You’re probably aware of all the computers and phones connected to your home network, but what about the other devices? Smart garage doors, light bulbs, refrigerators...the list goes on. Most of these smart home devices aren't properly secured—their makers focus on function, not security. Once you install Firewalla Purple on your network, though, you’ll know exactly what devices are connected, what they’re doing, and whether they have any security exposure. Beyond simple monitoring, Firewalla can act as your personal VPN server and provide VPN client functionality on a per-device basis. For making this cutting-edge technology understandable and usable for ordinary consumers, Firewalla earns our Editors' Choice award.
Firewalla’s One-Time Pricing
This review focuses on Firewalla Purple, which costs $319. That might sound like a lot, but it’s a one-time fee, not a yearly subscription like you’d have with a software-based security product. The biggest difference between this device and Firewalla Blue Plus is that the latter doesn't have any Wi-Fi or router capabilities. If you don’t plan to use those features, Blue Plus is a bargain at $189. Due to chip shortages, the company is not currently producing the lower-end Firewalla Blue ($169) or the Firewalla Red ($139), which I reviewed previously. And the top-of-the-line Firewalla Gold ($498) differs from Purple in areas like more ports and faster processing, but not so much in features.
At this point I would normally bring up the price of comparable products, but competing products just haven’t stayed the course. Users of the Norton Core secure router used to pay $279.99 for the device and, after the first year, $9.90 per month for the associated security software. However, Norton discontinued sales of the device at the tail end of 2019 and ended all support in January 2022.
It's Surprisingly Easy to Be More Secure Online
You’d pay $249 per year for Bitdefender Box 2, plus $99 per year after the first year. However, Bitdefender stopped making the Box in 2021 due to “post-pandemic market conditions.” If you already have one, you can keep using it, but you can’t get a new one. Bitdefender’s technology is available as Netgear Armor in certain Netgear Nighthawk and Orbi routers, but that’s not quite the same thing.
Like Bitdefender Box, F-Secure Sense is no longer being made. Even if you’re ready to plunk down $199.99 for the device, you just can’t.
Unlike these erstwhile competitors, Firewalla doesn’t require a monthly fee, because it doesn’t attempt to replace your security suite. The company recommends using it in conjunction with security software, and my hands-on testing agrees. This does mean you're free to choose the suite or antivirus that suits you best, rather than being locked into the one that matches your hardware.
Firewalla Dimensions and Specifications
The original Firewalla Red was crazy small, at 1.2 by 1.8 by 1.8 inches (HWD). Firewalla Purple, reviewed here, is a little bigger, 1.2 by 3.5 by 2.4 inches (HWD), but it’s still tiny compared to other network devices. For a little perspective, I calculated the volume of Firewalla and of several top-rated wireless routers. If Firewalla were liquid and the Asus ZenWiFi ET8 were hollow, you could pour more than 20 Firewallas into the router. The same is true of Asus ROG Rapture GT-AC5300. As for the extra-husky TP-Link Archer AX11000, it would hold more than 90 Firewallas. The device’s size is not surprising, given that the prototype started life running on a Raspberry Pi.
Inside the Firewalla box, you find a 64bit Six-Core ARM 1.6ghz - 2ghz processor running Linux, with 2GB of RAM and 16GB of storage. It has two Ethernet ports, one for LAN and one for WAN connection. You’ll also find a USB-C port for power, a USB 2.0 port, and a slot for a micro-SD card.
The USB 2.0 port exists “for future expansion” and isn’t supported at present. As for the micro-SD card slot, Firewalla’s documentation suggests you could use that slot to customize the device with docker containers. Docker containers? Yeah, that slot’s not for the average consumer. The one reason you might use the card slot is if you encountered a need to re-flash the device’s firmware.
You can’t see it, but the box also contains a limited-range Wi-Fi radio. Given the absence of any antennas, you won’t be surprised to learn that it’s not meant to replace a full-scale Wi-Fi hotspot. Per the documentation, Firewalla’s Wi-Fi capability is “meant for a fairly small number of users in a smallish space.” It proved very useful in my testing.
