A cable modem in front of OPNsense, pfSense or UniFi has one job: pass the ISP’s address to your router and stay out of the way. Every standalone modem does that by design. So the best cable modem for your setup comes down to three checks: is it on your ISP’s approval list, is it DOCSIS 3.1, and is its Ethernet port faster than your plan? A gigabit port caps a 2 Gbps plan before the firewall ever sees it.
We checked six DOCSIS 3.1 modems against maker spec pages, ISP approval lists and live Amazon US listings on October 27, 2026. We had no cable service in the lab, so throughput figures are the makers’ numbers. The firewall side was built on OPNsense 26.7 in October 2026 under nested KVM on an Ubuntu VM on Proxmox with a simulated modem, so the lease trap and status page fix below are real captures. We also cover bridge mode, the Xfinity, Spectrum and Cox lists, and 2.5GbE versus link aggregation.
Our picks at a glance
All six are pure modems with no router or WiFi inside, which is exactly what you want in front of a firewall. We ranked them by how well they fit a multi-gig cable plan behind a router you own:
- Best overall, ARRIS SURFboard S34: a 2.5GbE port, the faster upload tiers on Xfinity, and maker support for Comcast, Charter and Cox. About $230 to $240.
- Best value multi-gig, Hitron CODA56: one 2.5GbE port, sold by Hitron itself, with the widest ISP list of the group. About $185 to $195.
- Best for link aggregation, NETGEAR Nighthawk CM3000: a 2.5GbE port plus two gigabit ports you can bond, mid/high-split upstream. About $285 to $300.
- Best for gigabit plans, ARRIS SURFboard SB8200: two gigabit ports, sold and shipped by Amazon, and over 20,000 reviews. About $135 to $140.
- Cheapest 2.5GbE port, Motorola B12: the MB8611’s successor at about $95 to $110, sold by third parties.
- For a UniFi rack, UniFi Cable Internet (UCI): a 1U rack-mount modem with a 2.5GbE port, sold by Ubiquiti for about $280 and not on Amazon.
Cable modem prices move often, so treat the bands as where they sat on October 27 and check the live listing before you order. Two of the Amazon picks are third-party offers (Woot sells the S34, Kanga Supply the B12), which matters if you ever need a return.
How we picked and what we tested
Every spec in this guide comes from the maker’s own page or datasheet, and every Amazon link was checked for a new, in-stock offer on the exact model. That rules out a surprising number of listings: the S33 has renewed and used-only ASINs, the MB8611 is now used-only on Amazon, and the NETGEAR CM2000 only had third-party stock with a future ship date. ISP fit comes from each ISP’s own policy pages where they load, and from ModemGuides’ mirror of the Xfinity list where they do not, because Xfinity now puts its list behind a per-address lookup.
We left out three categories on purpose. DOCSIS 3.0 modems are being pushed off the big ISPs’ lists, so a cheap MB7621 is a short-lived saving. Modem and router combos defeat the point of running your own firewall. And there is no retail DOCSIS 4.0 modem to buy in the US yet: Comcast’s XB10 gateway is DOCSIS 4.0, but it is rental-only, and Xfinity says customer-owned modems are not compatible with its X-Class symmetrical tiers.
Our hands-on work went into the router side, where most cable installs actually go wrong. We ran OPNsense 26.7 under nested KVM on an Ubuntu 26.04 VM on Proxmox, with Linux network namespaces playing the modem and the ISP. The modem stand-in answers DHCP from 192.168.100.1 while it has no signal. Once it syncs, it steps aside for the ISP’s DHCP server, the way a real DOCSIS modem behaves on its Ethernet port. To build the same firewall VM yourself, follow our guide to installing OPNsense on Proxmox VE.
