If you want to understand what's Firewalla VPN, how does it different from traditional VPN, please read this article for explanation.

VPN Configuration

Here is how to configure Firewalla VPN:

Very first step is to turn on the VPN server on your Firewalla box (Step 0). Firewalla box will start a pre-installed OpenVPN server.  When the VPN server starts, it will generate a unique key and this key is only for your box.

Once you done that, click on the "Setup" arrow and it will guide you through the setup.

STEP 1: Configure Port Forwarding 

If your router has UPNP enabled (as most routers do),  it is simple, Firewalla will do everything for you.

If your router doesn't support UPNP, Firewalla will need you to manually setup port fowarding on your home router, please check out this page for instruction.

In this step, another thing is very import to check.  That is, "Make sure the router that your Firewalla is plugged in has a public IP assigned by your ISP".

STEP 2: Install VPN client

To use VPN, you will need to install an OpenVPN compatible client on your mobile or desktop device. We have created separate pages for different type of devices. The download link for VPN client is included in the page.

• iOS and Mac
• Android
• Windows
• Linux

STEP 3: Configure VPN client

Once you installed the client, you'll need a profile and a password in order to use the VPN client.  The profile and password are generated by Firewalla, they are device independent and can be shared.  How to add the profile to the client, detail steps are outlined in above device links.

Testing VPN

Now you have everything setup, to test if your VPN is working or not, you need to test it outside of your own network (or the separate network that Firewalla is installed on).  Many routers do not have this feature called NAT-hairpin, which doesn't allow you to VPN back to your own network. (Best way is to go to LTE/4G/3G on your phone).

Still not able to connect to VPN?

If you still have problems, do following checks to diagnose the root cause.

Check 1: Running in Simple mode

If you have problems with port forwarding in simple mode, try this:

1. Turn off global monitoring on Firewalla: https://help.firewalla.com/hc/en-us/articles/360008407613-Turn-on-off-Monitoring
2. Reboot your router
3. Try again and see if the VPN works.
4. If works, turn back on global monitoring on Firewalla

Check 2: Do you have Public IP

1. Login to the router that the Firewalla is plugged in and look at "WAN IP address" field.

2. Go to myip.com and compare that with (1)

If (1) and (2) are different, you don't have a public IP address.  Call your ISP to get a public IP from them.

Check 3: Are you under double NAT

If you are under double NAT, that is, you have another router (second router) in front of the router (first router) that Firewalla is plugged into.  If you have this configuration, you will need to do another port forwarding on the second router.  Port forwarding the second router public UDP 1194 port to the first router's 1194 port. 

How do you know if you are have double NAT?

First, look the physical connection of the router that Firewalla is plugged into, if this router is not given by ISP, you may under double NAT.

Next, check following:

1. Login to the router that the Firewalla is plugged in and look at "WAN IP address" field.

2. go to myip.com and compare that with (1)

If (1) and (2) are different you are definitely under double NAT. In this case, please login to the second router and manually setup port forwarding.

Check 4: Is your router running VPN

Some router may come with a default VPN server, if you want to use Firewalla VPN, please turn off your router VPN.  Otherwise, the two VPN will compete for 1194 port.

Import Tips:

- If you use the VPN feature very often, we recommend you do a static port mapping.  Because UPnP is not always reliable on certain routers.

- Firewalla Blue VPN profile may expire (depend on the revision of the software) around 30 days.   If you encounter this issue, please just regenerate a new one.

- If you ever have needs to port other than 1194, after you are done with port forwarding setup, don't forget to change your .ovpn profile (the line highlighted bellow):

client
dev tun
proto udp
remote xxx.d.yyy.com 1194
resolv-retry infinite
nobind
persist-key

VPN alarm and notification

Once VPN is setup and enabled, Firewalla will send you alarm every time a device is connected to your VPN Server.  In case someone got your profile and password, you are notified when they use your VPN service.