Learn how to set up a VPN on your Firewalla device with our step-by-step guide. We explain what a VPN is and how it can benefit you, as well as the different types of VPN protocols available. Follow our instructions to configure your VPN, whether you're using a third-party provider or creating your own VPN server. Stay secure and anonymous online with Firewalla VPN.
"A virtual private network, or VPN, is an encrypted connection over the Internet from a device to a network. The encrypted connection helps ensure that sensitive data is safely transmitted. It prevents unauthorized people from eavesdropping on the traffic and allows the user to conduct work remotely."
- What is Firewalla VPN Server?
- What does Firewalla VPN do?
- How to Configure Firewalla VPN Server?
- Testing VPN Server
- VPN Alarm & Notification
- Active VPN Connections
- VPN Flows and Device Management
- Troubleshooting: Not able to connect to VPN?
- Advanced Tips
Firewalla also has a built-in VPN Client, which can be used to talk to many 3rd Party VPN Services.
What is Firewalla VPN Server?
Firewalla VPN Server places the VPN server inside your house. It runs inside of the little Firewalla box. This VPN service can only be used when you are outside of the house. You get the same level of security protection as if you are at home, provided by Firewalla.
Connect to Firewalla VPN = You are at Home
Easy to setup
- You don't need to open additional ports on your router.
- You don't need to manually port forwarding random ports from your router to your home devices.
- You don't need to learn complicated technology to bring up a VPN server.
- One connection allows you to access all home devices.
- Securely surf the internet with the benefit of Ad blocking, blocking porn sites and malicious sites.
- Securely access your home camera, NAS (network attached storage), smart door knob/power plug (IoT devices), and more.
- Your own private VPN server, not shared with others.
- Bypass censorship and internet filtering at work or another country.
- Prevent eavesdropping when you are on the road, at Starbucks.
Always at Home
- Take your video subscriptions anywhere. Stream Netflix, Hulu or any service just as you are at home. No restrictions.
- Access your banking / financial sites as if you are home.
- Bypass internet censorship or filtering when traveling to a foreign country.
- Free VPN Server runs inside your home network. There is no monthly fee or additional charge.
What This VPN Server is NOT
- This is not the traditional VPN service that you use to hide from your service provider.
- You can not use this service to bypass Netflix restrictions. (Unless you are traveling and have a Firewalla at 'home')
What does Firewalla VPN do?
Surf the web as if you are at home when you are not
Firewalla VPN Server allows you to easily set up an encrypted connection from anywhere in the world to your home. Although you are outside on public network, your security protection is the same as at home.
- You can access the internet as secure as you are at home.
- If you are at a place that controls internet access, you can use this to get around it.
- You don't need to open additional ports on your router when you are outside and want to view your home camera or file system.
If you are looking for VPN out from your home to a 3rd party VPN provider, please check out the VPN Client feature: https://help.firewalla.com/hc/en-us/articles/360023379953-VPN-Client-Beta-
Access your home network from anywhere
While Firewalla VPN allows you to safely connect back home, it can also allow you to easily access all your network-enabled home devices, such as IoT devices, NAS file system, etc.
The Firewalla VPN server is a transport service provided by security certificates. It is much more difficult to be attacked than an HTTP service provided by your camera. It also encrypts all traffic between you and your home network. Whatever sites you are surfing or files you are accessing are kept in private, and won't be snooped by anyone in-between.
VPN Server Configuration
Firewalla VPN server supports two types of VPN– OpenVPN and Wireguard. Please refer to the links below for configuration instructions:
Additionally, as of box release 1.976, Firewalla now supports running the VPN server using an IPv6 address. You can find instructions for how to manually specify your VPN server's IP type and read more about this feature in our box version 1.976 release notes.
Testing VPN Server
Now you have everything set up. To test if your VPN is working, you need to test it outside of your own network, i.e. a network separate from the one Firewalla is installed on (many routers do not have this feature called NAT-hairpin which can allow you to VPN back to your own network). For example, if you are testing this on your phone with a VPN client installed, the best way is to switch it to cellular mode.
VPN Alarm & Notification
Once VPN is set up and enabled, Firewalla will send you an alarm every time a device is connected to your VPN Server. In case someone got hold of your profile and password, you are notified when they use your VPN service.
Active VPN Connections
If you have the VPN Server feature enabled, Firewalla App is able to show you how many active VPN connections are connected to your Firewalla box, where they’ve been connected from, and how much data has been transferred between your Firewalla box (as VPN server) and the VPN clients.