The best cable modems side by side
Two columns decide the purchase: the Ethernet ports and the Xfinity upload tier. A plan above 940 Mbps or so needs either a 2.5GbE port or two bonded gigabit ports. On Xfinity, a plan with the enhanced uploads of up to 200 Mbps needs a modem tagged for that tier, while symmetrical X-Class plans above 200 Mbps need Xfinity’s own gateway:
| Modem | DOCSIS | Ethernet ports | Link aggregation | Xfinity faster upload tier | Price band |
|---|---|---|---|---|---|
| ARRIS SURFboard S34 | 3.1 | 1x 2.5GbE, 1x 1GbE | Not advertised | Yes | $230 to $240 |
| Hitron CODA56 | 3.1 | 1x 2.5GbE | No | Yes | $185 to $195 |
| NETGEAR CM3000 | 3.1 mid/high-split | 1x 2.5GbE, 2x 1GbE | Yes, up to 2 Gbps | Yes | $285 to $300 |
| ARRIS SURFboard SB8200 | 3.1 | 2x 1GbE | ISP firmware dependent | No | $135 to $140 |
| Motorola B12 | 3.1 | 1x 2.5GbE | No | No | $95 to $110 |
| UniFi Cable Internet | 3.1 | 1x 2.5GbE | No | Yes | About $280 direct |
Read the table as two groups. The S34, CODA56, CM3000 and UCI are the modems we’d buy for a plan above 1 Gbps, and the CM3000 is the only one that gives you both a 2.5GbE port and a bonding option. The SB8200 and B12 are the cheaper answers for a plan at or under a gigabit, and neither carries the Xfinity faster-upload tag, so skip both if your plan is sold on its upload speed.
ARRIS SURFboard S34, the safe default
We would put the S34 in front of most firewalls and not think about it again. It is DOCSIS 3.1 with two downstream and two upstream OFDM channels on top of 32×8 DOCSIS 3.0 bonding, and SURFboard markets it as optimized for the next generation of upload speeds. The maker says every SURFboard modem is tested by Cox, Comcast Xfinity and Charter Spectrum, and the Xfinity list mirror shows it as Recommended and Next Gen Speed Tier at up to 2.32 Gbps.
- 2.5GbE port: plug it into a 2.5GbE WAN port on OPNsense, pfSense or a UniFi Cloud Gateway and a 2 Gbps plan arrives intact.
- Second 1GbE port: SURFboard does not advertise link aggregation on it, and the Amazon listing describes it as a port for another wired device or a backup handoff that depends on the provider.
- Warranty: two years, limited, which is the norm for this group.
Skip it if the price matters more than the upload tier, because the CODA56 does the same multi-gig job for about $45 less. Also check who’s selling it: on our check date the in-stock offer came from Woot rather than Amazon. The older S33 has the same port layout but is not tagged for Xfinity’s faster upload tier, and at about $200 to $210 from a third-party seller it is not much cheaper. Check the current S34 price on Amazon before you order.
Hitron CODA56 for multi-gig on a budget
Hitron’s CODA56 is the cheapest way we found to get a 2.5GbE port and Xfinity’s faster upload tier in the same box, and it’s sold on Amazon by Hitron Americas rather than a reseller. Hitron lists it for plans up to 2.5 Gbps and names Xfinity, Xfinity Business, Spectrum, Cox Gigablast, Sparklight and Zito as approving ISPs, with Astound, Grande, RCN and Wave as working on their networks. That is the broadest list of any pick here.
Its single Ethernet port is the trade-off. There is nothing to bond and nothing spare, so the CODA56 only makes sense if your router has a 2.5GbE WAN port, which most current OPNsense mini PCs with Intel i226 ports have. Skip it if your router tops out at gigabit, because the SB8200 gives you the same gigabit result for less. The listing is also a variation family with one-year and three-year warranty styles, so confirm which one is selected before checkout, and check the current price on Amazon.
NETGEAR CM3000 when you want both port options
The CM3000 is the one to buy when you do not know yet which WAN port your next router will have. NETGEAR rates this mid/high-split DOCSIS 3.1 modem for up to 2.5 Gbps down and 1 Gbps up. It gives you two ways in: the 2.5GbE port straight into a multi-gig WAN, or the two gigabit ports bonded to a router that does link aggregation for up to 2 Gbps. NETGEAR’s page quotes 2 Gbps for the bonded case in one place and 2.5 Gbps in another, so plan on 2 Gbps. Its comparison table also lists the CM3000 at 2 Gbps down on Xfinity but 1 Gbps on Spectrum and Cox, so the multi-gig case is mainly an Xfinity one today.
