Firewalla VPN Client is a service running on your Firewalla box that enables you to direct any home device to a VPN connection; VPN clients provide a secure and encrypted connection between the user and the internet, making it difficult for outsiders to access sensitive information.
What is Firewalla VPN Client?
With a Firewalla VPN client, you can send any device (even if they can't install VPN software) or any type of traffic to a VPN Server/Service. You can create three types of VPN connections:
- Site to Site VPN
- Remote Access VPN
- 3rd-Party VPN (Verified 3rd-Party VPN services)
| Site to Site VPN** | Remote Access VPN | 3rd-Party VPN | |
| Network Access | Bi-directional | One way | One way |
| Certificate-only Setup | Yes | Yes | No |
| Box Requirement | 2 Firewalla Boxes | 2 Firewalla Boxes | 1 Firewalla Box |
| VPN Protocol |
OpenVPN |
OpenVPN Wireguard1 |
OpenVPN |
Notes:
1 Wireguard is not supported on Firewalla Red and Blue.
2 Firewalla AnyConnect VPN client supports SSL, not IKEv2.
3 Firewalla IPsec VPN client can only be configured via Firewalla MSP. For more info, see here.
**Please refer to this document for more information about Site to Site VPN.
Firewalla VPN Client is not available for boxes in Transparent Bridge Mode.
3rd-Party VPN Server
Scenario:
You have many devices at home, all connected to a router that provides access to the Internet. You worry that your ISP can see your internet traffic and log your browsing history. Or, you're in a location where some websites you want to use are inaccessible.
Problem:
You paid for a 3rd party VPN Service to protect your online traffic from snooping, interference, and censorship. But you have to install VPN Clients on all your devices to get them connected to the 3rd party VPN Service, and you have to manage them (all your laptops, smartphones, tablets, and gaming consoles) with apps on different platforms. Some of your devices may not even be able to install a VPN client app. Or, you want to watch Netflix on Apple TV, but it's not supported in your location.
Solution:
Firewalla VPN Client enables you to connect your network to a 3rd party VPN Server. You don't need to install individual VPN apps on all your devices– just enable the VPN Client on the Firewalla app and select which device you want to connect to the 3rd party VPN Server.
Due to how each 3rd party VPN Server operates, Firewalla cannot guarantee performance. The speed of your VPN connection depends on how the server allocates bandwidth.
Remote Access VPN
Scenario:
When working from home, you must access your company network to see files and printers or connect to a computer.
Problem:
You want to have an easy way to access company resources remotely while you are at home. Your company wants to provide a secure way to access its network.
Solution:
Remote access VPNs enable you to connect to your office network from anywhere securely. This is an encrypted channel that is only visible one way. This setup requires 2 Firewalla boxes– one as the VPN server, the other as the VPN client. Read more in our article about Firewalla's VPN Server.
Site to Site VPN
Scenario:
Your company has offices at two different sites. The headquarters and the subsidiary office have separate networks with computers and servers connected.
Problem:
Someone sitting at a computer in headquarters is not able to access the server at the subsidiary office, and vice versa.
Solution:
Site-to-site VPNs allow you to connect two separate networks. Devices in one network can reach devices in the other network under strong encryption. You can read more in our article about Firewalla Site to Site VPNs.
How do I use Firewalla VPN Client?
Step 1: Create a VPN connection
- Tap on the VPN Client button on your box's main page.
- Tap on + Create VPN Connection to create a new profile/connection. You can create up to 9 VPN connections in total.
- Select what type of VPN connection you'd like to create: Site to Site VPN, Remote Access VPN, or 3rd-Party VPN. If you have multiple VPN profiles, you can also create a VPN Group.
- If you select 3rd-Party VPN, you'll need to choose a protocol:
- OpenVPN: You can create an OpenVPN connection by importing or manually filling in your VPN server profile information. Follow your VPN server's manual for the credentials (username and password) or profile required for the VPN connection. Here is a detailed guide on several verified OpenVPN providers.
- WireGuard: If your WireGuard service has provided a VPN profile or a QR code containing VPN configurations, you can import the profile or scan the QR code to create the connection. You can also copy and paste the configuration text to the app to create the connection from scratch.
-
AnyConnect (supported on Gold and Purple in router mode): With AnyConnect, you can connect any of your devices (or your entire network) to a VPN server with one tap.
- If your VPN service provider requires Multi-Factor Authentication, enable the option, and the app will ask for a one-time password (OTP) when connecting to the VPN.
- To have Firewalla auto-fill your OTP, tap One-Time Password, select Auto-Fill, then fill in the secret or tap the "[-]" icon on the right to scan the QR code provided by your VPN service provider. Please note that this only works if your VPN service provider allows you to generate your OTPs using a Secret or a QR code.
