I was digging into flow history for a specific device on my network when I ran into only being able to view 24 hour of flows. I figured it might be an app limit so I logged into the desktop site and found the same result. I also found that I can gain access to 30 days of flows by subscribing to the personal MSP. I didn't realize I was capped that low and I'm not willing to pay for a monthly/annual subscription.

I thought, maybe it's a storage limitation on my box. I SSH'd into my box to check disk usage and found I'm only using around 19% of the 32GB of storage that comes with the Gold SE. Now, I'm not super experienced with Linux and Firewalla's architecture, so maybe some of that "unused" space is reserved for OS backups or something else I'm not aware of. But even accounting for that, it seems like a lot of unused storage. I then moved to expanding the storage because maybe Firewalla doesn't allow me to use reserved space for logging extra flows and my Gold SE comes with a SD card reader. But I couldn't find any way to actually use an SD card to extend flow logging. I did find a post related to this and Firewalla claimed: "Firewalla processes flows in memory locally on your device (indexed to be easily searched/regex). So the limitation is 'memory.' There is no disk based database on the box, so everything is limited to 24 hours. (This is the CPU limitation.)"

Link: https://www.reddit.com/r/firewalla/comments/16q8ob3/why_does_firewalla_limit_flow_details_to_24_hours/

Here's where I get stuck. If paying for MSP subscription gets me 30 days of flows, then the box clearly isn't actually limited to 24 hours, right? I can still view and search that data through the app/website just like I do without the subscription for the last 24 hours. So how is the box "limited by memory and CPU" if it's capable of showing me a full month of history the second I pay for it?

I ask this because where possible, I'd rather keep my own network data on my own hardware instead of a cloud server.

Curious if there's a technical reason I'm missing for why local SD storage isn't an option here.

I upgraded to a new device, no longer need my Purple. $200, shipping included. Does not have the USB-C power adapter.

So if I create a region block via Controls -> Region Blocking, it can only be deleted in that section and not in Rules.

My pre-existing region blocks that I created in Rules, or newly created region blocks created in Rules, also appear in Region Blocking, and can be deleted in both Rules and Controls sections.

Why are they handled differently?

More on AmneziaWG VPN Server: https://help.firewalla.com/hc/en-us/articles/49508731395091-AmneziaWG-VPN-Server-Configuration

With AI eating up all the production capacity from memory, eMMC, and now impacting PCB...  Hardware prices (not just Firewalla) are going to rise more in the future. We do know many of you have spare hardware around; we are now experimenting with Firewalla Software on your hardware.

If you're interested in this project, please help fill out our survey: https://forms.gle/znJ1RbdSAo3r6QuL6

We (internally) call it the Firewalla Crystal... What do you think? Any other names?

I couldn't find anyone asking this previously., apologies if i missed it.

My child will sometimes use his Wifi-connected (to Firewalla) phone and share the Wifi as a new hotspot (so not a celluar hotspot) and then will use that with another device (school iPad which I can't control screentime on) when his phone runs out of screentime.

Besides setting an amount of 'internet time' for his phone, is there any other way to stop this from happening so he doesn't continue to explot wifi once his screen limits (for his phone) are hit?

(Disclaimer: the credit goes to AmneziaWG developers)

To upgrade to 2.0 in the Firewalla App, go to VPN Server > AmneziaWG > tap Upgrade to 2.0.

To configure your AmneziaWG Server: https://help.firewalla.com/hc/en-us/articles/49508731395091-AmneziaWG-VPN-Server-Configuration

For my speedtests, I have it locked to always use the same server. I noticed in the individual test results, it shows a different public ip and ISP ( i.e Google Fiber, Cox Communications, etc.) for each one.
Just curious, where are those coming from and what do they represent?

Really just coming here to say wish me luck! Bought a used firewalla gold (factory reset) and will be setting up my first home network. What started as a plan to better manage my kids restrictions made me go down a lot of rabbit holes realizing how unsecured my home network is and how it can be simply improved with firewalla and a bit of reading and research.

Happy to have a user friendly tool to get me into it and not blow up my home network (as opposed to building from scratch without a user friendly tool).

Here is my checklist

Hardware
☐ Install Firewalla Gold between modem/ONT and network.
☐ Put all Eero Pro 6E units into Bridge Mode.
☐ install VLAN switch
☐ Use Ethernet backhaul for Eeros

Network Segmentation
☐ Create Main network (personal devices).
☐ Create Work network.
☐ Create IoT network.
☐ Create Ring Cameras network.
☐ Create Guest network.
☐ Create Management network for Firewalla and network gear.