Skip it if you do not need bonding, since the S34 and CODA56 cover a 2 Gbps plan through one port for less money. NETGEAR also says it is not compatible with Xfinity Voice, which applies to every pick here because none of them has a phone port. The Amazon listing we link is the current “(NEW) 2.5Gbps” style sold by Amazon.com; an older CM3000 style on the same page is marked discontinued. Check the current price on Amazon before buying.
Do not treat the cheaper NETGEAR CM2500 as a bonding shortcut. It has the same mid/high-split design and two gigabit ports with link aggregation, but NETGEAR’s own table rates it at 900 Mbps down on Xfinity, Spectrum and Cox. At about $195 to $200 from Amazon.com it is a gigabit-class modem that carries Xfinity’s Next Gen tag, but the same table puts its Xfinity upload at 100 Mbps against 200 Mbps for the CM3000.
ARRIS SURFboard SB8200 for gigabit plans
We’d still hand the SB8200 to someone on a plan at or under 1 Gbps, because it is DOCSIS 3.1, it is sold and shipped by Amazon.com, and it has more than 20,000 reviews behind it. SURFboard positions it for plans up to 1 Gbps with two gigabit ports and lists wired speeds up to 2 Gbps, which is the bonded figure across both ports.
Bonding is less useful than it sounds. It needs a router that does LACP on two ports, a plan above 1 Gbps, and an ISP that supports it on that modem, and you are still capped at 2 Gbps across two cables. On a 2 Gbps plan, spend the extra on a 2.5GbE model instead. Skip it too if your plan advertises fast uploads, as Xfinity does not tag it for the faster upload tier. Check the current price on Amazon.
Motorola B12 as the cheapest 2.5GbE port
Motorola’s B12 replaced the MB8611 and keeps its best feature, a 2.5GbE port, for about $95 to $110. Motorola’s datasheet lists DOCSIS 3.1 with two OFDM and two OFDMA channels, downstream up to 2.5 Gbps, upstream up to 766 Mbps, Low Latency DOCSIS where the provider supports it, and a two-year warranty. It names Xfinity, Cox and Spectrum as compatible.
- Upstream split: 5 to 85 MHz with a configurable 5-42 or 5-85 MHz diplexer, and the Xfinity list mirror does not tag it for the faster upload tier, so check your plan’s upload speed against the list before you buy.
- Seller: third parties only on our check date. The listing we link was in stock from Kanga Supply, while the older B12 listing only offered a future ship date.
- Listing: the older B12 ASIN shares a variation family with the MB8611, MB7621 and MB8600, so if you land there, select the compact DOCSIS 3.1 (2.5 Gbps) option.
The older B12 listing’s 3.6-star average on 202 reviews is the weakest in this group, so we’d only take the B12 for a downstream-heavy plan where the price gap to the CODA56 matters. Skip it if you want the upload headroom. Check the current price on Amazon.
UniFi Cable Internet for a UniFi rack
Ubiquiti’s UCI is a DOCSIS 3.1 modem in a 1U rack chassis with one 2.5GbE port, sold on the Ubiquiti store for about $280. Ubiquiti’s activation guide lists Xfinity residential, Comcast Business without a static IP, Spectrum residential and Cox residential, all US only, and once the ISP has activated it the UCI works as a plain modem in front of any router.
Ubiquiti’s spec page adds that on Spectrum, performance may be limited beyond 1,000 Mbps down and 35 Mbps up. Buy it for the rack, not for the specs. A CODA56 delivers the same 2.5GbE handoff for about $90 less and sits on a shelf. Skip it if your gear is not racked or you would rather buy through Amazon, where we found no listing.
