Emergency Access (on a divide) bypasses “Traffic to All Local Networks” (on a network) rule

Follow

Till

• August 30, 2026 18:20

Device: Firewalla Gold (1.983)

On a Firewalla-managed Untrusted VLAN, a network-level rule blocks Traffic to All Local Networks and is applied always. 

A test device is connected through a switch access port whose native VLAN is the Firewalla Untrusted VLAN. The target is in a separate Firewalla-managed VLAN with a different private subnet. 

Expected behavior: According to Firewalla’s documentation, “Outbound Local Traffic Blocking Rules” are Not Paused when Emergency Access is enabled. A new TCP connection from the Untrusted-VLAN device to the target VLAN should remain blocked. 

Actual behavior: With Emergency Access disabled, the cross-VLAN TCP connection is blocked. With Emergency Access enabled for the device, a new TCP connection to a controlled HTTP listener on TARGET-IP:9876 succeeds.

This makes Emergency Access bypass the documented local-VLAN isolation rule.

Please confirm whether this is a bug or whether there is an undocumented condition that causes an “All Local Networks” rule not to apply.

0

• 

  FirewallaSupportDesk

  • August 31, 2026 00:11

  Emergency access should not effect local network block rules. I'll open a ticket for you, so you can share more details with us to take a look.

  0

  Comment actions Permalink
• 

  Support Team

  • August 31, 2026 03:49

  Thanks for flagging this. Pausing local traffic blocking rules, VqLAN, and Device Isolation when Emergency Access is enabled was an enhancement introduced in 1.983. With Emergency Access on, no local blocking rules are enforced; this lets you temporarily bypass local rules to debug connection issues.

  The documentation is outdated, we'll get it updated soon.

  0

  Comment actions Permalink
• 

  Till

  • September 01, 2026 19:20

  Is it possible to exclude a device from monitoring while still enforcing all applicable network blocking rules for that device? 

  0

  Comment actions Permalink
• 

  Firewalla CM

  • September 01, 2026 19:29

  Unfortunately, disabling Monitoring means Firewalla will not check traffic or block any connections.

  Do you mind sharing your use case for this scenario? Is this for flow privacy of a certain device, or something else? 

  0

  Comment actions Permalink
• 

  Till

  • September 01, 2026 19:42

  Hi,  
  the goal is essentially unmonitored internet access, while retaining isolation from the local network.  
     
  The device should be able to access the Internet without Firewalla applying monitoring, Active Protect, ad blocking, or other traffic-inspection/filtering features.  
  However, it must still be prevented from accessing other devices and networks on my local LAN.
  
  

  0

  Comment actions Permalink

Please sign in to leave a comment.