Firewalla Security Gateways are next-generation firewalls that bring enterprise-class security to professional users who want deeper visibility, policy control, segmentation, VPN, threat protection, zero-trust network architecture, and ongoing network management beyond a typical business router.
- There is no subscription fee for any physical product.
- The Firewalla mobile app is required to set up all products. Larger networks can also be managed through the MSP web interface.
- Firewalla units are security gateways that can be deployed as your main firewall/router or as a bridge to your existing router. You will need an additional access point (WiFi) for all Gold, Purple, and Purple SE units (or configure your existing router to bridge/AP mode)
- Packet Processing Speed is how fast the unit can run full IDS/IPS with 3 regions blocked and a 1,000-entry target list rule between LAN and WAN (DHCP). Choose a unit whose Packet Processing Speed is at or above your WAN speed.
- To get a feel for the basic security features, please see the Getting Started guide and Manual Pages. Firewalla is not a set-and-forget device or a consumer product; it requires proper configuration and active management.
- While Firewalla aims to simplify security, we assume you already know some networking and security concepts to properly configure and run the unit.
Have questions before purchasing (or returning)? Check out our Frequently Asked Questions or email us at help@firewalla.com.
Quick Comparison Between Products
When choosing a Firewalla unit, check:
- The packet processing speed it supports (greater than your current or future ISP speed)
- The number of devices (if you are close to the upper limit, best get one size up)
- The feature set
- If you plan to run more rules than usual, or are near a unit’s device limit, go one size up.
| Ports (**) | Packet Processing Speed (*) |
Wi-Fi | Rack |
Best For (***) | |
|---|---|---|---|---|---|
| Gold Pro | 2x 10 Gbit + 2x 2.5 Gbit |
10 Gbps | No | With Gold Pro Rack Mount (Purchased Separately) | Large networks (150 - 500/1000 devices), fastest speeds, medium-sized businesses, and commercial deployments |
| Gold Plus | 4x 2.5 Gbit |
Up to 5 Gbps (with LAG) 2.5 Gbps single port |
No | With Gold Rack Mount (Purchased Separately) |
Medium networks (50 - 150/200 devices), small businesses with dual WAN Industrial / Warehouse / Commercial Networks |
| Gold Plus SFP | 2x 10 Gbit + 2x 2.5 Gbit + 1x SFP+ (fiber) |
5 Gbps | No | Coming Soon |
Medium networks (50 - 150/200 devices), small businesses with dual WAN Industrial / Warehouse / Commercial Networks |
| Gold SE | 2x 2.5 Gbit + 2x 1 Gbit |
Up to 2 Gbps | No | With Gold Rack Mount (Purchased Separately) |
Medium networks (50 - 150/200 devices), small businesses with dual WAN Industrial / Warehouse / Commercial Networks |
| Orange | 2x 2.5 Gbit | Up to 2 Gbps | Yes, WiFi 7 | No | Small networks (<30 - 50 devices), SOHO, shared workspaces, small office less than 10 people (2000 sqft), travel |
| Purple SE | 2x 1 Gbit | Up to 500 Mbps | No | No |
Most affordable option for very small networks (<30 - 50 devices), remote work with slower internet, and small branch offices. For fast delivery, you can order this unit directly from Amazon.com |
(*) Choose a unit whose speed is at or above your WAN speed.
(**) All RJ45 ports can run multiple speeds.
(***) The network size per unit is estimated/suggested only. The actual number depends on the device type. For example, we've seen Gold Plus / Gold SE running 1000 devices, and Gold Pro running >3000 devices.