Bridge mode on a standalone cable modem
A standalone modem is already in bridge mode, which is why nothing in this guide has a setting for it. It has no NAT, no DHCP server for your LAN and no WiFi, so the public address the ISP assigns lands directly on your router’s WAN port. Bridge mode as a setting only exists on gateways, the modem and router combos ISPs rent out, and Xfinity’s own description is that it “turns off its routing capabilities while leaving the modem capabilities on.”
Bridging a rented gateway works, but you keep the limits that come with it. On an Xfinity gateway, bridge mode turns off the private WiFi, allows only one device to be connected, and does not disable the Xfinity WiFi Home Hotspot. Owning a standalone modem removes all three, since there is no router or WiFi in it to switch off.
ISP approval lists and the end of DOCSIS 3.0
Your ISP decides which modem works, not the modem maker, so check the list for your own address before you order. The lists have moved and tightened during 2026:
- Xfinity: the approved modems page now sends you to the My Device Info lookup, which checks devices against your address. ModemGuides reports roughly 30 DOCSIS 3.0 models dropped from the public list in April 2026, including the SB6190, CM500 and CM700. X-Class symmetrical tiers do not work with customer-owned modems.
- Spectrum: the DOCSIS modem policy requires an authorized modem and splits its list into Recommended and Minimally Qualified, and Charter recommends against the second group because it may not deliver the speed you pay for.
- Cox: its certified modem list blocked our fetch, so open it yourself and check the model against your plan before you order.
- Sparklight: requires DOCSIS 3.1 for any customer-owned modem.
Every list points the same way: DOCSIS 3.0 is on its way out, and DOCSIS 3.1 is the floor for anything you buy now. DOCSIS 4.0 is live on Comcast’s network, and CableLabs rates it for up to 10 Gbps down and 6 Gbps up. It only reaches homes through ISP gateways, though, so a 3.1 modem bought today does not lock you out of anything you can actually purchase.
2.5GbE, link aggregation and your WAN port
A gigabit Ethernet link carries about 940 Mbps of real TCP traffic, so any plan sold above 1 Gbps is wasted on a gigabit modem port or a gigabit WAN port. The fix has to happen at both ends of the cable. On the router side, check the WAN port before the modem:
- OPNsense or pfSense on a mini PC: current Intel i226-V boxes have 2.5GbE on every port, which matches the S34, CODA56, CM3000, B12 and UCI. Our pfSense and OPNsense hardware guide covers the boxes we would use, and our OPNsense vs pfSense comparison helps with the software side.
- UniFi Cloud Gateway Ultra and Max: both have a 2.5GbE RJ45 WAN port by default, so any 2.5GbE modem plugs straight in.
- UniFi Dream Machine Pro and UXG-Pro: the RJ45 WAN is gigabit only, so a 2.5GbE modem needs the 10G SFP+ WAN port and a multi-gig SFP+ to RJ45 module in it. The UDM Pro Max and UDM SE have a 2.5GbE RJ45 WAN.
- Link aggregation: only worth it when the router has no multi-gig port. OPNsense can build an LACP lagg from two ports, but the modem, its ISP-pushed firmware and the plan all have to support it.
If you are choosing between gateways for the router side, our UniFi Cloud Gateway comparison has every port listed. One warning on i226-based firewalls: some boards drop the link under load or after power saving kicks in, and the fixes in our i226 NIC drops guide apply just as much to a WAN facing a cable modem.
The 192.168.100.x lease trap on OPNsense
A cable modem that hasn’t locked onto the cable signal runs its own small DHCP server on the Ethernet port, and your firewall will happily take a 192.168.100.x address from it. That happens after every power cut, because the firewall usually boots faster than the modem syncs. Once the modem is online, the firewall stays on the private address until its lease runs out, and nothing on your LAN reaches the internet in the meantime.
