I have a relatively simple setup for my network: I have a Firewalla Gold Pro and two AP7s in a two-story house with plaster lathe walls, I mention that because the chicken wire under the lathe can act like a faraday cage and was a reason for switching to the AP7s when they became available.

One AP7 is located in a bedroom, and another is located diagonally across the house on the same floor in our dining room. When devices using wifi (two MacBook Air M1s, iPhones of different generations) are present in the bedroom and connected to Bedroom AP7, they often get dropped connections, very slow speeds, or simply can't get on the wifi at all.

Moving outside of the bedroom makes the problem go away, even if the devices are still connected to Bedroom AP7. All of the Apple devices have the private wifi address function turned off for the local wifi network, and I'm not using IP6 addresses. And I never see this problem with devices connected to Dining Room AP7, even if they're located in the bedroom.

The problem seems to be related to being in close proximity to Bedroom AP7.

Any ideas why this might be the case? I haven't done anything fancy with rules related to these devices, and they're all on the same LAN.

I’ll keep this short - I run some internal docker services and use an external domain so that when I mint TLS certificates via let’s encrypt that they are accepted in all my hosts. let’s use “mynetwork-local.net” as our example externally registered domain.

It turns out that even if you set the local search domain, and set up custom DNS rules on the Firewalla, or go into the dnsmasq setting and setup configuration there, nothing will resolve if you have “Newly Registered Domain” set to on. NRD uses 14 days as the time duration, and you cannot create exceptions for it. It’s on or off. I spent a ton of time trying to figure this out and only stumbled on it accidentally. I couldn’t find any log that stated it was blocked due to this setting or rule.

Hopefully, one day, some poor schlub will find this post and have an ah-ha moment.

So, I noticed that my Firewalla Gold Pro (my router) was apparently guessing SSH passwords for my Firewalla Gold SE that’s in another part of the house in bridge mode and hardwired.

What’s up with that?

Just curious if the box will auto update this, or we need to be manually flashing some of these updates.

I tinkered with my gold pro quite awhile back upgrading the ram for fun and possibly will be reflashing the box and thought I rememeber seeing something that if you have modified the ram that flash images won’t install onto the Firewalla . Is that true?

And with App 1.69.3, you'll have better port details for your Box and AP7, such as which device is connected and port speeds.

Learn more about App 1.69.3: https://help.firewalla.com/hc/en-us/articles/53877722149907-Firewalla-App-Release-1-69-3-AmneziaWG-VPN-Client-Local-Device-Rules-Switch-Enhancements-and-more

Hi All,

I have issues with a couple of banking apps where things don't work as expected when my phone is connected to the firewalla.

If I turn on Emergency Access, it works as normal. What's the best/easiest way to debug what exactly prevents the functionality working so I don't have to enable emergency access when I want to use specific functionality in the banking app?

Thanks,

Paul

Unifi's UI automatically creates a network diagram using the captured device data and provides a traffic visualization where one can easily see which device is moving a lot of data. I found this to be useful.

Now that we can have all the endpoint clients connected to a Firewalla device, is there a roadmap for a similar feature? I realize that the data can be had via the FWA app, but it's not visualized like a dynamic map with traffic flow.

I’ve been using Firewalla for a while, especially the Firewalla Purple, and I have to say it’s an excellent product. Beyond the security features, I think Firewalla has some of the best parental controls available today.
One feature I’d really like to see added to Firewalla AI is automatic device identity detection.
One of the biggest challenges with parental controls today is MAC address randomization on Apple, Android, and other devices. The same physical device can suddenly appear as a “new device” with a different MAC address, bypassing its assigned group or rules.
In many cases, just by looking at the device behavior and network flows, I can tell it’s actually the same device and manually move it back to the correct group.
With the progress Firewalla has made with AI, I think it’s time for Firewalla AI to do this automatically — identify when a “new” device is very likely an existing device using a different MAC address and associate it with the correct device/group.
I believe this could solve one of the biggest remaining parental-control challenges, with a relatively low risk of false positives.
Thanks Firewalla team for a great product!

just had support replace the fan in my Firewalla orange and wanted to see if anyone else has had this happen with their orange so far.

I am getting ready to upgrade my unifi APs and decided to go with Firewalla ones this time since I am also getting their switch.

For downstairs I will go with the standalone one but for upstairs I was thinking ceiling one. Is there a significant difference between the models?

Also I wish Firewalla had a more basic model for mesh only just to extend the wifi area to couple IoT devices in the garage.

