Do I need to enable bridge mode to plug my router into an Openreach ONT?

No. The ONT is already a media converter that turns fibre into Ethernet, so it does not route or run WiFi and there is nothing to bridge. You simply run a cable from the ONT's LAN port to your router's WAN port and set up the connection (PPPoE for most ISPs, DHCP for Sky). Bridge mode is a concept for the ISP hub, which you are bypassing entirely on FTTP.

Where do I get my PPPoE username and password for FTTP?

Your ISP issues them. BT and EE lines often work with bthomehub@btbroadband.com and a blank or BT password, but the reliable approach is to ask the ISP for your account's PPPoE or network user ID and password. Zen, Plusnet, Aquiss and similar give you a per-account username such as zen123456@zen plus a password. Sky is different and does not use PPPoE at all.

Do I need to set a VLAN like VLAN 911 on an Openreach ONT?

No. Openreach FTTP does not need VLAN tagging, so leave it off. VLAN 911 is a CityFibre requirement, which is a separate full-fibre network, not Openreach. If you copy a CityFibre guide and add VLAN 911 to an Openreach connection it will stop working, so confirm which network your line is on first.

Can I use my own router on Sky full fibre the same way?

Almost, but the authentication differs. Sky does not use PPPoE in the UK, so there is no username and password to enter. Many newer ONT-based Sky lines just need the router's WAN set to automatic/DHCP, while some older lines need DHCP Option 61 with a value like anything@skydsl|anything. Pick a router that exposes Option 61 if your line needs it.

Will I lose my home phone if I connect my own router to the ONT?

Likely yes. On FTTP the Digital Voice phone usually plugs into a port on the ISP hub, not the ONT, so bypassing the hub means the landline no longer works through it. If you still need the home phone, keep the ISP hub for voice, or check whether your provider can move the line, before going router-direct.

Disclosure: This post contains affiliate links. As an Amazon Associate, ITBlogPros earns from qualifying purchases. It never changes the price you pay; it just keeps the lights on here.

Connect Your Own Router to an Openreach ONT on FTTP

On full-fibre, the box that matters is not your ISP hub; it is the small white Openreach unit on the wall. Once you understand what that box actually does, the whole question of running your own router gets a lot simpler. There is no bridge mode to hunt for and no clever toggle to find. You just plug in and authenticate.

We have run our own routers off Openreach lines across a few different providers, so here is the plain-English version. We will cover what the ONT is, why you can skip the ISP hub entirely, and the exact connection settings for the big names.

Key Takeaways

An Openreach ONT is a media converter, not a router, so there is no bridge mode to enable on FTTP.
For most Openreach ISPs you set your router's WAN to PPPoE and enter the username and password your provider issues.
Sky is the odd one out: it uses DHCP, sometimes with Option 61, and never a PPPoE login.
VLAN tagging like VLAN 911 belongs to CityFibre and other alt-nets, not Openreach; leave VLAN off on a genuine Openreach line.
Virgin Media has no Openreach ONT at all, so its own modem mode is the route there instead.

An Openreach ONT is a media converter, not a router

The ONT, short for Optical Network Terminal, is the small white Openreach box on your wall. A thin fibre cable feeds it through an SC/APC connector, and its job is narrow: convert the incoming light signal into ordinary Ethernet. That is the lot.

Here is the bit that clears up most of the confusion. The ONT does not route, it does no NAT, it runs no WiFi, and it holds no login. It is already the modem stage of your connection. So when you plug your own router into it, you are not putting anything into bridge mode; there simply is no router in the ONT to bridge in the first place.

That is different from the old FTTC and ADSL world, where the ISP hub was the modem and you had to either disable its WiFi or wrestle it into bridge mode. On FTTP that role moves to the ONT, which means your own router becomes the only router on the line. Cleaner, and far less fiddly.

The connection point is a single Ethernet socket on the ONT, usually labelled LAN or Port 1. Run a standard Cat5e or Cat6 cable from there to your router's WAN or Internet port and you are physically done. Before you touch any router settings, glance at the ONT's lights: a steady Power, a steady PON, and LOS off means the fibre side is healthy. If LOS is flashing red, that is a line fault to report, not something a router will fix.

Worth saying plainly: this is the full-fibre branch of the broader decision about running your kit. If you want the bigger picture of which method applies to which provider, start with our guide to using your own router with any UK ISP. And leaving the ISP hub inline behind your router is exactly what causes the mess we describe in what double NAT is and how to fix it; going router-direct avoids it entirely.

Most Openreach ISPs authenticate over PPPoE

PPPoE, Point-to-Point Protocol over Ethernet, is just your router opening a session across the ONT using credentials your ISP issues. That session is how the network confirms it is really your account on the line.

The generic recipe looks the same everywhere on Openreach. Set the WAN or Internet connection type to PPPoE, enter the username and password, leave the IP as automatic, and leave VLAN tagging off. Openreach lines do not need a VLAN, so do not add one.

BT and EE sit on exactly the same Openreach PPPoE method, which makes sense given EE broadband is BT-owned. The classic [email protected] with a blank or BT-supplied password works on a lot of lines. The reliable route, though, is to ring the ISP and ask for the account's PPPoE or network user ID and password rather than guessing. If you ever need to undo a change and start fresh, our notes on resetting a BT broadband router cover the basics. For EE specifically, we have a fuller walkthrough on how to use any router with EE broadband.

Zen, Plusnet, Aquiss and similar issue a per-account username, something like zen123456@zen, plus a password. Same PPPoE settings, VLAN left disabled. Zen's own guidance is explicit that you leave VLAN tagging unchecked, which is a useful sanity check if a setup screen tempts you to fill it in.

