garretblack I considered putting it in the dmz, but ultimately did not for two reasons. 1) I'm pretty savvy but I'm not that savvy, I worried I might leave a vulnerability in my network by not knowing exactly what I was doing. 2) 99% of the time my network failures were due to CL's crappy hardware and so I wanted that out. I have CL fiber and that made it easier to get rid of their hardware (input to my replacement router is now ethernet instead of DSL). Between port forwarding and static ips for my wired devices, I can do all the fancy stuff I needed with my router and just let eero handle my wifi in bridge mode. It's annoying in principle but I have the function I need with this setup.

ttnicky What router did you replace the CL PPOE router with?  I'm not sure what you mean by DSL... there's no DSL connection in a fiber -> CL PPOE router -> Eero configuration.

garretblack yes, what I was trying to imply is that my setup works because I have fiber. I previously had their DSL service and I couldn't replace their hardware then because I couldn't find a third party DSL router. But since fiber outputs a RJ45 connection from the gateway, it was easy to replace their router. I have a mikrotik wired router that takes the input from the fiber gateway, handles the PPPoE and VLAN tagging, all the routing, and sends a cat5e output to my network switch. My eeros connect to the switch and essentially function as hotspots, simply providing the wifi for my wireless devices while the mikrotik router does all the heavy lifting. It cost around $60 if I remember correctly, is small, and is rock solid. I haven't touched it the year I've had this setup and have had zero connectivity issues. Using the CL router I would have frequent power cycles that increased to daily after 1 year because it was dying. You can find a few detailed tutorials online if you search for "replace CenturyLink fiber router mikrotik." If you are interested and can't find them, I'm sure I have them bookmarked. Of course there are any number of other router options, I went with this one because 1) it was affordable, 2) people consistently had success with it, and 3) it is one of the few that is able to handle symmetrical gigabit speeds.