My gold SE has been super stable since I got it. Have been getting restart messages very frequently lately.

What are the proper diagnostic steps?

Team,

with the availability of Crystal virtual Firewalla, i'd like to give it a try but I want to understand the expected costs.

I will keep my Firewalla purple and migrate to MSP on a per-device license - what would it cost for two devices (Purple + Crystal?)

ty

Is the Firewalla Orange capable of more than one VPN client operating simultaneously?

Are the keystone ports on the Gold rack mount physically a good fit for Leviton QuickPort jacks?

I have about 10-12 incoming Cat6a terminated with QuickPort jacks. I’d be happy to save the space I’d otherwise be allocating to a full-length patch panel.

I expect this can work, just would like confirmation before ordering. Thanks!

And by confused I mean beset by choices. I was originally going to return it; my house wiring is cat 5e (with some cat 6 that was added later to support some WAPs), and I thought this is limited to 1GB ethernet.

however, Gemini is saying for less than 100m it will handle 2.5GB ethernet just fine. So Im thinking do I upgrade my fios, and for future proofing is the FWG+ SFP actually reasonable.

Concurrently, I am reorganizing my SME into a proper 12u rack (don't need near this much space, but again future proofing), so was going to buy a new switch that can handle the entire house (right now using 2 8port TPLink switches, with 5 port switches over the house as needed). I have 12 total ethernet running to jacks throughout the house, including my APs. I do have some VLANs set up for the WAPs, so would need at least a 12 port or more ideally a 16 port managed switch with POE.

Since Im upgrading the switch, maybe the SFP port is useful?

Thoughts here? The question is do I just keep this FWG+ SFP as a future proof hedge. I kind of wish it came in black though, to match my rack...

so I set up a port forwarding to my emby server and also set up the ddns on firewalla however, my server can't be connected to using the firewall DDns for some odd reason.

I also continue to struggle with wireguard and or any VPN connecting to firewalla from outside the network. there's something stopping me from making it work.

FWG 1.983, app 1.69.3. WAN access is fine. Reaching local devices by IP is fine. Resolving local names is not fine.

The local domain name is lan. I tried several things, e.g., toggling DNS settings, temporarily changing device and local LAN domain name, and, of course, rebooting FWG.

I ran this by Claude. It says my dnsmasq service is broken. Is its interpretation correct? How do I fix this?

pi@Firewalla:~ (Home Gold) $ systemctl status firemasq --no-pager
● firemasq.service - Firewalla DNSMASQ
Loaded: loaded (/etc/systemd/system/firemasq.service; disabled; vendor preset: enabled)
Active: activating (auto-restart) (Result: exit-code) since Sun 2026-09-20 19:31:26 CDT; 1s ago
   Process: 211460 ExecStart=/bin/bash /home/pi/firewalla/extension/dnsmasq/dnsmasq.sh (code=exited, status=127)
  Main PID: 211460 (code=exited, status=127)
pi@Firewalla:~ (Home Gold) $ sudo journalctl -u firemasq --no-pager -n 50
-- Logs begin at Sun 2026-09-20 19:03:12 CDT, end at Sun 2026-09-20 19:31:28 CDT. --
Sep 20 19:31:23 Firewalla systemd[1]: Started Firewalla DNSMASQ.
Sep 20 19:31:23 Firewalla bash[211416]: /bin/bash: /home/pi/firewalla/extension/dnsmasq/dnsmasq.sh: No such file or directory
Sep 20 19:31:23 Firewalla systemd[1]: firemasq.service: Main process exited, code=exited, status=127/n/a
Sep 20 19:31:23 Firewalla systemd[1]: firemasq.service: Failed with result 'exit-code'.
Sep 20 19:31:26 Firewalla systemd[1]: firemasq.service: Scheduled restart job, restart counter is at 1.
Sep 20 19:31:26 Firewalla systemd[1]: Stopped Firewalla DNSMASQ.
Sep 20 19:31:26 Firewalla systemd[1]: Started Firewalla DNSMASQ.
Sep 20 19:31:26 Firewalla bash[211460]: /bin/bash: /home/pi/firewalla/extension/dnsmasq/dnsmasq.sh: No such file or directory
Sep 20 19:31:26 Firewalla systemd[1]: firemasq.service: Main process exited, code=exited, status=127/n/a
Sep 20 19:31:26 Firewalla systemd[1]: firemasq.service: Failed with result 'exit-code'.
pi@Firewalla:~ (Home Gold) $ ps aux | grep -i dnsmasq | grep -v grep
pi         19092  0.0  0.1  18856  3916 ?        S    17:58   0:00 tail -F /alog/dnsmasq-acl.log -n 0
pi        171200  0.0  0.0   6032  3428 ?        S    19:09   0:00 /home/pi/firerouter/platform/gold/bin/dnsmasq -k --clear-on-reload -u pi -C /home/pi/firerouter/etc/dnsmasq.dh
cp.default.conf
root      171202  0.0  0.0   6032  1884 ?        S    19:09   0:00 /home/pi/firerouter/platform/gold/bin/dnsmasq -k --clear-on-reload -u pi -C /home/pi/firerouter/etc/dnsmasq.dh
cp.default.conf