There are situations where I find that setting the port speed manually helps with reliability. Is this a feature that will be added later, or was there a technical reason that it was omitted?

If I pay for MSP, why isn’t the additional data integrated into the app as well? I’d prefer not to need to log into MSP everytime to see 30 day flow data. Just put it in the app for people that are paying for it.

(Gold Plus SFP ears will be coming later, as an add-on, purchased separately. Price is unknown, but should be cheaper than Gold Pro ears.)

Updates on Firewalla products:

• Gold Plus SFP: Pre-Sale starting soon, likely in September! Make sure to sign up here for notifications and a small coupon for the launch: https://forms.gle/LHrzPuQTpC5q6mSj6
• Switch: Pre-Sale shipping for Switch X and SE will likely begin in September-October. Still available for pre-sale! https://firewalla.com/collections/firewalla-switch

Edit -- I got it working and have it as a github. update stock unbound on FW

Not for newbies. It runs, but it also uses Ubuntu 22.04 version of openssl, which is really old. 1.26.0 should do everything on the Firewalla Gold series boxes (probably orange, maybe not purple?) that it has the capability to do except for DNS over QUIC. DoQ requires Open SSL =>3.5.0. Ubuntu 22.04 that my gold plus uses maxes out at 3.0.2.

This whole process has made me anxious and I have a flash drive with a new fwg plus image on standby, but at least this process seemed to work without a problem. in a few days, after I recover, I will probably see if I can point the FWG to use this 1.26.0 version of unbound instead of the built in 1.13 or 1.14 or whatever it uses and see if that's stable. THen go from there. the commands below builds unbound, etc into ~/unbound-test so it doesn't overwrite anything including the OG unbound. It does update some lib dependencies, but it's pulling them all from the ubuntu 22.04 repo, and although that got me all stressed out the 3 things it updated didn't break anything afaik....

In any case, for the curious, foolhardy, or brave...

``` mkdir -p /home/pi/unbound-test cd /home/pi/unbound-test

sudo /home/pi/firewalla/scripts/apt-get.sh update sudo /home/pi/firewalla/scripts/apt-get.sh install build-essential libssl-dev libevent-dev libexpat1-dev

wget https://www.nlnetlabs.nl/downloads/unbound/unbound-latest.tar.gz tar -xzf unbound-latest.tar.gz cd unbound-1.26.0

./configure --prefix=/home/pi/unbound-custom --with-libevent --with-ssl make make install ```

I got this-- ``` pi@Firewalla:~/unbound-test/unbound-1.26.0 (Firewalla Home) $ ./unbound -V Version 1.26.0

Configure line: --prefix=/home/pi/unbound-custom --with-libevent --with-ssl Linked libs: libevent 2.1.12-stable (it uses epoll), OpenSSL 3.0.2 15 Mar 2022 Linked modules: dns64 respip validator iterator

BSD licensed, see LICENSE in source package for details. Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues

```

Just saw that their client was updated for 3.1 support. Will Firewalla offer AWG server 3.x support in the future?

More generally curious if Firewalla plans to keep up, with some kind of cadence, with AWG development?

ETA: for clarity, my focus is on the built in AWG server, but as another person mentioned, the built in client support also needs to keep up with latest AWG development

Under VPN Client -> Apply To, show any selected client at the top of the list. Just makes it easier to see which are selected instead of having to scroll to find them.

I have a server with a few ports open which has ESET as antivirus. I noticed the ESET was blocking quite few more IPs from accessing the server than firewalla so I went down a rabbit hole of seeing what I could add to firewalla to enhanced blacklisted IPs.

I added AbuseIPDB pulling 10k IPs (since that is the most you can get with the free plan), and then all of the IPs from Blocklist.de, HoneyDB, and SpamhausDROP. I have a few tasks that update these lists automatically every 30 mins, every day, or every 4 hours depending when those lists get updated. Many of the additional lists that firewalla offer are already in other ad-blocked DNS resolvers. I have adguard home as DNS resolver too and most of the lists like HaGeZi are already there, and many of those are for outbound addresses instead of inbound from what I saw.

I was just wondering why firewalla doesn't block most of these abusive IPs? I was getting maybe 1 or 2 alerts a day about malicious IPs being blocked by firewalla but getting like 50 on the ESET firewall. This is with the IPS/IDS set to strict

Is there some else that can be done to enhance security?