Exclusive Gold Features:
- Multiple Site-Site VPN Server Hub (more than 1 session)
- Port-based and unlimited VLAN-based segmentation
- Multi-WAN with multiple Ethernet WAN ports
- Device Active Protect
- Unlimited Geo-IP / regional blocking
- Link Aggregation (802.3ad)
| Ports(**) | Wi-Fi Radio | Mountable | PoE | |
|---|---|---|---|---|
| AP7 Desktop | 1x 10G + 1x 2.5G RJ45 | Triband 2.4GHz 2x2, 5GHz 2x2, 6GHz 4x4 | No | No |
| AP7 Ceiling | 1x 10G (PoE+) + 1x 2.5G RJ45 | Triband 2.4GHz 2x2, 5GHz 2x2, 6GHz 2x2 | On the ceiling or wall | PoE+ support (IEEE802.3at) |
Exclusive AP7 Features:
- Requires a Firewalla Box in Router or Bridge Mode
- Tri-band Wi-Fi 7
- VLAN Segmentation + VqLAN Microsegmentation
- WPA/WPA2/WPA3 Security + PPSK (Personal Key with WPA2) + WPA2/WPA3 Enterprise Security
- Mesh-capable with Ethernet or Wi-Fi backhaul for flexible expansion
- (**) All RJ45 ports can run multiple speeds
Learn more
Full Hardware and Performance Comparison
|
Gold SE $549 |
Gold Plus $679 |
Gold Plus SFP $779 |
Gold Pro $949 |
Orange $399 |
Purple SE $299 |
|
|---|---|---|---|---|---|---|
| Packet Processing Speed | 2 Gb |
5 Gb (with LAG) 2.5 Gb (single port) |
5 Gb | 10 Gb | 2 Gb | 500 Mb |
| Memory | 4 GB | 4 GB | 4 GB | 8 GB | 2 GB | 2 GB |
| Number of Ports | 2 x 2.5 Gbit 2 x 1 Gbit |
4 x 2.5 Gbit | 2x 10 Gbit 2x 2.5 Gbit 1x SFP+ (fiber) |
2 x 10 Gbit 2 x 2.5 Gbit |
2 x 2.5 Gbit | 2 x 1 Gbit |
| Active Protect Entries * | 40,000 | 40,000 | 40,000 | 80,000 | 20,000 | 20,000 |
| CPU | 64bit Quad-Core ARM | 64bit Quad-Core Intel (AES NI) | 64bit Quad-Core ARM | 64bit Quad-Core Intel (AES NI) | 64bit Quad-Core ARM | 64bit Quad Core ARM |
| OpenVPN Speed (Server/Client) |
100 Mbps | 120 Mbps | 200 Mbps | 500 Mbps | 100 Mbps | 60 Mbps |
| WireGuard Speed (Server/Client) |
350 Mbps | 500 Mbps | 1 Gbps | 2 Gbps | 350 Mbps | 220 Mbps |
| WireGuard Server Max Client | 25 | 25 | 25 | 50 | 25 | 25 |
| VPN Client | 5 Active | 5 Active | 5 Active | 10 Active | 5 Active | 5 Active |
| Storage (EMMC) | 32 GB | 32 GB | 32 GB | 32 GB | 32 GB | 16 GB |
| WiFi WISP (WAN) | With Wi-Fi SD | With Wi-Fi SD | With Wi-Fi SD | With Wi-Fi SD | Yes | With Wi-Fi SD |
| WiFi LAN | - | - | - | - | Yes, dual-band Wi-Fi 7 | - |
| Console Port | - | 1 | 1 | 1 | - | - |
| Power (Watt) | ~6W to 10W | ~10W to 15W | ~10W to 15W | ~17W to 33W | ~5W to 16W | ~7W |
| Size | 5.12 x 3.94 x 1.02 in 13 x 10 x 2.6 cm |
5.12 x 4.33 x 1.34 in 13 x 11 x 3.4 cm |
6.50 x 5.30 x 1.34 in 16.5 x 13.5 x 3.4 cm |
8.54 x 6.50 x 1.69 in 21.7 x 16.5 x 4.3 cm |
5.04 x 3.27 x 1.18 in 12.8 x 8.3 x 3 cm |
3.54 x 2.36 x 1.18 in 9 x 6 x 3 cm |
| Weight | 15 oz / 427 g | 19.9 oz / 565 g | 26 oz / 738.3 g | 38.5 oz / 1090 g | 8.64 oz / 244 g | 3.52 oz / 100 g |
| Operating Temperature (with airflow) |
32°F to 113°F 0°C to 45°C |
32°F to 113°F 0°C to 45°C |
32°F to 122°F 0°C to 50°C |
32°F to 122°F 0°C to 50°C |
32°F to 113°F 0°C to 45°C |
32°F to 95°F 0°C to 35°C |
| Compliance / Certifications | FCC, CE, RoHS | FCC, CE, RoHS, UKCA | FCC, CE, IC, RCM | FCC, CE, RoHS, UKCA | FCC, CE, ISED, RCM | FCC, CE, RoHS, UKCA |
Software Features Comparison
- All Firewalla units use the same software.
