Firewalla’s content control goes beyond simple blocking. By combining deep traffic insights, customizable user profiles, and layered protection features, it brings professional-grade network management. Whether you are managing employees or family members, Firewalla equips you with smart, flexible tools that respect both safety and autonomy.
Firewalla's activity/content control features can also be used in commercial spaces (not just in homes), such as schools, public libraries, churches, and public Wi-Fi. Keeping questionable content off the network. (In this article, we will use "family" to cover all of these)
Important: Firewalla does not decide what content or activity should be blocked in a business, workplace, or public setting. Examples in our documentation are illustrative only. You are solely responsible for choosing and applying policies that are appropriate for your environment.
Important: In public, shared, or workplace deployments, use these features only in compliance with applicable laws, regulations, and internal policies. Network administrators may be able to view network flows and other activity metadata.
If you detect a site that is not properly classified, please send us feedback via the app.
Firewalla is not responsible for misdetected internet usage. Please use only this as a reference.
If you want a setup that works from age 6 to 18, start with the right network setup. Learn how to build it here: How to Create the Best Network to Manage Kids of All Ages.
These same features are equally effective for small businesses looking to monitor or manage employee internet usage, helping to reduce distractions, enforce acceptable use policies, and maintain a secure work environment.
- Content Filtering Features
- Basic Controls
- Better Controls with Firewalla Wi-Fi
- Advanced Controls
- Network Visibility
- Intercepting Smart Users and Nosey Neighbors
- Protecting Networks while Traveling
- Example: Enforcing a schedule
As with any firewall, your policies can only be enforced if no one is meddling with them. If users have access to a device that's paired with your box, they may disable rules, pause monitoring, or make other configurations to your network. To prevent this from happening, we recommend securing your Firewalla app using App Lock.
1. Content Filtering Features
Firewalla offers a set of content-filtering features that make it easy to quickly block unwanted content from the internet. These features automatically identify and block offensive or inappropriate content. You just need to turn them on, and Firewalla will do its job.
Content Filtering
Content Filtering automatically blocks access to sites with offensive or unwanted content. Turn it on by tapping the Controls button on your Firewalla's main screen or in the Features list, then toggling Content Filtering on. You can choose which devices you apply it to.
Learn more about Firewalla's Control Center.
(Note: In App 1.68 or earlier, this feature is part of Family > Family Protect.)
We offer two different Content Filtering modes:
- Native: This mode leverages Firewalla's blocking features to give you full control over what to block right on the Firewalla box. When you turn on Native Family Protect, a set of default blocks will be automatically configured for you.
- 3rd-Party: This mode uses 3rd-party DNS services to filter content. Since this is a DNS service, it cannot be used with other DNS services, such as Unbound or DoH.
Safe Search
Safe Search automatically filters out offensive content in search results. It supports the most common search engines, including Google, YouTube, Bing, and DuckDuckGo.
With Safe Search enabled, it'll also enable YouTube's Restricted Mode, which will hide mature content, including comments on YouTube videos.
We do NOT recommend this for work. Safe search can limit a lot more useful sites.
Learn more about Firewalla's Control Center.
Ad Block
Ad Block automatically blocks pop-up or embedded ads as much as possible in browsers and mobile apps. This also prevents ads from tracking your devices' web traffic.
Social Hour
Social Hour temporarily blocks internet access for one hour on all personal, media, and entertainment devices. Just tap to turn it on and enjoy some social time, whether it's with your family or employees at a lunch meeting.
2. Basic Controls
Out of the box, we provide some basic controls that you can use to quickly manage network access on your users' devices.
Users: Activity Tracking & Time Limits
Firewalla Users help you organize devices and network activities by person. You can assign different devices to a User – for example, if your employee has a phone, a tablet, and a laptop, you can assign them all to one User. Firewalla can show you when, what, and for how long each User is accessing certain apps on your network, such as watching YouTube or playing Roblox.
To create a user, tap Users on your box's main page, tap Create User, then either manually add devices or select an existing Device Group to build your User from.
You can control when and for how long each of your Users has access to certain apps with Time Limits. For example, you can limit your Users to 2 hours per day of Fortnite on weekends or set a daily 1-hour limit for YouTube or Netflix. To set a time limit from the User's detail page, scroll down and tap Add Time Limit under the activity chart, select an app, and set a daily or weekly time limit.
Blocking Shortcuts
Quickly block popular content and apps using blocking shortcuts for each device. With one tap, you can block or unblock access to video, gaming, social media, and apps like Facebook, TikTok, and more. These shortcuts always accurately reflect the status of the target, allowing you to easily see and control whether a target is blocked on a certain device, group, user, or network.
