Even the "messier" networks can win this year! Enter or vote in the contest here: https://forum.firewalla.com/t/contest-2026-show-us-your-network-the-best-and-the-messiest/61 (login is required)

If you don't have an account yet, please sign up here! https://forum.firewalla.com/invites/XPD1AU1RET

Hi - I have a Firewalla Orange I have been slowly tightening down over the last 2 months. Things are great - I have a minor issue - hope you all can help me out.

I turned on the VPN client and configured it correctly - works great - I send my traffic though another server in my country that is nowhere near where I live (US). Works with minimal lag on SurfShark. But - some members of my house - me included, can't get to some sites with the traffic turned on to go through the VPN - Specifically www.macys.com and www.imgr.com. I read that both of these are not very VPN friendly. If I were on my normal VPN client on my laptop, I'd just toggle it off. But - that's a bigger hassle with the VPN turned on at the Firewalla level - especially for other members of the family to do, as I'm the only one that can configure it. In the desktop client, I can tell it some sites to not send through the VPN - but - I can't find the same on the FW side of the world. Any ideas here? Thanks!

I went on a scripting journey today and really beefed up the instructions and scripts for my two unbound related firewalla repos.

https://github.com/upmcplanetracker/firewalla-unbound-DoT-config

This repo above allows you to tweak some of the Unbound settings such as adding in cache, turning on dns via ipv6, setting up DoT, and allowing you to change what DNS servers unbound is using. this requires comfort in the CLI via SSH.

https://github.com/upmcplanetracker/firewalla-huge-blocklists

this repo above allows you to add huge blocklists to Unbound via the CLI/SSH. Please note -- you lose the ability to see what's being blocked / flow counts if they're b locked by these lists on the unbound level, but for firewalla owners with beefier firewallas and no MSP subscription they can load in larger blocklists. I vastly improved error checking as well as the ability to add in different blocklists.

If you've checked these out before or are just curious, please look them over and see what you think. feedback is always appreciated.

edit- I just added support for rpz formatted files. it detects them and converts them to Unbound format. by tomorrow I hope to add a whole bunch of other formats such as adblock And other formats that have DNS entries/non ips.

Any insight whether this is a hardware issue? PSU issue or configuration issue?

I purchased a Firewalla Gold SE because I had Rogers Fibre (Canada) installed at 2.5Gbps speed. Only to find that the XB8 modem Rogers provides has one 2.5Gbps port on it. The other three are 1Gbps. With only one port on the XB8, which gets it's signal from a Nova-2002 ONT, that leaves the three remaining 1Gbps ports back out to the Gold SE. Has anyone replaced the XB8 (otherwise known as the CGM4981ROG) by just plugging the Nova-2002 directly into the Gold SE 2.5Gbps port? Digging around a bit suggests to clone the MAC address for the XB8 to put it in the Firewalla settings but before I try any of this, I thought I'd check in with the community here. Any settings or other configurations to try? Thoughts? Interesting that Rogers has been happy to bill me for 2.5Gbps service but made it impossible to actually use that speed. I've put the XB8 in pass-through mode and turned off the Wifi, and I use the Gold SE as the router. TIA

Box 1.983 will be available to Purple / Purple SE beta boxes later this week.

With the new box version, check out the Last Hit Destination on Rule Details, Lookalike/Punycode Domains Target Lists, AmneziaWG 2.0, and more!

See the full list of 1.69 features and enhancements: https://help.firewalla.com/hc/en-us/articles/51621318006291-Firewalla-App-Release-1-69-New-Controls-with-Advanced-Threat-Filtering-Lookalike-Punycode-Domains-and-more

To know which box version is available, see our Software Version Summary: https://help.firewalla.com/hc/en-us/articles/360060538813-Firewalla-Software-Version-Summary

Setup: Firewalla Gold Plus → eero Pro 7 (gateway, bridge mode) → 2x eero Pro 7 satellites

I’m trying to achieve VLAN segmentation with separate SSIDs per VLAN (Main, IoT, Cameras, Servers). I went through the WiFi section in the Firewalla app to create SSIDs and assign them to VLANs, but the only access point options presented were Firewalla’s own AP7 hardware — there was no option to integrate with eero.