We reproduced it on OPNsense 26.7.7 with a modem stand-in handing out 120-second leases from 192.168.100.1. Before the modem “synced”, the WAN interface and the lease file looked like this:
ifconfig vtnet1 | grep -E 'inet |status'
tail -16 /var/db/dhclient.leases.vtnet1 | grep -E 'fixed-address|routers|lease-time|server-identifier|renewal|rebinding'The WAN had a private address with the modem as its default gateway, and a LAN client pinging 1.1.1.1 got nothing back:
inet 192.168.100.12 netmask 0xffffff00 broadcast 192.168.100.255
status: active
fixed-address 192.168.100.12;
option routers 192.168.100.1;
option dhcp-lease-time 120;
option dhcp-server-identifier 192.168.100.1;
option dhcp-renewal-time 60;
option dhcp-rebinding-time 105;We then switched the stand-in to its synced state, where the modem’s DHCP server stops and the ISP’s server answers instead. OPNsense kept 192.168.100.12 for 107 seconds, and a LAN client pinging once a second lost about 105 replies after the modem had synced. Neither the renewal at 60 seconds nor the rebind at 105 seconds got the firewall a new address. Only when the lease expired at 120 seconds did dhclient start over with a DISCOVER, and the ISP’s server answered within a second. This excerpt from its log drops a duplicate DISCOVER and OFFER pair:
Oct 26 23:53:03 dnsmasq-dhcp[43448]: 2086039777 DHCPDISCOVER(isp-lan) 192.168.100.12 52:54:00:00:01:10
Oct 26 23:53:03 dnsmasq-dhcp[43448]: 2086039777 DHCPOFFER(isp-lan) 203.0.113.52 52:54:00:00:01:10
Oct 26 23:53:04 dnsmasq-dhcp[43448]: 2086039777 DHCPREQUEST(isp-lan) 203.0.113.52 52:54:00:00:01:10
Oct 26 23:53:04 dnsmasq-dhcp[43448]: 2086039777 DHCPACK(isp-lan) 203.0.113.52 52:54:00:00:01:10 fw-lab-01In our lab, that meant the outage lasted as long as the modem’s lease, not as long as the modem took to sync. A real ISP server may refuse the stale address at rebind and end it sooner, but nothing guarantees it. Ours was two minutes because we set it to two minutes. A real modem’s lease can be longer, and the firewall sits on the private address for all of it.
Reject leases from the modem
OPNsense and pfSense both have a WAN option built for exactly this. In OPNsense, open Interfaces, then WAN, and in the DHCP client configuration block set Reject Leases From to 192.168.100.1, then save and apply. The help text in the 26.7.7 source says it is “useful for rejecting leases from cable modems that offer private IPs when they lose upstream sync.” In pfSense the field has the same name under the WAN’s DHCP client settings. In the lab we set it through OPNsense’s config model rather than the GUI, so the menu path follows the 26.7 documentation.
OPNsense writes the setting into the generated dhclient config for the WAN device. Check it from the OPNsense shell (option 8 on the console), using your own WAN device name, such as igc0 on an i226 box:
cat /var/etc/dhclient.vtnet1.confLook for the last line; without the setting it is not there at all:
interface "vtnet1" {
timeout 60;
retry 15;
select-timeout 0;
initial-interval 1;
script "/usr/local/opnsense/scripts/interfaces/dhclient-script";
supersede interface-mtu 0;
reject 192.168.100.1;
}We ran the same power-cut sequence again. The modem stand-in kept offering 192.168.100.12 and its log shows the offers going out, but the WAN stayed without an address instead of taking the bad one. When the stand-in switched to synced, the WAN picked up 203.0.113.52 after 18 seconds and the LAN client lost 20 replies after the switch instead of about 105. Those 18 seconds were dhclient waiting out a retry interval that had grown while it rejected the modem’s offers, so recovery took seconds rather than the length of the modem’s lease.
Set it on day one, before you need it. The only case to leave it off is an ISP whose real DHCP server sits at 192.168.100.1, and you’d notice that at once because the WAN would never come up.
