2.5G Cyber Security Firewall & Router

Through the years, I’ve reviewed many shopper routers from manufacturers like Netgear, TP-Hyperlink and D-Hyperlink.

I’ve then reviewed loads of extra area of interest merchandise such because the Vilfo VPN Router, Netduma R3 Gaming Router and the ExpressVPN Aircove.

Then, to a lesser extent, prosumer and enterprise choices such because the Zyxel SCR 50AXE Safe Cloud-Managed Router and the EnGenius ESG510 SD-WAN Gateway.

Then, after I began work for an MSP, I lastly dedicated and went all in with Unifi and have been utilizing the Unifi Cloud Gateway Max for the previous 12 months.

I’ve all the time hated the fanboyism in direction of Unifi, however, on the finish of the day, since committing to Unifi, my community has been fault-free and straightforward to handle.

One model I’ve by no means had an opportunity to work with till now could be Firewalla.

Not dissimilar to Unifi, Firewalla straddles the world of fanatic shoppers/prosumers and enterprise.

The corporate was based by a staff of veteran Cisco engineers, together with co-founder Jerry Chen whose daughter’s hacked child digital camera impressed the venture, Firewalla’s mission is to convey enterprise-grade cybersecurity to on a regular basis customers in a easy, inexpensive package deal.

Firewalla units mix intrusion detection and prevention (IDS/IPS), firewall performance, VPN servers, ad-blocking, parental controls, and behavioural analytics, all wrapped in a user-friendly cellular app expertise.

The Firewalla Gold Plus sits under the 10GbE Professional mannequin and might be the candy spot for fanatics, particularly within the UK.

Its 4 ports are 2.5GbE, and it helps 5Gbps IPS/IDS, making it ideally suited to 2500Mbps CityFibre connections. Particularly, it’s reported to work properly with PPPoE connections, which is one thing that Unifi has not all the time been good at.

Sadly for me, I’ve been ready for CityFibre to put in a brand new 2500Mbps line for round 6 months, with them continually cancelling. I had hoped that it will be arrange for this evaluation, and I might push the Firewalla to its limits and examine the efficiency of my Unifi, however I’m nonetheless caught on Virgin Gig1.

Nonetheless, I’ve nonetheless been very impressed with this highly effective little router.

Firewalla Product Specification Comparability

Core {Hardware} Specs

Specification	Gold Professional	Gold Plus	Gold SE	Purple	Purple SE
CPU	Intel N97 quad-core x86	Intel J4125 quad-core x86	ARM quad-core	6-core ARM (4x A53 + 2x A73)	4-core 64-bit ARM
CPU Structure	x86-64	x86-64	ARM64	ARM64	ARM64
PassMark Efficiency	~100% quicker than Gold unique	~50% quicker than Gold unique	Much like Gold unique	Raspberry Pi 4+ degree	Decrease than Purple
RAM	8GB SO-DIMM (expandable to 16GB)	4GB (expandable)	4GB	2GB DDR4	2GB
Storage	32GB eMMC	32GB eMMC	32GB eMMC	16GB eMMC	16GB eMMC
Energy Consumption	17W-33W (with fan)	<40W (passive cooling)	<20W (passive cooling)	~15W	~7W

Community Efficiency & Connectivity

Specification	Gold Professional	Gold Plus	Gold SE	Purple	Purple SE
Ethernet Ports	2x 10Gb + 2x 2.5Gb	4x 2.5Gb	2x 2.5Gb + 2x 1Gb	2x 1Gb	2x 1Gb
Most Throughput	10+ Gbps	5+ Gbps (LAG succesful)	2+ Gbps	1 Gbps	500 Mbps
IPS/IDS Efficiency	10+ Gbps	5+ Gbps	2+ Gbps	1 Gbps	500 Mbps
WiFi	No	No	No	802.11ac 2×2 (867 Mbps)	No
Bluetooth	Sure (through USB dongle)	Sure (through USB dongle)	Sure (through USB dongle)	Sure (5.0 built-in)	Sure (through USB dongle)
USB Ports	2x USB 3.0 + 1x USB-C	2x USB 3.0	2x USB 3.0	1x USB 2.0	1x USB 2.0