Two practical notes before you commit. First, the Digital Voice caveat: on FTTP the home phone usually plugs into a port on the ISP hub, not the ONT. Run your router straight to the ONT and that phone port goes quiet. If the landline still matters, keep the ISP hub for voice or ask your provider about moving the line. Second, for the keen: enabling jumbo frames or RFC4638 lets you keep a full 1500-byte MTU over PPPoE. If your router does not offer that, 1492 is the safe default and nobody will notice the difference in daily use.

Sky is the exception: it uses DHCP, not PPPoE

This one trips people up, so let us be blunt. Sky does not use PPPoE in the UK. Enter a PPPoE username and password on a Sky line and it will simply refuse to connect, no matter how many times you retype it.

There are two Sky cases. Many newer ONT-based lines just want the router's WAN set to dynamic/automatic IP (DHCP); the line authenticates at the ONT and you are away. Some older lines still need DHCP Option 61, a value along the lines of anything@skydsl|anything typed into a vendor or host ID field.

That makes router choice matter on Sky. Not every consumer router exposes the Option 61 field, so if your line needs it, pick one that does. For the full Sky-specific walkthrough, including why the bridge-mode answer catches everyone off guard, read the surprising answer on Sky hub bridge mode. Once the WAN is set correctly, the rest behaves like any other own-router FTTP setup; WiFi, NAT and devices all act normally.

VLAN tagging is for alt-nets like CityFibre, not Openreach

The rule is short: on a genuine Openreach ONT you do not set a VLAN. Leave VLAN tagging off and move on.

It is worth explaining where VLAN 911 keeps coming from in those forum threads. It is a CityFibre requirement. CityFibre is an alternative full-fibre network, not Openreach, and on it the router must talk PPPoE tagged on VLAN 911. Brilliant advice for a CityFibre line; poison for an Openreach one.

Telling the two apart is easy once you look. An Openreach ONT is branded Openreach, and your order or ISP will confirm an Openreach line. CityFibre and the other alt-nets ship their own, differently branded ONT. The common mistake is copying an alt-net guide wholesale and bolting VLAN 911 onto an Openreach connection, which stops it working stone dead. Other alt-nets vary too; some use no VLAN, some use their own tag, so verify the exact setting with that specific network rather than assuming.

Virgin Media does not use an Openreach ONT

If you are on Virgin Media, none of the above applies, and that is not a small caveat. Virgin runs on its own cable network, DOCSIS over coax, not Openreach fibre. There is no Openreach ONT on a Virgin install to plug into.

The Virgin equivalent is to put the Virgin hub into modem mode, which turns it into a transparent bridge and hands a public IP straight to your own router's WAN port. There is no PPPoE and no username involved; you set the router's WAN to automatic/DHCP once modem mode is enabled. If that is your line, head over to our Virgin Media Hub 5 modem mode guide instead of following this page.

One more thing for the future-proofers: Virgin's full-fibre XGS-PON rollout still uses Virgin's own kit and hub, not Openreach, so it never becomes an Openreach ONT job. On the coax Hubs (3, 4 and 5) modem mode is the clean route. On the XGS-PON Hub 5x, though, modem mode has been limited or missing and capped to a single roughly 1Gbps port, so check current support on your specific hub before you rely on it.

A short note on which routers handle PPPoE and 2.5G WAN well

Honest take first: almost any decent router does PPPoE fine. The reason kit matters at all is line rate. On FTTP tiers at 900Mbps-plus, or the new gigabit-and-beyond packages, you want a fast WAN port and a router that holds full speed while running the PPPoE session rather than choking on it.

For an all-rounder, the ASUS RT-AX86U is the easy recommendation: rock-solid PPPoE, jumbo-frame and RFC4638 support so you keep a full MTU, excellent range, and a true 2.5G port that doubles as WAN for both sub-gig and gigabit FTTP.

Check the ASUS RT-AX86U price on Amazon UK →

If you are on a faster-than-gigabit Openreach tier and want the premium pick, the RT-AX86U Pro brings newer internals for the same reasons, with its genuine 2.5G WAN being the headline feature.

Check the ASUS RT-AX86U Pro price on Amazon UK →

For typical FTTP speeds where a 1G WAN is plenty, the TP-Link Archer AX73 is the value standalone option. WiFi 6, good coverage for a normal house, and a price that stings far less.

Check the TP-Link Archer AX73 price on Amazon UK →

When coverage across a larger home is the real goal, mesh makes more sense. The TP-Link Deco X20 and X60, and the eero Pro 6E, all run PPPoE at the gateway node, so the ONT feeds the main unit and the mesh handles the rest of the house.

Check the TP-Link Deco X20 price on Amazon UK →

Check the TP-Link Deco X60 price on Amazon UK →

Check the eero Pro 6E price on Amazon UK →

One last point of honesty on the 2.5G question, because the marketing muddies it. Within the kit above, the RT-AX86U, the RT-AX86U Pro and the eero Pro 6E have a true 2.5G WAN; the Archer AX73 and the Deco X20/X60 top out at a gigabit WAN. So if you are on a faster-than-gigabit Openreach tier, those three are the ones to look at, and the eero Pro 6E is your 2.5G option if you also want mesh. A gigabit WAN is perfectly fine for the vast majority of lines.

Once the cable is in and the WAN is set, the rest is the easy part. If you want to sanity-check what your kit is telling you along the way, our guide to what every router light colour means is a handy companion. Plug in, authenticate, done.

Amazon Affiliate Disclosure: ITBlogPros is a participant in the Amazon Services LLC Associates Program. We only recommend kit we'd genuinely use ourselves.