Firewalla App version 1.68 is available to all users.

This is a 7-day phased release. All apps will be updated to 1.68 by 3/30.

Some features may require Box 1.982, which is available for:

All Orange, Gold Pro, Gold SE, Gold, Gold Plus boxes

Beta Required

Purple, Purple SE Beta boxes.

To join Box Beta:

Go to your box > tap Settings > Advanced > Beta Program > Join Beta Program

New Features
Enhancements
Bug Fixes
Known Issues

New Features

1. Device Active Protect - Strict Mode, Automatic Isolation, Restart Learning, and more

Device Active Protect just got even smarter. In this app release, we now support:

DAP Modes - Default/Strict
Automatic Device Isolation with Firewalla AP7
Restart Learning on eligible DAP devices
More general DAP enhancements

DAP is available on all Firewalla Gold Series units. Learn more about Device Active Protect.

Device Active Protect Mode - Default/Strict

You can now select a mode for Device Active Protect:

Default: More permissive. Devices may switch between learning and optimizing phases. In this mode, DAP may allow more sites over time.
Strict: More restrictive. Devices may enter the active phase after optimizing. In this mode, DAP will not allow most sites and should have a full understanding of your device's behavior.

After enabling Strict Mode, it may take a few days for DAP to move devices into the active phase.

Device Active Protect is still in beta. We will be adding more eligible devices in the future. The best way to help DAP learn about the device is to use its features during the learning and optimization phase. (For example, play Apple Music in the Sonos app or Chromecast from your phone, which will help the device get into the active phase faster.)

Automatic Device Isolation with AP7 and DAP

If you have Firewalla AP7, DAP may determine that the eligible device connected via Wi-Fi does not need local communication and automatically apply Device Isolation, blocking any local LAN traffic.

If you need to allow specific local connections, use Allowed Devices to bypass Device Isolation.

Restart Learning for DAP Devices

For any eligible device in the optimizing or active phase, send eligible devices back to the learning phase by tapping Restart Learning on its DAP Detail Page.

DAP will remove all allowed/blocked targets for that device and send it back to the learning phase (a less restrictive mode, where no blocks are applied).

This restart will help Firewalla learn more about its behaviors.

General Device Active Protect Enhancements

We've made a few additional updates to improve your Device Active Protect experience:

The Pause Device Active Protect button has been renamed to Turn Off Device Active Protect. Devices with DAP turned off are now marked as Disabled.
- Turning off DAP on a device will stop its learning process and pause any rules/features applied by DAP.
- When DAP is turned back on, it restores the targets learned in the previous phase and continues with the learning phase (a less restrictive mode, where no blocks are applied).
On the Protect Page, a new "Last DAP Action" field now appears under the Device Active Protect section, showing the most recent time DAP allowed or blocked a target on eligible devices.

2. New App UI Design - Navigation Bar, User Avatars

Introducing a new design layout for the Firewalla App! On your Firewalla's Main Screen, you'll now find:

Navigation Bar to navigate the app quickly
User Avatars to help find users quickly

Navigation Bar - Home, Devices, and Alarms Tabs

We moved the most commonly used Devices and Alarms buttons to a new Navigation Bar at the bottom. Similarly, a Home button is added to help easily move back to the main screen.

Tap on each button on the Navigation Bar to quickly navigate. To go back to the Firewalla Box Selection Screen, tap the "Boxes" icon in the top left corner of the main screen.

The Rules button has been added to the Feature buttons on the home screen, with a new, updated look.

User Avatars (Box Version >= 1.982)

You can now set custom User Avatars for each Firewalla User.

Select an image from your photo library as an Avatar for each User, to make it easier to distinguish between users at a glance.

User Avatars will appear wherever you can view or assign Users, including shortcuts on the main screen, Devices List, and more.
User Avatars are never uploaded to the cloud. They are always stored locally to your Firewalla.

This feature is only supported on box version >= 1.982.

3. Time Limit App Groups

You can now create a Time Limit Rule matching multiple apps.

Instead of setting separate time limits for each app individually, select multiple apps in a single rule.
Any activity time on a specified app will count toward the total time of the Time Limit rule.
On a Time Limit Rule, tap Select apps > Specified Apps > Select all the apps you'd like to include.

Learn more about User Activity Time Limits.

4. Internet Activity Tracking & Time Limits (Box Version >= 1.982)

In this release, we now support:

Internet Activity Tracking
Internet Time Limits

Please note that Internet time tracking is estimated. Due to factors like background traffic, reported usage time may vary by up to ~20% from actual activity. If you encounter any large discrepancies, please send us an email at help@firewalla.com.

This feature is only supported on box version >= 1.982.

Internet Activity Tracking

On any Firewalla User, you'll be able to track total time spent on the Internet, just like you would on other App Activity Tracking.

Tap Internet on a User's Activity to see more details on their daily and weekly Internet usage.