VPN Efficiency

VPN Kind	Gold Professional	Gold Plus	Gold SE	Purple	Purple SE
WireGuard	1+ Gbps	800+ Mbps	350 Mbps	400 Mbps	220 Mbps
OpenVPN	500+ Mbps	400+ Mbps	250 Mbps	150 Mbps	60 Mbps
Web site-to-Web site VPN	A number of	A number of	A number of	1 connection	1 connection

Superior Options & Limitations

Characteristic	Gold Professional	Gold Plus	Gold SE	Purple	Purple SE
Energetic Defend Entries	Limitless	Limitless	Limitless	Restricted (reminiscence constrained)	Restricted (reminiscence constrained)
VLANs	Limitless	Limitless	Limitless	Restricted	Restricted
Nation Blocking	Limitless	Limitless	Limitless	Max 10 nations	Max 10 nations
Docker Assist	Sure (8GB RAM benefit)	Sure	Sure	Restricted	Restricted
Multi-WAN	Sure	Sure	Sure	Sure	No
LAG/Hyperlink Aggregation	Sure	Sure (as much as 5Gb)	Sure (as much as 2Gb)	No	No
Console Port	USB-C	HDMI	HDMI	HDMI	No

Bodily Specs

Specification	Gold Professional	Gold Plus	Gold SE	Purple	Purple SE
Dimensions	218 × 165 × 44mm	130 × 110 × 34mm	130 × 110 × 34mm	~100 × 100 × 30mm	90 × 60 × 30mm
Weight	1.1 kg	565g	500g	300g	100g
Cooling	Energetic (fan)	Passive	Passive	Energetic (small fan)	Passive
Mounting	Rack-mountable	Desktop/wall mount	Desktop/wall mount	Desktop	Desktop
Working Temp	0°C to 40°C	0°C to 45°C	0°C to 45°C	0°C to 45°C	0°C to 45°C

Worth and Goal Customers

Mannequin	US MSRP	Goal Market	Finest For
Gold Professional	$899 (restricted time)	Enterprise/fanatic	10Gb networks, future-proofing, most efficiency
Gold Plus	$589	Energy customers	2.5Gb networks, a number of high-speed units
Gold SE	$509	Mainstream	Balanced efficiency, 2Gb+ connections
Purple	$369	Dwelling customers	Gigabit networks, transportable use, WiFi functionality
Purple SE	$249	Funds-conscious	Sub-gigabit networks, primary safety

• Gold Professional: The Intel N97 is genuinely quick – I’d anticipate this to deal with 10Gb throughput with out breaking a sweat. The fan is reportedly silent, however it’s nonetheless a transferring half that might fail over time.
• Gold Plus: The J4125 is a strong selection for many customers. 4 2.5Gb ports offer you correct flexibility, and LAG means you possibly can really get near 5Gb combination throughput.
• Gold SE: The ARM CPU retains prices down and runs cooler, however you’re buying and selling some uncooked efficiency. Nonetheless, 2Gb+ throughput is greater than ample for many UK broadband connections.
• Purple: That 6-core ARM setup (4+2 huge.LITTLE design) is surprisingly succesful. The WiFi is useful for transportable use, although the 867 Mbps score is theoretical most.
• Purple SE: Truthfully, 500 Mbps with full IPS/IDS is respectable for the value level. Excellent in case you’re on FTTP 300-500 Mbps packages.

Options

{Hardware} Specs

The Gold Plus homes a 64-bit Intel processor with 4 cores – particularly what seems to be a Celeron J4125 primarily based on the critiques I’ve seen. You get 4GB of DDR4 reminiscence, which frankly feels a bit tight for a tool at this value level in 2025. The unit measures 13 x 11 x 3.4 cm and weighs 565g, so it’s compact sufficient for many setups.

Energy consumption sits between 10-15W, which is affordable for an always-on system. The aluminium housing acts as a passive heatsink, so no noisy followers – although it’ll get noticeably heat throughout heavy utilization. Working temperature vary is 0°C to 45°C with correct airflow.