Pausing Rules
You can pause a rule from the rules detail screen if you'd like to disable it without having to delete or reschedule it. This is useful if you need to give users temporary network access, such as an extra hour of gaming or 15 more minutes of YouTube access.
To customize the duration when pausing rules, tap into your rule and scroll down to Pause Rule. Choose either For... or Until..., select either a time duration or a time at which to resume the rule, and tap Done. A rule can also be paused for "Today," which means it will be paused until the end of the day. See our video tutorial for detailed instructions.
3. Better Controls with Firewalla Wi-Fi
With Firewalla Wi-Fi (via Firewalla AP7 or Firewalla Orange), Firewalla has even better controls to ensure that no one bypasses your policies. You can create multiple SSIDs, Personal Keys, or Enterprise Wi-Fi to automatically assign devices to a user, group, or network as needed. Learn more about microsegmentation with Firewalla AP7 here.
This method works even if devices are using private or spoofed addresses to hide their identity. With Firewalla Wi-Fi, their devices can automatically be assigned to their group once they connect to Wi-Fi.
Multiple SSIDs
With Firewalla AP7 or Firewalla Orange, you can use separate Wi-Fi SSIDs to automatically assign devices to a user, group, or network.
For example, create separate SSIDs for each kid, parent, guest, and more. Each user has a unique Wi-Fi name and password to use when connecting to Wi-Fi. See here for a full tutorial on using multiple SSIDs with Firewalla.
Personal Keys
If you have many users to manage and don't want to create separate SSIDs for each one, you can also use Personal Keys (Firewalla AP7 only).
Personal Keys allow you to use a single SSID and create unique keys for each user. Each user uses their key as the SSID password to connect devices to Wi-Fi, which automatically assigns devices to their user profile in Firewalla.
See here for a full tutorial on using Personal Keys with Firewalla.
WPA3-Enterprise Wi-Fi
You can also use WPA3-Enterprise security with Firewalla AP7 or Firewalla Orange. This will require all devices connecting to the network to have a dedicated username/password to sign in. Most or all personal devices (smartphones, laptops, etc) will support Enterprise Wi-Fi.
This can be a useful feature to combat users trying to spoof their MAC address as a different device, and can ensure the best WPA3 Wi-Fi security and speeds at the same time.
Learn more about Enterprise Wi-Fi here.
4. Advanced Controls
Firewalla also includes many sophisticated ways to observe and configure your network. You can create rules and policies based on specific target domains or activity categories, and apply them to individual devices or globally to all devices.
Specific and Specialized Rules
Firewalla's Rules have a comprehensive array of blocking options. You can block a specific activity category, including:
- Gaming
- Social networks
- Video
- Porn
- P2P
- Gambling
- Shopping
- VPN
- Violence
- Drugs & Alcohol
You can also define a specific target, such as:
- Domain name
- IP subnet
- Region
Better yet, you can specify the application:
- Discord
- Netflix
- Roblox
- Snapchat
- Tiktok
- YouTube
- ... and more!
If the app you want to control isn't listed, you can use the domain name or create a custom Target List instead. On iOS, Apple's App Privacy Report makes it easier to discover which domains an app uses. Learn how to use App Privacy Report with Firewalla.
Once you have a target specified, you can apply the rule to selected devices or everyone on your network.
Disturb 
Disturb is a new rule option that offers a more flexible way to encourage healthy breaks and combat Internet addiction. Instead of completely blocking an application, Disturb will gently disrupt traffic to mimic a "bad" network, making it less enjoyable to use certain applications.
Target Lists
Firewalla has a large database of dynamic security intel that your box can use to judge the risk of your connections. While this is usually enough to provide a reliable baseline of security for your family, we offer the Target List feature in case you have a lot of custom targets or want to use an existing pre-created target list. A Target List is a set of domains or IP addresses you can use as a rule target. If you create a rule to block a target list, the target list entries will always be blocked regardless of the site's reputation.
One way you can use Target Lists is to block a certain game by creating a list of its servers. For step-by-step instructions, refer to our article about Blocking Specific Games with Firewalla.
Scheduled Rules
You can also set a schedule for a rule to take effect. This allows you to manage internet access based on when employees should be working. Through Firewalla, you can turn off some activities while allowing certain ones, or turn off the internet entirely. It's all your choice.
For example, if you want to block a device from accessing Facebook every weekday from 9PM to 11PM, you can create a new rule for this device:
- Target: Facebook
- Active Time: Every Week; Monday, Tuesday, Wednesday, Thursday, Friday; from 9PM to 11PM
Emergency Access
Under each device/network detail page, there is an Emergency Access button to control whether a device's internet access is controlled by Firewalla. When turned on, it means Firewalla can no longer block you from accessing any site.
