Firewalla Orange Wi-Fi Configuration Guide

Firewalla Orange is a fully integrated dual-band Wi-Fi 7 firewall and router. The integrated Wi-Fi 7 interface can also be used in WISP (Wireless Internet Service Provider) mode and help you to provide a WAN interface. WISP mode can also allow you to use the unit in mobile/travel mode. In this article, we will go through these three modes. 

Here's how to enable Orange Wi-Fi:

1. Wi-Fi LAN Network
   1. Additional Wi-Fi Features
      1. Assign SSIDs to Networks or Users/Groups
      2. Set Wi-Fi Security and Frequency Bands
      3. Generate QR Codes for Wi-Fi
   2. Wi-Fi Connection Details
      1. Sort Devices By Signal Strength
      2. Device Wi-Fi Information
   3. Advanced Wi-Fi Settings
      1. Manually Select Wi-Fi Channels
      2. 5 GHz DFS Channels
2. WAN/WISP Connection 
3. Mobile Mode

 

1. Wi-Fi LAN Network

With Orange, you have a full Firewalla Router + Wi-Fi Access Point, all in one device. This allows you to connect devices to your Orange easily via Wi-Fi, and all connected devices will be managed and secured by Firewalla. 

This is ideal for:

• Stationary setups, such as smaller homes, apartments, or offices
• Mobile/Travel setups, such as hotel stays, or public Wi-Fi

 

To connect your devices to Firewalla's local network using Wi-Fi:

1. From your box's main screen, tap Wi-Fi → Create Wi-Fi.
   • Alternatively, you can also tap Network → Create Network → Wi-Fi Local Network.
2. Enter a Wi-Fi Name (SSID) and password.
3. Select an existing network.  
4. Tap Create. 

 

Note: Orange also supports Firewalla Access Point 7. See the AP7 installation guide for details.

Orange’s built-in Wi-Fi cannot run at the same time as AP7. After installing AP7 with Orange, if you want to switch back to Orange’s built-in Wi-Fi, reset the AP Controller first: Wi-Fi → Wi-Fi Settings → Reset AP Controller. 

 

1.1. Additional Wi-Fi Features

Firewalla Orange allows you to create up to 10 separate SSIDs, each customizable for different needs, devices, or networks. For example, create separate SSIDs for kids, IoT devices, or guests.

 

Assign SSIDs to Networks or Users/Groups

Tap on any SSID listed on the Wi-Fi page, then tap Edit in the top right corner. For each SSID, you can configure the following settings:

• Network: When joining the Wi-Fi, the devices will be connected to the network. 
• User/Group (optional): When joining the Wi-Fi, devices will be automatically assigned to a User or Group.

For example, set the IoT Wi-Fi to use the IoT VLAN, or set the Guest Wi-Fi to assign devices to the Guest Group. You can then apply custom rules and features to each network or group, like VqLAN and Device Isolation. Learn more about VqLAN.

• For a full tutorial on microsegmenting and segmenting your network, please see Firewalla Tutorial: Microsegmentation and Segmentation. 
• Note: Orange does not support Personal Keys, or PPSK. If you want to use additional microsegments, check out Firewalla AP7.

 

Set Wi-Fi Security and Frequency Bands

You can also adjust more advanced settings from the Wi-Fi detail edit page, such as:

• Security Settings: Choose from:
  • Personal: WPA/WPA2, WPA2, WPA2/WPA3, or WPA3
  • Enterprise: WPA2, WPA2/WPA3, or WPA3. Learn more about Enterprise Wi-Fi.
• Frequency Band: Select from 2.4 GHz and/or 5 GHz. (For 6 GHz, check out Firewalla AP7.)

Tap on any SSID on the Wi-Fi page, then tap Edit in the top right corner to adjust the Advanced Settings.

 

Generate QR Codes for Wi-Fi

On any Firewalla Wi-Fi, create a QR code to allow others to connect without entering a password. 

On any Wi-Fi detail page using Personal Security (non-Enterprise), tap QR Code. Tap Share to export and send the QR code as an image. 

 

1.2. Wi-Fi Connection Details

With Orange Wi-Fi LAN, network visibility is extended to your LAN, giving you full visibility on how devices communicate within your local network.

 

Sort Devices By Signal Strength 

Firewalla displays all the devices connected to your network in its Device List. To make it easier to find which devices are connected to Wi-Fi and understand their connection strength, you can sort the list by Signal Strength. 

1. Tap Devices on the box main screen.
2. Tap the View Options in the top right corner.
3. Tap sort devices by Signal Strength.

 

Device Wi-Fi Information

Any device connected to Firewalla Wi-Fi will display more detailed Wi-Fi information as well. 

Tap on a device from the Device List, and scroll down. You'll see valuable Wi-Fi information, including:

• Connected Wi-Fi Name (SSID)
• Channel
• Signal Strength (as received by Firewalla Orange)
• Wi-Fi Security
• Wi-Fi Standard
• MIMO (Multiple Input, Multiple Output)
• Rx/Tx Rate (Receive/Transmit Rate).

 

1.3 Advanced Wi-Fi Settings

If you're an advanced networker and looking to improve Wi-Fi performance, Orange offers more options to customize your Wi-Fi.

 

Manually Select Wi-Fi Channels

By default, the Channel Selection method is Automatic and should function well in most cases. If this doesn't work for you, you can change the selection method to Manual. Channel selection is available for both the 2.4 GHz and 5 GHz bands.

