside your own network.
Be aware that some of the newest ISP-provided routers (i.e. Comcast gigabit, aka Xfinity xFi) have some rudimentary security software built in, and they do internal network monitoring and detection to help homeowners secure their networks. The most I've seen them do is alert the account holder that new devices have been added to the network, or warn you if you try to connect to a known malicious site, but it's certainly possible that it could detect other forms of behavior that it might consider hostile. So don't be surprised if your ISP notices, and perhaps tries to "keep you safe" by blocking traffic it considers dangerous. It's also probable that any such activity would be logged by them.
However, most ISP routers are older, and the older ones don't do any such thing. Their security functioning is limited to simple firewalls that keep bad traffic out.
If you're concerned that you don't know if the ISP's router is monitoring your traffic, you don't have to trust it. You can add a second router inside your network and dedicate the innermost network to your penetration testing activities. Any network IP addresses that begin with "10.", "192.168.", or "172.16." through "172.31.", are called "Private Networks" (RFC 1918, for a more formal definition). These are reserved address ranges that are not allowed to be routed outside of your network by your router. So anything you send to those addresses won't leave your network, making them safe to experiment with.
* NOTE: standard disclaimers apply, this is not legal advice, it may not be accurate, I am not a lawyer, don't believe everything you read on the internet, use at your own risk.