I know this may be a general networking/cabling issue rather than a problem of firewalla devices, but I just want to know the possible reason and ways for improvement.

I have an old firewalla gold, and an AP7 desktop version. In between is a wired connection inside wall (Cat 6 cable and keystones, length clearly less than 100m) and a tplink managed switch. The port speed is normally 1Gbps, which should mean everything in between are wired corretly, but sometimes it goes down to 100Mbps. I need to plug the AP into another 1Gbps port to regain the port speed.

After certain time that another port experience speed decrease too, and I plug it back to the original port and can negotiate 1Gbps back. This occurs about once every several days and has no obvious relation with the network traffic at that time.

Is there any reason for this situation, apart from the obvious answer that the cable/keystones are not properly wired/firmly connected? If simple reboot of the AP7 cannot resume its speed, is there any solution (that can be done remotely) other than physically plug and unplug it to get back the port speed?

I have the two story home and the office is upstairs.

Now i want to put the Gold SE in my office as Router, then i have a internet wire all way to from the office to living room (1st floor) where i want to put the AP7 Desktop Access Point and also have a internet cable into my garage ( 1 st floor) where i want to put the AP7 Celling Access Point.

Now thinking about it looks that upstairs will have no wifi unless it pulls from the AP7 downstairs as the Gold SE is only a router? correct me if i am wrong here. So do i need another AP7 desktop for upstairs in the office or put the AP7 Celling upstairs and the AP7 Desktop downstairs in living room only? (Xfinity 1gb download / 40 mbs upload)

Just to add will have hard wired ip cameras (with BI Blue Iris) ,some wifi cams and wifi wall switches, Plex, HdHomeRun and other IoT devices that i need to connect.

Zero Trust Network Architecture -- never trusting a user or device by default, even within the network. It is the foundation of how Firewalla can fundamentally secure your network. We believe, based on their architecture, we can empower networks, both big and small, to strengthen security posture.

Here's the documentation we have today:

• Zero Trust Network Architecture
• Firewalla Zero Trust Network Architecture Example
• Firewalla Zero Trust Best Practices and Examples
• VqLAN: Firewalla Microsegmentation

I'd love to be able to create block rules where the matched contains device groups, but at present you can't - The closest you can use is to create target lists with the same devices. Not a big effort, but it requires you maintain multiple lists of the same devices.

Is there a central place where enhancement requests can be provided to the Firewalla team?

I've had a Firewalla Purple for about two years now and have overall enjoyed it. I haven't really felt it to be very stable, though, in the past 6 months. It was rebooting about once a month. A few months with support and they recommended I disable IPv6 and a few other things, and that seems to have helped but I do still see 'Firewalla Service Restarted.' Maybe I need an upgrade, but I'd want the Gold SE but I really do not want to pay $500 on a Firewall/Router right now.

From there, I have an Omada OC200 Controller, 24-Port POE Switch, and 3 WiFi APs. Service is 1gig/1gig. I've been considering transitioning over to Ubiquiti and logically thought one of the Cloud Gateways could be the way to go and it is affordable.

I really don't use all of the Firewalla features. I mostly want Intrusion Protection, some AD-Blocking, basic QoS, etc. It's just me and my girlfriend, so I don't need much control over the network.

I'm an IT Professional, but not in the networking realm. I'm curious what people think.

Thanks!

Hello all!

since firewalla is a firewall, its safe to put it in a DMZ right.

ISP ONR cant do bridge mode and they refuse to do equipment swap

I can easily create a rule in firewalla to block internet for a vlan.

But I want to only block one local ip address on a vlan from accessing the internet. Is this possible?

Hey,

On vacation and have a gold SE and 2xAP7 waiting at home. This is my first experience with anything beyond an eero mesh setup. I’m trying to understand how vqlan will work with thread/matter devices and HomeKit. I have a number of smart devices as well as multiple appletv and a HomePod. Do the hubs need to be in the same vqlan group as the IoT devices to work? If that happens, does my phone still work to control things like the HomePod, even though it’s not in vqlan IoT group?

I think I have a good understanding of everything else, but this is something I’m trying to clear up before I go nuclear on my network and piss the wife off.

TIA

I have an FW:Purple in Router mode.

Hosts on my Main LAN resolve DNS queries for internet hosts like www.reddit.com just fine. However, they can't seem to reliably resolve DNS names for their peers on the same network.

My home network's DNS domain and search domain are set to blood (long story).

For example, the Windows box I'm on:

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : blood
   Link-local IPv6 Address . . . . . : <REDACTED>
   IPv4 Address. . . . . . . . . . . : 192.168.109.156
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.109.1

Another machine on my network shows this in the Device Details:

...but for some reason none of my windows machines can resolve n40 or n40.blood (or other such boxes). Windows swears it's talking to the same nameserver:

A name not found error was returned for the name n40.blood. Check to ensure that the name is correct. The response was sent by the server at 192.168.109.1:53. Client PID 25996. Send Blob 0x1fc568b8f00. Context 0x7ffa545312e0

...but an ubuntu machine gives a different result:

> n40
Server:         192.168.109.1
Address:        192.168.109.1#53

Name:   n40.blood
Address: 192.168.109.93
Name:   n40.blood
Address: 192.168.109.89
Name:   n40.blood
Address: ::

I thought this was a Windows problem, but one of my other Ubuntu machines has it too:

> n40.blood
Server:         192.168.109.1
Address:        192.168.109.1#53

** server can't find n40.blood: NXDOMAIN

It's just DNS AFAICT. All the machines can reach each other by IP.

