Firewalla vs FingBox

Comments

26 comments

  • Avatar
    Will

    Do you by chance which DNS service FingBox uses for filtering?  Either way, I would expect to not see any conflicts on your network with both running at the same time.  You would have to of course make sure either of them could connect to the internet and what not.  

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    I just jumped in the deepwater to find out what's happening ;-). And I'm able to make this posting so all works fine (so far).

    As far as I know is FingBox using NO DNS-service because there is no filtering available. You can disconnect devices from the internet (by default all new devices are disconnected) but it hasn't the same futures as Firewalla! As I understood it uses the same technique as Firewalla to reroute the packets to know the device and to cut them off from the internet. So I understand the initial question: twice the same way of fooling your router can make a mess of your network I guess...
    But so far so good for me!

    I didn't try to block devices from my fingbox yet, first I have to be sure everything stays stable!

    0
    Comment actions Permalink
  • Avatar
    GM

    @Will, I think it is not possible for the two to coexist in the same network, because they use the same ARP SPOOFING technique to block devices and monitor the network.

    0
    Comment actions Permalink
  • Avatar
    GM

    @Didier, So? Do you have the two devices connected to the same network?

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    @GM yes, Both are running on the same network, same vlan, ... And all works fine for now.

    FingBox still is blazing fast in detecting new devices and firewalla still is giving me all the info in network flows so I think we can say both are doing their jobs at the same moment without interrupting each other. I don't understand how it is possible either so I really do need to do some reading about ARP... :-/

    0
    Comment actions Permalink
  • Avatar
    GM

    Fantastic @Didier !!! As soon as I have time I do the test too. At the moment what I have noticed is that Firewalla makes my network go much slower, something that did not happen with FingBox. There are times when the network has lags or errors in the loads of websites or online games.

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    I'm not the expert here :-) but I would suggest you to solve the problem before adding another layer of possible problems :-D. I don't see any speed reduction in my network when using firewalla but I don't play games so I can't test that part...

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    Allright, 14 hours later and my network is still stable, Fingbox is still super-fast in detecting new devices so this one works 100%, Firewalla also works like a charm in reporting visited websites and so on.

    So far so good.

    Strange enough it seems like the Fingbox is fooling Firewalla... I perform 4 speedtests a day (ping, upload and download) and the only thing Firewalla is noticing is the 3MB upload (or something like that). It doesn't see any download for example.

    TEST 1: blocking and pauze on Fingbox

    I am performing this test as we speak: I just pauzed the internet on my webradio with my Fingbox (not with my Firewalla). Funny thing: first it was really pauzed (buffer of my radio went empty) and after a second or so the music was restarting... I think Firewalla is the big chief on the network and Fingbox is no longer able to pauze internet for a device.

    Then I "unpauzed" internet for the webradio and tried to block the device, again: on the Fingbox, not on Firewalla. That was a more of a succes! The music stopped and didn't restart. My laptop was still working fine. So, blocking on Fingbox while using Firewalla works fine!

    To complete the test I deblocked the device and I had to restart my webradio to have my music back (but I blame my radio for that).

    TEST 2: blocking on Firewalla

    Blocking internet for the device works like a charm.

    Unblocking works also like a charm: the device starts playing the moment I unblock it in my Firewalla.

     

    So, we are sure now: Firewalla and Fingbox are working together as friends :-). Except for the "pauze internet" by Fingbox, that button can't be trusted anymore.

    Oh, it also works fine with PiHole, just so you know :-).

    I hope Firewalla is reading with us... this can be interesting info for them I think.

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    Some new info. One hour ago FingBox did some strange things: it gave me a Network Security Alert: Network gateway changed to (MAC-address from my router). When I "allowed" it, it keeps coming back. But all functionality is still running OK

    EDIT: not true!
    and the warning is not returning if I don't allow the change (so I'm not spammed with warnings).
    /EDIT: not true!

    So there is no problem in using the setup but maybe I should point FingBox to this forum so they can help thinking with us?

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    Thanks, @didier on this nice write-up.  Will link it to some of our pages.  Fings is a very good box to scan for devices.   As of the last comment, Fing is absolutely doing the right thing,   It is detecting the router's MAC address has changed.  Which is true, firewalla will act as the man in the middle.

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    You're welcome!

    I hope Fingbox has a solution for it because even after I click "allowed" it keeps repeating every 1 or 2 hours, so not really handy...

    EDIT:

    12 hours later and no more warnings from FingBox... It's really strange behaviour... I would think FingBox would keep noticing the "MitM-attack" by Firewalla? I contacted them by twitter and as soon as I have more information I will post it here.

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    YES! I've got an official answer from FingBox on the issue and it's great news!

    Fing‏ @fingapp

    Thanks for reporting. This is a known issue with gateways and we're working on a fix to be released ASAP. Please stay tuned for an app update with this fix implemented. Sorry for the inconvenience. Once it's fixed they will work smoothly together.

    This means we can combine both (as tested above) but we have a few "security alerts" a day that can't be fixed by ourselves.
    They are fixing this problem and afterwards all will even work better :-). But so far no reason for me NOT to combine them in the same network.