-
IPsec (Firewalla MSP only): For Gold series boxes managed by Firewalla MSP, you can configure IPsec as the VPN protocol for 3rd-party VPNs. Due to its complexity, IPsec can only be configured via the MSP interface. Learn more about Firewalla MSP's VPN Client here.
-
For some examples on setting up IPsec, please consult these guides:
-
Step 2: Select Devices
After the connection is set up, you can selectively send your devices' network traffic through the VPN. Devices must be part of the Firewalla overlay network or in router mode to use the VPN.
- If you use DHCP mode, all your monitored devices are already in the Firewalla overlay network.
- If you use Simple mode, you must manually join your devices to the Firewalla overlay network. This is done by assigning a static IP address to the device. Here is a tutorial on how to join the overlay network in Simple mode.
- If you use Router mode, there is no need to do anything extra.
Step 3: Connect to VPN
There are two ways to connect:
- From the VPN Client page, tap on the connection you want to establish. Switch the VPN on, and the status will become "Connected."
- Tap the VPN button on the detail page of the device, network, or group you want to connect to, then select a VPN.
Firewalla supports up to 5 active VPN connections.
VPN Profile Configurations
After a VPN profile is set up, there are some options you can set.
-
Outbound Policy (Site to Site or Remote Access VPN Only):
- Server site subnets: The app will list all the subnets on the server site in this section. The outbound policy of all the subnets will be set to VPN, which means when VPN-enabled devices access those subnets from your local network, Firewalla will send the traffic via VPN.
-
Internet: Choose how VPN-enabled devices access the Internet.
- VPN means VPN-enabled devices will use their gateway on the VPN server site for Internet access.
-
Direct means VPN-enabled devices will use their default gateway for Internet access. Please note that Routes directing traffic to the VPN will also follow the Internet Outbound Policy. This means that if the policy is set to "Direct," any traffic sent to the VPN will still exit through the WAN, even if it's routed to the VPN.
-
Force DNS over VPN: Force VPN-enabled devices to use DNS over VPN or not.
- When it is on, DNS requests will be forwarded to the VPN server. Unbound, DNS over HTTPS, and Family Protect (3rd-party Mode) will not work on devices connected to VPN Client. While these DNS protocols won't take effect, other functions will still work, e.g., Blocking Rules, Ad Block, Safe Search, and Custom DNS Rules.
- When it is off, DNS requests will work as if there were no VPN connection, but traffic to the requested destinations will go over VPN. This means all your DNS traffic will be intercepted and protected by Firewalla. More detail can be found here: Firewalla DNS Services Introduction.
-
Internet Kill Switch: Automatically disconnect a device if the VPN is down. This option is ONLY available when the Internet option is set to VPN. When it is on, Firewalla will be able to:
- Detect and generate an alarm if VPN Connection encounters any error
- Auto disconnect the device's internet access if the VPN is down
- Detect and generate an alarm if the VPN Connection restores
-
Policy-Based Routes: Firewalla policy-based routing can direct traffic locally or over a VPN. For more detail, see our article on Firewalla Policy-Based Routing.
- Delete This Profile: Delete a VPN profile permanently. All related rules will be removed from the box.
VPN Group for Failover
For boxes running in Router Mode, Firewalla supports creating VPN groups, allowing you to connect to a group of multiple VPN clients for improved availability.
To create one, tap Create VPN Connection > VPN Group. Create a group name, choose the profiles you'd like to include, and save. You can also tap Edit in the top right corner of the VPN Group page to change the order of the VPN profiles.
Firewalla will connect to all VPN clients in the group at the same time. When the primary VPN profile fails, it will forward the traffic to the next available profile in the list.
Note: Port forwarding and Unbound over VPN are not currently supported with VPN groups; you may need to continue using individual VPN profiles for these features.
Common Issues and Fixes
- Firewalla VPN client does NOT support IPv6. IPv6 traffic will be blocked by Firewalla when the VPN is connected.
- Devices (i.e., laptop/phone/pad, etc.) should not use local DNS servers.
- Devices must be part of the Firewalla overlay network or in router mode to use VPN.(Does not apply to Router mode. See above for Simple and DHCP modes.)
- On a Firewalla box, both the Firewalla VPN server and the Firewalla VPN client can run simultaneously.
- Firewalla VPN Client only supports one remote address. If the .ovpn file from your VPN service provider has multiple "remote xxxx..." addresses, please delete all but one of them.
Verified 3rd-party VPN services
These are verified by our test team and contributed by customers. Although we try to keep this updated, sometimes we can't catch up with service changes. If you do have issues, please post them to our forums.
ExpressVPN
Fully compatible.
Follow the steps below to set up ExpressVPN on Firewalla:
- Log into your account on the ExpressVPN website.
- Copy the Username & Password under Manual Configuration -> OpenVPN (https://www.expressvpn.com/setup#manual), and paste it into the Firewalla app -> VPN Client -> Profile -> Create 3rd Party VPN.
