--- title: "Firewalla setup, restart, updates, UPnP and Smart Queue: a practical guide" url: "https://kilobat.app/routers/firewalla" description: "Manage a Firewalla Orange, Purple or Gold in the Firewalla app: why not to reboot, updates, devices, UPnP per network, Smart Queue, Wi-Fi, guest networks and DoH." --- Router · Firewalla # Firewalla setup, restart, updates, UPnP and Smart Queue Firewalla makes firewall routers such as the Gold, Purple and Orange, used as your main router or bridged behind your provider’s box. There is no admin web page to sign in to: you pair the box with the Firewalla app and manage everything there. Firewalla Sign in The Firewalla app App Firewalla app (iOS and Android) Password There is no admin password. You pair the app with the box by scanning the QR code on its underside. Wi-Fi passwords on Orange and Purple are ones you set in the app. Models Firewalla Orange, Firewalla Purple, Firewalla Purple SE, Firewalla Gold Pro, Firewalla Gold SE, Firewalla Gold Plus, Firewalla Gold **Checked 1 November 2026.** Firewalla Gold, Purple and Orange series in Router Mode, with the Firewalla app as of 2026 (Orange needs app 1.67 or later). Bridge Mode hides some features, such as Smart Queue. ## Sign in to the Firewalla 1. Install the Firewalla app, and make sure your phone has internet access, ideally over mobile data. 2. Connect the box’s WAN port to your modem or provider router, then power it on. 3. In the app, tap **+** and choose your model, such as **Firewalla Orange**. 4. When the box is found, scan the QR code on its underside. 5. Choose **Yes, set up as a router**, or Bridge Mode to keep your current router. After a reset, pair the box again as a new box. ## Restart it properly Firewalla advises against routine reboots. It updates without rebooting and recovers from faults by itself; reboot only when there is a real problem, such as no internet and no way to reach the box. 1. On Gold Pro, press the **Reboot** button; on the original Gold, Rev B and Gold Plus, the **Reset** button reboots it. 2. On other models, unplug the power and plug it back in. 3. Watch the status light; on Orange, light off means normal and blinking red means the network is down. ### Schedule a restart Firewalla documents no scheduled restart, and recommends against routine ones. ### Factory reset 1. In the app, tap **Box Settings › Advanced › Reset › Reset to Factory Defaults**. 2. Keep the old box icon in the app until you have restored your settings. On Gold SE and Gold Pro, the **Reset** button is a factory reset, not a reboot. A reset erases everything until you restore it from the app. **Kilobat can help.** Kilobat Pro’s [router check-up](https://kilobat.app/docs/home-network#router-checkup) learns how fast this router usually answers, says when a restart is due, and checks the next day whether it helped. ## Update the firmware 1. Leave the box connected; Firewalla installs box updates automatically. 2. Keep the Firewalla app itself updated from the App Store or Google Play. Firewalla says all box updates are automatic and mandatory, and install without a reboot and with minimal interruption. There is no manual firmware download. ## See connected devices 1. On the box’s main screen in the app, tap **Devices** to see every wired and wireless device. 2. Tap a device to see its activity, and on Orange or AP7 its Wi-Fi channel and signal. 3. To rename it, scroll to **Device Name**, tap the arrow, type a name and tap **Save**. 4. To find weak Wi-Fi devices, tap **View Options** and sort by **Signal Strength**. Firewalla alerts you when a new device joins. Turn on **New Device Quarantine** to limit new devices automatically until you approve them. **Kilobat can help.** Kilobat’s [new-device alerts](https://kilobat.app/docs/home-network#new-devices) tell you when a device you haven’t seen joins your home Wi-Fi. **Tools › Devices** lists what answers on the network, and you can name each one. ## UPnP and port forwarding Firewalla supports UPnP port mapping in Router and DHCP modes, and lets you allow it only on chosen networks, such as a gaming VLAN. 1. On the box’s main screen, tap **Network** to open Network Manager. 2. Tap **NAT Settings › Port Forwardings**. 3. Under UPnP, tap **Apply To › Specific Networks**, and tick the networks that may use it. 4. Ports opened by UPnP appear in the same list, where you can block any of them. Firewalla recommends manual port forwarding over UPnP, because any device or app can open ports without your oversight. Limit UPnP to the networks that need it. Ports only work with a public IP address; behind your provider’s NAT they won’t. ### Manual port forwarding 1. Tap **Network › NAT Settings › Port forwarding › Add Port Forwarding**. 