Community Efficiency and Connectivity

That is the place issues get fascinating. You get 4 2.5 Gigabit Ethernet ports – no mixing with slower 1Gb ports just like the cheaper Gold SE. The deep packet inspection can deal with as much as 5 Gbps complete throughput, which is genuinely spectacular for a sub-£600 system.

Two USB 3.0 ports are included, together with an HDMI output for console entry. There’s a USB-C port for serial console as properly. The purple Bluetooth dongle that ships with it handles preliminary pairing together with your cellular system.

Safety Options

The safety stack is complete, although I’d be sceptical of some advertising claims. You get:

• Intrusion Detection and Prevention (IDS/IPS)
• Deep packet inspection at line charge
• Geo-IP filtering to dam total nations
• Behaviour analytics for recognizing uncommon exercise
• Energetic malware safety with real-time updates
• Community segmentation for isolating units
• New system quarantine
• DNS over HTTPS (DoH) and Unbound recursive DNS

The system routinely blocks malicious websites and might warn you to suspicious exercise. Community segmentation is especially helpful – you possibly can isolate IoT units or create separate networks for visitors, youngsters, or work units.

VPN Capabilities

Constructed-in OpenVPN server helps as much as 120 Mbps throughput, while WireGuard VPN can deal with 500 Mbps. No month-to-month charges for the VPN service, which is refreshing in comparison with industrial VPN suppliers. You can even use it as a VPN shopper to route site visitors by means of third-party companies.

Web site-to-site VPN helps as much as 10 simultaneous connections, making it viable for small enterprise eventualities.

Content material Filtering and Parental Controls

The ad-blocking works throughout all units in your community, utilizing DNS filtering. Parental controls embrace:

• Time-based restrictions
• Software blocking (gaming, social media, and so forth.)
• Protected search enforcement throughout main serps
• Class-based filtering (gaming, social, grownup content material, playing)
• “Social Hour” function to dam social networks quickly

Superior Options

• Multi-WAN assist for load balancing or failover
• Superior Sensible Queue for site visitors prioritisation and buffer bloat discount
• Coverage-based routing to ship completely different site visitors sorts by means of completely different connections
• VLAN assist
• Bridge mode, router mode, or easy inline deployment
• Docker container assist for customized purposes
• Internet interface (beta) to enrich the cellular app

Bandwidth Monitoring and Administration

Deep perception offers granular bandwidth monitoring right down to particular person units and domains. You’ll be able to set charge limits on particular units or actions, and the month-to-month utilization monitoring helps in case you’re on a capped connection.

Unboxing / Design

The Gold Plus arrives in a compact brown cardboard field with minimal branding. Inside, you’ll discover the unit itself, a 40W energy adapter with US plug (worldwide adapters accessible individually), an Ethernet cable, wall mounting bracket, and the important purple USB safety dongle.

The unit itself is surprisingly compact at 13 x 11 x 3.4cm, becoming comfortably in your palm. The brushed aluminium end offers it a premium really feel that’s applicable for the value level. 4 rubber ft preserve it steady on surfaces, and the passive cooling design means silent operation.

The entrance panel homes two USB 3.0 ports, with one occupied by the purple safety dongle. There’s additionally an HDMI port for console entry. The rear options 4 similar 2.5GbE RJ45 ports, energy enter, and a USB-C console port.

Construct high quality feels strong all through. The aluminium development serves as an efficient heatsink, although the unit does get noticeably heat throughout heavy use. That is regular and anticipated for passive cooling.

Modes

If you’re spending $600 on this, then you’ll probably be shopping for it to make use of as a router to profit from the funding, however you don’t should.

This will work as a safety equipment, both in legacy mode with it connected to the community as you please, or in bridge mode, the place it sits between your router and community. For many of my evaluation, I really used it in bridge mode and also you get all the good options accessible within the router mode.

Router Mode: The Gold Plus replaces your present router totally. You join your ISP modem on to the Gold Plus, which then offers DHCP, NAT, and all routing features. This mode offers you most management and options.

