How to Replace Your ISP’s Fiber Gateway (ONT) in 2026: A Pro’s Guide to XGS-PON

Last Updated: May 10, 2026

If you’re ready to bypass your ISP’s fiber gateway and unleash the full potential of your fiber optic connection, you’ve found the definitive 2026 guide. I’m going to show you how to replace your ISP’s restrictive equipment with a third-party ONT—a critical step to gaining total control over your network, optimizing speeds up to 10 Gbps, and building a rock-solid infrastructure for your Home Assistant smart home.

This tutorial moves past the old GPON era and focuses on today’s standard, XGS-PON. I’ll explain which ONT to choose, how to hunt down your line’s authentication keys, and how to configure the whole system with a prosumer router for major ISPs like AT&T, Google Fiber, or Frontier. The freedom and performance you’ll gain are worth every minute of the effort.

Disclaimer: The content of this article is for educational and informational purposes only. We do not develop or distribute any of the mentioned plugins, software, or services, nor do we have any relationship with their creators. We are against piracy and the use of illegal content. The user is solely responsible for how they use the information presented here.

Why Ditch Your ISP’s Router and ONT in 2026?

Swapping out your provider’s gear isn’t just a tech-nerd flex; it’s a strategic decision. With home connections now easily exceeding 10 Gbps, the hardware ISPs hand out is almost always the first performance bottleneck. The advantages of running your own third-party router and ONT setup are clearer than ever:

• Total Network Control: Set up VLANs to isolate your IoT gadgets, servers, or security cameras. Run your own DNS servers to bypass censorship and boost your privacy. Deploy robust VPNs like WireGuard without the limitations of stock ISP firmware. Learn more about why your flat network is a security nightmare.
• Superior Performance: Free yourself from sluggish processors and tiny routing tables. A quality third-party router can handle hundreds of devices simultaneously without breaking a sweat—essential if you’re running Home Assistant with dozens of Zigbee, Wi-Fi, and Matter sensors.
• Real Privacy: By removing the provider’s hardware, you dramatically reduce the telemetry and potential snooping on your browsing habits. Controlling your gateway to the internet is the first step in protecting your digital life. Check out our ultimate guide to bulletproof home WiFi security.
• Timely Updates & Security: Manufacturers like Ubiquiti, Mikrotik, and Asus frequently update their firmware, patching security vulnerabilities that can take months to get fixed on ISP equipment—if they ever do.

The Key in 2026: Understanding GPON vs. XGS-PON

Before you buy anything, you absolutely must know which fiber technology serves your home. For years, the standard was GPON, but if you’ve signed up for or upgraded your fiber plan recently, you almost certainly have XGS-PON.

⚠️ IMPORTANT WARNING: The classic Ubiquiti ONT models (UFiber Nano G and Loco) are GPON ONLY. If you have a 10 Gbps XGS-PON line, they will not work. They are hardware-incompatible.

The difference is simple but crucial for choosing your gear:

To find out what you have, check your internet plan details or the model of the gateway your ISP installed. If it advertises speeds like “2 GIG,” “5 GIG,” or “10 GIG,” it’s XGS-PON.

How to Choose the Right XGS-PON ONT in 2026

With the Ubiquiti GPON ONTs out of the running for new multi-gig installs, the market has opened up to some powerful new alternatives. Your choice depends on your budget and whether you prefer a desktop device or an SFP+ module that plugs directly into your router.

My personal recommendation for most users is to go with a desktop ONT like the Leox or ZTE. They are easier to configure and troubleshoot. SFP+ modules are a cleaner, more compact solution, but they require a router with an SFP+ port and can sometimes be trickier to get working.

The Hard Part: Getting Your Authentication Keys

This is the most critical step and where many people give up. For a third-party ONT to work, it needs to authenticate with your ISP’s network. To do this, you need a unique key, often called the PLOAM Password or SLID. For some providers like AT&T, this involves extracting 802.1x certificates, a much more involved process.

ISPs do not want you to have this information. Here are the common methods that work in 2026, from easiest to hardest:

Method 1: The ‘Inspect Element’ Trick on Older Gateways

This method relies on finding the password hidden in the web interface of your ISP’s gateway. It’s less likely to work on modern, locked-down hardware but is worth trying first.

1. Connect your computer to the ISP gateway with an Ethernet cable.
2. Log in to its admin panel (usually at 192.168.1.1). The password is on a sticker on the device.
3. Navigate to the advanced settings or fiber connection status page. Look for a section named “GPON,” “XGS-PON,” or “WAN.”
4. Find a field labeled “ONT Password,” “PLOAM Password,” or “SLID.” Often, the field will show asterisks (******).
5. Here’s the trick: Right-click on the password field and select “Inspect” or “Inspect Element” in your browser.
6. The developer tools will open. Look for the HTML code for that field (<input type="password" ...>). Double-click on type="password" and change it to type="text". Press Enter.
7. Voilà! The password should now appear in plain text on the page. Copy it and save it somewhere secure.

Method 2 (Advanced): Exploits and Certificate Extraction

For modern gateways (like the AT&T BGW320), the method above is disabled. Bypassing these devices requires exploiting known vulnerabilities to gain root access and extract the necessary 802.1x authentication certificates. This process is complex, specific to each gateway model, and carries the risk of bricking your device. It is a path reserved for advanced users who are comfortable with networking and Linux. You will need to search for guides specific to your ISP and model number (e.g., “BGW320-500 bypass”).

