Emergency Access (on a divide) bypasses “Traffic to All Local Networks” (on a network) rule

Follow

Till

• August 30, 2026 18:20

Device: Firewalla Gold (1.983)

On a Firewalla-managed Untrusted VLAN, a network-level rule blocks Traffic to All Local Networks and is applied always. 

A test device is connected through a switch access port whose native VLAN is the Firewalla Untrusted VLAN. The target is in a separate Firewalla-managed VLAN with a different private subnet. 

Expected behavior: According to Firewalla’s documentation, “Outbound Local Traffic Blocking Rules” are Not Paused when Emergency Access is enabled. A new TCP connection from the Untrusted-VLAN device to the target VLAN should remain blocked. 

Actual behavior: With Emergency Access disabled, the cross-VLAN TCP connection is blocked. With Emergency Access enabled for the device, a new TCP connection to a controlled HTTP listener on TARGET-IP:9876 succeeds.

This makes Emergency Access bypass the documented local-VLAN isolation rule.

Please confirm whether this is a bug or whether there is an undocumented condition that causes an “All Local Networks” rule not to apply.

0

• 

  FirewallaSupportDesk

  • August 31, 2026 00:11

  Emergency access should not effect local network block rules. I'll open a ticket for you, so you can share more details with us to take a look.

  0

  Comment actions Permalink
• 

  Support Team

  • August 31, 2026 03:49

  Thanks for flagging this. Pausing local traffic blocking rules, VqLAN, and Device Isolation when Emergency Access is enabled was an enhancement introduced in 1.983. With Emergency Access on, no local blocking rules are enforced; this lets you temporarily bypass local rules to debug connection issues.

  The documentation is outdated, we'll get it updated soon.

  0

  Comment actions Permalink

Please sign in to leave a comment.