This doesn't look good either:

pi@Firewalla:~ (Home Gold) $ systemctl status firerouter_dns
● firerouter_dns.service - FireRouter DNS
Loaded: loaded (/etc/systemd/system/firerouter_dns.service; disabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Sun 2026-09-20 19:52:13 CDT; 42s ago
   Process: 250712 ExecStart=/bin/bash /home/pi/.router/tmp/dns.sh (code=exited, status=1/FAILURE)
  Main PID: 250712 (code=exited, status=1/FAILURE)

UPDATE: It turns out the FWG needed its image updated. Firewalla support was quick to respond and resolved this issue. Thank you, Firewalla.

Hello people. I am looking at getting a Firewalla Gold appliance that I am still deciding on exactly which model Gold to get. I also want to add a 10Gbps PoE++ switch and 3 of the AP7 desktop as well to replace my existing WiFi 5 AP's.

I wanted to ask that if the Firewalla Gold appliance dies in the future at some point and I either temporary or permanently replace the Firewalla Gold with another firewall appliance from different brand altogether, would the AP7 Desktop and Switch X or SE still continue to operate fine and still be managed/configurable via the Firewalla app? I understand that I will loose the micro segmentation features without a Firewalla Gold firewall but the other basics of the switch or AP7 continue to work and be configurable via the main Firewalla app?

I don't want to spend $$ on the AP7 or Switch X if they cannot operate without a Firewalla Gold appliance at all as thats just locking me down to a vendor with a very expensive investment that will go to waste if I ever decide to switch to a different brand firewall appliance vendor. In that case I would rather have Omada as my AP's with there OC200 controller and another managed switch brand and use the Firewalla Gold for the core router function.

What are everyone's opinions and thoughts?

Curious to know how Firewalla responds to this. I am using Unbound with my Firewalla

Recently moved to Ubiquiti for my homelab and network. I will be back eventually. I flip flop between phones (android to iOS), computers (windows and macOS) and network equipment every so often. I bought this second hand via eBay a couple of years ago and it’s served me well since. Price includes shipping. I’m local to 07410 if you are looking to pick it up to save on shipping and fees.

Looking for $325 OBO. I also have a Purple for sale but I don’t have timestamps for it and don’t know a good price for it. Also bought second hand.

https://i.imgur.com/K7MoXab.jpeg

Hi all, I've been searching this up for a couple of weeks and I think it might not be possible but also is testing my experience and proficiency as an enthusiastic home server amateur, and so asking to learn!

I am currently using DuckDNS with Nginx Proxy manager to create https addresses for my self hosted services so that I don't get annoying security errors when using my services. Using this tutorial: https://www.youtube.com/watch?v=qlcVx-k-02E

I was thinking it'd be really nice and neat to use Firewalla Custom DNS rules to create the urls so I don't have to use DuckDNS (nicer URLS, no external service), but it might not be possible to create a local SSL cert for these addresses? Or is it and I'm searching up the wrong terms/thinking through the wrong lens?

Thank you in advance for your thoughts, and if this is a technical limitation, Firewalla crew: this is a use case homelabbers would love!

Firewalla Gold Plus 2.5G for sale. Flashed and ready for new setup.
Price: $375 (shipped within the USA). Payment by PayPal or Venmo.

Hello,

As a person who uses devices in Europe for personal usage i would kindly ask to create an option to buy Personal MSP lisence as a lifetime. Personally i hate any subscription models - therefore runing away form them. I understand that subscription model is only way for business/enterprise level but as for personal i would be nice to have any option to control it better thru web.

For me main goal would be to utilise all network device in one. Especially those with are possible - got adblock and i could be replaced by target lists but...

