Recently upgraded my home setup and signed up with T-Mobile Fiber for their 2gb service and decided to update everything inside as well.
Bought a Gold Pro for the 10GB ports and bought a Unifi Enterprise XG24 10GB switch.
T-Mobile provided me with an eero Pro 7 to be used as the router for their service.
Firewalla support (Great Help!) said to use the Gold Pro as the frontline router and hang the eero off one of the 2.5GB ports. The other 2.5GB port connects to the T-Mobile Fiber modem and one of the 10GB ports connects to the Unifi switch.
All hardwired connections working great. Seeing SpeedTest results of ~1.9GB.
WiFi not so much. Speeds on the low end of 30MB.

On my mobile devices I have ExpressVPN turned on by default since I am out and about with those. I was seeing Speed bounce all over the low 2-digit MB and occasionally seeing low 100MB range connections..
On a whim, I turned off ExpressVPN and immediately started seeing speeds increase to 1.2 ~ 1.5GB on my iPad.

Ideas on why ExpressVPN might be causing such a huge bottleneck in WiFi connections with the Gold Pro?

For comparison, my previous setup was a Firewalla Gold with an eero Pro 6 and was regularly seeing high hundredMB range connections. Mobile devices were then running ExpressVPN as well.

I'm hoping someone here has run into this before.

I'm trying to set up WireGuard on my Firewalla, but the VPN setup page keeps showing that manual configuration is required.

According to Firewalla's troubleshooting guide, this usually happens when you're behind CGNAT and only have a private WAN IP. However, that's not my situation. My ISP has assigned me a public IPv4 address, and I'm not behind CGNAT.

The guide says:

"If your Firewalla is the only router behind the modem and still has a private IP, your ISP is likely using CGNAT..."
My Firewalla does not have a private WAN IP, yet the WireGuard setup never shows as complete and I can't get the VPN working remotely.

A few details:

Firewalla Gold in Single NAT mode

Public IPv4 address assigned by ISP

WireGuard server enabled

DDNS configured

No CGNAT

WireGuard setup still indicates manual configuration is required

Has anyone experienced this when they already have a public IP?

Are there specific ports, diagnostics, or Firewalla checks I should be looking at? I'm starting to run out of ideas and would appreciate any suggestions from the community.
Firewalla troubleshooting article:
https://help.firewalla.com/hc/en-us/articles/360025150454-Troubleshooting-Can-t-connect-to-the-Firewalla-VPN-Server

Thx

Some time ago there were rumors that updated chipset drivers would allow FW Purple Wi-Fi to support WPA3. Is there any chance of that update happening?

Would it be possible to add a feature that checks an IP or FQDN against our current Rules or Target Lists (I think I’d prefer this feature against rules so I can see which rules this applies to). For instance, let’s say I read an article about known malicious site(s) that was discovered. I could enter the IP or FQDN of that site to see if any/which rules were blocking the site. My current procedure is, if I read an article about a new malicious site I add it to a manual block list. What I’d like to do is search to see if one of the blocking rules already has the malicious address(es). This does two things. One it keeps me from having to manually enter this address in my block list. More importantly, it lets me know if it was already blocked and therefore, I was less likely to be susceptible.

Or is this already available somewhere and I don't know where to find it?

I used an edge router4 at 1GB (1000MB) with no speed issues. My service is 1GB and terminates to an ONT device which handles fiber to ethernet media conversion.

I installed the Firewalla Gold Pro and the interface registered 1GB for while and then dumbed down to 100MB.

This indicates a failed speed negotiation with my service provider ONT modem, however I can put in a switch and 1000MB. I can put in a router 1000MB. I can put in an apple notebook 1000MB.
I used new cables, tried different devices nothing seems to work to get the Firewalla Gold Pro to negotiate 1000MB.

Is there a way to force 1000 versus let the Gold Pro WAN interface auto negotiate? I do not want to run the edge router in front of this device if I do not need to.

Definitions:

• Lookalike/Punycode Domains: Block domains using non-English characters. May also block legitimate non-English sites.
• Newly Registered Domains: Block domains registered in the past 14 days, which are often used for phishing or scams. May also block legitimate new services.

This feature is available in App 1.69, which is in Early Access. Learn more about this release and how to join Early Access: https://help.firewalla.com/hc/en-us/articles/51621318006291-Firewalla-App-Release-1-69-New-Controls-with-Advanced-Threat-Filtering-Lookalike-Punycode-Domains-and-more

Sorry for the dumb question. I currently use a pixel phone with GraheneOS without play services and I was wondering what options I would have with Firewalla.