To change channels, navigate to your Orange Detail Page (from your box's main screen, tap Wi-Fi > Access Points > select Orange). Then, under 2.4 GHz or 5 GHz, tap Channel.

 

5 GHz DFS Channels

When the 5 GHz band is set to Automatic channels, Firewalla Orange will include DFS channels to optimize network performance. This increases the number of channels for your devices to connect to, but they're also shared with radar systems (e.g., airport or military radar).

If you have devices that don't support DFS (e.g., Roku TV) or live near an airport/military base and experience interference, you can disable DFS on the Wi-Fi Settings page.

From your box's main screen > tap Wi-Fi > Wi-Fi Settings (top right corner) > toggle the 5 GHz DFS Channels button.

 

2. WAN / WISP Connection

With Orange, you can configure a network WAN connection with Wi-Fi. This is ideal for:

• Connecting to a hotel or business Wi-Fi.
• Using your phone as a backup Internet connection at home.
• Connecting to a Wi-Fi-enabled LTE modem.

This allows you to connect your Orange via Wi-Fi to any Wi-Fi and then share that connection securely with all your devices. Orange Wi-Fi WAN supports the most commonly used Wi-Fi security protocols: 

• Open networks
• WEP
• WPA/WPA2/WPA3 Personal
• WPA/WPA2/WPA3 Enterprise

 

Configure a WAN / WISP Connection

Orange allows a maximum of one Wi-Fi WAN and one Ethernet WAN for a total of two WAN connections. This Multi-WAN feature supports both load balancing and failover modes. 

Currently, Orange does not support initial setup with a Wi-Fi WAN. If you'd like to use Wi-Fi as your only WAN connection, set it up with an Ethernet cable first, then add a Wi-Fi WAN connection or switch the WAN Network to Wi-Fi.

Notes:

• WAN connections via Wi-Fi are only supported in Router mode. If you are using Bridge mode, only Wi-Fi LAN is supported. 
• When Wi-Fi WAN is connected, the channel used by Orange's Wi-Fi LAN must follow the channel used on WAN, if they are on the same band. If you've manually set the channel on Orange, the settings may not take effect. 

 

Follow the steps below to connect Orange to the Internet by joining a Wi-Fi network:

1. From the box's main screen, tap Network > Create Network
2. Tap WAN Connection via Wi-Fi. Firewalla will start to scan for available Wi-Fi networks nearby.
3. Select a Wi-Fi network and enter the Wi-Fi password if required, then tap Join.
4. If you are trying to join a hidden network, tap Other… at the bottom of the list, enter the Wi-Fi name and password, then tap Join.
5. Tap Save to apply the network configuration.

Note: When Wi-Fi WAN is connected, the channel used by Orange's Wi-Fi LAN must follow the channel used on WAN, if they are on the same band. If you've set the channel on your Orange manually, the settings may not take effect. 

 

Editing a Wi-Fi WAN Connection

To convert a WAN connection from Ethernet to Wi-Fi:

1. Go to Network Manager, tap the WAN connection > Edit.
2. Tap the Wi-Fi icon, then select a Wi-Fi network (or choose Other and enter the SSID manually).
3. Enter the password if required.
4. Tap Save to apply the network configuration.

 

To change the Wi-Fi used for your configured WAN:

1. Tap Edit > tap the Wi-Fi Name > pick the Wi-Fi you'd like to join > Save.

 

Previously joined Wi-Fi SSIDs will be saved for this WAN connection as My Networks. Firewalla will auto-join these networks if they are nearby.

• You can tap the "i" icon to edit the Wi-Fi network, or tap Forget This Network to remove it.
• 2.4 GHz Only: If you are connecting the Firewalla box to a Wi-Fi network with mixed channels (2.4 GHz & 5 GHz), you can toggle 2.4 GHz Only. This will lock the Wi-Fi network to 2.4 GHz-only to increase the stability of Wi-Fi WAN connections. Please don't enable this feature unless your Wi-Fi SSID supports 2.4 GHz, or it may fail to connect.

 

3. Mobile Mode

You can use both Wi-Fi connections at the same time. Use the WAN/WISP Network to connect to the Internet and Orange's Wi-Fi Network (LAN) to connect multiple devices and maintain policies, VPN connections, and more across all your devices.

In this configuration, you do not need any Ethernet connections.

 

Configure Mobile Mode

When you travel with Firewalla Orange, follow the steps below to set up a Wi-Fi to Wi-Fi connection:

 

Before you go:

1. It's best to pair the Orange with the Firewalla app before traveling. 
2. Make sure your Orange is running in Router mode. Other modes don't support WAN Wi-Fi.

 

When you arrive:

1. Plug the power cable into Firewalla Orange to power it on.
2. Open the Firewalla app and tap Firewalla Orange. Wait for the app to discover the device.
3. After the Orange finishes booting, the app will show you a banner "Set up a Wireless Connection." Tap Get Started to follow the guide.
4. Tap any Wi-Fi network you'd like to join. It can be the public Wi-Fi at Starbucks or the Wi-Fi provided by a hotel. Enter the password if required.
5. After connecting the Firewalla box to the Internet, the app will guide you to create a Wi-Fi network for your devices to connect to the Firewalla box.

Note: If the public Wi-Fi you joined requires captive portal authentication, Firewalla will require you to join Firewalla's local network first, then guide you through the authentication process. 

If Firewalla fails to detect the captive portal login, please follow these instructions to connect manually: What to do if the ISP requires captive login/authentication via web?