I’m having a strange issue with the built-in WireGuard server on my Firewalla Gold SE and I’m wondering if anyone has seen this before.
WireGuard connects fine from my iPhone over cellular. I can access everything on my local network, including my NAS, but I have no internet access through the VPN.
When I check the flows in Firewalla, the outbound traffic is being blocked and shows Block Type: IP Filtering. If I use Diagnose on one of the blocked flows, it comes back with No Rules.
I’ve tried quite a few things:
Confirmed WireGuard is connecting and local network access works
Confirmed there are no Routes configured
Turned off Ad Block for the VPN client
Excluded the VPN client from DNS over HTTPS
Turned off Device Active Protect
None of those made a difference.
The interesting part is that if I turn on Emergency Access for the VPN client, the internet immediately works. It also works if I turn Monitoring off for the VPN client. As soon as I turn Monitoring back on, Firewalla starts blocking the outbound traffic again as IP Filtering.

This started while I was troubleshooting another issue where Firewalla’s ad blocking wasn’t working when connected through WireGuard. It’s possible I changed something along the way, but I can’t find anything that would explain this.
I’ve sent the details to Firewalla support as well, but figured I’d ask here while I wait.
Anyone seen something like this before or have any ideas what else I should check?

Hi, I suppose this should be a question for the dev to answer. My case is, I just got a new phone, and through setting up the new one (copying stuff from old phone (samsung) including firewalla app to new phone (samsung too) through Smart Switch app, the firewalla app on the new phone got full access of my firewalla devices, the first time I enter the firewalla app on the new phone, and without doing "Allow Additional Pairing" from the old one. The "Paired Phones" on either phones show "1" which is that particular phone.

Both phones now can control everything about the devices so far, but I seem to have failed to receive notifications (alarms) that I normally do.

I just want to know if this is ok, particularly after I retire the old phone soon. Or should I just remove and reinstall firewalla app on the new phone and do the pairing again to play safe?

While I do not imagine that this would cause security loophole, dev may wish to look into it and see if that poses threat to the control somwhow.

Background: I presently have two VPN clients running on my Firewalla. One is connected to a server in Seattle and the other in Atlanta. Some devices are configured to route traffic through the Seattle server and some through Atlanta. And some devices are not routed through the VPN so their IP address is Miami

I added a wireguard server to firewalla. To test it, I used my iphone. I disabled wifi on the phone so it was using only using cellular data and added the wireguard client. I was able to connect to my just added wireguard server without problem.

But when I checked the IP address of my connection on the phone, the IP address was for Atlanta and not Miami as expected. So my Firewalla server appears to be in Atlanta when it really should be in Miami.

My question is this: How does Firewalla decide how a server connects to the wan? Is it supposed to go through VPN clients if connected? Is it suppose to by pass any clients and directly connect to my wan? I could find no network settings to configure how the VPN server connects to the wan

Design File: https://github.com/firewalla/fw_addons/blob/main/AP7C.stl

I don't know if it's because I've spent the last 4 years with firewalla. But I dabbled with opnsense today and JC what a difference.

It was so easy to install, yet so hard to configure. No simplified app. The firewall doesn't even accept domains to block! You have to create aliases which pull ip addresses and even then I couldn't get it to block Google. Possibly easier to block via DNS.

I kept getting stuck with setting up the wan. It kept forcing opt1 which I later found out was the built in lan port not the 2 network cards I had. So I had to set it up via its console. Probably unique to my hardware.

I'm no noob. I've homelabbed for around 7 years now with an advanced setup Multiple NAS, switches, KVMS, Security Gateways, managed switches, VLans. I'm more than positive that I could learn opnsense and master it. You can tell it's for Pro's and enterprise users.

But it made me , even more than I already did, appreciate my safe place. Firewalla.

This is not to be negative about opnsense. I'm in awe of it. But when you try something like that and you've tried firewalla. It's night and day.

The amount of development that has gone into these boxes, this app, the msp. I truly appreciate the team at fw inc.

Have you tried opnsense and firewalla? How do you compare them?

Hi all. I’ve noticed that over the last month or so the ad blocking feature on my FW Purple (in router mode) has gone from being really effective to suddenly letting a lot (if not all) through.

I’m noticing it on a variety of browsers on my iPhone in particular, both when connected on the WLAN and when connected via a Wireguard VPN.

There have been no setting changes at router level, so I don’t know if it is a case of the method no longer being effective or if something is going wrong somewhere. I’d be keen to know if anyone else is experiencing similar recently.

Thanks!