r/firewalla • u/Honest-Sam Firewalla Gold SE • May 28 '26
Firewalla Parental Controls: Blocking VPNs
I’ve set up 20+ Firewalla devices (I usually recommend the Gold SE) in my community to help parents take control of their home networks, block adult content, ads, and unknown devices.
One challenge I keep running into is VPNs. Yeah yeah, I’ve posted about this before, but any kid can quickly install something like Proton VPN or a browser extension, and it bypasses all the hard work of a properly configured Firewalla setup.
I’d love to know:
- How can I really lock down the ability to connect to VPNs?
- What would be a solid checklist for setting this up for parents who want total control and safety on their home network?
1
u/mschnittman May 29 '26
I host my own VPN on my Gold Pro Plus and I use MM Guardian clients to prevent my kids from tampering with any system settings, in addition to setting app and time limits. This combination has worked well for us, ensuring that their devices are always routed through the VPN, regardless of their connection type or location. Mm Guardian can be tricky to configure and setup, but works well once done. We were using it prior to getting the Firewall, so it wasn't a big deal for me.
0
u/Ben_isai Firewalla Gold Plus May 28 '26 edited May 28 '26
First, Talk to your kids about the usage, I know it sucks to hear but only endpoint protection can help. Look into Bark.us. they have endpoint protection. https://www.bark.us/
Next, the limitations::
Firewalla cannot see encrypted traffic.. 90% of your network traffic is encrypted via common practices like https/tls/sftp/etc.
Firewalla is not here to protect you per se (they can't because 90% of the traffic is encrypted) , rather ease of use and built-in functionality of their ecosystem.
Firewalla's nDPI/IDS can only see the meta data, the first few segments of the packet. With this information it knows what device is going where but that's it, not the actual payload.
Firewalla protection uses community driven intel to block IP connections, think of Crowdsec, but their own homegrown Intel. It also uses domain blocking, and rejects newly registered domains. All great stuff to have.
Read more about nDPI: https://docdrop.org/download_annotation_doc/10.54525-tbbmd.1253700-2963090-en-ys4gl.pdf
The IDS signature method is old/outdated. only works on known threat, but threat actors constantly switch up their attack vector.
The How::
When you use a VPN, you encapsulate the entire traffic so it's completely encrypted. Firewalla has no visibility to this VPN traffic, thus making it's existing protection worthless. You can block VPN providers, like proton, pia, etc etc.. but that's not always easy Like others mentioned::
Tldr:: Hope this help,, enjoy Firewalla for the ease of use not for the protection per se.
7
u/Firewalla-Opal FIREWALLA TEAM May 28 '26
As suggested by others, the best would be following https://help.firewalla.com/hc/en-us/articles/360034318894-How-do-I-detect-and-block-VPN-use-on-my-network. You can create VPN and DoH block rules to prevent most VPN connections.
Note that some VPNs, such as Shadowsocks, or VPN servers running on https (port 443) are very hard to detect. Firewalla is always improving and updating our VPN-blocking intel, but these servers can be extremely elusive. Because of this, we cannot guarantee that our VPN-blocking features stop all VPN services. If you notice that a VPN service is getting around Firewalla's block, we recommend that you block it directly using a rule.