2. Choose the protocol, external port, device and internal port. 3. Under **Ingress Firewall**, limit who may reach the port, then save. ### NAT-PMP Firewalla’s help centre doesn’t mention NAT-PMP or UPnP status counters. **Kilobat can help.** On supported routers, Kilobat’s [call reports](https://kilobat.app/video-calls) can read available traffic counters, read-only, to identify another device that was busy when a call froze. Correlation does not prove the cause. Kilobat never opens ports. ## Prioritise calls and gaming Smart Queue reduces bufferbloat, prioritises traffic and rate-limits apps. It isn’t available in Bridge Mode. 1. On the box’s main page, open **Smart Queue** and toggle it on. 2. Tap **Mode**: **Static** for all traffic, or **Adaptive** with your internet speeds. 3. Tap **Smart Queue Rules** to prioritise a device or app, or limit its speed. 4. Choose a **Queue Type**: FQ_CoDel above 200 Mbps, CAKE below that. CAKE helps on slower or variable lines and with lag during uploads and video calls, but uses more CPU. **Kilobat can help.** Run Kilobat’s [stutter test](https://kilobat.app/guides/recipes/test-call-stutter) before and after you change priorities, to see whether calls really got smoother. ## 2.4 and 5 GHz, and the channel Only Orange and Purple have built-in Wi-Fi; Gold needs your own access points or Firewalla AP7. On Orange each Wi-Fi network can use 2.4 GHz, 5 GHz or both. 1. On the box’s main screen, tap **Wi-Fi** and select an SSID. 2. Tap **Edit** in the top-right corner. 3. Under **Frequency Band**, pick 2.4 GHz, 5 GHz or both, then save. 4. To split bands, create a second SSID with only one band. ### Change the channel 1. Tap **Wi-Fi › Access Points** and select **Orange**. 2. Under 2.4 GHz or 5 GHz, tap **Channel**. 3. Switch from **Automatic** to **Manual** and pick a channel. Automatic mode on 5 GHz includes DFS channels. Orange has no 6 GHz; AP7 does. **Kilobat can help.** Kilobat shows which band and channel your Mac is on, and `kilobat channels` suggests the least crowded channel. More in [crowded Wi-Fi channels](https://kilobat.app/guides/wifi-channel-congestion) and [Wi-Fi on a Mac](https://kilobat.app/wifi-analyzer-mac). ## Mesh: which node a device uses Mesh Wi-Fi comes from Firewalla Access Point 7, wired or wireless. Orange’s built-in Wi-Fi can’t run at the same time as AP7. 1. Pair the AP7 in the app; Wi-Fi networks you create apply to every AP7. 2. Tap **Network**, then the **Topology** tab, to see each AP7, its backhaul and its devices. 3. On an AP7’s detail page, tap **Connection Type › Backhaul Mode** to choose **Automatic** or **Wired Only**. Devices roam between AP7s on their own. **Kilobat can help.** When your Mac moves to another node or band, Kilobat’s Health says so, so a weaker node isn’t taken for a router problem. See [find a better Wi-Fi spot](https://kilobat.app/guides/recipes/find-better-wifi-spot). ## Guest network There is no single guest switch. You create a separate network for guests and give it its own Wi-Fi. 1. Tap **Network › Create Network** and create a local network or VLAN for guests. 2. On Orange, tap **Wi-Fi › Create Wi-Fi**, set a name and password, and select that network. 3. Add rules so guest devices can’t reach your other local networks. 4. Tap **QR Code** on the Wi-Fi’s page and **Share** it with guests. Turn on **New Device Quarantine** for the guest network for extra control. On Gold, use an access point that broadcasts a guest SSID on that VLAN. **Kilobat can help.** Kilobat can show a network as a QR code, so guests join with their phone’s camera: [share Wi-Fi with a QR code](https://kilobat.app/guides/recipes/share-wifi-qr-code). ## DNS settings 1. On the box’s main page, tap **Services** and toggle **DNS over HTTPS** on. 2. Choose the devices it applies to and the servers, such as Cloudflare, Google, Quad9 or OpenDNS. 3. To set plain DNS servers instead, tap **Network**, then the WAN or a LAN, and edit **DNS Servers**. Firewalla is the DNS server for your networks. With DoH on, covered devices use it even if they set their own DNS. DoH breaks names that point at local addresses, so turn it off if a local service stops resolving. **Kilobat can help.** Before you change DNS, [compare resolvers with Kilobat](https://kilobat.app/guides/recipes/pick-faster-dns) to see which answers fastest from your home. ## Connection status and logs 1. Look at the Network Performance bar on the box’s main page; red means the internet was down. 2. Tap it to see outages, latency, packet loss and events from the last 24 hours. 