- Download the OpenVPN file and import the profile to the Configuration section. Or, you can open the file and copy and paste the content in the text field.
- Save the profile, and you are ready to connect.
Note: For the username and password, please use the separate credentials dedicated to VPN connections from their setup website. Do not use your ExpressVPN app account username and password.
Surfshark
Fully compatible.
Follow the steps below to set up Surfshark on Firewalla:
- Log into the Surfshark manual setup. Find your Surfshark service credentials. Pick a server (location) and download the configuration file.
- Open the Firewalla App -> VPN Client -> Profile -> Create 3rd Party VPN. Enter your Surfshark account credentials.
- Import the config file you downloaded previously. Or, you can open the file and copy and paste the content in the text field.
- Save the profile, and you are ready to connect.
NordVPN
Fully compatible.
Follow the steps below to set up NordVPN on Firewalla:
- Go to the server picker on the NordVPN website. Tap on the Show available protocols button. Download the configuration file for the connection protocol you want to use.
- Open the Firewalla App -> VPN Client -> Profile -> Create 3rd Party VPN. Enter your NordVPN service credentials. Note, these are not the same as your NordVPN username and password. You can find your NordVPN service credentials (username and password) in the Nord Account dashboard. Copy the credentials using the "Copy" buttons on the right.
- Import the config file you downloaded previously from the NordVPN website. Or, you can open the file and copy and paste the content in the text field.
- Save the profile, and you are ready to connect.
Smart DNS Proxy
Fully compatible.
IPVanish VPN (Requires additional configuration)
WireGuard via IPVanish:
- IPVanish supports WireGuard configuration profiles. For more information and a user-submitted tutorial video, please check this Reddit post.
Per IPVanish support, new IPVanish profiles will have CA cert content embedded.
The steps below should no longer be necessary, but they are here in case of problems.
- Find the two profiles below: "ipvanish-XX-XX-XXX-XXX.ovpn" and "ca.ipvanish.com.crt".
- Open the file 'ca.ipvanish.com.crt' using a text editor and copy all the content.
- Open file 'ipvanish-XX-XX-XXX-XXX.ovpn' using a text editor and find the line "caca.ipvanish.com.crt".
- Replace the line with the following content:
<ca>
[Paste the content of ca.ipvanish.com.crt here]
</ca> - Save it and import the new file into your Firewalla VPN Client.
PureVPN (Requires additional configuration)
Before importing your PureVPN profile to Firewalla, open the profile in a text editor and remove these two entries:
route-delay 2
route 0.0.0.0 0.0.0.0
You'll also need to find your username and password on PureVPN. Here's how to easily find your existing VPN password.
ProtonVPN
Fully compatible.
Follow the steps below to set up ProtonVPN on Firewalla:
- Log into the web-based dashboard at account.protonvpn.com using your account credentials (the ones you set up during account creation).
- Select Downloads in the left navigation bar on the ProtonVPN dashboard. Find the OpenVPN configuration files section and choose (standard server configs; platform: Router; Protocol: UDP). Download the configuration file from ProtonVPN.
- Open the Firewalla App -> VPN Client -> Profile -> Create 3rd Party VPN. Enter your OpenVPN/IKEv2 username and password. Copy the credentials using the "Copy" buttons on the right and paste them into the "username" and "password" fields.
- Enter your ProtonVPN OpenVPN/IKEv2 Username and Password into the Firewalla app when creating a 3rd Party VPN. Then import the configuration file into the Firewalla app.
Unverified 3rd-party VPN services
These are some tips from contributions from our users:
-
PIA: Firewalla VPN Client is compatible with Private Internet Access (PIA) but some users report you may need to add this line to the PIA profile:
-
pull-filter ignore "auth-token"
-
see https://forum.netgate.com/topic/128325/solved-openvpn-reconnect-auth_failed/5
- Wireguard via NordVPN: Tutorial on using WireGuard via NordVPN and this one.
Comments
81 comments
Am I missing something - my VPN provider asks I change my password every now and then.. I go to the current active VPN profile to update the password but can't see how?
Thanks
I believe you have to delete and recreate the VPN configuration if you need to change it afterwards. You might be able to change it from the CLI, but it’s not documented how anywhere how it is stored.
This is a big gap in the management of vpn client configurations. You can’t even do basics like edit the server hostname or port after it has been created.
Has anyone successfully managed to get a firewall 3rd party VPN to connect to pfSense running an OpenVPN server? I can't get it to import any of configuration profiles. They are all invalid.
Just for info : I got Ivacy & VPNsecure running with remote help from the firewalla team! Works great.
What were the steps to get VPNSecure to work properly?
*** For those users attempting to us PureVPN. This could save you hours. ***
When using PureVPN be sure to verify your password is correct.