Bridge Mode: The Gold Plus sits between your present router and community infrastructure. Your present router continues to deal with DHCP and primary routing, whereas the Gold Plus offers safety, monitoring, and superior options. That is splendid if you wish to preserve your present setup.

Easy Mode: A legacy mode the place the Gold Plus operates extra like a standard add-on safety equipment. This mode has limitations and Firewalla is planning to part it out in favour of improved bridge mode performance.

I examined primarily in bridge mode because it allowed me to check immediately with my present UniFi setup. The transition was seamless – units maintained their IP addresses and community configuration while gaining all of the Firewalla safety features.

Set Up

Preliminary setup is refreshingly simple. After connecting the system to your community and powering it on, you obtain the Firewalla cellular app and use it to scan the QR code on the system. The purple USB dongle handles Bluetooth pairing for preliminary configuration.

The app guides you thru community detection and deployment mode choice. Most customers will need both router mode (changing present router) or bridge mode (protecting present setup). The setup wizard handles the heavy lifting, although you’ll want to grasp your present community topology to make the suitable selections.

As soon as deployed, the system begins studying about your community. This preliminary discovery interval takes a number of hours because it catalogues units, identifies companies, and establishes baseline behaviour patterns. The notifications might be overwhelming throughout this era, however they quiet down because the system learns.

One frustration is the necessary cellular app requirement for preliminary setup. While the online interface exists (in beta), you can’t full setup with out the cellular app.

Whereas this can be the norm with sensible house units, I believe most prosumers who’ve an curiosity in networking would a lot want an internet interface for your entire set-up and administration.

Putting in Your Personal Software program

The Gold Plus helps Docker containers, permitting you to increase performance with customized purposes. The 4GB of RAM is considerably limiting right here – you possibly can run light-weight containers, however don’t anticipate to host resource-intensive purposes.

Standard Docker purposes embrace UniFi Controller (for managing UniFi entry factors), Pi-hole (although the built-in ad-blocking is kind of good), and numerous monitoring instruments. The Docker implementation is easy in case you’re accustomed to container know-how.

The power to run customized software program is a major benefit over shopper routers. Nonetheless, the restricted RAM and x86 structure prohibit your choices in comparison with a devoted server or NAS.

I’ve learn reviews which you could improve the RAM as that is mainly simply an x86 mini PC. The additional RAM can be useful for any Docker containers you run.

Firewall App Settings / GUI

The cellular app is well-designed and intuitive for primary operations. The dashboard offers a superb overview of community standing, safety occasions, and system exercise. Navigation is logical, and most typical duties are simply accessible.

Nonetheless, complicated configuration duties might be irritating on a cellular interface. Creating refined firewall guidelines, managing VLANs, or configuring superior routing requires persistence and a number of display screen faucets. The net interface (in beta) addresses a few of these issues however feels incomplete.

The app’s power lies in monitoring and alerting. Safety occasions are clearly offered with adequate element to grasp what’s taking place. Gadget administration is easy, and the power to shortly block or quarantine units is effective.

Internet Interface

There’s a net interface that’s accessible at https://my.firewalla.com/, which it’s important to join with through the app.

Alternatively, there’s a Firewalla MSP portal, which has a Household plan choice for $40 per 12 months, or for precise MSPs, there’s the marketing strategy, which is $300 per 12 months.

The free Internet UI is kind of primary with restricted management over the Firewalla, it’s primarily for viewing knowledge and appearing on alerts. I do want utilizing this to the cellular app.

The MSP net UI provides extra performance, together with 30 days of flows.