The Blue Plus, Blue, and Red editions have no Wi-Fi or LAN/WAN capabilities, and are progressively less powerful in many ways. For example, Purple’s processing speed is 1Gb, Red’s is 100Mb, and the two Blue boxes come in at 500Mb. Each device has a slightly less powerful CPU than the next-bigger one. Purple and Blue Plus both boast 2GB of RAM, while Blue has 1GB and Red just 500MB. You can find a detailed Firewalla comparison chart on the company’s website.
Firewalla Connection Modes
Before you even open the box, you should consider just how you will integrate Firewalla with your network. There are so many possibilities it could make your head spin. The very simplest mode—and the mode that's recommended where possible—is to connect the Firewalla in between the modem that brings in your internet connection and the router that distributes that connection to your devices. In this mode, Firewalla takes over as your main router, with no compatibility worries.
There are many other possibilities, of course. You may have a single box that serves as both router and modem, or a mesh network with numerous hotspots, or a gateway that provides internet, phone, and TV service. Firewalla provides a detailed configuration guide to walk you through dozens of possible scenarios, with specific instructions for popular devices.
It’s also possible to install Firewalla as just another device on the network, though you lose access to some features this way. It can either take over DHCP management (DHCP mode) from your router or use a technique called ARP spoofing (Simple mode). You don’t need Firewalla Purple to use these modes—the Blue or Red devices can handle them. There’s hardly any setup, but not all routers are compatible. When I tried Simple mode, the ARP spoofing mode, on my home network it caused serious problems. Ominously, ARP spoofing is also called ARP poisoning.
Getting Started With Firewalla
In the box, you'll find the Firewalla device along with an Ethernet cable and a USB-C cable for power. There's no manual or startup guide, just a small instruction card with a URL pointing to installation instructions. Following the clear and detailed instructions, I downloaded the Firewalla app onto the iPad I use for testing and registered my email. I should point out that, as with other network security boxes, you must control Firewalla through an iOS or Android phone or tablet; PCs and Macs need not apply.
The next step is to power on the device and wait for the app to find it. A message warned that it might take five minutes, but the connection happened in less than a minute. Scanning a QR code on the bottom of the device completed the pairing. At this point, I tried setting up the device in Simple mode, just to see. As noted, it wasn’t compatible with my router. Continuing, I chose the recommended Router mode and plugged a subset of my network into the device.
I didn’t immediately see a way to enable Firewalla’s Wi-Fi mode, so I checked the website’s extensive set of articles and answers. It turned out to be a simple matter of tapping the Network icon, choosing to add a new network, and defining the desired SSID and password. This let me connect several other test devices through Firewalla. Since they were all on my desk, near the device, I didn’t have any worries about them being too far for a connection.
Devices and Notifications
At the outset, I got numerous notifications, as Firewalla detected devices connected to the network for the first time. Each new notification comes with the device's name and manufacturer, if supplied, as well as the IP and MAC addresses. If you see something that clearly doesn't belong, you can block its access with a single tap. And if you hear a scream of lost-connection anguish from elsewhere in your household (meaning you blocked the wrong device) you can restore access just as easily.
Getting notifications that new devices have joined is just the start. By default, Firewalla alerts you when anything it's monitoring starts using gaming, video, or porn sites or encounters a dangerous website. It also alerts on what it calls "abnormal uploads," and when someone connects to the VPN server (more about VPN below). You can fine-tune this system for each monitored category, telling Firewalla to give you a pop-up notification, an in-app alarm, both (the default), or neither. If you see that your kid is playing games instead of doing research for a term paper, you can tap the notification to cut off gaming on that device for an hour, or until you turn it back on.
Some hardware devices report an easily recognized name or manufacturer. Others may show up as something unintelligible, like a string of hex digits or a bare-bones IP address. With a little sleuthing, you may be able to match the reported IP address or MAC address to a specific piece of hardware. Once you’re sure, just rename the device so it's easy to find in Firewalla's list.
For example, suppose one device comes up with a name you don’t recognize at all. Tapping for details, you could get a graph of its recent activity. More usefully, tapping the Network Flows link lets you see just where it connected. If all named URLs in the list are subdomains of ring.com, you could deduce that this entry represents your Ring Video Doorbell Pro. This is exactly what happened during my previous review (I’ve since stopped using the Ring device).
