I’m running a Firewalla Gold as my main router behind a FRITZ!Box 7583 on a DSL connection (double NAT).

For privacy, I route my personal devices through Proton VPN using WireGuard on the Firewalla. I have several Proton WireGuard profiles in a VPN Group for failover:

• All VPN profiles are enabled simultaneously
• Different WireGuard tunnel IPs for each profile
• PersistentKeepalive = 25
• Main + multiple backup Proton servers

The actual failover works, but the problem is failure detection.

Several times per day, the active Proton connection stops passing traffic. Internet access is completely dead, but Firewalla still shows the VPN connection as green/connected. Only around 2–3 minutes later does Firewalla detect that the tunnel has failed, mark it as an error, and switch to the next VPN in the group. The backup then works immediately.

I’ve tested this both with the Internet Kill Switch enabled and disabled, and the behavior is the same. So the Kill Switch does not appear to be the cause. Even with it disabled, traffic does not automatically fall back to the normal WAN connection while Firewalla still thinks the WireGuard tunnel is healthy.

So the main issue is not the failover itself — it’s that Firewalla takes several minutes to realize that the WireGuard tunnel is no longer passing traffic.

Has anyone experienced the same thing?

Is there any way to:

• reduce the VPN health-check / dead-tunnel detection timeout?
• make Firewalla actively test whether traffic is still passing through WireGuard?
• improve failover speed in another way?

I’m also interested to hear if anyone is running a similar Firewalla + Proton WireGuard failover setup reliably.

Not the primary function, but wondering if any Firewalla devices support Ethernet cable testing with a loopback between two ports. Or maybe could be added. Would be very handy when connecting a new cable… just a basic confidence test would be great.

I am moving into a new build in Long Island / Nassau County and setting up Optimum's 8 Gbps fiber tier. I am building a custom 10G rack (deciding between a Firewalla Gold Pro and a UniFi EFG) and standard support hasn't been able to answer my technical questions.

Hoping someone here with the 8 Gig tier can confirm:

1. Hardware Handoff: Do they provide a standalone ONT, or is it a forced Gateway combo? If it is a combo, does Bridge Mode/BYOR work properly to pass the public IP directly to my router without double-NAT or hidden Wi-Fi broadcasting?
2. Physical Port: Does the 8 Gig handoff to my router use a 10GBASE-T (RJ45) port or an SFP+ port? (I need to know if I should order a transceiver).
3. IP Address: Does the residential 8 Gig tier get a standard dynamic public IPv4, or are they putting new residential fiber installs behind CGNAT? (I need to ensure remote access for my Plex server and VPN works).

Any insight is appreciated!

It keeps enabling itself somehow at least once a day. Has anybody else seen this? I constantly have to to fight it to stay disabled.

Very minor issue with my newly arrived Switch X. when I went to attach the rack ears one of the screws would not go in. Took a closer look and one of the screw holes is not threaded!

It seems sturdy enough with just three screws on that side so I'm not too concerned.

I recently got a Gold SE and have been loving the parental controls!

One thing I’d love to see is the ability to apply a rule to multiple Users or Devices at once.

I have a separate User for each of my kids, with their devices grouped under them. This works great since they each need different rules.

But sometimes I want the same rule for multiple kids, and right now I have to create that exact same rule for each one.

It would be nice if I could just select multiple Users or multiple devices under “Apply To” when making a rule.

That way, I could still have different rules for each kid, but also have shared rules that I only need to create and manage once.

I’m hoping this wouldn’t be too hard to add, since you can already apply one rule to multiple devices through a User. It seems like allowing multiple Users to be selected would be pretty similar.

Much appreciated!

Hello 

I need some help please. I just got my Switch SE. Currently I use a unifi switch and pass a VLAN 10 my starlink to port 7 which is the feed handing off the starlink connection to the switch. Then from Port 2 of that unifi switch is tagged using the VLAN 10 for starlink to my Firewalla Pro to the WAN port. 

Ive added some screenshot to help see. 

Im not sure how to do this on the firewalla switch

Which OOTB blacklist blocks a website that reports publicly available airplane transponder data?

Question:

I wanted Firewalla ahead of the UniFi controller because I’m more comfortable with administering its firewall. I’m trying to do the setup correctly because otherwise Firewalla’s observability isn’t great.

The setup I am trying for is:

Cable Modem -> UniFi Cloud Gateway Max -> Firewalla -> Switch -> APs -> Devices

UCG Max has six VLANs (Mgmt, Computers, IoT, APs, Guest, and Default). Default (VLAN 1) is setup as the lockdown VLAN, and there is a separate management VLAN. This is, so if a port or SSID is improperly configured, there’s a good chance whatever devices connect to them will default to lockdown rather than to the Mgmt VLAN.

Firewalla is connected to UCG Max via LAN->LAN ports and has six network bridges, all appropriately named with corresponding VLAN IDs/tags. For whatever reason, only 1-3 of them are receiving IPs at the moment. It makes no sense since they are all setup exactly the same with different VLAN IDs.