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    Nice!  Kudo's to the Fing team.   Great to see all the security companies working togethrr

    0
    Comment actions Permalink
  • Avatar
    Gareth Husk

    Nice article - my freshly minted, ice cold (it is Canada), firewalla blue just arrived and I was debating whether to pull the fingbox.

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    Tnx! After 9 days in use I still don't see any problems. Except for the security alerts (something like 10 times a day I guess) but we'll have to wait for the fix FingBox is making right now. And "Pauze internet" on the FingBox can't be trusted, "block internet" on both FingBox and Firewalla are working flawless.

    And that's my final conclusion ;-)

    0
    Comment actions Permalink
  • Avatar
    GM

    Finally yesterday I put some order in my connection of FingBox and Firewalla. The two were connected to a switch that was connected to another switch that went to the router. This was surely what caused problems of slowness. Now there are the two connected directly to the router, and the whole set works perfectly. Although, yes, I have changed the network cables of origin and I have put some Ethernet category 7 to ensure good speed and reliability. I hope that Firewalla is complemented with new control and blocking options. In fact, I'm thinking of buying another for my office. :)

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    UPDATE!

    Fing has released a new software-version and all seems fine now!

    From now on Firewalla, Fingbox and PiHole are working together as best friends :-D.

    0
    Comment actions Permalink
  • Avatar
    Gareth Husk

    I have 8.1.5 (Fing app) and have 7 up/down message pairs for my ASUS Router so far today - every 30-40 minutes or does this require a reboot of the Fingbox itself?

    0
    Comment actions Permalink
  • Avatar
    Dave Wengrovitz

    Just a warning to other Firewalla users who may have a Fingbox ... I installed a Firewalla blue device about a month ago, and have been getting tons of alerts from my Fingbox about Network Gateway changes (probably 10-30 per day) ever since.  The alerts imply that you can "manage" to turn them off, but I've yet to get that to work. I reported the problem to Fingbox support shortly after encountering it, but there's been no progress that I can see in providing a fix yet. 

    0
    Comment actions Permalink
  • Avatar
    Firewalla

     

    have you tried do not monitor fing in firewalla?  (devices->[find fing]->scroll down and disable monitoring

    0
    Comment actions Permalink
  • Avatar
    Gareth Husk

    @Firewalla - that's not the issue. These are alerts by the Fing box about changes it is detecting since installing the Firewalla  as previously described  the Fingbox alerts, pretty much on an hourly basis while the house internet is being used that the *router* they are plugged it is In-range and then On-line.  All of which I assume is to do with Firewalla spoofing the router.

    There were rumours that this was to be addressed but obviously not - while they do similar things there are differences in the functionality that means I don't want to drop one of them.

    0
    Comment actions Permalink
  • Avatar
    Dave Wengrovitz

    Thanks @Gareth ... you beat me to it.  This doesn't appear to be an issue with Firewalla monitoring the Fingbox.  It's the other way around. 

    As far as I can tell, Fingbox is issuing frequent alerts when it detects the network gateway changing between the normal router and Firewalla. Detecting this seems reasonable, but there should be a way for Fingbox to be told to trust Firewalla as a gateway and stop issuing alerts. I had read that this may have been addressed in the past, but it doesn't appear to be the case at present.

    0
    Comment actions Permalink
  • Avatar
    Didier Salembier

    I have the same experience:

    All worked fine for a long time until a few weeks ago… Today I had 5 alerts within the hour! There is no fun in it anymore :-/ and it seems like the fix is not comming back soon...

    0
    Comment actions Permalink
  • Avatar
    Christian Byrnes

    I did a formal bug report to Fing. Here is their reply:

    As we have investigated and found out that Firewalla and Fingbox can work side by side. Some of the features like Internet pause/ block might not work if Firewalla is installed. You can try to put Firewalla in passive mode and then connect Fingbox with router actively. This network set up should be able to maintain the network and stop the alerts.

    I am not sure how to understand that. It might just be connection sequence?

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    I think what Fing need just simple ignore "this type" of alarm.   Like how firewalla can selectively mute certain types of notifications.  

    The reason for pause and block function not working together is, fing and firewalla Simple mode both use spoofing to grab packets.  Fing is passive, meaning, it only spoof when you tell it to pause a device. 

    0
    Comment actions Permalink
  • Avatar
    Firewalla

    From a customer to solve the alarm problem.

    "

    I bounced the problem off of the Fing Community and received feedback that led me to take the following steps to remedy the alerts and messages about router address conflict:

     

    In the Firewalla App, I selected Devices, selected the Fing box identified as IEEE Registration Authority, scrolled to the bottom of the screen and turned monitoring OFF.  In the Fing App, when an alert occurs for Firewalla, on the Fing App Network tab, tap the alert message and select Trusted to set the device as Trusted. Next select the Device list tab , scroll down and select Firewalla, under notifications, turn off "Alert me when state changes".  Having done this, I have not received any further Messages/Alerts about the above mentioned problems.

    "

    0
    Comment actions Permalink

Please sign in to leave a comment.

Powered by Zendesk