On Firewalla App’s main screen, if anyone is connected to your Firewalla box via VPN, there will be a green tag shown on the VPN server button. Tap the VPN server button -> Active VPN connections, tap any connection to view more details of it. If you’d like to know exactly where the connection is initiated from, you can tap the Endpoint IP address and do a quick security lookup.
If you spot any suspicious or unwanted VPN connections, tap the “View VPN Profile” button to revoke the access or reset the profile, or tap the “View Network Detail” / “View Device Detail” button to pause a specific type of traffic.
VPN Flows and Device Management
Devices connected to the Firewalla OpenVPN server can be managed together. On the Devices list -> Networks tab, find the OpenVPN network and tap to enter the network detail page, you can view the network flows, and manage rules on the entire network.
For devices that are connected to the Firewalla WireGuard VPN server, you can manage them just like your local devices. The VPN devices will be shown up on the devices list, tap any of the VPN devices, you can view the network flows, and basic info and apply any rules or features individually.
Not able to connect to VPN?
If you still have problems, check the following:
Check 0: Wait a bit
- If you just installed Firewalla, it may take up to 1 hour to have the DDNS entry propagated. If you set up Firewalla VPN within 1 hour of the first power-up of the unit, please wait a bit.
- If you are running firewalla under NAT in router mode or in DHCP/simple mode, please make sure you do correct port forwarding on your main router. Tutorial: How to set up port forwarding for VPN Server
(Port forward is NOT needed if you are running in router mode and firewalla is your main router and has a public IP address)
Check 1: Running in Simple mode
If you have problems with port forwarding in simple mode, try this:
- Turn off global monitoring on Firewalla: https://help.firewalla.com/hc/en-us/articles/360008407613-Turn-on-off-Monitoring
- Reboot your router
- Try again and see if the VPN works.
- If works, turn back on global monitoring on Firewalla
Check 2: Do you have Public IP
1. Login to the router that the Firewalla is plugged in and look at the "WAN IP address" field.
2. Go to myip.com and compare that with (1)
If (1) and (2) are different, you don't have a public IP address. Call your ISP to get a public IP from them.
Check 3: Are you under double NAT
If you are under double NAT, that is, you have another router (second router) in front of the router (first router) that Firewalla is plugged into. If you have this configuration, you will need to do another port forwarding on the second router. Port forwarding the second router's public UDP 1194 port to the first router's 1194 port.
How do you know if you have double NAT?
First, look the physical connection of the router that Firewalla is plugged into. If this router is not given by the ISP, you may be under double NAT.
Next, check the following:
1. Login to the router that the Firewalla is plugged in and look at "WAN IP address" field.
2. go to myip.com and compare that with (1)
If (1) and (2) are different you are definitely under double NAT. In this case, please log in to the second router and manually setup port forwarding.
Check 4: Is your router running VPN
Some router may come with a default VPN server. If you want to use Firewalla VPN, please turn off your router VPN. Otherwise, the two VPN's will compete for 1194 port.
Check 5: If Firewalla is in DHCP mode, is your overlay network configured to be the same subnet as primary network?
In this case, VPN server may use the Firewalla's IP address in the overlay network to talk to VPN clients, instead of the IP address in primary network. When configuring port forwarding, you need to forward to the Firewalla's IP address in the overlay network. (You can check the IP address information in Settings -> Advanced -> Network Settings)
- If you use the VPN feature very often, we recommend that you do a static port mapping, because UPnP is not always reliable on certain routers.
- If you ever have needs to use port other than 1194, after you are done with port forwarding setup, don't forget to change your .ovpn profile (the line highlighted below):
remote xxx.d.yyy.com 1194
- If you're trying to access your Firewalla VPN Server using the T-Mobile cellular network and you cannot access your local devices, try lowering your MTU from the OpenVPN or WireGuard client on the device you're using. See this community post for more info.
- If your router can reserve an IP address for Firewalla, please do so. This will avoid problems if you have static port mapping.
- By default, Firewalla uses UPnP to map VPN ports, we have seen some routers are buggy, and may lose this port mapping to avoid this
- You can turn off and on VPN Server, this usually will fix the problem
- You should just add a static port mapping in your router if you use the VPN feature often.
- VPN Split Tunneling https://help.firewalla.com/hc/en-us/community/posts/360047915253
- If you are using Firewalla Gold, you can manage the VPN Server Network in Network manager, and edit the VPN subnet if you want.
- If you are using Windows machine, the best is to disconnect VPN on Windows when you are already home.