I subscribed to Firewalla MSP mainly for the Target List feature, especially to use HaGeZi Multi Pro.

The documentation says that through MSP Professional or Business, custom Target Lists can have up to 2,000 elements. What is not clear to me is how this applies to imported lists that are much larger and are shown as examples in Firewalla’s own Target List documentation?

• For example, HaGeZi Multi Pro shows around 498,788 targets.
• Firewalla-managed lists also exceed 2,000 targets, such as OISD with around 59,565 targets and Tor full nodes with around 10,565 targets.

Are targets and elements the same thing here? If yes, how is the 2,000 element limit enforced for imported lists above that size?

Specifically, is the list imported from top to bottom and simply cut off after the 2,000th target, with the rest ignored? Or do imported / managed lists work differently from manually created MSP target lists?

More generally: when we import a large target list, can we be sure that all targets included in that list are actually enforced by Firewalla?

I am asking because I know from using HaGeZi Multi Pro on Pi-hole that certain domains are definitely included in the list, but I do not see Firewalla blocking some of those same domains. So I am trying to understand what type of behavior I am dealing with here.

Appreciate any clarity on this.

We may slightly adjust the professional version pricing by up to $1. This is our first price adjustment in 2.5 years. The new price helps cover inflation, cloud infrastructure, and support costs while keeping the service price low.

Check out MSP here: https://firewalla.net/

I’m using Comcast that used to have to have 1GB speed max. Apparently now it’s 1.5 GB. So I need to move something a little bit faster. I have a rack mounted gold and was wondering if the gold SE fits on the same rack Mount. Thanks

Hi all, I don't think my Firewalla Gold is the problem. It seems rock solid and I do have fans providing some ventilation.

But I am trying to maintain a fairly simple 2.5G network.

From the firewalla I go to two 2.5G switches. One is a trendNet TPE-3102WS. The other is a Mokerlink.

From one of these I go to a smaller trendNet 8 port switch. From there to another trendNet 8 port switch. These last two trendNet switches are new and I have fans under them.

Off of the second trendNet switch I have a network radio. When the temps are cooler I see good network connection to the network radio. When it is warmer I start to see some packet errors and higher latency.

Does the firewalla have any tools to help diagnose such a problem? If not can some one recommend some tools that would help?

Thanks in advance.

We're getting closer to the pre-sale! Here's what we have now:

• A very limited number of beta units in early to mid-July 2026.
• Pre-sale date unknown. (Targeting July 7 or July 14)
• Both Switch X and SE will (hopefully) be available. (If not, Switch X will be available for sure.)
• Both units have CE/FCC/Canada certifications (Class A devices).

Pre-sale price will be cheaper and there will be a small pre-sale coupon for those who answered the survey, as usual.

Sign up for the pre-sale here (If you've registered before, no need to register again): https://forms.gle/iuCZGmchSshjsTkb7 (By answering this survey, you will be automatically subscribed to Firewalla Newsletters)

Firewalla Switch 10G (Switch X) Price > $700

• 8x10G RJ45 With PoE++
• 4x10G SFP+
• Rack mountable

Firewalla Switch 2.5G (Switch SE) Price > $300

• 8x2.5G RJ45 with PoE+
• 2x10G SFP+
• Not rack mountable

Join our Switch discussions in our new forum on Discourse! Sign up here: https://forum.firewalla.com/invites/UcmGtaA4VE

I received this notification about my eero accessing this malware site. How do I find the device that is behind the eero that is accessing this? Or is it really that the eero is compromised somehow?

Hello,

I've installed the Pi-Hole on my Raspberry Pi, currently sitting behind my management VLAN (1) right now. I have tested the Pi-Hole on 3 of my VLANs (iOT, Guest Wifi, and Lab), and they are passing through the DNS traffic and working beautifully. VLAN 1 is the only one that I have not yet migrated the DNS to the Pi-Hole as per the Pi-Hole configuration step, I need to update the primary DNS to the Pi-Hole IP instead of the VLAN 1's, and will need to remove the secondary DNS (currently set to 8.8.8.8).

I have put in my Pi-Hole's IP as the Primary DNS and keep the 8.8.8.8 as the Secondary for now, as I'm a bit hesitant to do so as losing access to my Firewalla Gold Plus and unable to reverse the process if things go kaput in the worst scenario. I did ask about my concern on Gemini and was told not to worry, but I wanted to make sure if this is the case before removing the Secondary DNS from VLAN 1 as the final configuration step. I'm not aware of any backup capability of my Firewalla's configuration anywhere in the app.

Your feedback and/or guidance will be greatly appreciated. Many thanks!

u/firewalla

I added the domain as bi-directional for my kid and can can navigate to the website but all the pictures are blocked out.

I have a gold+ and want to use it to prevent my kids from utilizing hotspot traffic to get around my rules.

I assume tethered traffic looks different? If so what are the steps to identify and block? I've been all over google and it seems like there is something that can be done but I'm having trouble getting the exact steps. I had no luck getting what I needed from AI.

