Almost every 'the firewall broke my internet' story is really 'the cables were in the wrong ports'. Spend the first hour proving which interface is which, and the rest of the setup becomes boring — in the good way.
NG Firewall has exactly one physical job: sit between the internet and your office. That means its two network ports have different jobs, and the software's names for them — External and Internal — must match the real cables. Nothing in the wizard can save you from a swapped pair; the box will happily configure the office side to face the ISP. This page is the disciplined first hour: learn the documented defaults, identify each port with a test instead of a guess, and only then trust the rest of the setup.
External faces the internet: it plugs into the ISP modem or the upstream line, and it normally takes its address by DHCP. Internal faces your people: it plugs into the office switch, and in router mode it owns the private address 192.168.2.1 and hands out DHCP leases to every PC. In the interface list the pattern is consistent — the first interface (eth0) is External and the second (eth1) is Internal — but treat that as a starting hint, not proof, especially on machines with add-in cards.
http://192.168.2.1, reachable only from the internal sideIf your office already uses the 192.168.2.x range for something else, change the internal address during setup rather than letting two networks collide.
Config > Network > Interfaces and watch which interface shows a link and an addressWAN-ISP and LAN-Office) and stick a physical label on each cableFive minutes of this is the cheapest troubleshooting you will ever do on a firewall. Every future fault — a dead ISP line, a failed switch — becomes a one-glance diagnosis instead of a guessing session.
Symptoms of an External/Internal swap are confusing precisely because half the system works: the admin console may answer, the box may even show an internet address — but it got that address from your office DHCP, or your PCs are receiving addresses from the wrong side and nothing routes. If your fresh setup behaves strangely, suspect the cables before the configuration. Power down, swap the two cables, power up, and re-test. It is the single most common first-install fault with any two-port gateway, and it costs nothing to rule out.
Only a gateway that passes all four checks earns the right to have apps switched on. Filtering problems layered over an unproven interface setup are how a one-hour install becomes a weekend.
Watch the interface setup done live in the video — which cable goes where, and how the console confirms it.
▶️ Watch Full VideoThe interface named External is the WAN side — it connects to the ISP modem and normally takes its address by DHCP. In the default interface list the first interface (eth0) is External and the second (eth1) is Internal, but verify with a plug-and-watch test rather than trusting port order on unfamiliar hardware.
Plug a laptop set to DHCP into the internal interface. It will receive a 192.168.2.x address from the box, and the Setup Wizard or admin console answers in a browser at http://192.168.2.1/.
Check the interfaces before anything else: confirm in Config, then Network, then Interfaces that External holds the ISP address and Internal holds 192.168.2.1, and rule out swapped cables by powering down and exchanging the two leads. A swapped pair is the most common cause of this exact symptom.