Internet Time Limits

Along with measuring Internet Activity, you'll also be able to set Internet Time Limits. (Remember, depending on the device and usage pattern, the actual usage may vary by ~ 20%.)

On a new or existing Time Limit rule, tap Select apps > Choose Internet.

5. Disturb - Time Limits, More Targets, Control Buttons

In App 1.66, we introduced Disturb - a new way to gently disrupt User activity by simulating a bad network for specific traffic. In this release, we now support:

Time Limit Disturb
More Disturb Targets: Target Lists, IP Addresses, and Domains
Disturb via Control Buttons

Learn more about Disturb.

Time Limit Disturb

We now support Disturb after a Time Limit Rule has been reached, in addition to blocking.

On a Time Limit Rule, use the Advanced Section to choose whether to Block or Disturb traffic after the limit is reached.

Please note that Time Limit Disturb is only available for Internet or single apps that support Disturb.

See the full list of Disturb apps here.
We currently do not support Disturb for Time Limit Rules matching multiple apps.

Learn more about Time Limit rules.

More Disturb Targets

We now support Disturb for Target List, IP Address, or Domain. Similar to Internet Disturb Rules, we only support Custom Disturbance Settings when using these targets.

Note that some Target Lists can only be used in blocking rules and cannot be used with Disturb.

Disturb via Control Buttons

We now support Disturb actions via Control Buttons.

Control Buttons are ways to quickly block or unblock targets, such as the Internet or specific apps, directly from a Main Screen Shortcut or Device Detail Page.

For all Disturb-supported targets (e.g., Internet, Netflix, Roblox, TikTok, YouTube), tap the Control Button and select Disturb.

Disturb via Control Buttons will use the default Annoying or Custom settings (depending on the target).
To adjust the Disturbance Level, please go to Rules and manually edit the Disturb rule.

6. AmneziaWG VPN Server (Box Version >= 1.982)

AmneziaWG is now available as a protocol in Firewalla VPN Server. AmneziaWG is a WireGuard-based protocol but obfuscates its traffic to evade most VPN-blocking policies. (References: AmneziaWG)

Compared to WireGuard, AmneziaWG may use a bit more network bandwidth and be a bit slower due to obfuscation.
AmneziaWG is likely to perform better when used in places where WireGuard is blocked.

Notes:

This feature is only supported on box version >= 1.982.
Editing the AmneziaWG VPN Network and MTU will be supported in future updates.

Learn more about how to configure AmneziaWG VPN Server here.

Enhancements

1. Rules - Rule Names, Hit Times on Rule List, Matched Rule on Flows

In App 1.68, we've made several enhancements to make Rule Management more seamless. You can now:

Set custom Rule Names
See Rule Hit Times directly from the Rules List
View Matching Rules from a Flow Detail Page

Rule Names

Set custom Rule Names to quickly identify different rules.

Rule Names are optional and will display as the top line on any Rule Shortcut or in the Rules List. Rule Names can also be searched from the Global Search or Rules Search. Rules without custom names will continue displaying as they did before.

Note: Rule Names may not appear in MSP 2.9. This will be improved in a future Firewalla MSP update.

Learn more about Managing Rules.

View Rule Hit Times from Rules List

Each Rule has a Hit Count and a Last Hit Time. To help make it easier for you to find your most active (or inactive) rules, we've made the Last Hit Time visible from the Rules List.

Matched Rules on Flow Detail Pages

In this release, matching Rules and Features are now shown directly on the Flow Detail Page, making it easier to understand and troubleshoot what blocked or allowed a flow.

On a Flow Detail Page, any Rule or Feature that matches the flow will be displayed in a new Rule Matched or Feature Matched section. Tap on it to jump directly to its Rule Detail or Feature page.

2. Devices - Device Summary, Device Notes

With this release, we've improved Device Management to make it easier to understand what's happening on your network at a glance. You'll now be able to:

View a Device Summary directly from the Devices Page
Add custom Notes for devices

Device Summary

At the top of your Devices Page, a Device Summary will show the total number of local devices, online devices, and offline devices.

If you have AP7 or Orange, you'll also see how many devices are connected via Wi-Fi.
VPN devices, such as WireGuard devices, are not included in the local device count.
This feature is supported in both Router Mode and Bridge Mode. If Firewalla is in Bridge mode, devices connected to its upstream router are not counted as local devices.

Device Notes

On each Device Detail Page, add Notes to keep track of specific details about an individual device.

3. General Enhancements

Control Buttons now support a Turn Off option. Previously, rules created using Always Block could not be easily disabled from the Control Buttons. This enhancement resolves that limitation and also applies to Always Disturb rules created via Control Buttons.
Improved the authentication experience when using a captive portal on public or hotel networks with Firewalla Purple and Orange.
With Box version 1.982, OpenVPN Server and Client now support IPv6.