- For software release updates and release notes, see here.
| Gold Pro | Gold |
Purple / Orange |
|
|---|---|---|---|
| Protect Features | |||
| Inline Ingress/Egress Firewall | ✔ | ✔ | ✔ |
| Active Protect - Default (up-to-date threat detection and prevention for the whole network) | ✔ | ✔ | ✔ |
| MSP Active Protect (extended behavioral-based detection) (Firewalla MSP only) | ✔ | ✔ | ✔ |
| Device Active Protect (auto-restrict IoT device access) | ✔ | ✔ | |
| Active Protect - Suricata (open-source IDS/IPS) | ✔ |
||
| Visibility & Monitoring Features | |||
| Deep Insights | ✔ | ✔ | ✔ |
| Alarms | ✔ | ✔ | ✔ |
| Bandwidth and Monthly Data Plan Monitoring | ✔ | ✔ | ✔ |
| Network Performance Monitoring | ✔ | ✔ | ✔ |
| Firewalla AI Assistant (FireAI) | ✔ | ✔ | ✔ |
| Core Management Features | |||
| Device Management | ✔ | ✔ | ✔ |
| Device Groups | ✔ | ✔ | ✔ |
| Manage Rules (Allow, Block, Domains, Categories, Applications) | ✔ | ✔ | ✔ |
| Ad Block | ✔ | ✔ | ✔ |
| Target List | ✔ | ✔ | ✔ |
| Blocking Flows | ✔ | ✔ | ✔ |
| New Device Quarantine | ✔ | ✔ | ✔ |
| Geo-IP Filtering / Regional Blocking | Unlimited | Unlimited | 10 countries |
| Web Portal Access | ✔ | ✔ | ✔ |
| MSP (container-based email login, reports, manage multiple boxes at once, ...) | ✔ | ✔ | ✔ |
| DNS and Internet Services Features | |||
| DNS over HTTPS | ✔ | ✔ | ✔ |
| Unbound | ✔ | ✔ | ✔ |
| Unbound (DNS) over VPN | ✔ | ✔ | ✔ |
| NTP Intercept | ✔ | ✔ | ✔ |
| IPv6 | ✔ | ✔ | ✔ |
| DDNS | ✔ | ✔ | ✔ |
| Activity / Content Control Features | |||
| Activity / Content Filtering | ✔ | ✔ | ✔ |
| Safe Search | ✔ | ✔ | ✔ |
|
Disturb |
✔ | ✔ | ✔ |
| Users (activity tracking, app & internet time limits) | ✔ | ✔ | ✔ |
| VPN Features | |||
| VPN Server - OpenVPN | ✔ | ✔ | ✔ |
|
VPN Server - WireGuard/ AmneziaWG |
✔ | ✔ | ✔ |
| VPN Client (Router Mode only) | ✔ | ✔ | ✔ |
| Site to Site VPN | 20x connections |
10x connections |
1x connections |
| VPN Devices Management & Flows | ✔ | ✔ | ✔ |
| Smart Queue Features (Router Mode only) | |||
| Advanced Smart Queue | ✔ | ✔ | ✔ |
| Traffic Shaping and Rate Limit | ✔ | ✔ | ✔ |
| Application Prioritization | ✔ | ✔ | ✔ |
| Active Queue Management - FQ_CoDel | ✔ | ✔ | ✔ |
| Active Queue Management - CAKE | ✔ | ✔ | ✔ |
| Advanced Features | |||
| Custom or 3rd-party software installation | ✔ | ✔ | ✔ |
| Docker Containers | ✔ | ✔ | ✔ |
| SSH / Root Access | ✔ | ✔ | ✔ |
| Deployment Modes | |||
| Router Mode | ✔ | ✔ | ✔ |
| Transparent Bridge Mode | ✔ | ✔ | ✔ |
|
Simple & DHCP Mode |
✔ |
✔ |
✔ (Purple/Purple SE) Not supported on Orange |
| Router Mode Features | |||
| WAN (PPPoE, Static IP, DHCP, Triple-Play) | ✔ | ✔ | ✔ |
| Network Segmentation (preset network types, inter-network traffic rules) | ✔ | ✔ | VLAN Only |
| VLAN | No license-imposed limit | No license-imposed limit | 5 Max |
| Policy-Based Routing - WAN | ✔ | ✔ | ✔ |
| Policy-Based Routing - VPN | ✔ | ✔ | ✔ |
| Multi-WAN - Load Balancing + Failover | ✔ | ✔ |
Wi-Fi+Ethernet (Purple/Orange) Wi-Fi SD+Ethernet (Purple SE) |
| Link Aggregation (802.3ad) | ✔ | ✔ | |
| Firewalla Access Point Support | ✔ | ✔ | ✔ |
For a full list of features, check our user manual.