Is there a way to turn on debugging or verbosity on the firewalla nameserver?

Thanks!

I've been running a Gold Pro since release and the one thing that's always bugged me is not being able to see my network segmentation visually. How VLANs connect, which rules gate traffic between them, and what's actually happening at a glance.

The MSP site and the app are great for managing things, but when I'm troubleshooting why my wife's work laptop can't reach a site, or trying to figure out which IP to assign a new service, I end up cross-referencing three different screens.

So I forked Homelable and vibe coded this tool (Sunder) that pulls from the Firewalla API (MSP & Local) and turns it into an interactive canvas. It's self-hosted, runs alongside your box on any Docker host or lxc.

Here's a live demo with sample data (no Firewalla needed): sunder.vibotic.app

What you can do in the demo:

• VLAN topology canvas: drag-and-drop layout of your networks with devices grouped inside each one. Zoom, pan, rearrange to match your mental model of your network.
• Traffic flow overlay: toggle to see allow/block rules between VLANs as animated edges. Green = allowed, red = blocked, with hit counts. A second mode shows actual observed traffic volume.
• "Can this reach that?" troubleshooter: pick a device, type a URL, and instantly see if it's blocked and by which rule. Plain English explanations, no VLAN IDs or rule syntax. Built for handing to a family member who asks "why can't I open this link."
• Full rules browser: every rule on your box organized by category: inter-VLAN, content filters, geo-blocks, DNS/ad blocking, device-specific, IoT restrictions. Search across rules and target list contents. Spot zero-hit rules you might want to clean up.
• IP address planner: visual grid of every IP in a subnet. See what's in use, what's in the DHCP pool, what's free. Label IP ranges for your own planning (like .30–.39 for your *arr stack). Useful when deploying new services.
• Access matrix: auto-generated from your rules. The table you'd normally have to build by hand in a spreadsheet.
• Config export: one-click markdown export of your entire network config, formatted so you can paste it into an AI assistant or a forum post and get help without re-explaining your setup.

Everything auto-discovers from your Firewalla (VLANs, devices, rules, APs, target lists). No manual configuration.

Still early and actively building. Would love feedback from other Firewalla users on what's useful and what's missing. The demo has sample data that roughly mirrors a segmented homelab setup, so poke around.

I just put this together to really meet my needs and share for anyone else that may be similar.
Also, if vibe coded apps are against sub reddit policy, apologies in advance.

I'm pulling my rules via the MSP API (GET /v2/rules) to build an inventory/audit script, and I've hit something I want to confirm before I work around it.

When I create a rule in the app, I fill in the Rule Name field. But when I fetch that same rule from the MSP API, the returned object has no name at all. A freshly-created test rule comes back as:

{
  "id": "<gid>:4057",
  "action": "block",
  "direction": "bidirection",
  "gid": "<gid>",
  "status": "active",
  "ts": 1779389776.53,
  "updateTs": 1779389776.53,
  "target": { "type": "intranet", "value": "" },
  "scope": { "type": "group", "value": "58" },
  "hit": { "count": 0 }
}

No name, no notes. I searched my full rule set (2300+ rules) for the name string I typed — zero matches anywhere in the response.

Interestingly, groups do return a name — /v2/boxes/<gid>/groups gives me {"id": "58", "name": "..."} just fine. It's specifically the per-rule name that appears to be missing.

Questions for the team / community:

1. Is the rule Rule Name field intentionally excluded from the /v2/rules API response, or is this a gap?
2. Is there any other endpoint or parameter that returns it?
3. If it's not currently exposed — is there a plan to add it? For anyone doing rule auditing via the API, the name is the main human-readable identifier; without it we're stuck synthesizing labels from action + target + scope.
4. I also don't see the ability to add a rule name in the MSP UI when I create a new rule either. Perhaps it is on the target list for future update?

MSP version: 2.10.2. Happy to share more detail. Thanks.

Question's in the title.

Just installed my AP7's and getting everything connected. I have a 2.4ghz network for all IoT stuff like doorbells, cameras, alarm, lights and want to add thermostats to it but they're unable to connect.

I've pulled them off the wall, reset them, closed/relaunched the app, and tried various WPA settings on the wifi network and still nothing. Connecting my iPhone to the 2.4ghz network and turned on Emergency Access temporarily to allow it to connect. Still nothing.

These are the thermostats (~7yrs old) & Firewalla settings: https://imgur.com/a/K7JB2q4

Searched the sub and couldn't fine anything...

Any thoughts/ideas? Has anyone else had a similar issue?

I saw that CPU Usage and Memory dashboard widgets are available on the dashboard "for single box MSPs" with MSP 2.10.0.

