Network security products typically fall into one of two types: on one hand, there’s the “plug it and forget it” gear for the average consumer. On the other is the hard-core, pro-grade equipment aimed at tech gods who know their SFP+ from their RJ45. The Firewalla Gold Plus SFP is the latest firewall I’ve been testing, falling squarely into the latter category.

Also: Are high-end thermal cameras worth it? I tested a $300 model with my iPhone to find out

All in all, it’s a very capable network appliance powered by an unspecified quad-core ARM CPU and 4GB of RAM: enough horsepower for 5 Gbps of firewall throughput. While you can think of an RJ45 port as a fixed wall socket for one kind of plug, an SFP+ port is more like a universal travel adapter designed to accept an array of different plug-in modules, such as fiber-optic or Ethernet modules, or a direct-attach cable (DAC) that links two devices together, such as a router and a firewall box.

The hardware

On the ports side of things, there are two 2.5G RJ45 ports, two 10G RJ45 ports, and a 10G SFP+ port. And it’s this SFP+ port (the acronym stands for small form-factor pluggable, words that don’t exactly roll off the tongue) that sets this firewall ahead of the game and makes it a true enterprise solution.

Also: I tested Anker’s air-cooled power bank with a thermal camera – here’s the result

And that’s who I’d first and foremost recommend this device to. If you’re a home user or have a small office, I recommend Firewalla Orange, a much more user-friendly product instead you can set up in under an hour.

The box has two USB-A ports (one is occupied by a Bluetooth dongle) and a console port for connecting a computer to perform tasks such as initial configuration, local management, or emergency troubleshooting.

The “+” means it’s capable of 10 gigabits per second of throughput, which is about ten times the speed of the fastest home broadband connection. Compare this to standard SFP, which tops out at 1 Gbps.

Note that while you get 10G ports, anything routed through the firewall caps out at 5 Gbps, including internet traffic and traffic routed between VLANs. Those 10G ports are there to connect other high-speed devices or something like Firewalla’s own AP7 Wi-Fi 7 mesh access point.

Also: Why the 16GB Raspberry Pi 5 costs $385 now – and your best alternative options

The upside of having an SFP+ port is that it allows fiber to be connected directly to the firewall box, without needing converter boxes in the middle. This sounds good in theory, but in practice it means buying the modules separately. You also need the right module for your cable and provider, which could lead to compatibility headaches.

Firewalla itself states that this is “not intended for residential use” and is intended for small businesses, schools, and “professionally managed deployments”. I’m not sure whether this is meant to put off the average user (the price alone should do that) or to serve as some legal or regulatory cover, but it’s odd to see this from a company that built its brand on home users.

The software is the same as you get with other Firewalla hardware, and offers a lot of functionality:

• Per-device traffic visibility and IDS/IPS
• GeoIP blocking, ad blocking, and DNS-over-HTTPS
• VLANs and microsegmentation
• Multi-WAN with failover or load balancing
• Bridge mode
• MSP Lite web interface

A big selling point of Firewalla is that there’s no subscription for any of the standard features or services. It’s very much a “buy once, cry once” package (we’ll get to the crying bit soon, I promise). If you want to enable Wi-Fi Direct on the Gold Plus SFP, you can use a USB dongle.

Who is the Firewalla Gold Plus SFP for?

I have a modest network, but this is like bringing an elephant gun to a peashooter contest. Even with the Starlink dish going flat out, a couple of NAS boxes humming away and all the devices I could muster, the Gold Plus SFP was never going to be the bottleneck (this is why I’m leaning more than usual on Firewalla’s own data for performance).

And this is the problem.

There’s definitely a market for the Gold Plus SFP, but it’s niche, and you need to leverage its strengths to get the most out of it. Its biggest strength — one shared across the Firewalla line — is that it supports bridge mode, which means you can drop it into your network behind an ISP router you can’t replace. This gives you an incredible upgrade without having to throw away or change anything else, which hardware like a UniFi gateway doesn’t really let you do.

As someone who has used UniFi hardware a lot, I have no problem saying that Firewalla’s per-device visibility and rules are far easier to figure out and use than anything I’ve used from UniFi.

In terms of speed, you need a pretty fast internet pipe to take advantage of the Gold Plus SFP — something around 3 to 5 Gbps delivered over SFP+ or fiber. Firewalla’s own community launch post describes the Gold Plus SFP as “faster than the Gold Plus and slower than the Gold Pro with SFP+,” and this is a perfect way to think of it. If you have a 5 Gbps pipe, this is the firewall to go for. Anything faster and the Gold Pro with SFP+ is what you need, but for anything slower, save a few bucks and go for the Gold Plus.

Final thoughts

I’ve danced around the “cry once” part of the adage a bit, so it’s time to come out with the price: $679. And this is a sale price, it’s normally $829. That’s a hefty price tag that separates it from the prosumer Firewalla Orange ($399) and consumer Firewalla Purple SE ($299) products.

What gives the Firewalla Gold Plus SFP — and every other Firewalla firewall product — a big edge is bridge mode, which lets it sit between your router and the rest of your network without a lot of headache.

Also: Don’t waste money on phone storage – try this instead

If you decide to beef up network security, and you want a solution that you can drop in, then, boom! A Firewalla product is a no-brainer. It also makes sense for those who are already familiar with the Firewalla ecosystem and already use the company’s hardware. Going with software you already know is a thumb on the scale tipping it in favor of Firewalla.

Where it doesn’t make sense is if you’re starting a high-end network from scratch, because the costs really do spiral rapidly.

A Firewalla Gold Plus SFP, a Switch X and a single AP7 access point will instantly set you back $1,847. Going with UniFi, a Cloud Gateway Fiber ($307), Pro XG 8 PoE switch ($549), and a U7 Pro XG access point ($219) is only $1,075 (this includes a surcharge that UniFi apply to cover memory price increases and tariff charges). And the Cloud Gateway Fiber has two SFP+ ports. Note that the best like-for-like switch would be the Pro XG 10 PoE, but that’s out of stock.

That’s a huge saving if you choose the UniFi route, and one that’s hard to hand-wave away.