Network Performance Features
Just by setting up Firewalla and responding to its notifications, you’ve gotten a head start on using its vast array of features, but there’s much more to this device than notifications. The wealth of features can be a bit daunting to a newcomer, so Firewalla sends an email every few days pointing out a particular feature and how you use it.
As noted, you interact with the device through an iOS app or Android app for your phone or tablet. The app packs a lot of features, so the bigger screen of a tablet is welcome. I used an iPad for testing.
The app, locked in portrait mode, displays features in a series of horizontal stripes. At the top you’ll see any alerts that need your attention, such as the appearance of a quarantined device (more about quarantine below). The next band graphs recent network performance and internet speed. As with almost all elements in this app’s interface, you can tap it to drill in for more detail.
On the Network Performance page, you see the same graph expanded plus a list of recent network events. You can tap for a quick test of your internet speed. Firewalla retains such test results and graphs them over time. There’s also an Internet Quality test that reports latency and checks for packet loss.
Firewalla’s built-in Wi-Fi has a limited range. You can use the Wi-Fi Speed Test to check the connection and find the best place for controlling your Firewalla device. I found I got over 500 Mbps sitting right next to the device, around 300 in the next room, and barely over 100 when I went to the farthest room in the house.
On the next stripe, you see “Flows in the last 24hrs,” “Blocked,” and a pie chart showing the percentage of blocked flows. But what are flows? Referring again to the website, I learned that a flow is a connection from a source IP address and port to a destination address and port. I also learned that you should simply ignore this section unless you are actively having problems.
You can dig in for a list of all flows or filter to just see blocked flows. You can open any individual item for a page of vastly more detail than you want about that item. You can also tap on the detail screen for an explanation of why it’s blocked. Given that my test system has more than 6,000 blocked flows in the first 24 hours, and that everything’s working fine, I chose to ignore the blocked flows.
A bigger stripe below the summary of flows graphs network activity. You can swipe it left or right to show activity for 30 days, 24 hours, or 60 minutes. In the 24 hours view you can tap the graph to see flows for a specific one-hour period. So, for example, if you see a surprising spike in the graph, you can get a view of what was going on at that time.
Device and Group Features
As noted, you get an alert any time a new device connects to your network. You also get an alert when any device starts consuming video, displaying porn, or gaming online. Right from the alert you can block access to the site or domain involved, or block, for example, all video activity.
Below the various network graphs, you’ll find a simple stripe with stats like “10 Devices, 74 Alarms, 7 Rules.” Tap the Devices label to get a list, then tap the device you want to configure. As with many messaging apps, a green dot indicates devices that are currently online.
On the device’s page you’ll see some of the network performance stats and graphs, but limited to this one device’s activities. Below that is a stripe with eight icons: Internet, Gaming, Social, Video, Porn, Safe Search, VPN, and a three-dot “more” indicator. With a tap on Gaming, Social, Video, or Porn, you can block access for an hour. Tap again to make the block permanent, and once more to remove the block. Tapping the Internet icon cuts all connection to the internet.
Tapping that three-dot “more” icon expands the list to include Family, Ad Block, and DNS over HTTPS (DoH). DoH is a system for encrypting the DNS requests that translate human-friendly domain names to machine-friendly IP addresses. It eliminates the possibility that a snoop could track your online activity by scraping your DNS requests. Ad Block works by blocking access to advertisers at the DNS level, not by analyzing web pages, and Family refers to a kind of simple parental control that I’ll discuss later.
There’s also an option to block connection by specific mobile apps: Discord, Facebook, Instagram, Netflix, Roblox, and Snapchat. TikTok and YouTube are also listed, with a “beta” overlay.
Scrolling on down you come to a collection of details about the device, IP Address, MAC Address, and Manufacturer among them. A Status item lets you know whether the device is online, and tapping it lets you configure alerts for when it comes online or goes offline. The former can be handy to let you know when family members have returned to the fold. The latter can provide a warning if the NAS unit you use for backup (or something equally important) goes down.
If you make serious use of Firewalla’s ability to block certain kinds of online activity, you may find configuring it for every device to be tiresome. No worries. Just put devices with similar configuration needs in a Group and edit the Group’s configuration.