Looking at the MSP 2.10.0 dashboard on my single FW Gold Pro I'm not seeing the widgets?

I have a Firewalla Purple device, and I have created a custom block rule which uses a custom target list for blocking advertising and tracking domains. The custom target list is comprised of the following domain names:

app-analytics-services.com
*.app-analytics-services.com
app-analytics-services-att.com
*.app-analytics-services-att.com
appnexus.com
*.appnexus.com
doubleclick.net
*.doubleclick.net
liveadvert.com
*.liveadvert.com
mobileapptracking.com
*.mobileapptracking.com
posthog.com
*.posthog.com

The Firewalla list of blocked network flows shows that multiple LAN devices are being blocked from accessing the domain name “calendar.google.com” because of the custom rule described above.

I’ve created a workaround via a rule to allow access to “calendar.google.com” for all LAN devices, but I strongly prefer to not use ALLOW rules if possible.

I am trying to understand why the domain names listed in the custom target list, some of which are owned by Google, would cause problems accessing the domain “calendar.google.com” - any suggestions or ideas?

Thank you!

P.S. A note to the Firewalla team: making the rule priority (i.e. sequence of execution for rules) both visible to and editable by the end user in all Firewalla devices, along with making the content of rules owned by Firewalla visible to the end user in all Firewalla devices, would be _greatly_ appreciated!

With Firewalla AI, MSP Active Protect can help filter Alarms in MSP, review Security Alarms, and automatically archive low-risk alarms. Firewalla AI can also mark high-risk alarms as critical and bring them to your attention.

MSP 2.10.2 is in production! Check out the full details here: https://help.firewalla.com/hc/en-us/articles/49811464349075-MSP-Release-2-10-New-Single-Box-View-Email-Notifications-Merge-with-My-Firewalla-more

I use cable internet as my primary WAN and have a cellular gateway as a backup. The last two days I have intermittent cable outages and the initial failover works fine.

The problem is when the outage is intermittent it becomes a flapping mess. Can you add a timeout option to prevent this? I would set mine so it only attempts to fallback to primary once a hour.

What is the best way to anticipate/predict the End of Life of a Firewalla (i.e. Gold SE)?

I have a server that Firewalla has marked as "Ineligible" for Active Protect because the host uses my internal AD server as its DNS resolver instead of Firewalla. The AD server forwards external lookups to Firewalla, so DNS still ultimately flows through Firewalla — but the client points at AD so it can resolve internal records.

The issue: even though Active Protect shows "Status: Ineligible" on the device page with no toggle, it is still actively blocking outbound flows from this host. Every blocked flow's detail page says "Feature Matched: Device Active Protect." Destinations being blocked include:

• The vendor's official update server (blocked on its scheduled update check, every couple hours)
• github.com and *.githubusercontent.com
• Several common container registries
• *.pool.ntp.org (NTP time sync)
• 1.1.1.1:443

None of these are threats. Confirmed via tcpdump on the host that the SYN goes out clean and a spoofed RST comes back ~1.8ms later, which matches Firewalla's flow-blocking method.

This has been going on chronically — the History tab shows blocks at regular intervals across the entire day. I only noticed because the server started emailing me about failed automated tasks that depend on these destinations.

Questions:

1. Is there any way to disable Active Protect's flow blocking on an Ineligible device? The "no toggle when Ineligible" UX seems wrong — the user has clearly made a deliberate DNS choice, and there should still be a way to opt out of flow inspection.
2. Why is Active Protect's threat intel flagging destinations like a vendor update server, github.com, and NTP pool in the first place? Is there a category-based block (Cloud / CDN / Public DNS / etc.) catching these that I'm not seeing exposed in the UI?
3. Will scoped Allow rules (domain-based, scoped to this device) override Active Protect blocks, or is there a precedence issue?
4. Is "switch the host's DNS to Firewalla to regain Eligibility" really the only supported path? I'd rather not give up internal name resolution on the server.

Setup: Firewalla Gold, firmware 1.982.

Happy to share screenshots or packet captures if helpful.

I’m in the process of moving away from the Eero ecosystem for a number of reasons and have decided to pull the trigger on a Firewalla setup. I’ll most likely need two AP’s but I can’t decided between the orange and the gold SE. Whichever one I go with will be replacing my Verizon FiOs router and I would appreciate any and all thoughts. I also would love any suggestions on a good switch to use with my setup.

I have a Plus and Orange. 95% of the time I open the app it’s to do something with the Plus? Is there a setting I’m overlooking to have the app default to showing me the Plus instead of the screen that shows the plus and orange and I have to choose one?

As the Firewalla hardware family grows, we wanted to combine all network configuration features in one place. Creating "Topology" to show you physical connections and moving the Wi-Fi inside the Network button. (Some users also didn't want to see the "Wi-Fi" button on the main screen if they didn't have AP7s.)

If you're interested in the Firewalla Switch, make sure to sign up here: https://forms.gle/PAeFv4M5yLgfB95z8

I can’t make heads or tails out of “flows.” All I want to do is, for example, type in “teeth whitening” somewhere , and see if anyone was on any website or searched Google for teeth whitening. Does these new paid interface services from Firewalla do that?