@dsj In fact I would even put my money on most of that upstream cabling beign wrong.

@3287bluehawk . "It's a cable that has a coupler on it which I connect one end of an ethernet cable to and the other to the router." care to share a picture of that whole concoction ?

@Reguna VLANs are not intended to replace access control lists or firewalls.

@Micky_Roth I took a good look at the crypto support on my ER7206 and is second to third rate, lack of sha2 is the tip of iceberg..l I strongly advice you not to use them for VPN. instead setup a VPN...

Starlink gen2 does support bridge mode according to the interwebz. it needs an "starlink ethernet adapter" and disabling all the routing capabiltites and wifi. so there it is.

@btx Yes, that's called CGNAT , still each customer CPE get a distinct IP address assigned from either rfc1918 or rfc6598 space. (or in some rougue ISPs by squatting valid already delegated Ip...