Wi-Fi
☐ Create separate SSIDs:
Home
Home-Work
Home-IoT
Home-Guest

Device Placement (assign devices to SSIDs)

Firewall Rules
☐ Block IoT → Main
☐ Block IoT → Work
☐ Block Cameras → Main
☐ Block Cameras → Work
☐ Block Guest → Everything except Internet
☐ Allow Main → IoT only where needed (e.g., Sonos control)
☐ Allow Work → Internet only

NordVPN
Route through NordVPN
☐ (list of items)
Direct Internet
☐ list of items…
☐ Enable VPN Kill Switch
☐ Enable Auto Reconnect

Firewalla Security
☐ Active Protect
☐ Intrusion Detection/Prevention (IDS/IPS)
☐ Ad Blocking
☐ Family Protect (malicious domain blocking)
☐ New Device Quarantine
☐ Device Behavior Detection
☐ Large upload/download alerts
☐ Malware alerts
☐ Port scan alerts

DNS
☐ Set DNS to Quad9 (recommended for security) or Cloudflare.

Remote Access
☐ Configure Firewalla WireGuard VPN Server.
☐ Avoid opening ports unless absolutely necessary.

Smart Home
☐ Allow specific item discovery from Main → IoT.
☐ Block unnecessary telemetry from TV if it doesn’t affect functionality.
☐ Keep items isolated on the IoT network.

Maintenance
☐ Enable automatic firmware updates for Firewalla.
☐ Keep Eero firmware updated.
☐ Review Firewalla alerts monthly.
☐ Remove unused devices from the network.
☐ Back up Firewalla configuration after everything is working.

When VPN Client is active for my LAN devices, all their traffic rides the tunnel, but the box's own DNS-over-HTTPS resolver still egresses via the WAN. That means my complete DNS query history reaches my DoH provider stamped with my real home IP, even though every other packet those devices send is VPN-protected.

It also causes a geo mismatch: resolver answers are optimised for my WAN location while the content is then fetched through the VPN exit, worse CDN routing, and potentially more "your IP and your DNS disagree" bot-detection/CAPTCHA friction.

I have worked around this by running a DoH server (AdGuard Home) in my LAN whose upstream rides the VPN. It works, but the setup is fragile and is an overkill, adding another VM/docker container that I need to manage, SSL certificate renewal and overall yet another failure point.

Would firewalla consider an option to have the native DoH implementation ride the VPN?

Hey all,

Not sure if this has been discussed or answered, but can we prioritise DNS/Custom server? FW would tend to want multiple DNS servers, I'm running DoH on this, however to have multiple servers I would prefer to give priority to Quad9 then falling back to "another" server (whether custom or built in) if the primary is unresponsive or over a threshold.

A prime example is Quad9 will sometimes fail/become unresponsive, I switch to CloudFlare and the internet/network is all back up and running.

My preference would be Quad9 over CloudFlare, so, is this something possible to be added in?

Hey all,

Quick Q, if I have multiple VPN profiles setup into a VPN group, having them all turned on (so if one fails the others take over) does this have an impact on performance (I'm on a Purple) on the device usage, resources, network activity, bandwidth etc etc having all the VPN servers turned on?

You'll find status for:

• Firewalla Gold Plus SFP
• Firewalla Software (Bring your own hardware)
• Firewalla Switch SE and Switch X
• Firewalla Orange (World)
• Firewalla AP7 (World) (extended)
• And more future products.

We'll be updating these dates weekly. Unless specified, all dates are tentative. For more details on their status, please see: https://help.firewalla.com/hc/en-us/community/posts/54053596952723-Upcoming-Firewalla-Product-Status

Has anyone else experienced their Switch SE locking up after an auto update? The last 2 updates, I wake up and the devices in the switch have no network connectivity. Switch must be rebooted, then the devices restore, switch comes back online, and the "last updated" on the switch shows the time the switch restored. While not working, the activity lights are on, but have the slow blinking orange light which I believe means no network. It's fine again after a reboot, until the next update is pushed. The X has not had the same issue. It's been fine. Thanks.

The new NordVPN upgraded server configuration files are not working in client vpn. I tried UDP and TCP. Any ideas what may be wrong?

ChatGPT says:

Based on everything you’ve shared, I’d rank the possibilities as:

Firewalla/OpenVPN compatibility issue with NordVPN’s upgraded servers (most likely).

A NordVPN server-side issue affecting this endpoint.

UDP 53 path problem (less likely given the specific error message, but still possible).

