Managing children’s internet access can be more challenging due to ever-evolving technology trends and outdated flat networks that may no longer fit today’s devices.

How can we make managing kids easier and more sustainable?

Our approach is to build an end-to-end solution with a Firewalla Zero Trust Network. 

• Enforcing per-device identity-based rules
• Preventing lateral movements (kids bypassing controls via other devices)
• Enabling microsegmentation (separating kids, parents, IoT, etc.)

While Firewalla offers many tools to protect kids, starting with a clean network makes long-term management simpler and more effective.

• Physical Design
• The Basic Idea: Segment Kids + Yourself + the Rest
  1. Create a User for Each Child
  2. Create Firewalla Wi-Fi and Assign Users
  3. Monitor Your Children’s Access
  4. Apply Firewalla Parental Controls to Each Child
  5. Physical Security
• Final Thoughts

Physical Design

If you plan to manage kids' access as they grow from age 5 to 18, it’s best to rethink your physical network to manage access from the top down. 

For moderately sized homes with high-speed internet, we recommend a setup that includes:

• A Firewalla Gold Series unit (Gold SE, Gold/Gold Plus, or Gold Pro) 
• One or more Firewalla Access Points

If your network is on the smaller side with moderate Internet speeds, you can achieve the same Zero Trust architecture using the Firewalla Purple series:

With a complete Firewalla physical network, you gain full control over:

1. Wi-Fi devices and local network traffic
2. All traffic going to and from the Internet

The Basic Idea: Segment Kids + Yourself + the Rest

To make management simple, we’ll use microsegmentation and keep everything on a single physical network. We’ll assume that all devices are connected via Wi-Fi to Firewalla AP7.

If you need help migrating your old network to a new one, check out Remodeling Your Big, Old Flat Network with Firewalla.

In this guide, we’ll walk through simple steps to manage your kids:

1. Create a User for Each Child
2. Create Firewalla Wi-Fi and Assign Users
3. Monitor Your Children’s Access
4. Apply Firewalla Parental Controls to Each Child
5. Physical Security

1. Create a User for Each Child

First, create a User for each person in your household. 

2. Create Firewalla Wi-Fi and Assign Users

After setting up your Users, create your Firewalla Wi-Fi so everyone can connect. 

Firewalla Wi-Fi can automatically assign devices to Users. This ensures that the parental controls you set are always applied correctly, even if a child gets a new device or tries to conceal their device's identity. 

While you can assign devices manually, automatic assignment with Firewalla Wi-Fi is the easiest and most reliable method.

We’ll manage our kids as follows:

1. Use WPA3 Enterprise Wi-Fi for personal devices and the best security.
2. Use Personal Keys for other devices that don’t support WPA3 Enterprise.

Instead of (2) you can also use multiple Wi-Fi SSIDs instead. Learn more about using multiple SSIDs here.

2.1. Use WPA3 Enterprise Wi-Fi for personal devices

WPA3-Enterprise offers the most secure method to ensure no devices can get around your policies. This requires each child to have their own Username and Password when connecting to Wi-Fi.

Most (or all) personal devices (smartphones, laptops, tablets, etc.) support WPA3-Enterprise.

1. First, create a new Wi-Fi SSID and password for your Enterprise Wi-Fi.
   
   
    
2. Change the Wi-Fi Security Type to WPA3 Enterprise.
   
   
    
3. Then, navigate to each User and set up a Username and Password so they can connect to Wi-Fi.
   
   

Finally, give each child their Username and Password to use when connecting to Wi-Fi. Every time they use their credentials, devices are automatically assigned to their Firewalla User.

Learn more about WPA Enterprise Wi-Fi.

2.2. Use Personal Keys for other devices

If your child has some devices that don’t support WPA3-Enterprise, use Personal Keys. Similar to WPA3-Enterprise, this allows you to use a single SSID and assign multiple groups using unique keys. 

1. Create a new Wi-Fi SSID for kids' devices.
2. Add an additional microsegment to the SSID, and set a unique Personal Key.
3. Assign the key to your child’s Firewalla User.

You’ll want to have one additional microsegment per child.

Then, to connect to Wi-Fi, give each child their unique personal key. They’ll use this as the Wi-Fi password. 

Every time a device connects using a specific Personal Key, it’ll be automatically assigned to its configured Firewalla User. 

Note that Personal Keys require Firewalla AP7. Learn more about microsegmenting with personal keys.

