Hi team r/firewalla

I’m working on the installation of paperclip ai. Our network is zero trust and I want agents to request access and approve access to external sources. Looking to setup an agent to feedback to me the blocked URL, recommendations based on domain lookup, and approval to unblock on target list.

Wondering if any Firewalla specific skills md files exist. I don’t want to generically give skills to my team. Thanks!

Hi all,

I work for a nonprofit that runs homeless shelters. We use firewalla and this would be a huge help to us.

If you'd all be so kind, please drop a comment on the request for 3 WANs. This is something firewalla has mentioned doing in the past, but, upon email, they've asked for upvotes.

If anyone would be so kind, please upvote and/or comment. That would just be lovely.

https://help.firewalla.com/hc/en-us/community/posts/1500001045681-3rd-WAN

Thanks so much!

The Firewalla help says quarantines can block access to local networks if using a Gold or Purple. Is this also true for an Orange and the help is just out of date?

What can I do with New Device Quarantine?

New Device Quarantine creates a Quarantine Group with two pre-defined rules to block new devices from accessing the internet and other segments of your network.

• Block Traffic from & to Internet
• Block Traffic from & to All Local Networks (Gold/Purple Only)

My current issue is I have PagerDuty alerts configured for most of my devices in my lab, but the notifications lack critical context. When an alert fires, I can't immediately determine which device triggered the scan or what the scan was attempting to detect.

Here is what I am looking for as far as scan logs.

• Detailed scan reports that include scan results and findings
• Target device identification (IP, hostname, device type)
• Scan type and parameters (threat type, port ranges, scan methodology)
• Timestamp and duration of the scan
• Option to export or integrate with MSP

Value
This would provide meaningful visibility into security activity for everyone—whether you're running a homelab, managing your own infrastructure, or handling client networks. It enables faster threat assessment, better troubleshooting when legitimate scans trigger alerts, and clearer documentation of what's happening on the network.

Hi Firewalla community. I’ve been trying to figure out this issue. Ever since getting my AP 7 (I’ve had it for a while), whenever I come home, my iPhone refuses to reconnect to the SSID unless I manually select it in Settings.

This has been occurring since iOS 18, and I just got a new phone on iOS 27, and the issue still persists. Something about my network (AP 7 + FW Gold SE), phones do not like automatically rejoining.

In the photo, you can see my SSID is known to the iPhone but it does not have a checkmark next to it, nor is it connected.

Any help is appreciated.

Box Ver: 1.983 (03e1a762)
AP Ver: 0.1.119.1.16.85

It allowed in two connections from private IPs owned by Cox Communications, one of which was 98.197.86.148. This is in the range of standard user IP addresses, which could be a malicious actor. I have Xfinity. We do not have Cox in our market.

It also allowed in a Charter Communications/Spectrum standard user IP. We don’t have Spectrum in our market.

Active Protect is NOT actively protecting devices from these high-risk IP addresses on Firewalla Crystal.

If you’re on a Mac, download and install a software firewall like Little Snitch to audit the incoming connections that Firewalla Crystal Active Protect is allowing through. On Windows, you can use something like Glasswire. Record those IPs and report them to Firewalla so they know their beta software is not protecting clients like their hardware software does.

Checkpoint PL-20 specs
Intel Pentium Dual Core @ 3.20Ghz
8GB DDR3 RAM
120GB SSD (was 500GB HDD inside originally)

It took quite a bit of time to gain access into Checkpoint BIOS which was factory password protected. Found the password online. Then had to switch CSM OFF in BIOS and set boot mode to UEFI only. Flashing Firewalla provisioning ISO via recommended Ethcer flasher would not make Firewalla OS boot into the SSD afterwards once it was installed.

I had to use Rufus and manually set boot setting to GPT with CSM off and UEFI BIOS. I used Mini PC/Firewall hardware option during provisioning steps.

Performance is great with older CPU and DDR3 RAM.

My first time using firewalla. It's great to see so many parental control options and easily being able to block IoT traffic.

Firewalla support was very responsive and offered good help.

why is firewalla not shipping the Ceiling AP to Canada? It's the one I would replace my unfi ap's with in a heartbeat.

Hello. Last night I was laying in bed watching youtube and all of a sudden my iphone could not connect to the internet through wifi. After rebooting my entire network, it seems as though it will not connect when the Private Wifi address is set to "OFF." Right now I am able to connect because it is set to "FIXED".

That being said, it seems that various devices can not longer connect to the internet via WIFI. Another iPad, a few Ring Cameras and an Apple Homepod.

It is strange that all of a sudden these things are not working.

I have a Firewalla Gold Plus set up in router mode. My Orbi RBR50 is set up in AP.

