Same box, same software, two very different jobs. Router mode makes Untangle your network's boss; bridge mode makes it a silent inspector behind your existing router. Picking wrong is the most common first-day mistake — here is how to pick right.
Every Untangle install asks one early question that confuses beginners: router mode or transparent bridge? Choose wrong and you either break the office network on day one or discover later that the feature you wanted cannot work in your mode. This page separates the two cleanly — what each does, what each cannot do, and the rollout order that keeps you safe.
In router mode the NG Firewall replaces your router completely. It takes the public connection on its WAN card, runs NAT and DHCP for the office, and every device gets its address from Untangle. You gain full control: firewall rules, port forwards, VPN and reports all live in one place, and the provider's basic router can be removed or reduced to a plain modem. The cost of that control is responsibility — if this box stops, the whole office loses internet and addressing, and you must configure the WAN connection type (DHCP, PPPoE or static) correctly yourself.
In bridge mode the existing router keeps its job and its settings. Untangle sits between the router and the office switch with no IP changes anywhere — it has no address on the traffic path and simply inspects, filters and reports everything passing through. This is the lowest-risk way to start: install it during lunch, and if anything misbehaves, one cable move bypasses it completely. It is how most small offices should begin, because nothing else in the network needs reconfiguring — no new DHCP, no changed gateway, no angry Monday morning.
Be clear about the trade-off. A bridge cannot provide your network addressing, cannot be the VPN endpoint in the usual designs, and some routing features simply do not apply because it is not routing. If your main goal is the owner connecting from home with OpenVPN, or replacing a failing router, bridge mode is the wrong tool. Also note that in bridge mode your existing router remains a single point of failure and its own weak security stays in the path — Untangle filters the traffic, but the router still owns the connection.
Start in bridge mode for two to four weeks. Learn the dashboard, read the reports, tune the free apps, and prove the value with zero network disruption. Then, if you want VPN, cleaner addressing or to retire the old router, plan a weekend switch to router mode with your configuration backup in hand. Offices that skip the bridge stage and go straight to router mode on day one are the ones who end up unplugging the firewall by day three. The video shows the product either way — the mode choice is about your network, not the software.
Watch the video walkthrough, then choose your mode with this guide open beside you.
▶️ Watch Full VideoTransparent bridge mode. Your existing router keeps working exactly as before, no IP addresses change, and if anything goes wrong you bypass the firewall with one cable move. Move to router mode later, deliberately, once you know the dashboard.
Not in the usual design. A transparent bridge inspects passing traffic; it is not the network's gateway, so VPN termination, NAT and DHCP belong to router mode. If remote access is a primary goal, plan a router-mode install.
The firewall still inspects every packet, so the same hardware sizing rules apply as in router mode. A correctly sized box adds negligible delay; an undersized one bottlenecks in either mode equally.