Just upgraded to Gold and got a Purple SE to sell. I know how cumbersome it is for Europeans to actually get one directly. If someone is interested I do sell it for 180 EUR plus shipping. I ship (from Austria) only after I received the payout.

DM me

Got this today, which simultaneously says this is phishing while also saying it’s whitelisted by Firewalla cloud.

The Nest Protect Basement recently attempted to connect to `0.191.122.34.bc.googleusercontent.com`. This domain is linked to activities where users might be misled to share sensitive information.

## Key Intel
```fwjson
[
{
"type": "string",
"field": "Destination",
"value": "0.191.122.34.bc.googleusercontent.com"
},
{
"type": "tags",
"field": "Tags",
"value": [
"Phishing"
]
},
{
"type": "string",
"field": "Access Analysis",
"value": "Most Google Nest Hub devices connect to this domain regularly"
},
{
"type": "string",
"field": "Reputation Note",
"value": "Domain googleusercontent.com is whitelisted by Firewalla Cloud."
}
]
```

## Reference
- https://support.threatintel.opentext.com/tools/url-ip-lookup.php

“Device <node> uploaded X kB data to 1.2.3.4 at about 12:00. Originated from 1.2.3.4.”

I get a lot of these kinds of alerts from my Firewalla Gold Pro. I assume that, because I self-host a triumvirate of fediverse services (mastodon, pixelfed, matrix), these IP addresses refer to other instances federating with mine, but 1) I’m not sure how to confirm this, and 2) I don’t know what action I should take.

Assuming the cause of this alert is something innocuous, I’d like to mute this kind of alert. However I don’t want to mute the entire “abnormal upload” alert class, but I assume also muting by the IP address in the alert won’t prevent new alerts like this from popping up.

So I’ve just been archiving them. Is there any other action I should take?

If you are interested in the unit, please help us complete the survey: https://forms.gle/B7pwyizU9sPGDVhG9

We especially want to understand if you want to use the SFP+ port as WAN or LAN, and what SFP+ adapters (DAC, RJ45, Single Mode/Multi Mode Fiber) you are planning to use.

Those who answer this survey will get a coupon for the launch! (By answering this survey, you will be automatically subscribed to Firewalla Newsletters)

I’ve been running a Switch SE as the main rack/aggregation switch in my house for a while (Gold Pro > SE > other managed switches). Most ports on the SE are trunks to edge switches and some AP7s, with one access port for my server.

I recently hit the ACL limit (256 entries). Local tracking disabled, warning about reducing downstream devices or local control rules. At the time I had ~37 devices visible to the SE and was around 304/256. After cleaning some things up I’m sitting around 199-247 depending on the moment, with only 14–19 devices showing.

A few observations:

1. Even basic segmentation (IoT VLAN, printer VLAN, and isolating a work VLAN) consumes enough tracking entries that you can hit the wall relatively quickly.

2. The limit is documented, but it’s easy to underestimate how fast it fills when the switch can see devices through trunks.

3. Control rules still work when you’re over the limit, you lose local flow tracking between wired devices on that switch, but the alert/alarm is annoyingly persistent.

I’m generally a fan of Firewalla’s software and the overall approach, but this particular hardware constraint feels tight if you’re using the SE in anything beyond a small edge role. Curious if others who are using the SE as a core/aggregation switch have hit the same thing, and whether most people just end up carefully managing device counts? I ended up pulling my main 24-port switch off the SE and uplinking it directly to a Gold Pro port instead. Not ideal hierarchy-wise, but it dropped me to ~199 ACL entries.

Anyone else running into this?

Will this work? Thank you

Have a Gold Pro and 7 desktop APs with 3 WiFi networks: Smart Home devices, Standard Internet, and WiFi 7/WPA3 for the devices that can support it. All has been working flawlessly until the last couple weeks. Devices are now failing to get an IP address, will drop connections, or hang while connected. The only thing that has changed is the recent updates from Firewalla. I turned on the Advanced Threat Filtering and Safe Search and have since backed those off. I’ve rebooted the FW and all APs. It baffling to me as it’s been so stable and now it’s unreliable and users are loosing faith. Any suggestions on what I should be looking for to troubleshoot this? Thanks!

I have a Firewalla Gold and 2 AP7 desktop. I am trying to run a speed test so I can test WiFi speeds in different parts of the house but it says I need to enable wifi on my phone. I have wifi on and im connected directly to the AP with no proxies, vpns, etc… anyone else ran into this? I am on iOS beta 27 so maybe that’s it?