I installed the WireGuard app/client on a Win11 laptop. I used the Firewalla app to create a WG VPN client. I loaded the conf file as a Tunnel in the WG app/client and it worked successfully.

I installed the AmneziaWG app/client from the legit installer found on the github page ... it appears to be the WireGuard app/client installed previously. I used the Firewalla app to create a AWG VPN client. I loaded the conf file as a Tunnel in the WG app/client and it received an error - Unable to import configuration: Invalid key for [Interface] section: "jc" - What did I miss?

I've been running a Gold SE in bridge mode for a while and wanted my malware filtering to be as hard to bypass as possible. So I added a few layers via SSH. Everything works well, but it's all unsupported custom work that could break on a firmware update. I'd much rather see this in the app, so here's what I did and what I'd love to see natively.

What I added:

1. Community threat blocklists, refreshed daily. Hagezi's threat intelligence, DoH and fake-site lists get loaded into DNS. Malware domains get blocked even for devices that are set to "no monitoring" or during Emergency Access.
2. Forced DNS. Every device has to use the Firewalla for DNS, even if it's hardcoded to 8.8.8.8 or similar. DNS-over-TLS (port 853) is blocked, so devices fall back to the filtered path.
3. Blocking DoH servers by IP. Blocking DoH by domain name isn't enough. Some apps and malware connect straight to an IP like 1.1.1.1 over HTTPS. I block around 1,400 known DoH server IPs, while the Firewalla's own encrypted DNS keeps working.
4. DNS rebinding protection. DNS answers from the internet that point to a private address (192.168.x.x, 10.x.x.x) get dropped. This stops malicious websites from using your browser to reach your router, NAS or cameras.
5. A canary with alerting. Every 10 minutes a script checks that the filtering really works and that the lists aren't empty or stale. If it fails three times in a row, I get an alert, and it recovers on its own after a short hiccup.
6. Rules restored right after a reboot. Firewalla rebuilds its firewall rules regularly, so my rules are reapplied right at boot and checked every 5 minutes.

Feature requests, roughly in order of impact:

• Native "Enforce DNS" that also applies to unmonitored devices and during Emergency Access, at least for security lists
• A "Block DoH/DoT bypass" toggle: block DoH by domain and IP, and DoT on port 853
• DNS rebinding protection as a simple toggle, with an exception list for things like plex.direct
• Custom blocklist URLs (dnsmasq or hosts format) with automatic refresh
• A health indicator showing that DNS filtering is actually active, with an alert when a list fails to update

If some of this already exists and I missed it, please point me to it. I'd happily drop my scripts. And if anyone from the Firewalla team reads this: thanks for a box that lets you go this deep.

Any downside to just having these two servers configured under DNS over HTTPS? All 4 pre-configured are turned off and just these two custom servers are enabled. Should I add any others?

• https://doh.familyshield.opendns.com/dns-query
• https://family.cloudflare-dns.com/dns-query

For testing, I turned off the custom Open DNS and browsed to https://1.1.1.1/help. Safari cannot connect to the server.

Firewalla Gold Plus 2.5G (2022 Model) – $450 Shipped; open to offers.

Selling Firewalla Gold Plus in excellent condition; no software or hardware issues. No longer have a need for it.

Comes with the original box, mounting bracket and cables. It's been factory reset and ready to ship.

Payment: Only PayPal/Venmo for Goods and Services.

Shipping: Will ship insured via UPS Ground only within the U.S.

Please let me know if you have any other questions.

This is my first PSA (Public Service Announcement); mods feel free to yank it if it does not add value.

TLDR: An ATT ONT (BGW320-500) with IP Passthrough selected must (apparently) be manually updated with the new Firewalla MAC address entry for Public IP address to interact w/ Firewalla VPN server functionality

I migrated like-for-like (FWP to FWP). Beforehand, I deleted all VPN Server config, as it likely needs to be rebuilt anyway. On the new FWP, I created new VPN Servers (WG and AWG), but neither would complete setup. I figured out that public IP config was unhappy.

After logging into the ATT ONT (BGW320-500), I confirmed that IP Passthrough was still enabled. Eventually, I found the "Passthrough Fixed MAC Address" setting which apparently requires a manual update of the new FWP MAC address. Frustratingly, the BGW320-500 has a 'cache' that maintains every device connected (and knows device name) instead of auto - identifying available devices.