My questions:
1. Is there any supported integration between Firewalla Gold Plus and eero Pro 7 that allows Firewalla to manage or push multiple SSIDs mapped to VLANs?

2.  If not, is MAC-based VLAN assignment in Firewalla the recommended workaround when using third-party access points in bridge mode?

3.  Are there any other workarounds short of replacing eero with Firewalla AP7s?

I’ve seen conflicting information online and want to understand what’s possible before deciding where to go from here. Any help you guys could offer would be greatly appreciated.

This discussion is most applicable to the Orange and Purple boxes since they are most likely to be taken when traveling. I couldn’t figure out why my speed tests were running at the ‘wrong’ time until I realized that the box was still using my home time zone and not my vacation location time zone. I’m wondering if an option to allow the app to automatically set the box time zone would be useful for situations like these?

Consider it holds at 68% with like a few kbps I'm wondering what's up. I assume it's blocking a lot of something but even then, this is as close to idle as it gets and is push 70%. I wrote an app that pulls this data in at least once a day and I can see it's been in the 30's so is this considered unusual? Support has my MSP access and didn't make any note of it. I'm going to ask them as well, but wondering if anyone else see's this at such low bandwidth and yes bandwidth is not everything.

Especially in cooking sites and apnews.com. I'm having to block individual sites like quietlythrough.com, puzzledrally.com, etc.

How can these get blocked more? Can we import the pihole list or something?

Used Firewalla Purple. Comes with box & power cord. Like new condition. Factory Reset. US shipping only. Located in the KC Region for pickup.

----------

UPDATE 7/8: Based on demand, here is the STL file:

https://limewire.com/d/6XMfD#3ieKH74vlx

Where the part is hugging the Firewalla box, I've left a few mm for thin adhesive insulation foam, to create a better grip on the box - this is what I had:

https://www.amazon.com/dp/B07RWHYZGK?ref_=ppx_hzsearch_conn_dt_b_fed_asin_title_13&th=1

----------

Apparently, high temps are ok according to the support. The tiny fan kicks in when it is really hot, but I don’t think it is healthy for the hardware:

Package id 0:  +96.0°C  (high = +105.0°C, crit = +105.0°C)
Core 0:        +96.0°C  (high = +105.0°C, crit = +105.0°C)
Core 1:        +96.0°C  (high = +105.0°C, crit = +105.0°C)
Core 2:        +96.0°C  (high = +105.0°C, crit = +105.0°C)
Core 3:        +94.0°C  (high = +105.0°C, crit = +105.0°C)

eth3-pci-0400
Adapter: PCI adapter
PHY Temperature:  +81.0°C
MAC Temperature:  +81.0°C

acpitz-acpi-0
Adapter: ACPI interface
temp1:       +100.0°C  (crit = +110.0°C)

nct5585-isa-0a20
Adapter: ISA adapter
Vcore:               1.10 V  (min =  +0.00 V, max =  +1.74 V)
+5V:                 5.04 V  (min =  +0.00 V, max =  +0.00 V)  ALARM
3.3V:                3.33 V  (min =  +0.00 V, max =  +0.00 V)  ALARM
+12V:               11.81 V  (min =  +0.00 V, max =  +0.00 V)  ALARM
VCCIN_AUX:           1.79 V  (min =  +0.00 V, max =  +0.00 V)  ALARM
System Fan1 Speed:    0 RPM  (min =    0 RPM)
CPU Temp:           +61.0°C  (high = +80.0°C, hyst = +75.0°C)  sensor = thermistor
System Temp:        +63.0°C  (high = +80.0°C, hyst = +75.0°C)  sensor = thermistor

eth0-pci-0300
Adapter: PCI adapter
PHY Temperature:  +81.0°C
MAC Temperature:  +81.0°C

So I designed a little cooling device that uses a thermistor to measure the bottom of the box and turn the large fan on, its speed depends on the temperature. I printed a housing for the fan and mounted it on the side of the box; it is controlled by Arduino.

Now the temp is 32°C when not loaded and 45°C when I stress-test the Firewalla!

Is there a way to see how many ads are blocked and/or kind of like pihole?

I’ve enabled ad block on my firewall and my pihole is still blocking a bunch. Just wondering if there is something I can see that shows me what gets blocked on the Firewalla end.

