Need a firewall for your 10 Gbps small business or home network? The Firewalla Gold Pro gets my vote

Thanks to the iOS and Android smartphone apps, setting up the Firewalla Gold Pro is straightforward. The setup and configuration procedure uses Bluetooth, which is provided if Ethernet connectivity is disrupted or the device needs to be managed or reconfigured out of band.

When the app prompts you during initial setup, scan the QR code on the bottom of the device to pair it with the app. If you’re an existing Firewalla user, you can “clone” your current configuration, preserving all settings, including rules, device groupings, segmentation, and ISP configurations. In my case, selecting “Replace Device” made the process seamless.

New users must choose between “Router Mode” and “Transparent Bridge Mode”:

• Router Mode: Firewalla functions as the primary router, managing all network traffic with full functionality.

• Transparent Bridge Mode: Firewalla is placed within your existing network without altering the IP address scheme. 

I recommend Router Mode because Transparent Bridge Mode disables key Layer 3 (IP layer) services like VPN Client, Policy-Based Routing, Smart Queue, Site-to-Site VPN, and Device Monitoring. If you opt for Router Mode, the setup may vary slightly depending on your ISP. Firewalla provides detailed documentation for various ISPs.

For example, as an AT&T Fiber user, I needed to configure my gateway for IP Passthrough, allowing Firewalla to manage the network. This involved logging into the gateway, navigating to the Firewall menu, selecting “IP Passthrough,” choosing “DHCPS-fixed,” and selecting the Firewalla device from a dropdown list. Once configured, all traffic is routed through Firewalla, bypassing the gateway’s router functions.

Also: Firewalla launches Purple: Its must-have network security device

One limitation is that Firewalla cannot monitor the built-in Wi-Fi of a residential gateway. Even in IP Passthrough mode, devices connected directly to the gateway’s Wi-Fi bypass Firewalla’s protection. To avoid this, dedicate a Wi-Fi access point behind Firewalla for all wireless connections. For smaller households or offices, a consumer-grade Wi-Fi router or mesh node in “bridge” mode (not NAT) also works well — I previously used a three-node Eero Pro 6 mesh setup with Firewalla Gold, which worked flawlessly.

The key is to avoid a double-NAT scenario. Firewalla should handle primary NAT, create your IP scope and segments, and act as your DHCP server.

Firewalla Gold’s Pro’s performance

<!–>

Once configured in Router Mode or Transparent Bridge Mode, the Firewalla Gold Pro intercepts all traffic at the deep packet inspection level. Thanks to its powerful Intel 12th-generation processor and 8GB of RAM, this process occurs without any performance loss. In our tests on a 2 Gbps AT&T Fiber service, the fastest available to us, we successfully pushed the broadband connection to its 2 Gbps limit. Internal tests achieved Ethernet link speeds of 10 Gbps, with data transferring at that rate.

Significantly, we pushed WireGuard connections beyond 1 Gbps to a metropolitan-connected Linux host in a test cloud region, limited only by the target system’s broadband capacity.

The smartphone app provides a detailed view of historical WAN and WiFi performance and live throughput for every device on the network. The system also runs periodic tests to verify whether your provider delivers the advertised speeds.

Network protection overview

<!–>

I’ve found that Firewalla’s security intelligence system, both on the device and in the cloud, is incredibly robust. The company tracks over 129 million security objects, including IP/domain histories and other critical data, and enables the device to effectively safeguard your network, constantly adapting to new threats as they emerge.

When it comes to protection, Firewalla’s approach is comprehensive. All data packets are meticulously filtered through multiple layers, including Block Lists, Ad Block Lists, and Static and Dynamic Block Lists, alongside IDS/IPS (Intrusion Detection/Prevention) and the Behavior Module. This multi-layered strategy gives you a continuous sense of security, knowing that known and emerging threats are being addressed.

One feature I particularly appreciate is the pre-configured Target Lists that come with each Firewalla device, like OISD and Log4j attackers, which automatically block malicious websites and IPs. Additionally, the ability to create custom target lists means I can tailor the protection to fit my specific needs, making the experience even more personalized.

Also: Firewalla hands-on: Easy to set up with plenty of features to help protect your home network

Firewalla also makes it easy to manage devices on the network. It automatically detects all devices and groups them by function (e.g., “Computers,” “IoT”), which simplifies applying rules across multiple devices. This is especially handy for devices with MAC randomization, like iPhones using private Wi-Fi addresses. Disabling this feature has improved visibility and made it easier to apply rules.

The IDS/IPS system is another critical layer of defense in my network. It detects and blocks unauthorized access attempts, like SSH intrusions or known exploits such as Heartbleed, which should give any network security professional at an SMB peace of mind.

Finally, the Behavior Module stands out as a vigilant guardian. It monitors network traffic for unusual patterns, such as a typically low-traffic device suddenly sending large amounts of data. When this happens, the module sends an alert, allowing you to address potential threats before they escalate. 

It’s this kind of proactive monitoring that has really reinforced my trust in Firewalla.

Configuration and management

<!–>

One of the things I appreciate about Firewalla products is how user-friendly they are, especially for a small office and home office setup like mine. The initial configuration through the Firewalla smartphone app is straightforward, and for most tasks, it’s all I need. For more detailed management, the my.firewalla.com website provides a handy dashboard for viewing flows, configuring rules, and monitoring network activity.

In April 2023, Firewalla introduced the Managed Security Portal (MSP) subscription service, which offers even greater functionality. While the MSP service has various plans, the Free plan with 24-hour flow storage for a home office is probably sufficient. It covers basic network management well and offers enough visibility into network activity for my needs. More advanced home users and small businesses who require more extended visibility into their flow data might want to go with the 30-day flow plan, which is only $39 per year.

Also: Upgrading my network to 2.5Gbps with the fastest small business and residential firewall: Firewalla Gold Plus

For organizations with multiple Firewalla devices and branches, Firewalla’s MSP also offers different seat options depending on how much detail you need to monitor your devices. The No Flows Seat works fine for basic monitoring, but there are options for more in-depth analysis if you need it. MSP also provides VPN Mesh capabilities to link your branch networks over the internet using encrypted tunnels with WireGuard.

Even though MSP adds many new features, I still find that certain configurations, like VPN settings and live network monitoring, are best handled through the smartphone app. It’s a good balance between ease of use and advanced features.

ZDNET’s buying advice

The Firewalla Gold Pro–>