One box between your office and the internet, filtering everything that passes. This is the documented gateway install in order: hardware first, then the installer, then the Setup Wizard — no guessing, no skipped steps.
Untangle NG Firewall turns a spare PC or a virtual machine into the gateway for your whole network: every computer reaches the internet through it, and its rack of apps filters and logs that traffic on the way. The setup itself is not long, but the order matters — hardware, install, wizard, interfaces, mode. Get one step out of sequence (the classic case is the WAN cable sitting in the LAN port) and every later symptom looks random. This guide follows the product's documented setup flow, the same flow the video walks through live, and calls out the few numbers worth memorising: the internal interface starts life at 192.168.2.1, and that is where your admin life begins.
First, one honest naming note, because it decides where you download things from: Untangle NG Firewall is sold today as Arista Edge Threat Management (ETM) NG Firewall. Arista Networks acquired Untangle in 2022 and renamed the product; the rack-style admin interface, the apps and the install flow carried over. The box, the ISO and older documentation may say either name — it is one product line, and the setup below is the same for both labels.
What the software does is simple to state: it is a gateway. It sits between your internet connection and your office switch, and all traffic passes through it. Filtering (web categories, phishing, viruses), VPN, user reports and bandwidth rules are then switched on as apps inside that gateway — setup first, apps after.
A gateway lives between two networks, so the machine needs at least two network interfaces: one will be labelled External (facing the ISP) and one Internal (facing your office). The classic build is a spare desktop with one extra PCI or PCIe network card added; a virtual machine with two virtual NICs works just as well for learning and small offices.
Two warnings that save real grief. The installer erases the entire hard disk of the target machine — this box becomes a dedicated appliance, so never aim the installer at a PC holding data you need. And put the gateway, modem and switch on a small UPS if you can: when the gateway loses power, the whole office loses internet, not just one desk.
http://192.168.2.1/ in a browser — the wizard is waiting thereThe wizard can be re-run later at any time from Config > System > Support > Setup Wizard, so a wrong early answer is fixable, not fatal.
The wizard's first real job is the server itself: set a strong administrator password, pick the correct timezone (your reports and schedules will be wrong without it) and add an admin email for alerts. Store the password in a password manager, not on paper taped to the gateway.
On current versions (16.3 and newer) the wizard also asks you to create or sign in to a free ETM Dashboard account. This is not marketing decoration: the account is what lets the box activate a trial or a licence and appear in Arista's central dashboard for remote management. An offline wizard exists for boxes that cannot reach the internet yet, but plan on registering — an unregistered box cannot unlock its apps.
Next the wizard configures the outside. The External interface defaults to DHCP — it takes whatever address your ISP modem hands out, which is correct for most cable and fibre connections. If your ISP gave you a static IP or your connection uses PPPoE, choose that option and enter exactly the parameters the ISP issued.
If the box shows no internet at this point, restart the modem before you start re-typing settings — Arista's own documentation notes that a modem restart is sometimes needed before the new gateway's network settings become visible to it. Prove basic internet through the box before moving on; every later problem is ten times harder to read while the WAN itself is unproven.
The last wizard decision is the one that shapes your network. Two honest choices:
192.168.2.1), runs the DHCP server and does NAT, so all office machines share one public IP. The NG Firewall is your router and firewall. This is the right choice for a new setup or when replacing an old routerMost small offices following this video's style of setup want router mode. Choose bridge only when something upstream must stay in charge.
http://192.168.2.1 and log in with the administrator password you setThat is a complete, honest setup: gateway installed, interfaces proven, mode chosen deliberately. What it is not yet is a tuned security policy — the apps, filtering categories and per-group rules are the next layer, covered in the companion pages of this set and in the deeper Arista install guides on this site.
The complete setup — installer, Setup Wizard, interface configuration and first login — shown live on a real machine, step by step.
▶️ Watch Full VideoThe internal interface is configured with the static address 192.168.2.1 and runs a DHCP server in router mode. Plug a DHCP-configured computer into the internal interface and open http://192.168.2.1/ in a browser to reach the Setup Wizard or, after setup, the admin console.
Yes. Arista Networks acquired Untangle in 2022 and renamed Untangle NG Firewall to Arista Edge Threat Management (ETM) NG Firewall. The rack interface, apps and setup wizard carried over, so a guide written for one name largely applies to the other.
Choose router mode when the NG Firewall box is your network's gateway — it hands out DHCP addresses and performs NAT. Choose transparent bridge mode when an existing router or firewall must stay in charge and you only want to slip filtering in between it and your switch without changing any client settings.