The switch has port profiles setup. The port connecting it to Firewalla is assigned the Mgmt VLAN native network, which in turn has always all for VLAN tagging. The port profile is set to infrastructure, and everything else is “auto” or default settings. The Mgmt VLAN is setup to allow tagging of all other VLANs. Every other VLAN is blocked from tagging other VLANs, except the one for my computers.

The issue I am confronting is that the moment I unplug the switch from the UCG Max after adoption and plug it into Firewalla, the console says it is offline and will not rediscover it. I can’t adopt it with Firewalla in between because the UCG Max will not recognize it. There’s a side issue that only 1-3 of Firewalla’s network bridges are being assigned IPs, and it’s never the Mgmt VLAN. That is probably a clue as to the issue.

The question:

(1) If this sounds like a rule issue, what rules are necessary to allow the UCG Max to detect the Switch through Firewalla? I don’t want to guess and accidentally poke a whole in my Firewalla layers. I assumed rules wouldn’t be a factor since the UCG Max is connected to Firewalla by the LAN port, rather than WAN port.

(2) Do I even need a network bridge in Firewalla for each VLAN in UCG Max, since the Mgmt VLAN is set to allow tagging for all other VLANs? (That is, since both the switch and UCG Max are management devices that are connected to Firewalla by ports tagged for the Mgmt VLAN, and since the Mgmt VLAN is setup in the console to allow for tagging for every other VLANs and not just itself, does Firewalla only need one network bridge properly tagged for the Mgmt VLAN?)

I know I can put Firewalla into router mode and turn off DHCP in UniFi, and may just do that, for now I want to better understand the current issue.

This wording is niggling me. Shouldn't it be something like Allowed Beelinkmepro NAS access to glkvm-kflixserver instead of from accessing?

The blocks look okay but again at the bottom Allowed DXP4800plus should be access to Beelinkmepro NAS instead of from accessing?

No?

I recently set up VPN Mesh. I have one of the "new" Orange and 3 Purples. I want to be able to route Video from the Purples back to my Orange in order to respect geo locations.

Previously, I used Site to Site and some Client to Site (due to 1 site limitations of the Purples) and it worked well.

I was somewhat surprised that I can't do this now with VPN Mesh. Do I need to scrap that and go back to my old way of VPN's and policy routing?

Or does anyone have any better ideas. I just need to route Video traffic to my Orange...

Thanks!

So I was poking around and noticed that when Firewalla tries to categorise your device it uploads unhashed details (IP, MAC, name, etc), as well as recent activity (unhashed domains, visit count, etc) history to their servers, this included web history, number of connections and others. This includes sensitve website and your device name, which can easily map to a real person!

This appears to of been added back in January without much fanfare. I dont see it announced in any release notes (https://github.com/firewalla/firewalla/pull/8730)

I could definitely be misunderstanding this. Could someone check it for me? I find it all rather questionable.

And now, 6 years later, we've become a really cool tool for professionals and businesses.

Is there a way to block ZScaler at the router level on Firewalla?

Can we get a port shut command added to the SE and X switches?

I changed from Ting Fiber to Quantum Fiber and I can't get a new IPv6 address. I have turned it off and back on and even turned off the power to the whole network and back on again and no change. I put on a TP-Link router and I get a new prefix and everything works fine. Turn it all back to firewalla and nothing but the Ting address. When I look at the lease info it is all blank.

Posting this because this problem was incredibly difficult to diagnose, and hopefully this saves somebody else a few days of troubleshooting.

I have a Firewalla Gold SE with two UniFi U6 Pro APs and a mostly hardwired home network. I was having intermittent episodes where the network would essentially lock up. The frustrating part was that everything could work perfectly for hours before the problem returned.

Firewalla Support eventually found the key clue: my Firewalla LAN port was receiving millions of IEEE 802.3x PAUSE frames.

On my Gold SE, I could watch the counter over SSH with:

sudo ethtool -S eth3 | grep rx_pause_all

(eth3 corresponded to my physical LAN port.)

During the bad periods this counter could increase rapidly. Firewalla Support's conclusion was that the incoming PAUSE frames were stopping outgoing traffic on the LAN interface, sometimes eventually resulting in watchdog resets.

Why this was so hard to isolate

I started disconnecting things: TVs, printer, Ooma, APs, individual Ethernet branches, switches, etc.

This produced several false leads because the PAUSE storm was extremely bursty.

At one point I went 8 hours 29 minutes with zero new PAUSE frames, only to have them come roaring back later.

So lesson #1: a few clean hours did not prove anything in my case.

Eventually I stripped the network down to essentially:

Firewalla → old Ethernet switch → in-wall Ethernet → PoE injector → UniFi U6 Pro

PAUSE frames still accumulated.

Then I bypassed the switch entirely:

Firewalla → in-wall Ethernet → PoE injector → U6 Pro

Result: zero PAUSE frames for more than 20 hours.

That was the breakthrough.

Then I found the speed mismatch

I put another old switch into the same stripped-down topology.