The next compares the options of the three plans:

Firewalla	Free	Skilled	Enterprise
Circulate Storage	24 hours	As much as 30 days	As much as 180 days
Included Seats	1	One 30-Day Flows seat	One 180-Day Flows seat
Seat Restrict	1	As much as 100 (at an extra value)	As much as 100 (at an extra value)
Reviews	–	As much as 30 days of knowledge	As much as 180 days of knowledge
VPN Mesh	–	1 mesh (as much as 3 packing containers per mesh)	3 meshes (as much as 10 packing containers per mesh)
Flows & Alarms Search	Primary	Superior	Superior
MSP Energetic Defend	–	Sure	Sure
IPsec VPN	–	Sure	Sure
Import Goal Record	–	Sure	Sure
FireAI	–	Sure	Sure
API/Integration	–	Sure	Sure
Cloud Container	–	Sure	Sure
Excessive Availability	–	–	Sure
E-mail Login	–	Sure	Sure
Variety of Admins	–	1	As much as 10
Field Group	–	Sure	Sure
Non permanent Entry	–	–	Sure
Self-importance Area	–	[random].firewalla.internet	[custom].firewalla.internet
Devoted E-mail Assist	Finest effort	Inside 24 hours	Inside 12 hours
{Hardware} Low cost	–	–	5% to 10% low cost

Notifications / Alarms / Guidelines 

The primary few days with the Firewalla are fairly annoying as a result of quantity of notifications you obtain. However in case you are proactive and mute notifications and/or arrange guidelines, then these will grow to be manageable inside a few days.

Whereas the notifications are annoying, that’s type of the purpose; you need to establish weak spots in your community.

You’ll obtain alerts for brand spanking new units, safety occasions, coverage violations, and system standing adjustments. The granularity is spectacular, you possibly can see precisely which system accessed which service at what time.

Rule creation is easy for primary eventualities however turns into complicated for stylish insurance policies. The cellular interface struggles with intricate rule units, making the online interface nearly important for superior customers.

The alerting system is efficient at catching real safety issues. Throughout testing, it recognized a number of suspicious connection makes an attempt and blocked them appropriately.

Ask FireAI

Firewalla contains an AI-powered assistant to assist with configuration and troubleshooting. In observe, it’s helpful for primary questions however struggles with complicated eventualities. The responses are generic and infrequently level you to documentation slightly than offering particular steerage.

The AI function feels extra like a advertising checkbox than a genuinely useful gizmo. Skilled customers will depend on documentation and neighborhood boards, while learners would possibly discover the responses too technical.

Advert Blocking

The built-in ad-blocking within reason efficient. It operates on the DNS degree, blocking identified promoting domains earlier than they will serve content material. The efficiency influence is minimal and can rival Pi Gap or different comparable choices with out-of-the-box settings.

You’ll be able to customise block lists and whitelist particular domains. The default configuration blocks most promoting while avoiding false positives with respectable companies. The month-to-month bandwidth financial savings are noticeable – sometimes 15-20% discount in general site visitors.

For households with a number of units, network-level ad-blocking is more practical than browser-based options. It protects all units routinely, together with these that may’t run ad-blockers like sensible TVs and IoT units.

Whereas it’s usually good, it’s far much less customisable than Pi Gap or Adguard Dwelling, or premium hosted options like NexDNS.

Personally, I’d be inclined to put in Pi Gap as a Docker container on the Firewalla for a lot superior advert blocking.

Scanning

The community scanning capabilities are complete. The system constantly displays for brand spanking new units, adjustments in system behaviour, and potential safety threats. The scanning is passive and doesn’t considerably influence community efficiency.

Gadget identification is usually correct. Commonest units are appropriately categorised, although some IoT units might require handbook classification. The asset stock is effective for understanding what’s really linked to your community.

Vulnerability scanning is primary in comparison with enterprise options however ample for house and small enterprise use. It identifies widespread safety points like default passwords, open companies, and outdated firmware.

VPN Server

The built-in VPN server is without doubt one of the Gold Plus’s strongest options. Each OpenVPN and WireGuard protocols are supported, with WireGuard providing superior efficiency and battery life for cellular units.

Setup is easy by means of the cellular app. QR codes simplify shopper configuration, and the efficiency is superb. I persistently achieved over 500 Mbps by means of WireGuard on my gigabit connection.

The VPN server contains helpful options like break up tunneling, automated DNS configuration, and bandwidth monitoring. For street warriors or distant staff, having a succesful VPN server constructed into your firewall is extraordinarily useful.