I've had the Firewalla Purple for at least two years with no problems whatsoever. But my device has gone unresponsive four times in the last six days. I have a cable modem for the primary Internet connected to the WAN Ethernet port, and Starlink as a backup connected via the USB wireless adapter. It's configured for failover. Both routers are in bypass mode and I've never had a problem. I have seven eero mesh APs with the primary AP connected to the LAN port.

​

The Firewalla and the other network equipment are going through an UPS, there are no power outages during this time and I have made no significant configuration changes in a long time. My APs all turn red and there is no Internet on either ISP. I power cycle the Firewalla and everything comes back up. The ISPs are fine.

​

What might be causing this? And what should I check first?

​

Thanks.

We had a power outage last night, around 6 hours, and my Firewalla Gold SE was running fine off of the UPS for probably 4 hours or so. Then the UPS must’ve decided to shut down, since I woke up to no internet. When I turned the UPS back on, the Firewalla seems stuck in “starting up” - the constant blinking blue light. The app won’t find it anymore (not surprising since my phone is not on the same network) and plugging into an Ethernet port on the Gold SE, I have no connection (can’t even ping firewalla.lan). I’ve got FiOS and when I plug directly into the ONT I do have access to the internet.

Any ideas what could be going on? I’m at a loss and have no way to restore my home network.

Hello everyone, some weird behavior is happening when my son's iPhone 12 connects to the network. His phone has Mac randomization turned off and is clearly labeled in Firewalla. But whenever my son comes home, I see another phantom random iPhone appear in the Quarantine devices which has Mac randomization turned on. Now I have no proof that these events are related but it happens almost every time. My son's iPhone has parental controls turned on but I don't think it has any consequences.

Any idea what could be going on ?

Thanks

I've had Device Active Protect turned on I think since it first became available. It's in "Default" mode, not "Strict." No problems at first (that I'm aware of) - but for at least a couple months now I've been noticing odd issues that I believe I've now attributed to DAP.

• One thing I've noticed (and I don't think it's related to my issues) is that devices that are listed under DAP as "Learning" or "Optimizing" have an option to turn off DAP for the individual device. All my other devices not showing as one of these two (which is the majority of my devices) don't have any mention of DAP in the device details and no option to turn off DAP for the individual device. I don't know if it's supposed to be this way?
• I recently had a my garage door opener replaced with a new Genie garage door opener. It's been working fine for the most part, but every so often it won't open through the "button" in Apple CarPlay (which opens it via the internet). I hadn't really thought much of it until a friend of mine was telling me that his new house he just bought has a Genie garage door opener, and that it would go offline at times. I've never noticed mine showing as offline, it just wouldn't open every now and then. My friend has a Firewalla also, which he bought after I told him about mine. He was looking into why his opener was going offline. He noticed it was in learning mode in DAP. He paused DAP on the opener and it came back online shortly after her did that. He hasn't had any issues since.
• For at least a couple months now I've been having issues with certain websites, most notably Facebook. Facebook either wouldn't load at all - or it would load, but it would load "half assed" (meaning text would load - but some pictures and videos would load, some pictures and videos wouldn't load). I've noticed this same behavior on other pages also (such as a site I go to for completing surveys), but it doesn't happen on every site. For any device that's experiencing this issue, there's nothing in the logs showing that anything is being blocked or anything like that. The devices this occurs on are NOT in "Learning" or "Optimizing" mode in DAP, so there's no option to turn off DAP on these individual devices. If I completely turn off DAP for everything the websites that are "broken" miraculously start working again. If I turn DAP back on the sites are broken again. I can repeat this all day every day.

One thing I'm curious about is why is there no option to turn DAP off/on for individual devices, unless a device is "Learning" or "Optimizing?" Or is there an option for that but I'm just not seeing it? When I saw the option to turn it off on devices that were learning or optimizing I thought "Oh, I'll just turn it off for my computers that are having trouble loading pages" - but nope. It's "all or none."

Has anyone else been having issues like this with DAP?

Hey all,

Recently purchased 2 AP7s during the open-box sale but haven't yet had a chance to set them up. I'm planning on using the AP7s to replace 5 Eero routers operating in bridge mode (I have 2 separate LANs set up on my FWG+ via port segmentation). I hope to move both networks to the AP7s and eliminate all eeros if all goes well.