ISP Compatibility & VLAN Configuration Guide (U.S. 2026)

With your ONT and authentication keys in hand, the next step is configuring your own router. Each service (Internet, TV, Voice) travels in a separate virtual lane called a VLAN. You must configure these manually in your router’s WAN interface. **You must research the correct values for your specific ISP, as they vary widely.**

A quick note on IPTV & VoIP: Getting your provider’s TV service to work often requires IGMP Snooping/Proxy support on your router, which not all consumer models handle well. For your landline, you’ll need a VoIP (ATA) adapter or a router with PBX capabilities. If you rely on these services, thoroughly research your router’s compatibility. Here’s a guide on how the general principles work for getting your landline working.

Tutorial: Configuring Your XGS-PON ONT & Third-Party Router

Let’s get to it. Here’s the general process I followed with a Leox ONT and an Asus router running Merlin firmware.

1. Physical Setup: Unplug the fiber cable from your ISP’s gateway and connect it to your new ONT. Use a quality Ethernet cable (Cat 6a or better) to connect the 10G port on the ONT to the WAN port of your own router.
2. Accessing the ONT: For the initial setup, connect your PC directly to the ONT. Set a static IP on your PC (e.g., 192.168.100.10). In your browser, navigate to the ONT’s IP address (often 192.168.100.1, but check the manual). The default login is usually admin/admin.
3. Entering Credentials: Look for a section like “PON,” “GPON,” or “WAN.” There will be a field for the “SLID (PLOAM Password).” Paste the key you obtained from your old gateway here. Save the changes and reboot the ONT.
4. Verifying Sync: Log back into the ONT’s interface. On the status page, look for an indicator like “OLT Status” or “PON Status.” It should show a state like “O5 – Operation,” which means it has successfully synced with the provider’s central office. That’s half the battle!
5. Configuring Your Router: Now all the logic moves to your router. Disconnect your PC from the ONT and plug it into one of your router’s LAN ports. Access its web interface and go to the WAN settings.
   • Connection Type: Select PPPoE (common for DSL-based providers like CenturyLink) or DHCP/Automatic IP (common for others like Google Fiber). For AT&T, your router must support 802.1x authentication on the WAN port.
   • Credentials: If it’s PPPoE, enter the username and password for your service.
   • VLAN Settings: Enable the VLAN option and enter the correct values for your ISP’s internet service (e.g., VLAN ID 2, PRIO 2 for Google Fiber).
   • MTU: For PPPoE connections, it’s best practice to set the MTU to 1492.

Save the changes and reboot your router. If everything went well, the internet light on your router will turn on, and you’ll be online. You’ve successfully managed to bypass your ISP fiber gateway!

Final Warning: You Forfeit Official Tech Support

Before you rush out and buy new hardware, I have to be completely honest with you. When you replace the ISP’s equipment, something important happens:

You become solely responsible for your network. Your ISP’s tech support will not help you.

If you have a connection problem, the first thing they will demand is that you reconnect their equipment. If you don’t, they will close the ticket. This means you must be willing and able to diagnose and solve your own problems. For me, the freedom and performance make it a no-brainer, but it’s a factor you must seriously consider.

The 2026 Verdict: Is It Worth The Hassle?

After years of running this type of setup, first with GPON and now with XGS-PON, my verdict is clear: absolutely yes, but it’s not for everyone.

If you’re a power user, a Home Assistant enthusiast, a gamer chasing the lowest possible latency, or simply someone who values their privacy and wants the absolute best performance from your 10 Gbps line, then installing an XGS-PON ONT and a quality router is one of the best upgrades you can make to your digital infrastructure.

If, on the other hand, you just use the internet for browsing and streaming and don’t want any complications, the equipment your ISP provides is more than enough. The philosophy remains the same as it was years ago: your network, your rules.

Frequently Asked Questions (FAQ)

Can I use any XGS-PON ONT with my ISP?

No. The ONT must be compatible with the OLT (the equipment in your ISP’s central office). The most common OLT manufacturers are Huawei, ZTE, Nokia, and Alcatel/Lucent. ONTs like the Leox or ZTE models often have built-in compatibility profiles for multiple OLTs, which increases your chances of success.

Is it legal to replace my ISP’s ONT?

Yes, in the United States, it is legal. However, by doing so, you waive your right to technical support for that component. The ISP is only responsible for ensuring a good fiber signal reaches the demarcation point in your home.

Will I lose my landline phone if I change the ONT?

Almost certainly, yes, out of the box. The VoIP phone line is pre-configured in the ISP’s gateway. To keep it, you need to extract the SIP credentials (which can be even harder to get than the PLOAM password) and configure them in an Analog Telephone Adapter (ATA) or an advanced router with that functionality. My guide on restoring VoIP service explains the general process.

What kind of cable do I need between an XGS-PON ONT and my router?

To take advantage of speeds over 1 Gbps, you need a Category 6a (Cat 6a) or better Ethernet cable, which is rated for 10 Gbps connections. In addition, both the ONT and your router’s WAN port must be multi-gig (2.5GBASE-T, 5GBASE-T, or 10GBASE-T).

Conclusion

You now have all the up-to-date information to bypass your ISP fiber gateway in 2026 and make the leap to a high-performance network. As you’ve seen, the process requires research, patience, and some technical know-how, but the result is a stable, fast, and completely private network that is entirely under your control.

I hope this guide serves as a valuable resource. If you decide to take the plunge and have any questions, or if you want to share your own experience, drop a comment below!