- This article also applies to the Nest Wifi.
- To configure Google or nest Wifi with Blue series boxes, see Setup Guide: Mesh Routers Simple and DHCP modes
- To configure Google or nest Wifi with Purple series boxes, see Google Wifi or Nest Wifi Mesh network with Purple (Beta).
The best way to set up a mesh network with Firewalla Gold series boxes in router mode is to configure the mesh network in AP Mode/Bridge Mode.
If you just have one Google Wifi unit, you can turn on bridging mode and attach it to the Firewalla Gold LAN port.
However, the Google Wifi mesh network doesn't support AP Mode or Bridge mode (when the mesh is enabled). This tutorial provides a workaround. This workaround is NOT perfect, if you have any issues, please let us know. You can also help convince Google/Nest to support "AP mode". This is the best solution.
If you don't want to use up all your ports on Firewalla Gold you can also set up the Google Wifi mesh network with VLANs as shown here for Firewalla Purple. Note this requires a managed switch.
There are two recommended solutions for using Google Wifi with Firewalla.
Solution 1: Wireless Backhaul
Use this configuration when you cannot connect the Points to the Google Wifi Router with Ethernet. Configuration 2 is preferable when you have a choice.
There will be three network subnets created:
- Google Wifi LAN, managed by Google Wifi. This subnet is only used for Google points (satellites) (e.g. 192.168.86.0/24).
- Gold - Port 3, managed by Gold. This subnet is only used for Google Wifi's WAN IP (e.g. 192.168.200.0/30).
- Gold - Port 2, managed by Gold. This subnet is used for the remaining Wifi devices (e.g. 192.168.210.0/24).
Solution 2: Wired Backhaul
Use this configuration when you can connect the Points to the Google Wifi Router with Ethernet. This is the preferred option.
Network configuration steps remain the same.
ISP -> Gold Port 4
Gold Port 3 -> WAN port of the Primary Unit
Gold Port 2 -> Your Switch -> LAN port of the Primary Unit
-> WAN port of the Point (satellite)
-> Other devices
The idea is the LAN port of the Primary Unit and WAN port of the Point (satellite are in one ethernet network (for subnet 192.168.86.1/24), and other devices and Gold port 2 are also in another ethernet network (for subnet 192.168.210.1/24). Both subnets are using the same physical ethernet network. Wi-Fi Clients that need an IP will ask Google Wifi for one, but there will be none for it to give and the request will go upstream to Firewalla DHCP server.
Step 1: Set up Local Networks in Gold
- Make sure Firewalla Gold is running in Router Mode. (See Mode) in the Firewalla app).
- Create a dedicated local network on Port 3. (e.g. start IP 192.168.200.0 end IP 192.168.200.3)
- Create another local network on Port 2. This network can include Port 1 if you like or be separate. (e.g. 192.168.210.1/24). However, Port 2 and Port 3 must be configured for different local networks.
1. Here is the tutorial on how to manage networks on Gold.
2. We'll use the subnets above as an example in this guide.
Step 2: Set up a Google Wifi Mesh network with a limited DHCP address range
- Connect the WAN port of the Google Wifi primary unit to FWG's Port 3, then follow the official guide to set up the Google Wifi primary device. Double check that the WAN IP of Google Wifi should be under 192.168.200.1/30 (between 192.168.200.0-192.168.200.3). Once the Google primary unit is running, you should see the Google router appear as a device in Gold.
- In the Google app, configure DHCP address range in Google Wifi primary unit so that the number of available IP addresses is N (N=number of additional Wifi points)
For example, to allow two Wifi Points in the Google Wifi mesh network, you can set the DHCP address range as 192.168.86.2-192.168.86.3; for three Wifi Points use 192.168.86.2-192.168.86.4.
- Set up Google Wifi Mesh network by adding additional Google Wifi points one by one, and verify that they get IP addresses within the range of what's reserved in step 2.
If you are setting up with configuration 2, connect the LAN port of the Google Wifi primary unit (Router) and the WAN port of additional Google Wifi Points to the switch. As you connect them, you should see the Google wifi satellites appear in the Google router.
Note: We recommend not connecting any other devices to the Google Wifi network while setting up the limited DHCP address range. This is because the IP address in the pool may be assigned to other devices that are supposed to be assigned to the Google Wifi Points.
Unfortunately, Google Wifi and nest Wifi do not allow IP reservations for the Points which would ensure that they don't create conflicts or get IPs from Firewalla. However, users of these APs report that usually once the router gives them an IP they tend to be "sticky" for a long time. A power cycle shouldn't cause it to get a new IP, but a factory reset (and subsequent setup) quite likely will. So in most cases, it shouldn't be a problem if you add one Point/Puck at a time and limit the IP range to be just big enough. Once you know if the units you have require one or two IPs and allow for that this workaround should not allow other devices to get IPs from the Google/nest router.
- Sometimes one Google Wifi Point may have two mac addresses, so you may need to reserve more IP addresses as needed. Just be sure the number of addresses you allow doesn't exceed what is needed for the Google or nest Wifi.
Step 3: Use DHCP from Gold for devices in the wireless mesh network
- For solution 1: Connect the LAN port on the Google Wifi primary unit to Port 2 on Firewalla Gold.
- For solution 2: Connect the switch to Port 2 on Firewalla Gold.
Now, any device connecting to the Google Wifi network should be able to get an IP address from Gold. They should get IP addresses under 192.168.210.0/24. in this example.
Step 4: Configure Gold to not allocate IP for Google Wifi Points (satellites)
Google Wifi points may accidentally get IP addresses from Gold If the DHCP allocation from Google Wifi expires. This may break the mesh setup. When this happens:
- The Firewalla app will get a New Device Alarm on google wifi points.
- Find the Wifi point devices in the Firewalla app (usually, the name is Google, Inc. and the IP address is under 192.168.210.0/24)
- For each Wifi point device, tap on "IP Address", and select "Do not allocate". This only needs to be done once.
- Reboot Wifi point to get an IP from the Google Wifi primary unit.
Important: Never set "Do not allocate" for the Google Wifi primary unit, otherwise the whole Google Wifi mesh will lose the internet.