3. Tap **Test Internet Speed**, or set automatic daily tests under **Test Options**. 4. Tap **Wi-Fi Test** while on the box’s Wi-Fi to measure the link from your phone. From a Mac on your network, `http://fire.walla:8833/ss/` tests the speed between it and the box. **Kilobat can help.** When the line keeps dropping, Kilobat’s [provider report](https://kilobat.app/docs/health#report) lists outages, latency and speed tests against your plan, ready to send to your provider. ## Manuals and downloads - [Firewalla Orange Installation Guide](https://help.firewalla.com/hc/en-us/articles/46820153546643-Firewalla-Orange-Installation-Guide) - [Firewalla Gold Series Installation Guide](https://help.firewalla.com/hc/en-us/articles/360046669734-Firewalla-Gold-Series-Installation-Guide) - [Firewalla Feature Guide: Network Manager](https://help.firewalla.com/hc/en-us/articles/360046703673-Firewalla-Feature-Guide-Network-Manager) Links go to the maker’s own pages. ## Questions **Is there a Firewalla web admin page?** Not for setup. Firewalla is managed in the Firewalla app, paired to the box by its QR code. **Should I reboot my Firewalla every week?** No. Firewalla says the box updates and recovers without reboots, and recommends rebooting only when there’s a specific problem. ## Sources - [Firewalla Help: Firewalla Orange Installation Guide](https://help.firewalla.com/hc/en-us/articles/46820153546643-Firewalla-Orange-Installation-Guide) - [Firewalla Help: Firewalla Gold Series Installation Guide](https://help.firewalla.com/hc/en-us/articles/360046669734-Firewalla-Gold-Series-Installation-Guide) - [Firewalla Help: Do I need to reboot Firewalla once in a while?](https://help.firewalla.com/hc/en-us/articles/50733102793491-Do-I-need-to-reboot-Firewalla-once-in-a-while) - [Firewalla Help: How to Reset Firewalla Box?](https://help.firewalla.com/hc/en-us/articles/115004370213-How-to-Reset-Firewalla-Box) - [Firewalla Help: Rename A Connected Device](https://help.firewalla.com/hc/en-us/articles/360006163513-Rename-A-Connected-Device) - [Firewalla Help: Feature Guide: Network Manager](https://help.firewalla.com/hc/en-us/articles/360046703673-Firewalla-Feature-Guide-Network-Manager) - [Firewalla Help: Create Port Forwarding on Gold/Purple/Orange Series](https://help.firewalla.com/hc/en-us/articles/1500009502622-Create-Port-Forwarding-on-Gold-Purple-Orange-Series) - [Firewalla Help: Smart Queue](https://help.firewalla.com/hc/en-us/articles/360056976594-Firewalla-Feature-Smart-Queue) - [Firewalla Help: Firewalla Orange Wi-Fi Configuration Guide](https://help.firewalla.com/hc/en-us/articles/47072943981203-Firewalla-Orange-Wi-Fi-Configuration-Guide) - [Firewalla Help: Getting Started with Firewalla Access Point 7](https://help.firewalla.com/hc/en-us/articles/37151746345491-Getting-Started-with-Firewalla-Access-Point-7) - [Firewalla Help: Network Segmentation Use Cases](https://help.firewalla.com/hc/en-us/articles/360050707534-Firewalla-Network-Segmentation-Use-Cases) - [Firewalla Help: DNS over HTTPS (DoH)](https://help.firewalla.com/hc/en-us/articles/360038449734-DNS-over-HTTPS-DoH) - [Firewalla Help: Network Performance and Quality Monitoring](https://help.firewalla.com/hc/en-us/articles/4413511352083-Network-Performance-and-Quality-Monitoring) - [Firewalla Help: A Secure and Better Network with Firewalla (Part 1): Visibility](https://help.firewalla.com/hc/en-us/articles/360049374514-A-Secure-and-Better-Network-with-Firewalla-Part-1-Visibility) Checked on 1 November 2026. ## See what your router can’t tell you Kilobat is a Mac menu-bar app that watches the network from your side: which app is using it, whether the Wi-Fi, the router or the provider is slow, and why a call froze. [Download for Mac ↓](https://kilobat.app/downloads/Kilobat-1.31.1.dmg?via=site) ``` brew install seifip/kilobat/kilobat ``` ## More router guides - [AmpliFi](https://kilobat.app/routers/amplifi): AmpliFi is Ubiquiti’s consumer mesh Wi-Fi line, with a touchscreen router and MeshPoints. - [Apple AirPort](https://kilobat.app/routers/apple-airport): AirPort Extreme, AirPort Time Capsule and AirPort Express are Apple’s Wi-Fi base stations. - [ASUS router](https://kilobat.app/routers/asus): ASUS RT, ROG Rapture, TUF Gaming and ZenWiFi routers all run ASUSWRT. - [Cudy Wi-Fi router](https://kilobat.app/routers/cudy): Cudy’s Wi-Fi routers and mesh systems, such as the WR3000 and M3000, share one web interface at cudy.net.