Features, Enabled and Disabled
Network and device monitoring is the most visible function of Firewalla, but it has many other tricks. The very last stripe, the one at the bottom of the app’s main screen, offers access to a varied collection of features. Out of the box, you’ll see: Network, Routes, Smart Queue, Data Usage, VPN Server, Ad Block, Family, Open Ports, Monitoring, VPN Client, DNS over HTTPS, and More.
Not all these features are enabled, and not every feature appears in that final stripe. Tapping More gets you a list of features separated into Enabled and Disabled; tapping any feature lets you enable or disable it. By default, Active Protect, DDNS, Device Port Scan, Network, Open Ports, and Routes are enabled. In the Disabled list you find Ad Block, DNS over HTTPS, Data Usage, Family, New Device Quarantine, Smart Queue, VPN Client, and VPN Server.
That’s a lot of features, but some are simple, and some are beyond the skills of most consumers. I’ve mentioned Ad Block and DoH—you must enable those here before you can use them on specific devices or groups. New Device Quarantine tells Firewalla to quarantine devices not seen before on the network, leaving you to let them in (or not). And tapping Network lets you enable Firewalla’s short-range Wi-Fi system, among other things. As for Monitoring, don’t turn that off or you’ll lose all the features I’ve described above.
Tapping Open Ports causes Firewalla to check for any ports exposes to the outside world. If it flags a problem, get a network-expert friend to look over your setup. Device Port Scan, on the other hand, is all about connections within the network, and only of interest to a network expert. Likewise, unless you’re trained, you won’t use DDNS, Routes or Smart Queue.
Does your internet provider limit you to a set amount of data each month? I hope not. But if you’re in that unenviable position, you can configure Firewalla to track usage and warn if you’re close to running out. Just enter the cap and the reset date.
That leaves Active Protect, Family, and the VPN Client and Server features. Those need a deeper look.
Active Protect
According to the simple settings page, Active Protect causes Firewalla to automatically block “high risk network activities” when enabled, as it is by default. You can leave it in its Default detection mode or crank it up to Strict, which checks in with the cloud more often and generates more alerts.
This is a multi-faceted feature. I didn’t realize it, but I already saw it in action, flagging an “Abnormal Upload” from my VMWare Host PC to the NAS that backs up my virtual machines. A 350GB upload across the network is normal for me, but unusual enough to get flagged. Active Protect also blocks download of known malware and also blocks network attacks such as HeartBleed by detecting their behavior.
Firewalla blocks egregiously bad sites automatically but notifies you and asks what to do about others. That makes sense. I wouldn’t have wanted it to block that backup that I mentioned. Note that any such notification occurs on the device where you’ve loaded the Firewalla app, not on the device making the dangerous connection.
To test this feature, I started with a list of the newest malware-hosting web pages discovered by London-based lab MRG-Effitas. Setting the test iPad right next to my test virtual machine, I went down the list launching each item in turn. Having the iPad and its notifications at hand made it easy for me to distinguish errors due to inactive URLs from errors caused by Firewalla suppressing the site. When I accumulated enough data to run the numbers, I found that Firewalla blocked 33% of the verified dangerous URLs completely and detected another 9% by recognizing malware files.
I did find that Firewalla doesn’t prevent the download of malicious files. It’s up to you to peruse the warning and (usually) delete the file. The warning does come with a Block button, but clicking it simply blocks future access to the site. Hackers sometimes sneak malware into otherwise valid sites, so use that ability with care. In one case, I would have blocked future access to the Internet Archive had I wildly clicked the Block button.
Tapping Alerts on the main screen to review alerts from Active Protect, you get an unusual display. When Firewalla makes the blocking optional, it also displays a map with the geolocation of the URL in question. China, Russia, and the US all showed up multiple times.
If Firewalla were a local antivirus I would expect it to block access to as many dangerous pages as it could and then rip through any malware that made it as far as download. McAfee, Norton 360 Deluxe, Sophos, and ZoneAlarm all fended off 100% of their samples in this test. Firewalla’s 42% looks poor by comparison. However, Firewalla is meant to supplement your antivirus or security suite, not replace it. Every dangerous site that Firewalla walls out is one that your system will never encounter. And unlike a typical security suite, it blocks those connections for every device on your network.
