The one decision that shapes the whole install: should NG Firewall become your router, or sit transparently behind the one you already have?
During the setup wizard you pick how NG Firewall joins the network, and the choice confuses more new admins than any setting after it. Router mode makes the box your gateway: it owns the internet connection, NAT and usually DHCP. Bridge mode keeps your existing router in charge and inserts NG Firewall silently between that router and your switch, filtering traffic without changing one IP address. Neither is 'the pro mode' — they solve different situations, and this page separates them honestly.
Choose router mode for a new network, a replacement firewall, or any install where you want NG Firewall's full feature set. It terminates the ISP connection (DHCP, static or PPPoE), performs NAT for the office, and normally serves DHCP to clients. VPN apps, WAN failover and policy routing all assume this position. The cost: every device's gateway address becomes the NG Firewall, so you are re-plumbing the network — do it in a planned window, and expect to renew client leases (a reboot of the switch's clients, or waiting for leases to cycle) before everything settles.
Bridge mode is the surgical option. The box passes traffic between its two ports like a smart cable: no NAT, no DHCP changes, clients keep the existing router as their gateway, and most users never know it arrived. You keep the filtering and reporting apps — the usual reason for choosing it — while the old router keeps routing. The honest limits: features that need to be the gateway (its own VPN termination behaviour, multi-WAN handling) are reduced or unavailable, and if the bridge box dies, the wire is broken until you bypass it, because it sits physically in-line.
The classic mistake: router mode installed behind an ISP router that is also doing NAT, with no plan. Double NAT works for browsing — which is why it survives — and then quietly breaks inbound services, some VPNs and game or VoIP traffic. If you choose router mode behind an ISP box, put the ISP device into its own bridge or modem mode where it offers one, or accept and document the double NAT deliberately. Never discover it during the first video-call failure.
You can change mode later, but it is a re-install class of change, not a toggle — plan the network around the mode you pick.
The video installs and configures the gateway end to end — watch how the mode decision appears in the wizard before you commit your own network.
▶️ Watch Full VideoYes — filtering happens as traffic crosses the box, whichever mode placed it in the wire. What bridge mode gives up is gateway ownership: NAT, DHCP and the VPN and multi-WAN features that depend on being the router. The Web Filter and other inspection apps still inspect what passes through.
Not automatically. If the existing router is solid and the goal is filtering and visibility, bridge mode delivers that with almost zero disruption. Pick router mode when you specifically want NG Firewall to own the edge — its VPNs, its failover, its policies — and you have a maintenance window to move the gateway role.
Nothing changes. Your existing router or server keeps handing out addresses exactly as before, which is precisely why bridge mode is the low-risk insertion. In router mode, NG Firewall normally takes over DHCP, and the old DHCP server must be switched off to avoid two servers fighting on one network.