You can leverage this feature by scheduling Emergency Access to give extra time for Users. Similar to pausing rules, emergency access can be turned on for 15 minutes, 1 hour, always, or for any custom time period. At the end of the specified period, Emergency Access will automatically be turned back off. This way, you'll never forget to turn access rules back on.
5. Network Visibility
Firewalla's deep insights help you see what every device on your network is doing. Here are some examples of helpful things Firewalla can show you:
Alarms
Activity Alarms can tell you if people are playing games, watching videos, or visiting adult sites.
Online/Offline Alarms can tell when a known device rejoins and leaves your network. For example, you can see when employees arrive and leave work.
This type of alarm must be manually turned on from Device detail -> Status -> Notify me when offline/ back online.
Network Flows
Network Flows allows you to monitor what people are doing online remotely. To see what a device is doing, locate it from the device list, tap on its device name, and click "Network Flows." This shows what devices are doing and for how long. With a bit of knowledge of basic networking, you can detect and block any abnormal activities.
You can also sort your flow history by a set of common categories: Gaming, Social, Video, Porn, and VPN. Simply tap one of these filters to apply it to your list of blocked flows. See our tutorial video for step-by-step instructions.
Firewalla looks at everything that is happening on your network. For example, our customers have discovered PS4s that were downloading pornography and routers that were "phoning home" extensively and sending suspicious amounts of data outside of the network.
6. Intercepting Smart Users and Nosey Neighbors
If a new, unrecognized device joins your network, it can be hard to tell who or what it might be. It could be an unwelcome neighbor looking for free Wi-Fi, a guest trying to connect to the Internet, or a smart user trying to get around their work's policies. With Firewalla, you can decide how much to trust unfamiliar devices. Here are some things you should be aware of:
- Private Addresses and New Device Quarantine
- Enforce Your Policies with Bypass Prevention
- Physical Security
- App Protection with App Lock
Private Addresses and New Device Quarantine
Android, iOS, and Windows have a feature called Private Addresses to protect consumers when they are on public Wi-Fi. Smart users may try to get around your rules by turning on Private Addresses to hide their identity.
Firewalla lets you shut off access to unknown devices using Rules and New Device Quarantine.
- Instead of manually reviewing devices in New Device Quarantine, consider using Firewalla Wi-Fi and automatically assign devices to a user, group, or network whenever they connect using separate Wi-Fi SSIDs, Personal Keys, or Enterprise Wi-Fi.
Enforce Your Policies with Bypass Prevention
There are many different privacy-enhancing encryption services and features out there– unfortunately, clever users might take advantage of them to get around Firewalla's monitoring capabilities. Use Bypass Prevention to block VPN sites, Apple Private Relay, and DoH Services to enforce Firewalla policies.
On your Firewalla's main screen, tap Controls > toggle Bypass Prevention on. It can be applied to specific devices.
Learn more about Firewalla's Controls Center.
(Note: In App 1.68 or earlier, this feature is part of Family > Family Protect.)
Physical Security
No matter how strong your network security protocols are, you must still ensure your system is physically protected. Information Security is only as strong as the weakest link in your network. Here are some recommendations for how to physically secure your network:
- Peel off the license sticker on your Firewalla and store it in a safe place to prevent others from pairing with the unit.
- Ensure others have no physical access to the unit so they can't tinker with it.
- Please watch out for notifications in case someone powers off the unit.
- If you are using the Gold series, you can remove the red dongle; this will prevent initial pairing.
Check Paired Devices
Make sure that no unauthorized devices have access to your Firewalla. Sometimes, smart users may find a way to pair with your device. View and remove paired phones by going to your Firewalla box's settings > Advanced > Paired Phones.
Phones will be displayed by the device type and the email the user entered during the initial app setup. Tap on any paired phone to delete it.
- Note that if you have Firewalla MSP or access your Firewalla from the web (my.firewalla.com), it may appear as another pairing here.
- With MSP, you can also adjust mobile app access so that any unknown paired devices have No Access to your Firewalla. This can be a better alternative to removing the paired device completely.
App Protection with App Lock
App Lock can lock the Firewalla App with Touch ID, Face ID, or a PIN Code to prevent users who share or have access to your devices from accidentally changing network settings. This option is off by default. To turn it on, you can go to App Settings in the top right corner of the main page and tap "App Lock".