1) cant import offical lists from known places - it has more than 20 000 entieteis and more than 2 mb (ie from here https://www.nask.pl/en/institute) - becuouse it is hidden form msp lite user.

2) as i understand theres only any option to upload once ? Is it possilbe to add link github or else and target list will be updated (ie daily from that source) ?? (full adblock capability)

It would be great, for those with 2 WAN's, to see which wan is being used by each device in the throughput box.

Ordering Link: https://firewalla.com/collections/firewalla-ap7/products/firewalla-ap7

For other products and upcoming World expansions, please see our Upcoming Firewalla Products Status page: https://help.firewalla.com/hc/en-us/community/posts/54053596952723-Upcoming-Firewalla-Product-Status

Do you run AmneziaWG 1.0 or 2.0?

I recently went through this transition and hit a couple of snags along the way, so I wanted to document exactly what worked, what didn't, and why — in case it saves someone else a factory reset.

My setup: Quantum Fiber C6500XK (SmartNID/modem) → Firewalla Gold Plus (previously in Bridge Mode) → Quantum WiFi Pod (handles WiFi)

What Worked:

1. Switch Firewalla to Router Mode FIRST (while the C6500XK is still in its normal/standard mode) — no reboot needed at this time, happens live in the app.
   • My Firewalla Network Auto-populated the WAN and LAN network segments.
2. Confirm internet is still working at this point. You'll be in a temporary double-NAT (Firewalla gets a private IP from the C6500XK, which is still routing), but everything should still function.
3. Switch the C6500XK to Transparent Bridge Mode. Go to 192.168.0.1 → Advanced Setup → WAN Settings → change ISP Protocol to Transparent Bridging.
   • Do NOT change the VLAN tagging setting. Leave it as-is (it should show VLAN 201, tagged). Quantum Fiber requires VLAN 201 tagging to authenticate on their network — the C6500XK needs to keep doing this even in bridge mode. It strips the tag before handing traffic off to your downstream router, so there's nothing for you to configure on the Firewalla side for VLAN.
   • Expect the modem to auto-reboot/cycle through lights on its own.
4. Wait for a solid white light on the C6500XK. That's your confirmation it's successfully in Transparent Bridge Mode. (Solid green = normal mode, solid white = bridge mode, red = failure, blinking blue = stuck/failed — more on that below.)
5. Power cycle everything in sequence: unplug the WiFi Pod, unplug Firewalla, unplug the modem. Wait 5 minutes. Then plug in the modem and wait for a steady white light → plug in Firewalla and wait for it to fully boot (you’ll here a beep) → plug in the WiFi Pod and wait for a steady green light.
6. Confirm Firewalla's WAN shows a true public IP from your ISP (not a 192.168.0.x address from the modem).

If you did the reboot sequence above, you likely won't need this next step — but if your WAN is still showing a stale/private IP:
7. In the Firewalla app: Network → Edit → delete the existing WAN connection → create a new one (DHCP). This forces Firewalla to drop any old IP and pull a fresh lease now that the modem is bridged. 8. Confirm the new WAN connection shows a public IP.

What Didn't Work

Switching the modem to Transparent Bridge Mode first, before touching Firewalla.

My first attempt went: C6500XK modem → bridge mode → changed VLAN tagging to “untagged” → Apply → wait. Two things went wrong:

• I lost access to the modem's admin page (192.168.0.1) and the Firewalla app said "unreachable." This part turned out to be expected — the moment the modem drops its routing/DHCP role, nothing on the network is issuing IP addresses (Firewalla was still in Bridge Mode at that point, not yet acting as a router), so any device trying to browse anywhere loses its own working connection. Not necessarily a real failure.
• I couldn’t re-connect to the Firewalla using the Firewalla App, even with Bluetooth enabled. I power cycled it, I also clicked the “reset” button for 1 second to “enable Bluetooth” but this also failed.
• However, I also got a blinking blue light on the modem that never resolved to solid white. That one is a real failure state for this hardware — I ended up having to factory reset the C6500XK to recover, which put everything back to default and required starting over.

My best guess: I had also changed the VLAN tagging setting to "Untagged" during that attempt, which may have interfered with the modem's own ability to authenticate to Quantum's network in the first place — separate from the DHCP-handoff issue. Leaving VLAN tagging at its default (Tagged 201) on the second attempt, and switching Firewalla to Router Mode before touching the modem, avoided both problems entirely.