Disclaimer: Some of the features above may be in beta and eventually be in production mode.
* Active Protect Entries:
Active Protect Entries refer to the relative scaling capacity of a unit. Some units have more memory and can apply a greater number of rules. For example, due to its memory limitations, the Firewalla Purple series has a maximum limit on how many countries it can block and how many VLANs it can create.
If you have a large network or complex rules with more things to block, consider a unit with more Active Protect Entries, such as the Firewalla Gold series.
Frequently Asked Questions
Can I use Firewalla in a commercial space?
Yes. Firewalla has been used in environments such as schools, libraries, cafés, small offices, and other professional spaces. Some of the fanless units are also used in industrial / warehouse settings.
If you use Firewalla for content filtering, activity monitoring, or security policies in a workplace or public environment, please make sure your use complies with applicable local laws and regulations. For questions, please contact help@firewalla.com
Why is Firewalla much more expensive than business routers?
Firewalla is an enterprise-class security gateway with features commonly found in very large enterprise networks, including zero trust network architecture, device visibility, firewall rules, VPN, network segmentation, content filtering, activity monitoring, and threat detection. It can act as a router or a transparent network bridge;
Many similar capabilities often require a separate license/subscription. With Firewalla, you just pay once. We also have a great support team (human) who will answer your emails at no additional cost.
Who is Firewalla best for?
Firewalla is best for businesses, small enterprises, industrial, managed security service providers, and professionals who want more visibility, control, and security than a basic router can provide, and is not intended for residential use. Firewalla should be installed/configured/managed by professionals.
An understanding of networking and security concepts is required, such as reviewing alerts, adjusting network rules, and deploying configurations across the network. (Otherwise, best to find a professional or MSP that specializes in security and networking to help you install and use the unit)
Disclaimer: Misconfiguring a firewalla unit may cause security or network issues.
Why choose Firewalla instead of a basic router?
A basic router mainly connects devices to the internet. Firewalla is designed to help you see what is happening, control what is allowed, segment your network, access it securely, and respond to potential risks. You can use Firewalla to implement a 'very' secure network based on your own policy and tolerance for security risk.
Can Firewalla help separate business, guest, and IoT devices?
Yes. With compatible network equipment, Firewalla can help segment devices into different networks or groups, making it easier to apply different rules for employees, guests, cameras, IoT devices, and sensitive systems.
Can I use my existing Wi-Fi system with Firewalla?
Yes. Many users use Firewalla with their existing Wi-Fi access points, mesh systems, or routers in bridge/AP mode. For the best experience, make sure your Wi-Fi system supports AP or bridge mode.
In certain deployments, if you are required to keep your existing router for compliance reasons, you can run the firewalla between your primary router and WiFI Access Points in bridge mode.
Will Firewalla automatically secure everything for me?
No. Firewalla simplifies many advanced networking and security tasks, but it is not a completely set-and-forget device. For the best results, you should be willing to review alerts, understand your devices, and tune rules over time.
Can I purchase Firewalla from IT Service Providers or internationally?
Yes. In addition to buying directly at firewalla.com, you can purchase through our IT business partners and resellers worldwide. See the Partner Directory.
Comments
24 comments
Are there any subscription fees? Or do I just buy the hardware?
No, there is no subscription fee…
You just buy the hardware and download the free mobile App.
I have Gigabit fiber to my house. I like all the features of BluePlus but don't need the enterprise capabilities of Gold.
Will the packet processing speed of Blue Plus just end up throttling my 1 Gigabit fiber? Can I get a blue plus (feature set) with Gigabit throughput?