Your username will begin with "purevpn0s" and the password can be different than your login password.
To check your password> Login to PureVPN Membership area > Account and Billing > Under Subscription Details: There is a Dropdown box. > Show/Update VPN Password
I hope this helps someone.
I am trying to implement IP Vanish.
I have all the updated OVPN configuration files on the FW. Let's not discuss if that was a good idea or not, there was a reason that they ended up there, let's just agree they are there now. :-)
How can I import those files when setting up the VPN clients on the mobile app?
Hello, awesome post.
Is there a way to define the VPN routes for VPN configuration without having to modify the OPVN file directly? I would like to only tunnel the vpn routes rather than using a tunnel all traffic.
Thanks in advance.
The Surfshark links don’t work and I’m trying to used the 3rd part VPN to setup. Any updated tips how to do this?
@Edward
I don't have surfshark account to try, but you may check if this link is helpful:
https://support.surfshark.com/hc/en-us/articles/7162567821586-How-to-set-up-a-manual-WireGuard-connection-on-iOS-
https://support.surfshark.com/hc/en-us/articles/6585805139474-How-to-set-up-a-manual-WireGuard-connection-on-Android-
When setting up a third-party VPN on Firewalla using NordVPN, it may be worth noting that the current step 1 (Go to the server picker on the NordVPN website. Tap on the Show available protocols button. Download the configuration file for the connection protocol you want to use.) in that process is if you are using the "find the best" server approach. If you have a Dedicated IP through NordVPN and what to connect to your specific NordVPN Dedicated IP Server, you can go to https://nordvpn.com/ovpn/ on the NordVPN website to get the config file. This is the recommendation approach from support at NordVPN and a page that they actively maintain. All of the other steps listed in this article are the same. Passing along to Firewalla support for possible inclusion to help save folks a little extra researching in the future.
Hi Guys,
do you know if there is any way to stop/start the 3d party VPN function using the cli instead of disabling / reenabling using the GUI ?
Since sometimes my VPN hangs up, I would like to configure a job to automatically stop and then restart the VPN Client.
Thanks
Alfredo
My NordVPN site-to-3rd Party used to work fine. But now when I attempt to connect up the 3rd party VPN config always fails. Not sure why. I have attempted to use the UPD and TCP protocols and it keeps failing. Can someone please explain why??
Hi all, new Firewalla user here. I have a paid Proton VPN subscription and followed the guide listed here, also tried the modification listed in the comments, and I can't connect.
I get AUTH_FAILED notice in the logs. I do have 2FA on my account and I'm guessing that might be why I can't connect but want to confirm. And if that is the case, is there a way to continue?
You are probably having the same issue I had with my NordVPN service. In order to Utilize the NORDVPN service, you have to setup a Service Level authentication login. Its pretty straight forward but you will have to do this from a PC and not on your phone. The link is the one I used below to configure mine and then I just imported it into my Firewalla Desktop Dashboard.
https://help.firewalla.com/hc/en-us/articles/360023379953-VPN-Client#h_677d2026-6bf7-4fe6-abbd-7566ef1c362c
anyone using VPN Unlimited with Firewalla as a VPN client? tia.
https://www.vpnunlimited.com/
anyone using VPN Unlimited with Firewalla as a VPN client? tia.
https://www.vpnunlimited.com/
I use VPN unlimited, have tried both Wireguard and OpenVPN. The OpenVPN config seems to work better. Wireguard, after running for a few months, will stop working and can no longer connect unless I create and download a new profile from the management console on KeepSolid (VPN Unlimited parent company).
thanks andy. yep that's the familiar vpnu wg feature. it's wg tun stopped working after running for a few months and had to create a new profile on keepsolid. same vpnu wg experience here.
Has anyone tried setting up the Firewalla VPN, either Wireguard or OpenVPN, with Azure VM?
I'm not sure how to create the config file for the wireguard. l have completed the setup on the Azure end but am now sure how to create the config file.
You guys do a great job with the articles. I would love to see how to solve VPN on mobile over Starlink.. Right now, the only way this can happen is that everyone has to support IPV6, and if anything in the chain is IPV4, it will fail due to how Starlink Nat is set up. Having a solution to this would help anyone on Starlink.
Hello Firewalla Team,
A possible upgrade for the Proton VPN part.
Instead of using OpenVPN opention, you also can use the Wireguard option. This way you don't have to use the OpenVPN user creadentials and only need to scan the QR-Code.
So goto "Proton VPN -> Downloads -> WireGuard configuarion"
1. fill-in a name
2. Select platform: router
3. Filter options: none and VPN accelerator
4. Create -> QR Code
Goyo "firewalla app -> VPN client -> Create VPN Connection -> 3rd-Party VPN"
Choose WireGuard -> Scan QR Code
Please sign in to leave a comment.