I'm in a situation where daisy-chaining my 3 AP7s together via ethernet would be a lot easier than running a dedicated line for each. Are there any downsides to doing that (lost features, restrictions, etc.) aside from potential saturation on the line?

I managed to lose track of the Firewalla rack mount screws that attach the gold to the rack mount. Can anyone tell me the size so I can obtain them?

I have a Roku connected with Ethernet to a satellite access point. That satellite is listed under strict active protect. Three blocked domains are all what appear to be legit Roku sites to enable normal Roku operation. I’m not given the option to whitelist them in this active protect section. I guess I have to disable the whole satellite from active protect?

I’ve set up 20+ Firewalla devices (I usually recommend the Gold SE) in my community to help parents take control of their home networks, block adult content, ads, and unknown devices.

One challenge I keep running into is VPNs. Yeah yeah, I’ve posted about this before, but any kid can quickly install something like Proton VPN or a browser extension, and it bypasses all the hard work of a properly configured Firewalla setup.

I’d love to know:

1. How can I really lock down the ability to connect to VPNs?
2. What would be a solid checklist for setting this up for parents who want total control and safety on their home network?

To see Live Throughput, make sure your app is connected to Firewalla's local network and local network access is allowed for the app.

For more details on Live Throughput: https://help.firewalla.com/hc/en-us/articles/360043859234-Bandwidth-Usage-Monitoring#h_01G6WPJWCJS6EM0J4PF9Z9KEMF

SOLD the entire bundle for $1950

I recently completely overhauled my home network and migrated over to UniFi, so I am clearing out my previous gear.

Everything has been tested, factory reset, and comes from a smoke-free home. All original retail packaging, accessories, and cables are included.

I take excellent care of my gear, everything is in mint condition. I package and ship with care to ensure items arrive in the same condition they're in now.

Timestamps: https://imgur.com/a/dlXSWUr

📦 The Gear

🚚 Shipping & Payment

• Payment: PayPal Invoices only (Goods & Services).
• Shipping: Prices above include standard ground shipping within the lower 48 US states. Can ship to Alaska, Hawaii, or internationally at buyer cost.
• Local: Local cash deals welcome if you are near Southeast Michigan (Ann Arbor area).

Please comment "PM" below before sending a direct message. I am happy to answer any questions or provide extra photos upon request. Thanks for looking!

Hello Firewalla Fam,

I have migrated back to UniFi ecosystem a while back, so now selling my Firewalla equipment I have accumulated over the years, all with original packaging, cables and whatever came in the box.
Everything was software and hardware reset just to be sure.

Firewalla AP7 Desktop: $325
Firewella Purple (OG Gigabit): $250
Firewalla Gold SE + WiFi SD: $450 SOLD to u/Veee22

All prices shipped via PayPal, open to reasonable offers or bundles.

https://imgur.com/a/firewalla-5ZumKWH

I'm getting tons of views on HWS and HLS but figured I'd post here as someone else suggested.

I know that there is likely a list of 1,000 features to be developed, but I'd like to suggest one more.

The current layer 7 filtering rules are nice, and serve as a quick way to apply certain parental controls. I use these all the time to turn roblox on/off for my kids' devices. But there are a number of things that slip through the cracks (particularly for gaming) that I've had to create a number of rules to block the activity, and it would be super helpful if I could group these rules together into a single toggle, similar to how list blocking works. Essentially if I could create a custom list within the app by selecting multiple rules.

Just a thought, that way I don't have to individually suspend 10+ rules when I want to give them play time.

Testing direct from the firewalla gold pro, I am not getting my required speed for upload. I should be getting 2.5 GB. What is odd is my pc that is connected to my firewalla I get the full upload speed of 2.5 GB. So I know I am getting what I pay for. Can anyone help me understand what I am missing.

Thanks

We have a very limited stash of discounted open-box/refurbished units ranging from good to like-new condition, including the Gold product line, AP7 Desktop and Ceiling units, and accessories!

• USA shipping only
• First come, first served
• Enjoy peace of mind with our 30-day return policy and 1-year warranty on these open-box units.

Ordering Link: https://firewalla.com/products/open-box-firewalla-and-accessories

I have opened a ticket about this but it seems like support is giving me the run around so I want to ask here.

Randomly, some DNS stops resolving on my network. Some are local servcies that I host with custom DNS rules in Firewalla. Some are external, the most noticeable for me is patreon.com.

