Running Firewalla Gold SE
behind a Google Wifi mesh

BackgroundWhy this is tricky

The ideal way to put a security firewall like Firewalla in front of a mesh WiFi system is to configure the mesh in Access Point (AP) or Bridge mode — let Firewalla handle all routing and DHCP, and demote the mesh to a dumb radio tower. This works perfectly with most mesh systems.

Google Wifi and Nest Wifi cannot do this. Google's mesh protocol requires the primary unit to act as a router. When you enable mesh mode, bridge/AP mode is disabled. There is no workaround for this at the Google level.

The solution is a multi-subnet architecture: Firewalla handles all client devices on one subnet, while Google Wifi's mesh protocol runs on a second, isolated subnet. The two networks are connected such that all internet traffic flows through Firewalla first, giving you full visibility and protection over every device.

01Hardware & prerequisites

This guide is written for the following hardware. It applies to any combination of Google Wifi and Nest Wifi units.

Before starting, do a factory reset of your Google Wifi system and set it up fresh using the Google Home app. This avoids any legacy IP conflicts.

02Network architecture

The finished network uses three distinct IP ranges:

03Step 1: Configure Firewalla ports

Open the Firewalla app. Go to Network Manager.

Port 4 — WAN

This should already be set as your WAN (internet) port from initial setup. Connect your ONT/modem here. No changes needed.

Port 3 — Google WAN subnet

1. Tap Port 3 → Create new network
2. Type: Local Network
3. IP address: 192.168.200.1
4. Subnet: /30 (or 255.255.255.252)
5. Enable DHCP: Yes
6. DHCP pool: Start 192.168.200.2, End 192.168.200.3

Port 1 — Main LAN

1. Tap Port 1 → Create new network (or edit if it exists)
2. Type: LAN
3. IP address: 192.168.151.1
4. Subnet: /24
5. Enable DHCP: Yes
6. DHCP pool: 192.168.151.2 – 192.168.151.254

Port 2 (optional)

Include Port 2 in LAN 1 if you want an extra ethernet port available on the Firewalla side. This is optional — you can leave it unassigned.

04Step 2: Limit Google Wifi's DHCP pool

This is the most important and least-obvious step. By default, Google Wifi assigns 192.168.86.x addresses to every device that connects — including your client devices (phones, laptops, TVs). You need to restrict this pool so it only has enough addresses for the mesh Points themselves, forcing all client devices to get IPs from Firewalla instead.

1. Open the Google Home app
2. Go to Wifi → Settings → Advanced networking → DHCP IP reservations (path varies slightly by app version — look for DHCP settings)
3. Set the DHCP pool range to exactly cover your Points:
   Start: 192.168.86.2
   End: 192.168.86.5 (for 4 Points; use .6 for 5 Points, etc.)
4. Save and allow the mesh to restart

05Step 3: Physical cabling

Wired vs. wireless Points

Wired Points (connected via ethernet to the passive switch) get faster, more reliable backhaul. Wireless Points use the WiFi signal for backhaul. Both types work fine in this setup. For best performance, wire as many Points as practical.

06Step 4: Fix mesh Points getting wrong IPs

After cabling up, power everything on. You'll likely find that some or all of your mesh Points have grabbed 192.168.151.x addresses from Firewalla, instead of 192.168.86.x from Google. This happens because the Points' ethernet ports are connected to Firewalla's switch and Firewalla answers their DHCP requests first.

Fix this for each affected Point:

1. In the Firewalla app, go to Devices
2. Find the Point (it may show as "Google Wifi" or by its MAC address)
3. Tap the device → IP Address
4. Select "Do not allocate" — this tells Firewalla to stop offering this device a DHCP lease
5. Unplug the Point's ethernet cable, wait 10 seconds, plug back in (or reboot it from the Google Home app)
6. The Point will now request an IP from Google's DHCP server and receive a 192.168.86.x address
7. Repeat for each Point that had a wrong IP

07Step 5: Verify the network

Once cabling and configuration are done, run through this checklist:

The "Points offline" warning — ignore it

The Google Home app will likely show your mesh Points as offline, even though WiFi is working perfectly throughout the house. This is a known cosmetic side-effect of having Google Wifi behind another router. Google's cloud-based status check can't reach the Points directly in this configuration.

The network is fine. Verify by checking that devices connect and get internet in every room — that is the real test, not the Google Home app's status screen.

08Step 6: Parental controls

One of Firewalla's strongest features is per-device or per-profile parental controls. Because all client devices (including those on WiFi) get their IPs from Firewalla, every device is fully visible and manageable.

Create a family profile

1. Firewalla app → Family → Add Member
2. Name the profile (e.g. your child's name)
3. Assign all of your child's devices to this profile (phone, tablet, laptop)

Recommended settings

Defeating MAC randomization

Modern iPhones and Android devices use MAC address randomization by default, which means a device can appear as "unknown" or "new" to Firewalla every time it connects, evading assigned controls. Disable this on your child's device:

• iPhone: Settings → Wi-Fi → tap your network → turn off "Private Wi-Fi Address"
• Android: Settings → Network → Wi-Fi → tap your network → Privacy → "Use device MAC"

09Step 7: New device quarantine

New device quarantine automatically blocks internet access for any unknown device that joins your network, and sends you a push notification. This catches unauthorized devices — a friend's phone, a game console your child sneaked in, or an unknown device.

1. Firewalla app → main screen → tap "+"
2. Find New Device Quarantine → toggle ON
3. A "Quarantine Group" is created with pre-built internet-blocking rules

When a new device joins, you'll get a notification. To release it: open the notification → swipe left on the device → Leave Group. Then immediately assign it to the right group (Kids, IoT, Personal, etc.).

10Common gotchas & pitfalls

11Known limitations of this setup

This setup works well, but you give up some things compared to running a mesh system that supports true AP mode:

• Google Home app shows Points as offline. The app's status screen is unreliable in this configuration. Use Firewalla as your primary network management tool instead.
• Google Wifi's parental controls are disabled. Since Firewalla is the real router, Google's own Family WiFi features won't work. Use Firewalla's parental controls instead — they are more powerful anyway.
• Double NAT. Traffic goes through two NAT layers: Firewalla → Google primary → client devices. For most home use this is invisible, but it can occasionally affect peer-to-peer applications or gaming services that require port forwarding. If you need to port-forward, you must do it on both Firewalla and the Google router.
• WiFi speed test from the Firewalla app may fail. The speed test feature requires your phone to be on Firewalla's local network. If it reports "connect to local network first," ensure your phone's IP is on 192.168.151.x, not 192.168.86.x.
• Google Wifi features become unavailable. Priority devices, usage reports, and some Google Home integrations stop working when Google Wifi is behind another router.

AppendixReference: IP addressing summary

# Firewalla Gold SE port assignments
Port 4  WAN         ← Fiber ONT
Port 3  192.168.200.1/30  ← Google Wifi primary WAN port
          DHCP pool: .2–.3
Port 1  192.168.151.1/24  ← Passive switch → wired devices
          DHCP pool: .2–.254

# Google Wifi internal mesh
Primary WAN  192.168.200.2    (assigned by Firewalla)
Primary LAN  192.168.86.1     (Google's own gateway)
Points       192.168.86.2–.5  (4 Points; expand for more)
DHCP pool    192.168.86.2–.5  (restricted: Points only)

# All client devices (phones, laptops, TVs)
IP range     192.168.151.x    (from Firewalla)
Gateway      192.168.151.1    (Firewalla Port 1)