DNS / Companies

DNS administration is refined for a shopper system. You’ll be able to configure customized DNS servers, allow DNS over HTTPS (DoH) for privateness, and create customized DNS guidelines for particular units or domains.

The Unbound recursive DNS resolver offers higher privateness than forwarding to third-party servers. Efficiency is superb, and the power to create native DNS information is helpful for house servers and companies.

DNS filtering integrates with the safety features to dam malicious domains routinely. The menace intelligence feeds are frequently up to date, offering efficient safety in opposition to newly found threats.

Firewalla MSP

The Managed Safety Supplier (MSP) interface prices $40 yearly however considerably improves the person expertise for complicated configurations. The net-based interface is far more appropriate for creating refined guidelines and managing enterprise options.

For enterprise customers, the MSP subscription is nearly necessary. The cellular app merely isn’t ample for managing complicated networks or creating detailed safety insurance policies. The annual value is affordable in comparison with enterprise firewall licensing.

The MSP interface contains higher reporting, historic evaluation, and batch operations. In the event you’re managing a number of Firewalla units or want detailed compliance reporting, the subscription is worth it.

Worth and Various Choices

The Firewalla Gold Plus prices $599 and is shipped from the US. Delivery is freed from cost however you’ll be on the hook for any VAT and import charges.

The Gold Professional has 2x 10GbE ports plus 2×2.5GbE and prices $899 whereas the Gold SE has 2x 2.5GbE and 2x1GbE for $479.

Then the Purple fashions are gigabit solely with the Purple have 2 ports, one every for LAN/WAN for $369 and the SE is a decrease spec mannequin priced at $249.

The primary competitor is inevitably Unifi.

The Cloud Gateway Max is the closest competitor within the sense that it has all 2.5GbE ports. It has some benefits with extra ports and multi-WAN performance. I additionally want the best way the VPN works. However, the firewall parts and site visitors inspection should not pretty much as good. You’ll be able to subscribe to CyberSecure for improved IDS/IPS efficiency at a value of £95 per 12 months.

The Cloud Gateway Fiber has 1x10GbE WAN then 2x 10G SFP+ ports with one for WAN and 4x 2.5GbE ports with one being POE. That is £275.

Total

The Firewalla Gold Plus is undeniably a powerful little bit of equipment that brings some spectacular enterprise performance to the prosumer/fanatic market. Additionally it is a viable choice for small companies.

The safety capabilities are genuinely spectacular. The IDS/IPS system catches threats that may slip previous shopper routers, and the community segmentation options present enterprise-level isolation. VPN efficiency is superb, and the absence of ongoing subscription charges for core safety features is refreshing.

The {hardware} is well-built and efficiency is robust. 4 2.5GbE ports with 5Gbps combination throughput offers wonderful future-proofing for when multi-gigabit connections grow to be extra widespread. The passive cooling ensures silent operation, and the compact kind issue matches most installations.

Software program growth seems lively with common updates and new options. The neighborhood is engaged, and Firewalla responds to person suggestions. The Docker assist offers extensibility that shopper routers merely can’t match.

I discover the mobile-first method a bit odd. I believe most individuals who take networking critically would a lot want browser entry as the first type of administration, and I dislike having to make use of the cellular app to scan the QR code simply to log in. That being stated, you possibly can acquire entry to the Firewalla MSP interface for $40 per 12 months.

It’s not an affordable system within the first place, and it’s a onerous promote to UK consumers with import charges. You’ll be over £600 making this greater than double the value of Unifi.

The Firewalla Gold Plus is a succesful system that delivers on its safety and efficiency guarantees. The function set is complete, construct high quality is strong, and ongoing prices are cheap. Nonetheless, the excessive upfront value for UK consumers and mobile-centric administration method restrict its enchantment.

In the event you want the superior safety features and might justify the associated fee, it’s a strong selection. The absence of ongoing subscription charges makes the entire value of possession cheap over time. Nonetheless, most house customers can be higher served by inexpensive alternate options except they particularly want the enterprise-grade safety capabilities.

For small companies or severe fanatics keen to put money into complete community safety, the Gold Plus represents good worth regardless of the excessive preliminary value