The Blue Plus will throttle your speed to around 500mbit. This is not an artificial limit, but rather the CPU doesn't have enough power to sustaining examining packets at gigabit speed.
I really need the features of gold but our speed right now is not in the range stated. We are running at about 25-30 mbps. Will the firewalla gold work with this internet speed?
@Jason, Gold will work with any speed less or equal to gigabit.
I work from home and need good internet reliability, so I have 2 Internet providers - one via cable modem and one via dsl. I could write scripts to leverage Linux advanced networking to create an automatic active/active connection, but I'm wondering if it would be easier to drop a Gold in and be done with it. Is this something that would be fairly straightforward?
@JJ, you should get the Gold, it can do standby/failover or load balancing between two different WAN, more information here https://help.firewalla.com/hc/en-us/articles/360051575473-Firewalla-Gold-Feature-Guide-Multi-WAN
will packet processing speed affect my internet speed? just say my internet package is 1Gbps and i buy blue which has a limit of 500Mbps packet processing speed, will it slowdown to read the packets in SME organization?
The packet processing power is the total CPU power to dig into your network. For example, if you have a blue+, and it is rated 500mbit, this means if your total bandwidth is 1gigabit, once that passes through Firewalla, it will get shaped (reduced to) 500mbit. You can stop monitoring devices to bypass firewalla monitoring, then that traffic is not shaped, it will be 1gbit.
On the Gold it is rated 3Gigabit, this means the gold can process 3 gbit of traffic in parallel. Since each port is 1gbit, the 3gbit is the aggregation of all traffic flowing (LAN to WAN, and LAN to LAN if you are segmenting)
Hi, What if I already have a VPN services, Can I integrate with Firewalla? by example: ExpressVPN.
Best Regards.
@Rojas, the feature is VPN client, which allows you to use third-party VPN services. https://help.firewalla.com/hc/en-us/articles/360023379953-VPN-Client
Hi Firewalla Team, should the operating temperatures in the comparison be in Celsius instead of Fahrenheit? It just seems like some low values for embedded devices. 45C/113F for a max temperature on my FW Purple seems extremely low. Especially since I'm running consistently at 60C with peaks around 80C. Thanks a bunch, I'm definitely interested in the real op temps.
@Noah, these are operating temperatures, which is the local ambient environment at which a Firewalla operates. (or just the room temperature).
is Active Protect, Deep Insights, Ad Block, Family Protect, Safe Search, and Family Time/Social Hour available when in bridge/transparent mode?
@USTSG Yes, they are supported. However, VPN client & Policy-based routing are not supported in bridge mode.
Does the router replace my Comcast router?
@kirk, it depends. Best look at article and follow the xfinity example https://help.firewalla.com/hc/en-us/articles/4411167832851-Firewalla-Router-Mode-Configuration-Guides#h_01FQZAFRQ5QAXQZBJ76GK204H7
Does the purple SE have wifi build-in?
and for the firewall speed it 500M or 50M? as I read from the review its 50M only.
Do you have disti/reseller for indonesia?
Purple SE does not have WiFi, but it can use wifi SD as a secondary WAN.
Firewalla speed of the Purple SE is 500 Megabits. (with IPS/IDS on, all of our quoted speeds are with IDS/IPS on, a few country blocks)
You will have to buy direct from us
Just setup Firewalla Gold Plus inside Starlink --- fantastic router with pretty easy setup, thank you very much for a fantastic appliance!
Can you please make a switch to complete the package for wired VLANS to work with your APs?
Hello,
I’m looking for a solution for my home. My internet provider gives me 300 Mbps, and I currently have an Amazon eero Pro 7 setup. I’m based in Argentina—are there any regional restrictions or limitations I should be aware of?
I’m also planning to implement a Multi-WAN setup as a backup, using a Starlink Mini as a secondary connection (wireless, not connected via cable).
Sorry to be such a nit-picker, but you have some inaccuracies in the notation you're using for your packet speed comparisons. In the graphic at the top and again in the "Full Hardware and Performance Comparison" table it states that the Gold Plus router is "> 5 Gbps". This means "greater than 5 Gbps" ("> X" means "greater than X"). This clearly doesn't make sense, and in your "Quick Comparison" table it says "Up to 5 Gbps (with LAG)" - that would be better shown with something like "<= 5 Gbps".
Please sign in to leave a comment.