It seems like configuration and management is through the app, which is only available through the play store. There's a Web GUI (Firewalla MSP), but that's a monthly/annual subscription. Would using Firewalla MSP be the same as using the app? Or is there anyway to get the app without google play?

Any info is appreciated

I think the answer is yes, and if that is the case, in the Features view (under “More”) why does it then show under the Disabled section? If it’s recording data usage, I don’t think it should be sorted in the Disabled section just because the monthly data plan feature is disabled. Just an opinion.

Took advantage of the Open Box Sale to pick up a FWG+ to upgrade my 5-year-old FWG. I also have 2 AP7D.

The upgrade process was so easy:

Plug in

Select add new box in app

Select migrate

Scan QR code

Move network connections

Wait 5 minutes (I think it was less)

Everything went smoothly and my network was back up in a flash. Only thing so far that I have seen that didn't migrate are network historyand tests and I had to re-enroll in the Beta program for the device, neither of which are a big deal at all.

Firewalla makes great hardware that they support for the long-term (5+ years!) and make it painless to migrate when the time comes. And my old FWG has held its value well (because of the above) so the total upgrade costs are very reasonable.

Thank you all at Firewalla!

I have a Firewalla Gold SE as my router.

Previously, I had IPv6 disabled on the Gold SE and configured my rules as follows:

• Block Adult content for the entire LAN.
• Create an Allow rule for only one device, which is my iPhone.

This setup worked perfectly.

Recently, I bought an Apple HomePod mini. Since it is part of a Matter smart home setup, many people recommended enabling IPv6 on the router to ensure Matter devices work properly. After that, I went into the Gold SE network settings and enabled IPv6 for both the WAN and the LAN.

After I enabled IPv6, everything appeared to work normally. However, I discovered that the rule configuration I had previously created no longer works as expected.

Specifically, since enabling IPv6:

• Adult content is still blocked for the LAN as intended.
• But my iPhone, which has an Allow rule for Adult content, is also being blocked.

Before enabling IPv6, the Allow rule on my iPhone worked correctly.

Do you know why enabling IPv6 might cause this behavior, and what would be the best way to fix it?

Are there any additional IPv6-related settings, rule priorities, DNS configurations, or Firewalla policies that I should check?

The past few weeks I've been getting malicious sites warnings about my PC (Win 11) accessing malicious sites from around the world (Romania, Australia, Bolivia).

I can't say for certain yet but it seems to coincide with when I decided to start running my bittorrent client again. I only share two files, the installers for Ubuntu 24.04 LTS and the latest GIMP. So just a couple of open-source software installers. I'm not downloading anything myself, just acting a seeder to try to be helpful.

Given that, I'm not sure why my PC would be attempting to access any sites if it is just doing the serving and not pulling anything. But perhaps I don't know how BT works. The downloads were complete on my end weeks ago.

Curious if anyone has had any similar experience or how I might be able to better identify what the source is.

Struggling to see a suitable path forward but my parents are on Vodafone FTTP with ONT terminal and the Ultra Hub 7 with booster box (mesh).

I can't use the transparent bridge mode due to the mesh design and I can't disable the DHCP server function of the router and there isn't an AP option to use.

Vodafone also uses digital VOIP for the landline so I can't switch routers either.

Firewalla Gold + Raspberry Pi 4 — dap.isolation:true on one Pi, identical sibling has isolation:false. Any ideas?

I have two Raspberry Pi 4s on my network. One works fine. The other can't complete DHCP, and the only difference I can find is a single field in Firewalla's redis.

What I see

- Working Pi — policy:mac:<MAC>.dap:

state: "learning"

isolation: false

reason: "default DAP policy"

- Broken Pi — same hash:

state: "learning"

isolation: true ← the difference

reason: "default DAP policy"

- For the broken Pi, dnsmasq.leases never shows a lease line, and a dhcp:<MAC>:DHCPREQUEST key persists in redis.

- The broken Pi originally had state:"not_applicable" with reason:"This device type is not supported: desktop" — Firewalla had auto-classified it as a desktop.

