Running a node behind a hostile ISP

A residential connection is not a neutral pipe. It is a business relationship with a company that has opinions about what you do with it, and increasingly the equipment to act on those opinions.

If you run a full node, you look like a server. Servers are what the terms of service quietly forbid.

What they actually see

Without inspection they see volume, port numbers, and connection counts. With inspection they see handshake fingerprints. A default node advertises itself in the first few bytes of every connection.

What still works

Move off the default port. Terminate through a VPS you control. Where the protocol supports it, use the obfuscated transport — not because it is unbreakable, but because it raises the cost of a classifier that has to run on every customer at line rate.

None of this is a threat model against a state. It is a threat model against a middlebox with a quota.