Router Compatibility

For Simple and DHCP Modes

• Firewalla Gold and Firewalla Purple work best in Router Mode and Bridge mode. These two modes are compatible with any device. If you are using or planning these modes, this guide DOES NOT apply to you. Learn more about Firewalla Router Mode. 

See below on router compatibility if:

- You have the Firewalla Red, Blue, or Blue+

- or you want to run Simple Mode or DHCP mode with the Firewalla Gold or Purple. 

Learn more about Firewalla monitoring mode and what mode to use

Firewalla works in either Simple Mode (Plug and Play) or DHCP mode (need to login to the router and disable the DHCP server. Learn more about DHCP Mode). Your router should be able to work with at least one of these modes.

The Firewalla app auto-detects you during the initial pairing with the Firewalla box. If you are running into problems, please check the list below to see if there are any known issues. The auto-detection process is not perfect, but you can always manually force a mode to use.

• If your router is not on the list, it is very likely to be compatible with Firewalla in either Simple or DHCP mode. This list will be updated as we learn from our customers.
• DHCP Mode: If your router has the option to turn off the built-in DHCP server, then DHCP mode will work for you. For some routers where DHCP can’t be disabled, then a trick like this might work.
• To connect Firewalla, your router (or a switch connected to the router) must have a free ethernet port. Here is the installation guide.
• Any questions? Just email us at help@firewalla.com, it will create a support case, and our engineers will help you directly. 

Here is some detailed compatibility information: 

• Firewalla Confirmed Router List & User-contributed List
• VPN Server Compatibility
• Compatibility with Other Devices
• Special Configuration

Firewalla Confirmed Router List

User Confirmed Router List

Following list of routers known to be compatible with Firewalla, contributed by our wonderful users across the world.  Discussions can be found here: user-contributed router list.

* Run the following command with SSH to disable DHCP on ASUS Lyra Trio

nvram set dhcp_enable_x=0; nvram commit;

Special Configuration

Network Extenders

There is a class of network extenders that will actively change or randomize all the Wifi devices connecting to it.  These are not compatible with Firewalla. The reason is, Firewalla uses the device MAC address as the key to the device, if it keeps on changing, it will make monitoring impossible.  (Such as NETGEAR EX3700)

Wifi Access Points (Simple Mode)

If you have network devices, such as extenders, or routers acting as access points, you may need to put them into "not monitor" mode.

Comcast Routers

Certain Comcast routers that run in DHCP mode (such as XB6/XB7) may have issues with blocking IPv6 traffic. Please contact your Comcast provider and make sure they can turn off ipv6 before purchasing if you have XB6/XB7 as your main router.

IPv6

In Simple mode:  IPv6 support needs manually turning on.  Please tap on "+" then add the IPv6 feature.

In DHCP mode:  DHCPv6 and auto-config should be turned off.

Network Size (For advanced + business users)

Most home network by default is /24 network mask (253 networked devices).   Please limit Firewalla Red's network to /24 and Firewalla Blue to /19

Guest Networks

Guest networks are generally not supported by Firewalla.  These networks are mostly 'inside' the router and not visible on the LAN side.

LAN Ports

Certain router's LAN ports (we have confirmed on the Synology 2600) when shared with multiple devices (multiple devices connecting to the LAN ports), there will be a speed reduction (even more if there is a 100mbit device attached to the router LAN port). This is the problem relating to the Linux bridge interface and router's LAN implementation. To correct this problem, attach a switch to one LAN port and connecting the rest of the devices to that LAN port. 

VPN Server Compatibility

(So far we see issues below happening in Germany and China)

To access the Firewalla VPN server, your ISP will need to give you an externally routable IPv4 address.  (Most ISPs does this already, we have seen cases in Germany, China, where the IP address provided is a private IP) Without this, your VPN client will not able to talk to Firewalla.

VPN will not work in a pure IPv6 network, it only supports IPv4 at the moment. We are working on getting it working over IPv6. We encounter problems in some German ISP's, where IPv4 in IPv6 tunnel is used.

Compatibility with Other Devices

The idea behind the defense-in-depth approach is to defend a system against any particular attack using several independent methods. We engineered our box to play with other boxes just for this purpose. Many of the tips here are contributed by our customer base.

Circle: If you have Circle on the network, make sure Circle is not monitoring Firewalla and Firewalla is not monitoring Circle.  And both are not monitoring the same devices.  Otherwise, your network will be shut down with packets flying all over the place.

Cujo: We have one user claim he ran Firewalla in Simple Mode under Cujo. (verified by another user)

Fing: Fully compatible. Do not use Fing to block a device that's monitored by Firewalla in Simple Mode.

PFSense: Pending confirmation, we have one user got Firewalla Simple mode working with it.

PiHole: This is the open-source DNS server.  Much like what Firewalla does.  If you have this as your DNS server, please disable the monitoring of the PiHole Unit inside the Firewalla App. (tap on devices->find pi hole->tap on it->move to the bottom and monitoring off)

You also can install pi-hole inside the firewalla Blue by following this Guide.

SonicWall: Should work in the Simple mode

Bitdefender: We do know a few users run Firewalla with Bitdefender in router mode.

Bitdefender Total Security: Firewalla Device Port Scan feature is reported to be NOT compatible with Bitdefender's Port Scan Protection, which may impact the whole network. Disable either Device Port Scan on Firewalla Box or Port Scan Protection on Bitdefender will solve the problem. 

Ubiquity: Firewalla works with many Ubiquity devices in simple mode.

Untangle: Firewalla works with Untangle with the help of an additional switch sit in between them. Firewalla will NOT be able to monitor devices connecting to interfaces other than which Firewalla is connecting to.

Rattrap: Firewalla works with rattrap as the front end. Tested by one of our customers, who really love the concept of layered security.