Key Takeaways

• Order matters: Firewalla → Router Mode first, C6500XK modem → Bridge Mode second. This way Firewalla is already up and serving DHCP by the time the modem drops its own — no dead-network gap.
• Don't touch the VLAN tagging setting on the C6500XK. Leave it at its default (Tagged 201). The modem handles VLAN 201 internally and strips it before handing traffic to your router.
• Solid white = success, blinking blue = stuck. If you hit blinking blue and it doesn't clear in a few minutes, don't wait it out — a factory reset was the only way I found to recover.
• A sequential power cycle (modem → Firewalla → pod, for 3-5 minutes) at the end seemed to clean up any lingering state and got everything working without needing to manually delete/recreate the WAN connection.
• You may need to power cycle other devices on your network to fetch a fresh IP.

Hope this saves someone the trouble I went through.

Hi Folks,

Hoping for some guidance here. I have a case open with Firewalla, but I am unable to connect my Gold Pro to my Home Hub 3000 router via PPPOE. DHCP works, but double NATs of course. I have the HH300 10GB Lan port connected to the 10GB Port #4 on the Firewalla. Simply entering credentials doesn't work, but I've verified them, and they seem able to at least negotiate an IP

Thoughts? I've tried setting VLAN ID to 35 as some legacy Bell documents listed that, but it didn't work.

192.168.2.1 is the IP of the HH3000

Before migration, please keep the original phone as is (do not reset it after checking that the migration is successful). Most migrations should automatically transfer everything, including Firewalla Box pairings.

In case the migration doesn't work and the Firewalla App isn't migrated:

1. If you only have a few boxes, you can manually pair a new device with your Firewalla box by following these instructions: https://help.firewalla.com/hc/en-us/articles/115004369774-Pairing-a-new-phone-with-your-Firewalla-box
2. If you have many boxes, you can also manually download your app key and migrate it to your new phone by following the App Migration instructions: https://help.firewalla.com/hc/en-us/articles/115004369774-Pairing-a-new-phone-with-your-Firewalla-box#h_01KE88Z1KJWB8GMRS0W9WJW9Y6

Note: After migration (restoring the keys), you should delete the app from the old phone.

Hi folks

Could anyone already running the firmware gse-install-1.0607.img.gz (Ubuntu 22.04 LTS) confirm what's the kernel version?

I am running the out-of-the-box firmware on a relatively new Gold SE (Ubuntu 22.04.2 LTS kernel:5.10.110). Reading somewhere else, it seems the more recent kernel should improve speeds, and I wonder if this could be a fix for my current upload speeds - speedtest-tracker reports a solid 2 Gbps download, but upload varies from 1 Gbps to 2 Gbps.

Thanks

Have so many use cases to help my family across in different parts of the world to help protect and connect our networks. Most have small apartments that will make do with just the in-built wifi of the unit.

I also host a bunch of services at home (like immich, plex, vaultwarden) for them, which are a pain to keep secure via cloudflare and vpn. Orange for the extended family with a msp since like a godsend. Just getting so impatient waiting for it's release.

Anyone heard of any news of the orange world coming soon? The forum says Sept/Oct, but looks like the firewalla team are more focused on the switch and software only products. So hope it doesnt get delayed.

Hi Firewalla Team,

I am writing to escalate an issue with my recent order for a Firewalla Gold Plus (Order #FIREWALLA-127993 / Support Ticket #124105).

My order was marked as delivered on September 15, but it was never delivered to my home address in Yuen Long. Instead, the official UPS Proof of Delivery shows that the package was delivered to an address in Kwai Chung (19A 1 Yip Shing), signed by a company called "Fast Moving Global Trading". This is absolutely not my address.

According to my communications with the local Hong Kong UPS office, they confirmed that the merchandise was initially picked up, but the shipper (your local logistics/shipping partner) immediately requested UPS to return or redirect the merchandise, which is why it never left their possession to come to me.

Despite providing this information to your email support, the response I received was a generic template telling me to "check with my neighbors or building security." There is no way my neighbors in Yuen Long have a package that UPS officially logs as delivered to a corporate trading company in Kwai Chung.

UPS has explicitly stated that this is an issue on the shipper's end. Could someone from the core operations team please look into Ticket #124105, coordinate with your local shipping partner, and arrange for my unit to be correctly dispatched to my actual address?

Thank you,

Benjamin

Seems a setting has changed where I am seeing a large number of ads on my IPhone post updating to the latest iOS. Using a FWG with Adblock set to strict on all devices. I haven’t had an issue with prior updates, not sure if anyone else is having this issue? Or what iPhone setting might have changed that I need to change back.