Firewalla App Release 1.69.3: AmneziaWG VPN Client, Local Device Rules, Switch Enhancements, and more

Firewalla App version 1.69.3 is available to all iOS Early Access users. 

Please follow the links below to sign up for the Firewalla iOS app beta program:

• iOS: https://testflight.apple.com/join/Nr0IMETY

Then, to get the early access version of the app, please send an email to help@firewalla.com with the following subject line:
 

subject: [iOS] early access [iTunes ID]

1. New Features
   1. AmneziaWG VPN Client Support
   2. Local Device-to-Device Rules
   3. Improved Topology Details for Firewalla Boxes & AP7s
   4. VPN Device Isolation
   5. Firewalla Switch Enhancements: Device Isolation, Reset Port Stats, ACL Overflows
   6. DFS Radar Detection Events for Firewalla AP7
   7. WAN ISP Profiles for High Latency Detection Tuning
2. Enhancements
3. Bug Fixes

Bridge mode support for Firewalla Switch (Requires Early Access Box) 

• Installing and managing the Firewalla Switch.
• VqLAN, Device Isolation, and Allowed Devices with Firewalla Access Point 7 or Firewalla Switch.

How to upgrade your Firewalla box to early access version:

• Firewalla app and go to Settings -> Advanced -> Beta Program.

Learn more about how to join Box Early Access program.

New Features

1. AmneziaWG VPN Client Support

AmneziaWG is now available as a VPN protocol in VPN Client. Use AmneziaWG for Site-to-Site, Remote Access, and 3rd-party VPN connections.

• AmneziaWG VPN client is compatible with both AmneziaWG 1.0 and 2.0. 
• Same as the AmneziaWG VPN Server, the client does not support I1-I5 parameters. If your server has the parameters set, please remove them on the server side before importing the profile. 

2. Local Device-to-Device Rules

At the community's request, we now support selecting Devices as a target in Rules. When creating an Allow or Block rule, tap Matching > Device to select a device, group, or user as the target. 

Note:

• Must have a Firewalla Access Point 7 or Firewalla Switch paired to the Firewalla Box.
• All local device rules are bidirectional. 
• Devices within a group/user cannot be selected individually.
• Group-to-group/user rules are currently not supported.
• If devices are not directly connected to the Firewalla Box, AP7, or Switch (traffic does not pass through Firewalla), then device-to-device rules may not work as expected.

3. Improved Topology Details for Firewalla Boxes & AP7s

Similar to Firewalla Switch's detail view, you can now view better port details and topology for your Firewalla Boxes and Firewalla Access Points. From your Firewalla's main screen, tap Network > Topology. Tap into your Firewalla Box to see port speeds and connected devices. Tap each Firewalla port to see more details.

Similarly, tap into your Firewalla Access Points to see more details on each band and port.

4. VPN Device Isolation

Device Isolation is now supported on VPN devices (even if you don't have a Firewalla AP7 or Switch). 

When a device is connected to your network via WireGuard or AmneziaWG VPN, you can enable Device Isolation to block it from communicating with any other devices.

5. Firewalla Switch Enhancements: Device Isolation, Reset Port Stats, ACL Overflows

We've added a few more enhancements for the Firewalla Switch:

• Device Isolation and Allowed Devices are now supported with devices wired directly to the Firewalla Switch.
• Switch Port Stats can now be reset at any time. On the Switch Port Detail page, tap "Reset Stats".
• Added warnings for ACL Overflow to help ensure usage stays below limits.

6. DFS Radar Detection Events for Firewalla AP7(Upcoming)

Upcoming feature

With the Firewalla AP7, if DFS radar is detected, the AP7 will switch its 5 GHz channel automatically. In this release, the app will now generate Network Events for DFS detection, so you'll always know when this change occurs.

7. WAN ISP Profiles for High Latency Detection Tuning

We've added a new ISP Profile for WAN Connection settings. On your Firewalla's main screen, tap Network > tap your WAN Connection > Edit > ISP Profile. Choose the profile that best fits your ISP connection, or leave it as Default.

This can help tune High Latency Detected Events, so that they're more accurate and trigger fewer false positives. 

Enhancements

• Clear Device/Alarm Filter:
  • Devices: Added a clear indication when the devices list is filtered by local, online, or offline status. Tap "Clear" to reset and show all devices. 
  • Alarms: Added an "All" option at the front of the alarm type filter. Tap it to clear any active alarm type filters.
• WAN Disconnected Events: The WAN Disconnected event now shows diagnostic results, so you can see whether the issue was caused by a port disconnection or a DNS/ping test failure.

Bug Fixes

• Fixed an issue where the active WAN port was not properly highlighted on the topology page.

• Fixed an issue where VPN clients created by an MSP could not be deleted after the box was removed from the MSP or the MSP subscription was canceled.