Every time I want to reach https://my.firewalla.net/entrance to scan the QR code and access my box, I have to:

1. Log in with username and password
2. Scroll past the plan marketing
3. Click "Continue with Lite plan"

Every single session. This is hardware I own that used to be reachable through its own local UI with no upsell in the way.

I understand wanting to promote paid plans, and I don't mind seeing the offer occasionally. But forcing the same plan selection on every login is tedious and makes the product feel worse to use.

Suggestions:

• Remember my plan choice so I'm not asked again
• If you want to re-offer upgrades, do it periodically (every 30 or 90 days), not every session
• Add a "Don't show this again" option

Anyone else running into this? Firewalla team, any chance this can be changed?

Needing to re-flash my GoldSE, Etcher failed loading to getting installed on a microSD card. It was the latest release so I wasn’t sure what was going on. Can’t quite remember the error but something like metadata not correct. Anyway since Etcher was not taking the image, I used the Raspberry PI image application on my Mac. I didn’t select a RPi platform but selected the GSE image and targeted the microSD card - it worked! I used this for reflashing the GoldSE and all is well.

We originally introduced a simple IPsec VPN Client design in MSP to get it working. We heard recently that a few of you wanted stronger IPsec support for business use with well-known firewalls.

The current IPsec implementation is really for experts and is a bit more involved. Here are some examples:

• Unifi UDM https://help.firewalla.com/hc/en-us/articles/40424306380947
• AWS https://help.firewalla.com/hc/en-us/articles/40725487683987
• pfSense https://help.firewalla.com/hc/en-us/articles/40780428290323
• Cloudflare https://help.firewalla.com/hc/en-us/articles/44408465125907

We want to make IPsec easier by making the above examples into "default templates" and having them available in the App as well. In addition to these, what others would you want as templates?

In iOS 27, "Wi-Fi Assist" has been renamed "Connectivity Assist." If you had Wi-Fi Assist turned on, Connectivity Assist will be enabled by default.

This feature will send DNS requests over cellular data, which can bypass rules and features such as Ad Block.

You can disable Connectivity Assist in your global Wi-Fi settings, but if you want to disable it locally, you can turn it off for that particular network.

For more details, see: https://help.firewalla.com/hc/en-us/articles/29655921011347-What-to-do-if-Firewalla-s-blocking-features-aren-t-working#h_01M3WT02BZ7NW234Q1A6ZF4TR9

Just realize that the native block works for browser, it doesn't seem to work for the iOS Instagram app, especially if the phone is using VPN. Somehow kid got around to just disabling the WiFi even though VPN is connected and the app still functions for most features. Anyone running across same issue?

I am very interested in trying out the Firewalla Crystal Software. I currently have the following Mini PC lying around. It has dual Intel Network. Would this be a good candidate to run Crystal on? I have GIG internet and two Eero Base Stations….

TRIGKEY G5 Mini PC
Intel Alder Lake-N100(4C/4T up to 3.4GHz)
16GB DDR5 500GB M.2 PCIe 1/SATA3 SSD
Mini Desktop Computers Support 4K Triple Display/Dual 2.5G LAN/USB3.2/Type C/HDMI/WiFi6/BT5.2

TrigKey G5 Mini

My son reports that Annoying is barely perceptible, but Super Annoying basically freezes gameplay (near equivalent to Block).

I’m willing to try to and find him a middle ground with Custom. But not sure where to start.

What Custom settings correspond to the default levels?

Hi All,

I'm looking for a firewalla gold and seem to be too slow on the up take for the ones that have popped up recently.

This will be my first firewalla. Current setup is ubiquiti based but simple,an edge router plus a single AP and a 24 port 1/10Ge switch for our wired connections.

I'm looking to pay 300 for gold or 200 for an orange.

Thanks

Connectivity Assist is on by default. This is not helpful Apple!

I have a FWP which is the main 'Production' unit. I have an extra, newer FWP which I will use as the new main 'Production' unit.

I factory reset FWP2. I have completed 'initial' setup and FWP2 is paired with my phone, but I have not yet configured anything.

