The best-of-both-worlds solution here is to have the outer ISP-provided router put your own router into some kind of DMZ, or use a bridge mode if the ISP router provides it. This basically turns your ISP-provided router into a dumber modem, and leaves all NAT and routing to your own hardware.
Other comments here mention how to put the AT&T router behind a Ubiquiti gateway and proxy the authentication to it via some scripts. This reduces the reliance on the AT&T router for direct traffic, but you still need the router operational for those authentication handshakes.
The latency measured inside is around 9-11ms, so much higher than the 3-4ms measured at the ATT gateway.
I am not doing any port-forwarding, but I can definitely see it run into all kinds of problems, or require some configuration beyond my simple skills.
I'll investigate your comment: The best-of-both-worlds solution here is to have the outer ISP-provided router put your own router into some kind of DMZ, or use a bridge mode if the ISP router provides it. This basically turns your ISP-provided router into a dumber modem, and leaves all NAT and routing to your own hardware.
The router they provided also had a tendency to both get 'congested' and drop connections.
Last, they have remote access to the provided router and do automatic, remote updates, which I am opposed to. I suspect they have other features they can abuse remotely. I want to control all my own hardware.
Are there any benefits to what you're doing over just doing that?
Edit: In my case, bandwidth drops from 970mbps at the ATT gateway to 930mbps at the internal router (2nd NAT). Latecy drop is higher, from 3-4ms at the ATT gateway to about 9-11ms, but most likely that is due to the Moca 2.5 that I've had to run between ATT and my internal router.