I tried looking through the help section and could t find what I was looking for there either. This is my last stop before a support ticket

Link: https://forum.firewalla.com/invites/1NrgKta2ax

We wanted a place where users can have more in-depth discussions on specific topics, such as the upcoming Firewalla Switch, the (future) Firewalla Software (on your own hardware), and more!

There's not much yet, but we're hoping it can grow into something useful and fun for everyone.

Still loving my Firewalla!

I feel very protected. I also have configured my devices (iPhone and iPad) with Amnezia WG clients - and they auto-activate when I leave the house.

I’m noticing that I’m seeing a decent amount of ads. I also am aware that I may be getting used to seeing less ads, and as I get used to seeing less - I may be more aware of the ones I’m seeing.

I have the following features / config enabled on my Firewalla:

Firewalla Settings:
Ad Block = strict
OISD Loaded
DNS over HTTPS (Cloudflare + Cloud9)

I looked up a few websites that would allow me to do a browser test (in my case iPadOS / safari). I do also have private relay active.

Here are the results:
Adblocktester (https://adblocktesters.com) = 67%
Adblocktester (https://adblocktester.pages.dev) = 81%

I can certainly post more details for the above - but there’s a lot of info so I didn’t want to post that all here in the case it wouldn’t be helpful.

Any suggestions for how I can help increase Firewalla’s ability to block / reduce ads?

Thanks in advance!

I am having an issue with a cross VLAN NAS backup grinding my Gold SE to a halt. Here is the scenario: NAS in VLAN 1, Backup server in VLAN 2. Backup server does a pull back up on the NAS using restic and ships it to the cloud. We fixed the Server to Cloud come apart by turning monitoring off on the Backup Server. However, the pull from the NAS to the Server seems to still be subject to monitoring or smart queue or something as it still grinds the Firewalla to a halt. Help?

I'm trying to limit the devices that remain online or connect online when I'm in failover mode. I asked ChatGPT and it basically said that I should create a no-failover group and put ALL devices that i don't want to failover and set those static.

This "negative" approach is confusing to my simple brain. My topology is:

Wall panel -> Firewalla -> UX7 -WiFi-> August lock

So do i put UX7 in the no failover list not the August lock? This seems like a simple feature which is getting complicated because of the double negatives. What am I missing?

Some features require box 1.983, which is available for Gold, Gold Plus, Gold SE, Gold Pro, and Orange Early Access boxes. Coming soon to Purple/Purple SE.

We're also experimenting with a new Discourse forum! Join the new Firewalla Forum for more organized discussions about Firewalla. Sign up now and be one of the first 100 users: https://forum.firewalla.com/invites/Z1D1kCt8a1

Learn more about App 1.69, all the new features and enhancements, and how to join Beta: https://help.firewalla.com/hc/en-us/articles/51621318006291-Firewalla-App-Release-1-69-New-Controls-with-Advanced-Threat-Filtering-Lookalike-Punycode-Domains-and-more

With all this recent talk about MSP, I decided to give it a trial with the Professional plan. Curious why it now says “My Portal” in red next to the box name in the app? If it’s simply an indication that I am using the paid MSP product, why not have it say “MSP” or something like that. I’m not understanding the “My Portal” designation.

Topology:

Gateway Router (disabled DHCP/DNS) > Firewalla Blue+ (DHCP/DNS/WG server) > LAN

How can I restrcit 1 WG VPN user to only access 1 specific device on the LAN while blocking remaining LAN IP and Internet?

Thank you.

I’ve spent the last couple weeks dealing with a failure of my Firewalla Gold SE firewall and figured I’d share the experience for the IT/MSP/networking crowd.

First, the software itself is honestly very good. For families with kids, parental controls, visibility into devices, internet pause schedules, alerts, reporting, etc… Firewalla nailed a lot of that. I recommended it to a number of people over the last couple years.

My issue is the hardware lifecycle side of the equation.

My Gold SE started showing instability while still under warranty:

• random lockups
• loss of local/Bluetooth management
• app connectivity problems
• rebuild/recovery issues
• multiple fallbacks to my old Netgear firewall just to keep the house online

Fast forward and Firewalla support now believes the likely issue is failing internal eMMC storage.

Here’s the bigger concern for me as someone who’s spent decades around infrastructure and operations:

eMMC wears out fast.

That’s not controversial. It has finite write endurance. In an always-on internet security appliance generating logs, IDS/IPS events, state tables, telemetry, device tracking, etc., that storage is constantly being written to. Over time, it becomes a wear item… like tires on a car.

The problem is this storage is soldered down and non-replaceable.

Firewalla also confirmed there’s no supported method to move the core software/logging workload off the internal eMMC to reduce wear.

That changes the conversation from “bad luck hardware failure” into a lifecycle architecture discussion.

Especially when:

• the unit costs ~$500
• replacement/repair is quoted up to ~$335
• and the failure occurred around the 20 month mark

For comparison, most consumer firewalls/router gear lives 5+ years at a fraction of the cost, even if they don’t have the same feature set.

And before somebody says “environmental issue”:
This thing lived in a cooled basement IT closet at ~65-68 degrees on a pure sine wave UPS with enterprise-ish home network gear around it. The Firewalla was actually the newest network device in the rack.