Family Protection
I mentioned earlier that you can turn on Family protection for any device or group of devices, provided that you’ve enabled the feature overall. I’ve also mentioned that Firewalla has the built-in ability to block porn. What’s the difference?
When you tap to enable the Family feature, you’ll fine it has three parts, Family Protect, Safe Search, and Social Hour. Turning on Safe Search redirects traffic for popular search sites (Google, YouTube, Bing, and DuckDuckGo) so it goes through the site’s own Safe Search system. There’s no filtering by Firewalla. Social Hour simply blocks access to social media on everyone’s devices for an hour. The theory is that without Facebook, Instagram, and the like, family members will have to socialize with each other.
That leaves Family Protect, which is the feature most like traditional parental control. When you turn it on, you can apply it to all devices or to individual devices and groups.
If you’ve used a modern, dedicated parental control system, you may be disappointed. All Family Protect does is run internet requests from the device through the Family Shield servers managed by OpenDNS. Or rather, by Cisco, parent of OpenDNS. This is a simple, non-configurable filtering system, not the customizable OpenDNS Home or OpenDNS Home VIP.
In testing, I couldn’t find any raunchy websites that got past the filter. With the simple Porn filter built into Firewalla itself, trying to reach a blocked site just gets an error message, as if the site were unavailable. Family Protect replaces the naughty page with a warning that Cisco Umbrella blocked the site, along with the category that triggered the block. There’s no mention of Firewalla.
One more thing. More and more porn sites are going secure, using HTTPS to connect. If you try to visit one of those, you’ll get an error message about a certificate problem. That’s logical, given that the filtering happens at the DNS level, but it could be confusing.
Make Firewalla Your VPN Client
When you subscribe to a typical VPN service, you get two things: a VPN client to install on your devices, and access to a world-wide network of VPN servers. Firewalla offers a VPN Client feature, but you have to arrange access to a VPN server network separately.
VPN Client isn’t a local app, but rather a service running on the Firewalla box. Firewalla supports the up-and-coming Wireguard VPN protocol as well as the well-regarded OpenVPN protocol. You can use it to give a remote worker access to the office network or set up a mutual connection between two offices. Both those scenarios require two Firewallas, one in each location, and both are rather business-centric. More interestingly, you can use the client to connect to a third-party VPN service.
A network-savvy user could theoretically make Firewalla’s VPN Client work with any VPN service that supports Wireguard, OpenVPN, or (beta) AnyConnect. For those of us who don’t eat VPN for breakfast, there are specific instructions for connecting to ExpressVPN, IPVanish, NordVPN, ProtonVPN, PureVPN, and Surfshark.
For testing purposes, I used a ProtonVPN account and simply followed the instructions. These included making use of a special username and password obtained through my ProtonVPN login, completely different from the ProtonVPN account password, and downloading a profile with the necessary settings. But it wasn’t in any way difficult.
Using the VPN Client on Firewalla is like configuring your ordinary router to connect through a VPN, but easier. For most routers, the VPN connection necessarily affects every device on the network. That means it protects devices that can't have a local VPN client installed, which is great, but it can be a problem if you ever need a non-VPN connection. With Firewalla you’re in charge of which devices connect through the VPN. You can easily run your computers and tablets through the VPN while exempting your smart TV and gaming consoles.
By default, a Kill Switch feature cuts off the VPN-connected devices from the internet if the VPN connection fails. Also by default, it forces DNS over VPN, which secures your DNS traffic. That’s it for features.
The biggest feature you don’t get with the Firewalla VPN Client is the easy selection of services that comes when you use a third-party VPN company’s own client. The same is usually true when you install VPN protection on a router. In general, the profile you download connects you to one specific server. Some services, ProtonVPN among them, offer profiles that choose a random server within a specified country. But there’s no handy list of possibilities like you get with a local app VPN client.
Note, too, that to use a company’s server network you typically have to pay, whether or not you use the company’s VPN client. Yes, there are free VPNs, but they often come with limitations. For example, when I tried a free ProtonVPN account I found that the only profiles available were for specific servers in Japan, the Netherlands, and the US. On the positive side, if your VPN service puts a limit on the number of simultaneous device connections, well, Firewalla counts as just one device.