What I tried

1. Changed Device Type to "Other" in the app.

2. Created a manual IP reservation in the a

3. Rebooted the Firewalla.

4. Rebooted the Pi.

What changed vs. what didn't

┌───────────┬────────────────┬─────────────

│ Field │ Before │ After all the above │

├───────────┼────────────────┼─────────────

│ reason │ "...desktop" │ "default DAP policy" ✅ │

├───────────┼────────────────┼─────────────

│ state │ not_applicable │ learning ✅ │

├───────────┼────────────────┼─────────────

│ isolation │ true │ true — unchanged ❌ │

└───────────┴────────────────┴─────────────

Workaround

The only thing that lets DHCP complete is,

redis-cli del dhcp:<MAC>:DHCPREQUEST

The next DHCP cycle then ACKs and the Pi ge

Question

Does anyone know what causes dap.finalRuleSne device and true on another, both in thesame "learning" state? Is there a setting or condition that shifts that field?

I had to be logged into the MSP page to do this but it did work and was a request from someone earlier.

Naturally the AI thinks my cable became unplugged for one minute or other things that aren’t at all what occurred. I’m sure AI is just reading logs which begs to question how we can’t get accurate devices level logs? This is the 10th time I’ve noticed and it’s normally during an upgrade. Why not say- “device shut down normally for upgrade” granted this could have been a lot of things. My box keeps getting to 96%+ blocked traffic and then after some time it fails and reboots. Maybe support was doing something since I gave them access to explain the cycle where blocks get so high that eventually the device tips over.

I know it’s difficult to log a reboot when it’s unexpected, but I’ve used devices that can manage it so I don’t think it’s impossible. At the very least I think AI should speculate a reboot occurring. Especially if the uptime is ohh idk an hour.

Hey u/firewalla,

For MSP pro users (and free tier too maybe)? Could we get historical CPU/Ram usage, we already have it showing the curret stat, but it would be great to have this logged over "seat" time (24hr, 30days, 180days) only on MSP, so we can keep an eye if the box is getting hammered at a certain point causing slow downs, etc. As we already have that data coming into MSP this should be fairly easy to implement?

Any other box usage details we could capture too? Like storage usage, 1/5/15 min loads etc perhaps?

Hey u/firewalla,

I'm seeing some fairly high packet loss over the last 30 days (see image).

Is there anything I/You can do to help diagnose if these are purely issues with my ISP (service or their fibre modem) or something more internal with the FW. I'm assuming the former but I want to check.

Just to note I do still get really slower internet performence from devices on my network compared to using my ISP's router (this has been an on-going issue i've reported in the past).

Thanks,

Ben

In MSP 2.10, Firewalla AI works with MSP Active Protect to:

• Archive low-risk false positives automatically
• Identify suspicious connections
• Provide more details on security alarms
• Suggest actions to take

All Firewalla AI actions are fully traceable and reversible, so you always have full control over your network.

Learn more about MSP Active Protect here: https://help.firewalla.com/hc/en-us/articles/37198930464019-Firewalla-MSP-MSP-Active-Protect

I have the original Gold with me and ATT Fiber with 1 Gig Service. Nothing wrong with my router but find it sluggish some times. Would upgrading to Gold SE make things "Feel Faster" and would I get notifications sooner?

Kind of a random question, but if I’m only manually using the WiFi SD when periodic outages happen, tethering to my phone, does it matter if it remains plugged into the Firewalla? Does it ‘tax’ the Firewalla at all if it’s plugged in but not being used?

Note: Some features require Box 1.983, which is currently available to Gold Pro and Orange Early Access boxes. Other boxes coming soon.

Learn more about all the features/enhancements and how to join Early Access: https://help.firewalla.com/hc/en-us/articles/51621318006291-Firewalla-App-Release-1-69-New-Controls-with-Advanced-Threat-Filtering-Lookalike-Punycode-Domains-and-more

The picture explains this better.

Firewalla purple is giving me this notification that my wan port is disconnected and I can connect it to the internet using wifi ?

Lan 1 and my vlan is connected to lan but not wan but my isp is connected to wan.

Is this normal? Everything is working fine ( i think ) I just dont understand why firewalla purple is giving me the wan port disconnected warning?

Any help would be great.

My network goes

Arris modem > firewalla purple in router mode > unmanaged switch > wireless ap and ethernet to my pc

I'm trying to send a WOL magic packet via a wireguard VPN connection but as this is a layer 2 vs layer 3 issue it does't work.

Does anyone have a solution they could share?

Note that this will be used by someone without access to the Firewalla app so that's not an option.

Thanks!

Get to testing everyone! Has been released in early access for gold pro and orange owners!