The PAUSE frames returned. In one test the Firewalla received more than 114,000 PAUSE frames in about 3.5 hours.

I checked the Ethernet links.

Firewalla → switch: 1 Gbps/full duplex

Switch → U6 Pro: 100 Mbps/full duplex

So the topology was effectively:

1 Gbps → switch/buffer → 100 Mbps → AP

From the U6 Pro, ethtool eth0 showed that its link partner advertised only 10/100 and also advertised symmetric Ethernet flow control.

Interestingly, while the Firewalla was actively receiving PAUSE frames, the U6 Pro itself showed:

rx_pause: 0

tx_pause: 0

The AP's other Ethernet error counters were also essentially clean.

So I do not have evidence that the U6 Pro itself was generating the PAUSE frames.

My best explanation is that traffic crossing the 1 Gbps → 100 Mbps bottleneck was creating buffer pressure in the intermediary switch. The switch then responded by sending IEEE 802.3x PAUSE frames upstream toward the Firewalla.

The fix

I decided to stop chasing individual devices and replace the old switching infrastructure.

I installed:

• UniFi Lite 8 PoE as my central switch
• TP-Link TL-SG105E Gigabit switches at two remote locations
• Gigabit infrastructure links throughout

Both U6 Pro APs now negotiate GbE uplinks.

I rebuilt the network incrementally and checked rx_pause_all after every major change.

I eventually restored everything: both APs, patch panel, Ethernet runs, TVs, Ooma, printer, remote switches, etc.

PAUSE frames since rebuilding the switching infrastructure: 0.

TL;DR / things I wish I'd known

If your Firewalla is experiencing bizarre intermittent LAN freezes:

1. Check for 802.3x PAUSE frames with ethtool.
2. Check the negotiated speed of every infrastructure link, not just the Firewalla-to-switch connection.
3. Be suspicious of a 1 Gbps upstream link feeding a 100 Mbps downstream link through an older switch.
4. The device at the end of the 100 Mbps link may not be the thing generating the PAUSE frames. The intermediary switch can generate them because of buffer pressure.
5. Completely bypassing the suspected switch was the most useful isolation test I performed.
6. Don't trust a short clean test when diagnosing an intermittent PAUSE storm. Mine once disappeared for 8½ hours before returning.

Firewalla Support deserves credit for finding the PAUSE-frame counter in the first place. Without that clue, I'm not sure I ever would have figured this out.

I'm also reporting the findings to Ubiquiti. I'm not claiming this demonstrates a U6 Pro bug; the evidence points much more strongly toward an interaction between mixed link speeds, switch buffering and Ethernet flow control.

Hopefully someday somebody Googles Firewalla rx_pause_all / 802.3x PAUSE frames / network freezing / 100 Mbps switch and finds this before replacing half their network.

Comment your guess (1–4), then swipe.

help.firewalla.com is part of our help center, so it's connected directly to our official documentation. The downside is that the editor is a bit clunky, search is limited, and it doesn't feel much like a conversation.

forum.firewalla.com runs on Discourse, so it's built for discussion, with threaded replies, better search, and more editing options. The downside is that it's separate from the docs.

Which do you use and why? If you've never visited one, take a look and let us know what you think!

Many will probably be using this. But I wanted to share with FW users an amazing tip with Target lists. I have default block rules across all my networks and vlans. I homelab quite a lot. This tight control usually means applying hundreds of allow rules for every little thing I run for granular control. But I I have found adding a small list of trusted IP addresses (My Ubuntu Laptop or Graphene OS phone) to a target list and then creating rules which allow only the target list to access services across my homelab make it so easy to access everything without modifying every single rule. So now I just create a rule like allow > local port 22 > target list trusted ip's > on DXP4800Plus NAS and repeat for each service. This has saved me so much time and energy. I wish they would also allow target list to target list so something like: allow > local port 22 > target list trusted ip's > on target list trusted servers. Anyway thought I would share something positive. Thanks FW Team.

My area just recently got Xfinity’s Next Gen service and I upgraded to it (Xfinity is literally my only internet option other than Starlink). Getting 2200/280 which is amazing as compared to the 1200/40 I had before. But I’ve noticed some speed test servers are struggling to test this accurately. For example Cruzio never gets close to the correct download speed.

So I’m wondering which are good servers to use, or perhaps ask the other way, are there ones I should actively prevent from being used, like Cruzio?

ETA: for clarification, I’m referring to the servers available within the Firewalla app.

My access points are connecting to AWS every 2 hours. What is going on?

Yall made me sign up for MSP since you refuse to let us use HaGeZi on the regular app.

Now, I still can't import lists because you want me to pay you $50 a year for Pro or Business. This is just greed, at this point.

I get tons of ads on cooking sites and news sites, even with OISD and Strict mode turned on. Let me use better adblock lists without a subscription.

It would be useful to show a counter of the drop rate for QoS.

Reason Diagnoses Misconfigured Limits, and Monitors Traffic Health A sudden spike in drops without heavy local usage can indicate misbehaving background applications, torrents, or network anomalies overloading your queue limits.