Some advanced users actively need the ability to pick from a wide range of servers. If you just want VPN protection for the security, not for spoofing your location, then going through Firewalla’s VPN Client can be rewarding.
Log Into Firewalla as Your VPN Server
The time when a VPN is most needed is when you’re out and about connecting to sketchy networks. Even if the owner of the café you’re haunting has set up gadgetry to trap every bit of network traffic, using a VPN means you won’t be exposed. And if you’re in a distant land, connecting through a VPN back home can be a lifesaver. Well, good news. You have a VPN Server right in the Firewalla, and there’s no monthly fee.
Setting up the server required working through yet another set of detailed instructions. Not difficult, but detailed. Your first step is to enable VPN Server on Firewalla and choose Wireguard (preferred) or OpenVPN. Depending on your configuration, you may also need to set up port forwarding on your regular router. There’s no guesswork about that; the indicator for port forwarding either shows Complete or Need Manual Setup. The app includes instructions for configuring your router, and in some cases Firewalla can reach out and make the changes using UPnP (Universal Plug and Play). I had to poke around for a while to find the setting; Comcast seemed intent on burying it. But I managed.
The next step is to install the free Wireguard app on your device—Wireguard has clients for all popular platforms. You also need to create a client profile for each device (up to 12) on Firewalla. You can connect a mobile device by scanning a QR code displayed in the profile or export a configuration file for import on another device.
You’ll be pleased to know that once you connect that profile, you’re done. Turn the connection on within Wireguard and you’re connecting through Firewalla. Wherever you may be in the world, websites see your connections as coming from your home IP address. Firewalla’s Active Protect filters out dangerous sites, and the device monitors your network activity just as if you were at home.
Note that this does not mean your device can access other devices on the home network. For that kind of access, you need a Firewalla device at both ends. My technical contact at the company says he always travels with one, for just this purpose. I doubt many consumers do.
To test this feature, I enlisted the help of my colleague Max Eddy, on the opposite coast. He imported the profile I sent and immediately connected through my distant Firewalla. With that connection active, Max ran his standard speed tests. The results weren’t great, just as I expected. Even connecting to the industrial servers owned by a VPN company we see an impact on connection speed. Going through not one but two residential internet connections, well, it’s not a setup designed for speed.
Max found that download speed decreased by 78.3% and upload speed by 4.6%, both of which are better than I expected. Latency, that measure of how fast the server responds to a request, increased by well over 600%. To be fair, Max pointed out that some commercial VPN servers have shown an even higher impact on latency.
Firewalla’s documentation notes that there’s no guarantee on what speed you’ll achieve, but that’s not the point. The point is that by using VPN Server you keep your mobile devices protected by Firewalla, just as if they were on the local network. That’s truly impressive.
High-Tech Network Protection
Once you add a Firewalla to your network, you can use the mobile app to monitor and manage all network devices, as well as their connections and other actions. You get notified when a new one connects, or when an existing one starts using video, gaming, or porn domains, with the option to block any of those types temporarily or permanently. Firewalla keeps you from visiting dangerous sites, and includes a very simple form of parental control. You can use its VPN Client to connect some or all of your devices to a commercial VPN network, or configure its VPN Server to let your own devices reach back to your home network from wherever you may be. It’s a technical marvel.
Firewalla is surprisingly easy to use. Some of its features are only needed by experts, true, but the extensive documentation gives any moderately tech-savvy user all the instructions needed to perform tasks such as connecting to a third-party VPN server or setting up a home VPN connection. Best of all, it's a one-time purchase, with no annual fee. Firewalla's many virtues make it an Editors' Choice winner.
Firewalla Purple lets you see and manage all your network devices and their actions. There's lots for techies to love, including a VPN client and server, but even the average user can reap most of its benefits.
Like What You're Reading?
Sign up for SecurityWatch newsletter for our top privacy and security stories delivered right to your inbox.
This newsletter may contain advertising, deals, or affiliate links. Subscribing to a newsletter indicates your consent to our Terms of Use and Privacy Policy. You may unsubscribe from the newsletters at any time.
Thanks for signing up!
Your subscription has been confirmed. Keep an eye on your inbox!
Sign up for other newsletters
