I was pissed at my ISP locking down features so I mapped the whole routing infrastructure behind it. Port forwarding broken? "That's just how it works." Custom DNS? "Not supported." Bridge mode? "What's that?"
Spoiler: it all works. They just don't want you touching it.
So I pulled the config.bin off my ZTE F670L — the same router they shipped me, the same one they said was "fully managed for my convenience" — and decrypted it.