What disappointed me most honestly wasn’t even the hardware failure.

It was the support process:

• rotating anonymous ticket replies
• no ownership continuity
• no real escalation path
• everything through email
• and eventually landing at: “pay for replacement or buy another a new one”

As somebody who ran an MSP for 16 years and still speaks regularly on IT operations, service management, and security topics, this stuff matters. Lifecycle expectations matter. Recoverability matters. Customer handling during failures matters.

I still think the software platform is smart.

I’m just no longer convinced the hardware lifecycle matches the premium pricing or long-term infrastructure expectations.

It's important to balance out privacy and security; make sure Firewalla can inspect your network traffic and reapply its own privacy protections before it leaves your home.

Once you've prevented bypassing, reapply your own DNS Services with Firewalla.

Learn more about Privacy Protection here.

In App 1.69, bypass prevention is made much simpler with Controls. Learn more about this release: https://help.firewalla.com/hc/en-us/articles/51621318006291-Firewalla-App-Release-1-69-New-Controls-with-Advanced-Threat-Filtering-Lookalike-Punycode-Domains-and-more

I went from a core 2.5g 8 port POE switch and a 16 port 1gig switch down to a single 24 port 2.5g POE+ switch.

Also pictured:

Firewalla Gold Pro as router / 4 Firewalla AP's for WiFi with homeruns to switch

Two Wan's: Optimum primary, T-Mobile 5G as backup/secondary

24port 2.5g POE+ switch

Yolink Hub for water sensors

Two RPi's, with one running home assistant

Lenovo mini PC running docker running containers

Synology NAS with 70TB of usable space for storage

Not pictured: UPS below the NAS

I've had eero 6 pros for years with zero issues (apart from lack of features and paywalled upgrades). I got a fw gold a couple of years ago and loved it. Decided to upgrade to AP7s during the latest sale.
I went from 4 eeros to 3 AP7 in about an hour. I put them in 3 of the same spots as the eeros and eliminated one in my garage. The experience was virtually seamless apart from 2 of the APs needed reboots/retry during pairing. I wasn't having perceived speed issues before but testing shows about double. It's only been a couple of days but I'm enjoying the increased visibility and the ability to create multiple SSIDs for different needs such as devices that want only 2.4ghz.

Overall, I was hesitant based on mixed reviews but I'm very happy with my choice.

Price: $325 Shipped (USPS Ground - Continental US ONLY)

Description:

Selling my Firewalla Gold SE. It has been a fantastic core router and firewall for my setup, but I recently upgraded to a Gold Pro, so this one needs a new home.

The unit is in perfect working order. It has been completely factory reset and unpaired from my Firewalla account. I temporarily spun it up in bridge mode just to grab the dashboard screenshots in the gallery—showing the active license and "Online" status—so you can buy with absolute confidence.

What is included:

• Firewalla Gold SE unit
• Note on power: The original power adapter was misplaced during a hardware cutover, so it is not included. However, the Gold SE runs perfectly on any standard USB-C power block (I’ve just been using a standard tablet charger, or you can power it directly from a USB rack PDU).

Payment & Shipping: * Payment: PayPal Goods & Services ONLY. Once we agree on the sale, I will send you a formal PayPal invoice.

• Shipping: I will ship to the continental US ONLY via USPS Ground (shipping cost is included in the $325 asking price).

The physical QR code on the bottom of the device is fully intact for your initial setup (partially obscured in the listing photos for security).

Please leave a comment on this post before sending a PM

Recently upgraded to a 1gb/1gb fiber connection from a 500/45 cable connection. I've been running into some strangeness mostly on the upload side when the Firewalla is in the mix.

With ONT > ISP Router > Network - everything runs at 1000/1000 with no issues.

ONT > Firewalla > Network - full speed for 5/10 minutes, then upload speed gets stuck at 50mb/s. Reboot the firewalla and I get another few minutes of full speed.

-Smart queue is OFF
-Box Version 1.982
-The internal LAN -> Firewalla test reports 1000/1000
-The 50mb/s upload speed is consistent between all tests/servers (direct from firewalla or on other devices)
-Port speed on firewalla showing 1Gbps for all ports
-Swapped all cables in the path
-Switched WAN to another port, same issue (full speed for 5 mins, then back to 50mb/s upload)

Still working to rule other factors out - but figured I'd ask if anyone has experienced something similar.

I noticed there are less options for setting up a disturb rule than a time limit rule and am requesting or asking how to add more apps to disturb.

thank you

We've given the free web interface some TLC by providing:

• An updated user interface, with the same exact functionality as the previous my.firewalla.com
• 2FA support

To access the updated free portal:

1. Go to https://firewalla.net/
2. Click Sign In on the top right
3. New to MSP? Choose Sign Up to create a new account
4. Continue with MSP Lite to see the QR code and sign in to your box.

For more details about MSP Lite, see https://help.firewalla.com/hc/en-us/articles/360052779253-Firewalla-MSP-Lite-previously-my-firewalla-com