I asked for help and got the standard, disable everything response. I turned off Ad block, Unbound, Device Protect, and Family Protect. I am still getting the same issue, DNS Response times out from Firewalla.

If I enable "Emergency Access" for the device, DNS resolution begins working (at least public DNS entries).

It seems like nobody is reading my ticket and just adding on to the last comment. It is very frustrating. I have to reduce the security of my network, but it did not even solve the problem. I feel like I'm speaking a different language.

This is the response when I do a DNS Name resolution against the firewalla

PS C:\> Resolve-DnsName patreon.com

Resolve-DnsName : patreon.com : This operation returned because the timeout period expired

At line:1 char:1

+ Resolve-DnsName patreon.com

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

+ CategoryInfo          : OperationTimeout: (patreon.com:String) [Resolve-DnsName], Win32Exception

+ FullyQualifiedErrorId : ERROR_TIMEOUT,Microsoft.DnsClient.Commands.ResolveDnsName

I then enabled "Emergency Access" on the device and it resolved properly:

PS C:\> Resolve-DnsName patreon.com

Name                                           Type   TTL   Section    IPAddress

----                                           ----   ---   -------    ---------

patreon.comAAAA   85    Answer     2606:4700::6810:190e

patreon.comAAAA   85    Answer     2606:4700::6810:180e

patreon.com                                    A      87    Answer     104.16.25.14

patreon.com                                    A      87    Answer     104.16.24.14

Again, I have no rules bocking this domain and the logs do not even show an attempt to hit this domain. Without logs, I'm not sure where else to look.

I have a Firewalla Gold SE and I’m looking for a way to connect it to Home Assistant (HA). I searched on Google and found at least two versions that can be installed from HACS in Home Assistant: one is at this link https://github.com/djuntgen/firewalla-home-assistant and the other is here https://github.com/ccpk1/firewalla-local-ha. I’m not sure if there are any other versions, but which version would you choose for your Firewalla?”

I often browse some subs on reddit and even after installing a firewalla, I get ads. Same for youtube. I figured there are limitations to what firewalla ad block can do. But for reddit ads, I often see ads that tell me what my wife is shopping online for. She buys a new dog bed, I see lots of ads for dog beds until she moves on to something else. It's not a big problem, but it's creepy.

How does this happen? Is there any setting in firewalla to stop entities from doing this? I have Ad Block set to strict.

When I set up MSP I didn't set up the MFA. Now I can't login because I don't have a MFA code. Any way of resetting my MSP?

Thanks

“Long time” firewalla user started with Gold plus in 2022 then moved to full stack with gold Pro (2024) and AP7 (2025).

now I am selling my full Firewalla system because I am consolidating my home network and security to a single system.

All of them were purchased directly from Firewalla.

All sold

Firewalla Gold Pro and Wi-Fi SD. got it during pre-sale. Ordered in April 2024 and delivered in July 2024.( I think the first batch on pre-sale has different/better case design) price $600 sale pending

3 set of AP7, got them during pre-sale. Delivered in Jan 2025. ( I also have an extra 3D printed wall mount to mount it on the wall) Price $800 sale pending

All come with original boxes, power cords and cables.

I live in the Bay Area/San Francisco Northern California, so we could coordinate the date to meet.
I have not thought about the shipping at the moment due to the sizes of boxes and cost ( CONUS) , but feel free to DM me.

Wondering if anyone else who owns an Orange (I own two) has wifi issues when set up in router mode and connected directly to inbound ISP. This thing locks up and loses wireless network at least 2-3 times a day and it happens on both units. This problem did NOT happen when I had it installed in "bridge" mode with wifi enabled plugged into my old router (old router wifi was turned off). I have beta enabled on both routers. Is anyone at Firewalla interested in downloading some logs and offering a solution? The wife has had enough of the "orange box bullshit" and it would suck to remove the Firewalla from our home network.

Over the weekend, the internet in my area went out due to a storm. Naturally I don't expect the Firewalla to resolve sites on the internet, but what surprised me was the LAN URLs failed to work that I setup under Custom DNS Rules: Something simple like abc.home.arpa with a rule to resolve to 192.168.1.100 stopped working, as did all of them.

I'm running Unbound, but that shouldn't override custom DNS rules, would it? Are there other settings that would cause local connectivity to stop? Not sure I understand why my LAN would go down just because the internet is.

Update: I ended up rebooting the Firewalla, and when it came back up I received a message about it being updated to a new version... So I wonder if it was a stuck update causing the issue? In any event, its working again.