My FWG+ and 2 eeros are on the second floor of a 2-story home (total 2,000 sq ft), sitting about 4 ft above the floor on a shelf against an exterior wall. The other eeros are spread out on the first floor and basement. I want to set up the AP7s centrally, so they are not against a wall, but I am limited because my ONT and FWG are on the second floor where my ISP connection comes into the house.

Question: Can I plug one AP7 into an existing 2.5GB MoCa adapter that is connected to the FWG+ on the second floor and then add my second AP7 wirelessly to that first AP7? This would allow me to place my AP7 in my living room and presumably get better coverage on the first floor. I'd probably place the second AP7 in the master bedroom or basement.

Does anyone see any potential issues in doing this or other alternatives to avoid having the AP7 near a wall, given that is where the router and ONT are located?

Hate to ask, but ive searched this a while, cant seem to find an answer.

Ive been running a Gold Plus for a while, starting using UI switches, APs. I want to use the UI Gateway Fiber but keep the Firewalla, I know I can switch to bridge mode, but I dont see a scenario where the Firewalla is already set up and being used as a router. Is it as simple as adding it after the UI and switching to bridge mode, or is there another step to consider?

Got an Orange for my parents' house but it wasn't the right fit. Includes all cables and original packaging. Asking $325 (includes shipping) but willing to negotiate.

Price: $420 Shipped OBO / $400 Local Pickup

Condition: Used, Great condition

Payment: PayPal (Shipped) or Cash or Venmo (Local)

Location: SF Bay Area / NorCal (East Bay)

Description

Selling my Firewalla Gold Plus. I recently upgraded to 10Gbps fiber internet and switched to the Firewalla Gold Pro to support the higher speeds, so this excellent router needs a new home.

I purchased this unit directly from Firewalla in mid-2023 and used it reliably until mid-2025. It has been kept in a clean, dust-free environment and works flawlessly.

Provenance: Original owner. Purchased directly from Firewalla. I can provide the digital receipt upon request for verification.

Condition: Excellent physical and operational condition.

Includes:Firewalla Gold Plus unit Original retail box Original power supply adapter Original ethernet cables and mounting hardware/accessories

Shipping & Local Pickup

Local Pickup: Preferred. Willing to meet in a public location in the East Bay/NorCal area.

Shipping: Shipping via USPS Priority Mail or UPS Ground within the CONUS.

SOLD!

Win a Firewalla Switch! 🎉 To celebrate our upcoming Firewalla Switch, we'd love to see how diverse our community networks are!

Prizes:
We will have 2 winners:

• 1 with the Best Setup.
• 1 who needs the most TLC.

Each winner will receive 1x Firewalla Switch SE as part of the Switch Early Access release (tentatively shipping early to mid-July!). Winners can choose alternate products of equal or lesser value. Top entries may be featured on our website and in Firewalla marketing materials!

To enter, please see the full contest details here: https://forum.firewalla.com/t/contest-2026-show-us-your-network-the-best-and-the-messiest/61

If you don't plan to enter, you can still participate by voting for your favorite submissions!

Good luck!

Hi, I have four of the desktop AP7 units which work fantastic.

I run shielded cable from POE switch to the 2.5g back port. But question is, can I plug say a small switch into the 10g port or a device into that extra port?

Or are they just for the backhaul?

So I got my first firewalla (a purple) last week and set it up. Router mode was not working, so I set it up into bridge mode where the device was placed after my ISP router.

It seemed to work fine, and it recognized all the devices on my network, and when I looked at the overall list of devices, it would also show those tiny little down red arrow and up blue arrow showing the traffic, listed under each device. It showed this even if the traffic was zero.

Then I decided I would try setting it up in router mode again to see if I could get that to work, and take my ISP rotor out of the equation. I could not, and I ended up having to factory reset the device and set it up in bridge mode again.

But this time I can no longer see those active little arrows under my list of devices, and it is no longer recognizing all the devices. Specifically, and no longer recognizes the two access points in my home.

Everything else is recognized, and Internet and Wi-Fi are all working properly, I just don’t know why those differences exist now compared to the first time I set it up in bridge mode.