Firewalla Transparent Bridge: Place It Behind the Router and Know What Disappears

Supported Firewalla bridge mode; existing router continues to provide routing and addressing.

Applies to: Supported Firewalla bridge mode; existing router continues to provide routing and addressing.

Correct position

The documented transparent bridge sits between the existing router and downstream devices. It needs an upstream network address. Do not place it between an un-routed cable modem/ONT handoff and the router as though those were the same topology.

Existing router LAN → Firewalla bridge → downstream switch / AP / client

Plan the change

1. Record the existing cabling and choose which downstream traffic must physically cross the bridge. A client connected elsewhere on the upstream router does not become monitored simply because discovery sees it.
2. Review feature loss before switching mode: the documented bridge mode does not provide VPN Client, policy-based routing or Smart Queue.
3. Follow the app's mode-selection process for the supported hardware. Avoid parallel paths that bypass the bridge or form a loop.
4. Retain the existing router's DHCP service and verify that Firewalla itself receives the required upstream address.

Verify / undo

Test a downstream client and check that expected flows appear. Compare an intentionally upstream client without assuming it is protected. If connectivity fails, restore the original router-to-switch connection and prior mode configuration. Do not weaken unrelated blocking rules merely to make a wiring test pass.

Official evidence

• Firewalla Transparent Bridge Mode — rf2-firewalla-bridge
• Firewalla Gold series installation — rf2-gold-install

Editorial boundary: No hands-on testing was performed. Confirm the device label, current firmware and live official instructions before making changes. Never send passwords, VPN keys or complete configuration backups to RouterFix.

Referenced models

Try the right tool