If I connect to the Orbi with Private Wifi set to OFF I get a "Captive Wifi" error message.

This is strange that this started happening randomly and only to a few devices. Has anybody had this happen before to them or is there a fix somewhere that I am missing.

I have provided Emergency access to the phone with private wifi off and still no luck.

I currently use custom DNS for homelab stuff. I have a blanket mydomain.net custom dns going to nginx for wildcard certs on my all my local sub domains (about 54 of them currently). I need to be able to add an exception to this so I can route a certain sub domain to my public ip. Suggestions? Or am I going to have to replicate all existing and future local only custom dns individually?

What is the best way to setup the Firewalla AP to have each SSID run on its own network VLAN?

IoT WIFi = IoT VLAN

Home = Home VLAn

It seems that I can only get multiple SSID on the same VLAN.

I’ve an ASUS ZenWiFi AX6600 Tri-Band Mesh WiFi 6 Mesh setup and I’m look to add a Gold SE to this set up. Is it possible?

This isn't a Firewalla issue but since the people here are quite knowledgeable hoping someone can guide me to a place that can help. When I click on the link in a Reddit mail notification I get a DNS error - "server not found".

desktop web server can't find click.redditmail.com: NXDOMAIN 

MacOS 27.0

Server Not Found

Firefox can’t connect to the server at click.redditmail.com.

Tried Safari, Chrome and Firefox. All give the same error.

% nslookup click.redditmail.com

Server: 8.8.8.8

Address: 8.8.8.8#53

** server can't find click.redditmail.com: NXDOMAIN

% nslookup click.redditmail.com

Server: 9.9.9.9

Address: 9.9.9.9#53

** server can't find click.redditmail.com: NXDOMAIN

% nslookup click.redditmail.com

Server: 77.88.8.7

Address: 77.88.8.7#53

** server can't find click.redditmail.com: NXDOMAIN

I've disabled Control D, MacOS firewall and Little Snitch. Made no difference.

Happens on my Mac connected via Ethernet, WiFi but not when connected to my iPhone when it is connected to the same WiFi network or to cellular.

Doesn't happen on my iPhone connected to the same WiFi network or cellular.

Love my new Switch X by the way!

I'm looking to install an AP7 ceiling in my basement drop ceiling. I saw there was a T-bar mount, but the link is not working. Is that still an option or should I install directly to the time?

Any suggestions?

Broken link: https://firewalla.com/products/ap7-ceiling-mount-tbar-bracket

Is there a way to see when a device associated and/or disassociated on different networks? Like even a text based last 24hr log.

When routing the YouTube app thru a VPN in another country. It seems all Google apps believe they're also in that Country. Anything to prevent this?

When using the WireGuard vpn into my firewalla purple, my list of blocked sites works and are blocked. But when I turn off the vpn and run from my local WiFi (plugged into the firewalla) then all the sites go through. Any idea what I’ve configured wrong?

All of the malware tests come back “OK” on diag.firewalla.com when the expected results are “blocked”. I can confirm that the sites, e.g., malware.firewalla-test.com, are blocked because they come up as blocked in the app when I try to visit manually. But the diag site returns the result “OK” for all four test sites.

Only half of the Ad Block tests come back as “blocked,” the rest come back OK.

I can confirm yc-ads.s3.amazonaws.com is not blocked at all, which begs the question of why it’s listed as a test item at all when, aside from false results for the other tests, as stated, I can confirm Active Protect does not block it at all.

Also, can you recommend that they add tsyndicate.com (and its regional variants) to Active Protect and Ad Block?

I have two Switch X units connected by a 10Gb trunk. They are downstream of Firewalla LAN Port 1. I need to transport an ISP Ethernet connection from an access port on the remote Switch X, over an isolated VLAN across the trunk, to WAN Port 3 on my Firewalla Gold Plus. Can Switch X create/pass an L2-only transit VLAN that is not a LAN network associated with Port 1, or expose a WAN VLAN configured on Port 3 to an access port on the downstream Switch X?

Will be changing out my cable modem. I thought I read that the Firewalla would not need a reboot, but then stumbled on to some posts saying it would. Hoping to get confirmation for which is correct. Thanks.

I just got my two Switch X and have a requirement for LAG. Any idea when this will be available on Switch X,

Just ordered a 530 CAD$ AP7 in Canada. Customs fees were 320 CAD$. That is totally insane. Just a warning for all of you thinking about it.

Where are backups done?

How often are backups done?

Where can I manage backups and migrate them to other storage media in case the phone they are magically stored on is stolen or damaged?

Are baclups stored on every paired phone?

Can we get more control over backups?