3. Monitor Your Children’s Access

Once you know your kids’ devices can be properly identified and grouped, we recommend monitoring your children’s access before applying any policies.

This can help you get an idea of what your kids typically access daily. Firewalla offers a wide range of visibility features to ensure you always know what your kids are doing online. 

1. Check daily and weekly User Activity
2. Review Alarms for odd activity
3. Add Users to the Main Screen for easier control and access

3.1. Check daily and weekly User Activity

Find out how your kids are spending time on the network with our User Activity Tracking. Firewalla can summarize the activity for the day or the week, so you can have a better idea of your kids' daily usage.

3.2. Review Alarms for odd activity

Firewalla will automatically send you Alarms if it detects certain activities, such as playing a game, watching videos, or accessing adult content. You can block or allow the activity directly from the Alarm.

3.3. Add Users to the Main Screen for easier control and access

Add your kids’ Users to the main screen of the App using Main Screen Shortcuts. 

This makes it easier to navigate to their User Detail Page, and you can quickly block/allow access to the internet, certain categories, or apps with a control button.

4. Apply Firewalla Parental Controls to Each Child

After monitoring your children’s online access, apply policies to fine-tune their Internet usage.

1. Quickly filter inappropriate content with Family Features
2. Set a Time Limit for apps
3. Gently disrupt addictive app usage with Disturb
4. Set schedules to block the Internet at night

4.1. Quickly filter inappropriate content with Family Features

Apply Firewalla Family features with the simple tap of a button. We recommend leaving all blocks enabled.

• Family Protect – Block inappropriate content automatically.
• Safe Search – Filter out inappropriate content in search engines, and automatically use kid-friendly versions of certain sites (e.g., YouTube Restricted Mode) 

4.2. Set a Time Limit for apps

Set a one-hour Time Limit to regulate your kids’ usage of YouTube (or other supported apps), and specify certain days of the week. This can help you set a healthy screentime limit for your children without completely restricting them.

4.3. Gently disrupt addictive app usage with Disturb

Prevent Internet addiction in your kids by creating a Disturb rule for Roblox (or other apps you find are addictive). Disturb will gently make the experience less enjoyable and encourage your kids to stop using it on their own.

4.4. Set schedules to block the Internet at night

Create a new Firewalla Rule to Block Traffic to the Internet on your kids' devices. Set the Schedule to be active Every Day after 9 PM, so that your kids go to sleep at reasonable times.

5. Physical Security

Once everything is configured, you’re now ready to relax and let Firewalla do its job. But before you do, make sure your kids can’t gain access to Firewalla and adjust their own policies.

1. Physically secure your Firewalla from kids
2. Protect your Firewalla App with Kid Lock
3. Lock down other networks in case kids gain access
4. Create a Parents Network with no restrictions

5.1. Physically secure your Firewalla from kids

Keep your Firewalla in a secure place, so your kids can’t physically access it. 

If you cannot “lock” the unit physically, you should peel off the license sticker. This will prevent your kids from gaining access by pairing with your Firewalla.

5.2. Protect your Firewalla App with Kid Lock

In case your kids gain access to your phone, prevent them from accessing the Firewalla App by enabling Kid Lock.

5.3. Lock down other networks in case kids gain access

With a new remodeled network, you may have kept the old SSID and password for your default network, allowing devices to reconnect easily. Your kids may already know this SSID and password, and try to use this network to bypass your restrictions.

Lock down your other networks to prevent them from gaining access. Block all gaming, videos, and social media, and make sure the Family Protect and Safe Search features are enabled. This can help deter them from trying to join another network.

5.4. Create a Parents Network with no restrictions

Create a separate network for parents (yourself) with a new Wi-Fi SSID and password. Keep your password a secret, so that your kids can’t bypass their policies by joining your network.

Final Thoughts

With a Firewalla Network, kid management becomes simple—no more rogue devices on your network, and no more kids accessing things they shouldn’t be. With Firewalla Parental Controls, you have full flexibility and control over when and how your kids use the internet, keeping your network safe and your mind at ease.

Learn more about Firewalla Parental Controls:

• Activity and Parental Control
• Firewalla Feature: Users
• Disturb
• Manage Rules

Learn more about Firewalla Wi-Fi & Microsegmentation:

• Firewalla Tutorial: Microsegmentation and Segmentation with AP7
• VqLAN: Firewalla Microsegmentation