7. Protecting Networks while Traveling
Public Wi-Fi networks in airports, hotels, and other public places are often unsecured, making it easy for cybercriminals to intercept your data and steal sensitive information. Additionally, you have no control over these networks, making it nearly impossible to enforce any activity limits or screen time rules. Firewalla can help you keep control over your network usage through:
Firewalla VPN Server
A VPN creates a secure and encrypted connection between your device and the internet. By using a VPN while traveling, you can have peace of mind knowing that your online activity is secure.
Firewalla offers a built-in VPN server that allows you to direct your devices' traffic through your home network, no matter how you're connected to the Internet. By connecting back to your own Firewalla through a VPN, you get the same protections as if you were at home, and all your home network rules are still in place.
A Trusted LAN with Firewalla Purple
Firewalla Purple and Firewalla Orange are the perfect routers and firewalls to take on the go. With a Purple, it's easy to create a Trusted LAN no matter where in the world you are, giving you:
- The same level of protection you get at home, anywhere in the world.
- Easy access to your home devices without opening additional ports on your router.
- A simple way to connect all your devices to a VPN server.
- The ability to enforce restrictions on all devices, even when traveling.
Read more about setting up a portable trusted LAN in our article about Traveling with Firewalla.
8. Example: Enforcing a schedule
Emily is entering 4th grade. Her parents set the following schedules and rules during school days:
- No online gaming or social media outside of open play hours (7 PM - 5 PM the next day)
- Social apps, such as TikTok, are not allowed
- Educational game apps, such as Prodigy, are allowed during school hours (8 AM - 4 PM)
- No Internet access from 7 PM until 8 AM the next day
To enforce these rules, Emily's parents enable Ad Block, Content Filtering (Family Protect on App 1.68 or earlier), and Safe Search on Emily's device (or device group if she has multiple devices). Then, they add the following rules:
- Block all social sites from 7 PM to 5 PM the next day, every weekday
- Block all gaming sites from 7 PM to 5 PM the next day, every weekday
- Block all Internet access from 7 PM to 8 AM the next day, every weekday
- Block TikTok
- Block porn
- Allow Prodigy from 8 AM to 4 PM, every weekday
If you have any feedback for our team or suggestions for articles we should write, please don't hesitate to contact us at help@firewalla.com. We're always looking for ways to help you get more value from your Firewalla.
Comments
17 comments
How does the "Adult" filter work? Is this OpenDNS or something else?
The family mode is OpenDNS, fully DNS based
Porn block inside device control is both DNS and IP based controls. It will block faster, quicker, and done locally on your blue/red box.
People tend to turn on both ...
Under a devices "Network Flow" the "Apps" tab is always empty why is that? Upload Download and History all have content.
I have the following queries:
@ani
You should be able to create multiple rules to cover different times.
And there is no way to block search terms, those Firewalla can't see on the network.
Hello,
Is there anything to prevent turning off WiFi and using cellular data?
Can URL blocking policy be performed per device/IP and per user? Also, is the full set of 27 OpenDNS categories available for use in Firewalla gold?
The blocking policy can be per device, per group of devices (Gold, or you are on firewalla red/blue beta), and per network segment (gold only)
So is tiktok still an unknown or has it been added to one of the categories? Can I add new sites to the categories to simplify management?
Or are categories based on opendns categories and so those can't be changed?
tiktok is social networking. Categories are computed from various sources, so you can ask us to change anything, if it make sense, we can override
Is there a list available on all the apps you can block currently , and also is there a way to check under what category you place a certain site/ app ?
Where can I turn on "Kid Lock" in version 1.9731? I am not seeing it in the application.
I find that the ability to block a specific video game makes no sense, because my kids will just download a different game. And blocking "all known video games" leaves plenty of loopholes - they will just switch to lesser known games.
Which is why I take the whitelist approach - everything except for school stuff is always blocked, and I unblock it during "reward time" , after the homework and chores are done.
I would love an easier workflow for adding items to my target list - the kids access request a new educational web site, Firewalla captures all involved urls and suggests updates to the target list. I review the suggestions and save them.
Can more apps be blocked other than from the list? I would like to block certain game, example: Valorant, is that possible?
I would like to be able to block their ability to download anything from the Playstore without consulting a parent. I can do this on the Disney Circle with some devices, but not all of them (newer devices seem to be able to get around the block). Does Firewalla allow this type of blocking? What happens is that they try to download any app in the store and it just spins and spins.
Blocking special applications like Facebook, Roblox, and other social media does not work. After selecting them, my children still use those applications. They use web-based Snapchat, TikTok, etc.
This is great! Do you have a timeline for inclusion of these features in MSP?
Please sign in to leave a comment.