Firewalla is a networking device that sits in between your connected devices and the main router. By sitting in between, Firewalla is able to see and control all traffic going through your network.

• Firewalla does not monitor your local traffic (LAN to LAN). If you're using network segmentation, Firewalla will be able to filter traffic between your LAN networks.

There are four different monitoring modes that Firewalla supports to intercept network traffic. Your box's monitoring mode can be changed by tapping More on your box's main page -> Mode.

• Simple Mode : plug-and-play mode, no need to change the wiring.
• DHCP Mode : plug-and-play mode, only need to disable your upstream router's DHCP server.
• Router Mode: Use Firewalla as your main router. This is the recommended mode for Firewalla Gold and Firewalla Purple.
• Transparent Bridge Mode: Use Firewalla to bridge two networks transparently. This is available for Gold and Purple.

Please note that support for Simple Mode may be reduced soon due to increasing compatibility issues with Android 14. We highly recommend using Bridge or Router Mode.

There are advantages and disadvantages to each mode. Please see the chart at the end of this article for a full comparison.

 

Firewalla Simple Mode

To make life easier for consumers and at the same time make our solution affordable, we use the behavior of ARP protocol (ARP spoofing) to route traffic virtually from connected devices to the Firewalla box.

Once started, Firewalla will tell each of the connected devices that it is the router and tell everyone, "please send all network traffic to me". This will virtually divert all live traffic to Firewalla to be monitored and managed.

Technically, this method is called ARP spoofing, a creative way to do man-in-the-middle. In our case, the "good" man is Firewalla, and we have modified a few things to make this work better at home. (This method was inspired by another product on the market, and we take no credit for inventing this.)

Since the ARP protocol is supported differently on different routers, this mode may not be compatible with all routers. Please take a look at our compatibility guide. If your router is not compatible, no worries, we have you covered with other modes. 

Pros:

• Simple to install, simple to use (that's why we call it Simple Mode).
• If anything goes wrong with Firewalla, your network will still be there.
• No need to rewire or configure anything, true plug-and-play

Cons:

• Not compatible with all routers.
• In certain situations, packets may "leak" outside of Firewalla.

 

Firewalla DHCP Mode

For Firewalla Red, Blue, Blue Plus, in the DHCP Mode, Firewalla creates another network over the existing network. So if you have a network on your main router, you will also see an overlay network from Firewalla.

This overlay network is created by Firewalla, and it is statically overlayed on top of your home network's physical layer. You can statically point your devices to this overlay network, or disable/modify the existing DHCP service on your main router and have the Firewalla serve DHCP requests.

To find out about your Firewalla's overlay network on the Firewalla app, tap Box Settings -> Advanced -> Network Settings -> Overlay Network. 

 

Note: Firewalla Gold and Firewalla Purple don't create another overlay network. It will use the same subnet as your original network so that you don't have to configure the IP range used for DHCP on Gold in order to keep your network unchanged. Learn more about Gold in DHCP Mode. 

 

Pros:

• All traffic will go through Firewalla.
• Double NAT

Cons:

• Need to login to the router and disable the DHCP server
• Double NAT

To enable this mode, please read "How to set up with DHCP mode". 

 

 

Firewalla Router Mode

This mode is unique to Firewalla Gold and Firewalla Purple. Here, Firewalla can act as your router/firewall/IPS/IDS inline to your network traffic. There are no compatibility issues in this mode.

• When in router mode, Firewalla will also be able to segment network traffic using the extra ports and/or VLAN.
• Router mode requires Firewalla to be in between two network elements, such as a modem and a wifi access point. 
• This is the best mode to use for the Firewalla Gold and Firewalla Purple.

Pros:

• Physically inline between LAN and WAN networks; High performance, gigabit rates.
• Routing and security functions are handled by Firewalla, leaving Wi-Fi routers only focus on wifi.
• The Gold operates the best in this mode.

Cons:

• If you only have one single device as your modem + router + access point, it will not work for you. This mode requires Firewalla to be in between two network elements, such as a modem and a Wi-Fi access point.

Learn more about the Firewalla Router Mode.

 

Firewalla Transparent Bridge Mode 

This mode is unique to Firewalla Gold and Firewalla Purple. Here, Firewalla can be placed in between your router and access points/switch and act as your firewall/IPS/IDS inline to your network traffic. There are no compatibility issues in this mode.

Pros:

• Physically inline between your existing router and switch (or access point)
• Preserve existing network assignments from your router
• LAN devices are not aware of the bridge
• A good transition mode without removing the existing router

Cons:

• Features include "Route", "Smart Queue", "VPN Client" will not work.
• This mode is very specific to certain network topologies.

Learn more on the transparent bridge mode here.

 

Which Mode To Use 

We made this chart which ranks the different modes in terms of installation, compatibility, and performance.

 

Why support different modes?

• Not all networks are the same
• Not everyone has the same requirements
• For example, Simple Mode is the easiest to install, but its performance is ranked lowest. This mode is not compatible with all routers. (https://firewalla.com/compatibility)
• Router mode is compatible with pretty much anything, but it will require you to physically replace your existing router. It's our best-performing mode and is recommended for the Gold and Purple.

Note: the performance difference usually is not detectable during bandwidth tests.

	Simple Mode	DHCP Mode	Router Mode	Bridge Mode
Firewalla Red	Yes	Yes
Firewalla Blue/ Blue Plus	Yes	Yes
Firewalla Gold	Yes	Yes	Yes	Yes
Firewalla Purple	Yes	Yes	Yes	Yes
Requires wiring change	No	No	Yes (replace your router)	Yes (place it between two networks)
Simple Install (ranking)	#1	#2	#4	#3
Compatibility (ranking)	#3	#2	#1	#1
Performance (ranking)	#3	#2	#1	#1
Preserving Routing	Yes	No	No	Yes
Transparency	No	No	No	Yes
VPN Client	Overlay Only	Yes	Yes	No
IPv6 Monitoring	Yes	No	Yes	Yes
Route Functions	No	No	Yes	No
Smart Queue	No	No	Yes	No
Multi-WAN	No	No	Yes	No

 

 

If you want to see the difference between the different products, please see this.

 

Other Modes

Firewalla Experimental Simple Mode

DO NOT USE THIS IF:

• Your router is compatible with Simple Mode.
• You are good with DHCP mode.

Please note that support for Experimental Simple Mode may be reduced soon. We highly recommend using Bridge or Router Mode. Experimental Simple Mode enables more routers that aren't compatible with Simple Mode. These tricks may or may not work, hence the "experimental simple mode". DHCP mode is still preferred. 

 

Firewalla Limited Mode (Red/Blue/Blue+)

In this mode, Firewalla simply turns off monitoring and becomes a small network server.

Remember we talked about the overlay network? It is still there! What you can do is, to assign static IP addresses like in the overlay network to your device (such as iPhone), and make DNS point to Firewalla's Gateway. Now you have just secured one device.

We often use this mode to "check out" a particular device. Pretty good learning too.