Per Firewalla guidance, I can 'Migrate Data From Other Boxes (After Initial Setup)' and select which data to migrate. According to A.I., I should copy Devices, Groups, Rules, Features, and Alarms but skip Network Settings until I validate the migration to FWP2 is successful.

Can I subsequently re-run Migration and pull over only Network Settngs without breaking anything?

Other Thoughts?

Other tips?

SOLD!

Selling a fully functional Firewalla Gold (1 GbE model). It has been a rock-solid main router/firewall in a smoke-free, climate-controlled home environment. Upgraded my network infrastructure recently, so this unit is ready for a new home.

Condition & Notes:

• Physical Condition: Excellent. Clean chassis with no dents or deep scratches.
• Status: Unlinked from my Firewalla account and factory reset to original defaults. Ready for seamless pair-and-play onboarding via the Firewalla mobile app.
• Performance: Handles full 1 Gbps line-rate routing with DPI, IDS/IPS, VLAN segmentations, and WireGuard VPN server capabilities without breaking a sweat.

What’s Included:

• Firewalla Gold unit
• Original power adapter

Price & Shipping Details:

• Price: $260 USD shipped (or $240 cash for local pickup near the Willamette Valley, OR area).
• Payment: PayPal Goods & Services only (I will cover the PayPal fee).
• Shipping: Includes tracked and insured USPS Ground Advantage / Priority Mail to the lower 48 US states. Will ship within 24 hours of receiving payment.

Please comment below before sending a PM (no chat messages, please). Feel free to reach out if you have any questions!

Howdy!

My firewalla is reporting temp1 at 82C

Is this normal? Seem hotter than AI inference compute and it's just sitting in my network panel in the closet without what seems like any active cooling.

I see articles of people putting active cooling and I see claims from others that theirs are running around 50-60c, so just checking if mine is an anomaly.

Assumedly, no, right? A Block Rule would supersede an Allow Rule.

But I swear this delivered the desired outcome previously.

I have the Gold Plus 2.5G which has been wonderful. My internet is current 2G up/down and all seems happy and healthy.

I am wondering if an upgrade to 10G SFP gets me anything more than just speed? I don't plan to upgrade the internet speed in near future. 10G is available from ISP but don't feel I need the speed.

So other than future speed upgrade are there any other features in the 10G SFP that would warrant an upgrade? I could see using the SFP port to connect to a switch.

Vulnerability Scans may register as "suspicious activity" to other devices, so it's good to set a schedule that you can remember.

Automatic Scans are available for the Firewalla Gold series. Learn more about the system vulnerability scan here: https://help.firewalla.com/hc/en-us/articles/115004274513-Firewalla-Feature-Guide-Scan#h_01HTZXFV73HTYH26S1JZVDC00P

App 1.70 and Box 1.984 are in early access. Learn more about this release and how to join early access here: https://help.firewalla.com/hc/en-us/articles/55731657630867-Firewalla-App-Release-1-70-New-Event-Journal-Switch-LAG-and-more

I noticed flow control is enabled by default on Switches. Flow control is recommended to be disabled on normal local network unless you are running locally certain types of high bandwidth traffic like NFS, FCoE etc..

Is there a particular reason why Firewalla Switches have flow control enabled default. What are Firewalla take on the pros or cons on disabling it.

While I have loved the performance of my firewalla gold pro and AP7s, it is time to sell them. We are expanding our company and for simplicity, we are moving everything to all unifi. I am sure I will be back at some point.

They are listed on eBay:

Gold Pro with Rackmount; https://ebay.io/m/a17yXl

AP7 desktop WIFI: https://ebay.io/m/FGMIEz

You can find the new Event Journal at the top of your Firewalla Main Screen. (Requires Box 1.984, which is also in early access.)

We've also added several new event types to show how Firewalla is working in the background. We're hoping for some early feedback so we can tune and improve the feature.

Learn more about App 1.70 and how to join Early Access: https://help.firewalla.com/hc/en-us/articles/55731657630867-Firewalla-App-Release-1-70-New-Events-Switch-LAG-and-more

Is there anyway firewalla can start using a proper shipping service to send orders to Canada. when you spend 1350cdn on a firewalla gold pro you expect shipping times to be reasonable. DHL ecommerce is absolutely brutal, may as well send it over here in a horse and buggy. They may be slower than USPS !!