Reaching the modem status page from your LAN
Signal levels and error counters live on the modem’s status page at 192.168.100.1, which is what you check first when the line drops. With a public address on the WAN, OPNsense routes that private address to the ISP’s gateway like any other destination. Whether a modem still answers in that case depends on the model. When it does not, a client on the LAN just times out:
curl -m 5 http://192.168.100.1/That is what we got, with route get 192.168.100.1 on OPNsense pointing at the ISP gateway 203.0.113.1:
curl: (28) Connection timed out after 5002 millisecondsFixing it takes two pieces, and we found the second one the hard way. First, add an IP alias on WAN under Interfaces, Virtual IPs, Settings: mode IP Alias, interface WAN, address 192.168.100.2/24. That puts the modem’s subnet directly on the WAN, so OPNsense stops routing it to the ISP. On its own, though, it did not work. Automatic outbound NAT kept translating LAN traffic to the WAN’s primary address, and a capture on the modem side showed the SYNs arriving from 203.0.113.52, an address the modem has no route back to:
23:57:40.330680 IP 203.0.113.52.37711 > 192.168.100.1.80: Flags [S], seq 893619441, win 64240, options [mss 1460,sackOK,TS val 1462040577 ecr 0,nop,wscale 10], length 0
23:57:41.354542 IP 203.0.113.52.37711 > 192.168.100.1.80: Flags [S], seq 893619441, win 64240, options [mss 1460,sackOK,TS val 1462041601 ecr 0,nop,wscale 10], length 0One outbound NAT rule is the second piece. In OPNsense 26.7 that lives under Firewall, NAT, Source NAT, where the Outbound page used to be. Switch rule generation to Hybrid so your manual rule runs ahead of the automatic ones. Then add a rule on WAN with your LAN subnet as the source, 192.168.100.0/24 as the destination, and the alias 192.168.100.2 as the translation target. We set both through OPNsense’s config model rather than by clicking, so the menu names here follow the 26.7 documentation. Apply, then confirm the rule made it into pf from the OPNsense shell:
pfctl -sn | grep 192.168.100Our lab LAN was 10.0.1.0/24, so the line reads:
nat on vtnet1 inet from 10.0.1.0/24 to 192.168.100.0/24 -> 192.168.100.2 port 1024:65535With the rule in place, the same curl from the LAN client returned the stand-in’s page with HTTP 200, and the pf state table showed the client’s connection leaving as 192.168.100.2. Internet traffic from the same client was untouched, because the rule only matches the modem’s subnet.
Swapping the modem without a dead WAN
Most “my new modem does not work” threads come down to the order of operations, because cable ISPs tie service to MAC addresses. Netgate’s setup guide puts it plainly: certain ISPs, primarily cable providers, will not work properly if a new MAC address is encountered, and some need the modem power-cycled while others need the new address registered by phone. This is the order we’d follow:
- Check the list for your address: run the ISP’s lookup (My Device Info on Xfinity) with the exact model before you order, and again before you return the rented gateway.
- Set Reject Leases From first: put
192.168.100.1on the WAN while the old gateway is still in place, so the first boot on the new modem cannot strand you on a private address. - Activate the modem on its own: connect the coax, then activate through the ISP’s app or phone line. Xfinity’s app flow needs the primary account holder or a manager and says to allow about 20 minutes.
- Power-cycle the modem with the firewall attached: turn the modem off, plug its 2.5GbE port into the firewall’s WAN, then power it back on with the firewall already connected.
- Read the WAN address: it must be a public address (or your ISP’s CGNAT range), never 192.168.100.x. Then load the modem’s status page through the alias and NAT rule above to confirm the downstream and upstream channels are locked.
Keep the old gateway boxed until the new modem has run for a few days. If the WAN never leaves 192.168.100.x, the modem is not provisioned yet and the problem sits with the ISP, not OPNsense. A WAN that comes up but stops at about 940 Mbps needs a look at the link speed on both ends of that Ethernet cable. A 2.5GbE port that negotiated gigabit looks exactly like a slow line. And if a cable outage would take down remote access to the house, a 5G failover router on a second WAN port is the cheapest insurance we know of.
