Firewalla's VPN Server supports both OpenVPN and WireGuard VPN. This is our guide on configuring a WireGuard VPN. To learn more about Firewalla's VPN Server, please refer to this article: Firewalla VPN Server.
This feature is not available on Firewalla Red or Blue.
WireGuard is a newer VPN protocol than OpenVPN. Like OpenVPN, it's also open source. WireGuard is simpler and can have a higher encryption rate. (References: https://wireguard.comhttps://en.wikipedia.org/wiki/WireGuard)
- WireGuard is UDP-based (OpenVPN can run over TCP or UDP)
- On Firewalla Gold, WireGuard performs 1.5-2x faster than OpenVPN
- The WireGuard source code is newer and simpler than OpenVPN
- Firewalla supports Site to Site VPN via WireGuard
- There is a known issue that causes unstable WireGuard VPN connections if you are in dual-WAN load balancing mode. If you run into this issue, please contact us at firstname.lastname@example.org.
1. Enable WireGuard
Tap the VPN Server icon on your box's main page in the Firewalla app, then tap the WireGuard button to turn it on.
If you have an IPv6 address that you'd like to use to set up your VPN server, you can manually specify your server's IP type (and WAN interface if needed). You can read more about this feature and how to use it in our box version 1.976 release notes.
2. Configure Port Forwarding
Similar to OpenVPN, WireGuard requires its port to be accessible from outside your network.
- If you are using Firewalla in Router mode without double NAT, skip this step. Port Forwarding will be shown as complete.
- If you are using Firewalla in Simple or DHCP mode, and your main router has UPnP enabled (as most routers do), Firewalla will do everything for you. If your router doesn't support UPnP, you will need to manually set up port forwarding on your home router. Tutorial: How to set up port forwarding for VPN Server
3. Connect to Firewalla WireGuard VPN Server
3.1 Use The WireGuard App
Step 1: Add Clients
To connect your mobile device or computer to the Firewalla VPN server, you'll first need a VPN profile.
On the Firewalla app, tap Setup -> Add a Client, and a client will be created automatically. Tap the client and it will show you a profile and a QR code.
- Up to 12 clients are now supported on the Firewalla VPN Server.
For Boxes in Beta & Alpha programs, up to 100 clients are supported.
- You can remove a client by tapping 'Delete This Client' at the bottom of the client profile.
- Please do NOT use the same VPN profile on different WireGuard clients at the same time.
Step 2: Set Up The WireGuard App
To connect to the VPN server, you will need to install the WireGuard app on your mobile or desktop device. Here is the installation guide provided by WireGuard.
There are two ways to use the WireGuard app to connect your device to the WireGuard VPN Server:
- Create from file, or
- Create from QR code.
Depending on which method you select, you'll need to access either the VPN client profile or QR code from the Firewalla app. Here is an example of the WireGuard app on iOS:
3.2 Using Firewalla Site to Site VPN
A Site to Site VPN allows you to securely connect any two Firewalla boxes, such that devices in one network can reach devices in the other network under the protection of Firewalla. With WireGuard, the VPN connection can have a higher encryption rate and better performance.
To create a Site-to-Site VPN connection using WireGuard, open the client side box in the Firewalla app. Then, tap VPN Client -> Create VPN Connection -> Site to Site VPN -> select the server box you'd like to connect -> Select WireGuard. You can learn more about Site to Site VPN here.
4. VPN Device Management (Gold & Purple Only)
The WireGuard VPN server creates a local network on Firewalla. All the devices will join the network once connected to the VPN. Each VPN device corresponds to a VPN client you created in the VPN server setup.
On the Devices list, tap the WireGuard network or a VPN device. You can view network flows and basic info, receive alarms, and apply rules or features to the entire VPN network or to any VPN device individually, just like any local device. You can learn more about device management here.