4. UI Enhancements

Notification Badge on the Navigation Bar
Presets for Custom Disturb Rules
Time Limit Action Icons - Block or Disturb
New Icons for VqLAN and Device Isolation Controls
Display Wi-Fi Security from Devices List
Show Total Clients Connected to Each AP7

Notification Badge on the Navigation Bar

If a new device joins your network, or you receive a new alarm, you'll now see a notification badge on the Devices and Alarms tabs of the Navigation Bar. Tap on the Devices or Alarms tab to dismiss the notification badge.

Presets for Custom Disturb Rules

Disturb rules applied to the Internet, Target Lists, Domains, or IP Addresses only support Custom Disturbance Levels. To make it easier to apply Disturb rules quickly, we now support two Preset settings: Annoying and Super Annoying.

Tap Annoying or Super Annoying in the Custom Disturbance Settings to automatically populate with some default settings. You may adjust each setting as needed.

Time Limit Action Icons - Block or Disturb

As Time Limit Disturb rules are now supported, we enhanced our Time Limit rules to display a Block or Disturb icon when the Time Limit rule is reached.

New Icons for VqLAN and Device Isolation Controls

With Firewalla Wi-Fi (via Firewalla AP7 or Firewalla Orange), if you've enabled VqLAN or Device Isolation on a Device, Group, or User, you'll now see a new VqLAN and Device Isolation icon from the Devices List.

If both VqLAN and Device Isolation are applied to the same Group/User, only the Device Isolation icon will display from the Devices List.
If you're using Device Active Protect (DAP) with the Firewalla AP7, and DAP automatically applies Device Isolation, you'll also see the Device Isolation icon from the Protected Devices List.

Learn more about Device Control Icons here.

Display Wi-Fi Security from Devices List

For devices connected to Firewalla Wi-Fi, the Devices List will now display the Wi-Fi Security type.

To view Wi-Fi Security type, sort the Devices List by Signal Strength by tapping the View Options in the top right corner.

Show Total Clients Connected to Each AP7

As requested by the community, we now display the total client count for each AP7, along with the number of clients connected to each frequency band.

From your Firewalla's main screen, tap Wi-Fi > Access Points to view your AP7 topology and client count.

Bug Fixes

Fixed a bug where Firewalla Purple and other boxes with Wi-Fi SD may fail to connect to WPA2/WPA3 Personal Wi-Fi networks.
Fixed a bug where adding an IPsec VPN profile to a VPN group may cause the VPN connection to fail.
Fixed an issue where migrating data from one Box to another may cause DAP to stop working.
Fixed an issue where a Disturb rule may disappear from the UI while still remaining active.
Fixed an issue where the app may incorrectly parse comments in a VPN profile as configuration.
Other minor display improvements and bug fixes.

Known Issues

Issue: On boxes running version 1.982 with a multi-WAN setup, if one WAN uses DHCP with a /32 subnet mask, traffic may be routed through the other WAN even when this WAN is shown as Active.
How to Fix: Please contact Firewalla Support for assistance. This issue will be fixed in the next box update.
Issue: When updating a Time Limit rule that matches multiple apps to another rule with a different target, the rule may fail to update and continue matching the previously set apps.
Workaround: To update a Time Limit rule that matches multiple apps, delete the existing rule and create a new one for the intended target.
How to Fix: It will be fixed in the next app update.
Issue: After upgrading to box version 1.982, users on WPA2 or WPA3 Enterprise Wi-Fi may occasionally be unable to sign in with their username and password. (rarely happens)
How to Fix: It will be fixed in the next box update.
Workaround: Go to Services -> Radius Server, turn it off, then turn it back on.
Issue: Time Limit rules that match Internet are only supported on box version 1.982. If these rules are created on 1.982 and the box is later downgraded to 1.981, they won’t be removed automatically and may continue blocking internet access with reduced accuracy.
How to Fix: After downgrading to 1.981, delete all Time Limit rules that match Internet.
Issue: New user avatars are not migrated when transferring box data.
How to Fix: Re-upload the avatars after migrating data to the new box.
Issue: Rule Diagnostics may show Time Limit rules as matched even when the limit has not been reached.
How to Fix: This will be resolved in the next box update.
Issue: On iOS, when changing the port on the AmneziaWG VPN Server, the warning message may incorrectly state that WireGuard VPN connections will be lost.
How to Fix: This is a display issue that will be fixed in the next iOS app update. Changing the AmneziaWG port only affects AmneziaWG VPN connections and does not affect the WireGuard VPN Server.

Articles in this section

Firewalla App Release 1.68: Smarter Device Protect, New App Design, Time Limit App Groups, AmneziaWG and more

New Features

1. Device Active Protect - Strict Mode, Automatic Isolation, Restart Learning, and more

Device Active Protect Mode - Default/Strict