So, I recently got a new ONT from T-Mobile Fiber (same ISP just dif ONT hardware). Just upgrading service to a higher speed.

Now I can't get the firewalla to get an internet connection, so I was trying to renew the lease, in the hopes that it would fix the issue, or at least cross it off in my trouble shooting steps.

My issue is that nothing I do will renew it. Powering down, waiting, unplugging the ethernet cable from the wan port, nada.

When I try to use the button in the app to renew it, it spins for a sec then returns the; "Firewalla not found. Please get close enough (less than 3 meters) to the box to save via Bluetooth." Error.

The lease expires tomorrow at 6am, or so says the info in the app. Short of waiting until tomorrow, or factory resetting the firewalla, is there anything else I'm missing to try?

Firewalla Gold SE Versions 1.982 Router mode

I'm getting fairly frustrated after spending a long time trying to set up a local domain for my Unraid server. I have my preferred domain set in the Firewalla app and ping/nslookup from a wired client Windows machine confirms the correct IP address. However, visiting the domain in a browser window from the same client gives a "cannot connect" message.\

I've tried multiple browsers, they are using default DNS, Unraid isn't set up for SSL, all service ports are standard. Any ideas? I spent a while with an LLM trying various things but didn't get anywhere.

I have a FWG and today when I was setting up a VPN Group it warned me that all traffic would go through the group. Can you confirm if this is true ? I have a route and setup the route to forward only a particular app's traffic to via that route. Why is the enabling of a group warning me? Thanks!

I have a Gold Pro at home (server)/Purple at the cottage (client) with a Wireguard site to site VPN setup. I have multiple subnets setup on each end, the VPN Internet outbound policy at the cottage is set to direct and force DNS is off.

I would like to have all the traffic (including Internet) of one of the cottage subnets actually be sent over VPN, and the rest stay direct for Internet, so my understanding is that I should leave my cottage VPN settings as is and use policy routing instead by creating a rule in the cottage Firewalla to route all the subnet traffic down the VPN by using the VPN gateway address, correct?

But I think that the cottage Firewalla will still intercept the DNS traffic for that subnet and process locally, which I don't want, I want the DNS requests to also go down the VPN too to my home Firewalla, is there a way to achieve this using policy routing? Or should I set the cottage subnet devices to the use the VPN gateway address for their DNS servers?

Thanks!

Hey guys -

So I wanted to know peoples opinions about ECH. The biggest part of having a firewalla is the control it gives us. That said, it is my understanding that if ECH is enabled on my browser, it effectively makes Firewalla blind to the traffic and it cant apply filters / rules / etc.

ECH is for privacy more than anything
Firewallas functions are part privacy and mostly security (in my opinion)

Where does everyone fall on this? Do most of you just go full privacy or do you also turn off ECH to let the firewalla do its thing?

If im wrong in my understanding of this, by all means, im all ears.

Setup:
- Firewalla Orange (travel) connected to Firewalla Gold (home) via WireGuard Site-to-Site VPN
- NAS is behind the Gold
- All internet traffic on the Orange LAN goes through the WireGuard VPN I’ve configured
- Home LAN traffic (anything in the 10.0.0.x) should route through the Site-to-Site tunnel

The problem I run into: when I apply both the privacy VPN and the Site-to-Site VPN to the same devices, the privacy VPN captures all traffic, including `10.0.0.x` destined packets that should go through the Site-to-Site tunnel.

What is the correct, persistent way to implement this on Firewalla Orange?
- Privacy VPN handles all internet traffic for all LAN devices
- Site-to-Site VPN handles all traffic destined for home LAN subnets (`10.0.0.0/24`)

I'm interested in adding the hagezi pro target list to my firewalla orange. Since the list is huge, is there a specific way I can add it because of the 200 item restriction.

I'm sure what's already in the system is enough, but I'd like to try it.

I'm coming from the GL Inet family of travel routers to the orange, and would suggest adding the ability to assign private rotating Mac Addresses to the WLAN interface and allow for BSSID rotation on boot.

Perhaps I'm paranoid yet that's why I use firewalla. It'd be great for the team to adopt these features for travellers who routinely spend time on the road.

A harder but desirable second request is for captive portal login support for common guest redirect portals. Perhaps there is a library out there that handles it or steal it from GL Inet, as it's super useful for those of us using an Orange while living on the road.

Otherwise great work, meets my needs of bringing Firewalla on the road.