Firewalla Xbox Gaming Monitor

Live Xbox traffic dashboard powered by Firewalla Gold/Purple. Monitors connections during gaming, classifies server roles (matchmaking, CDN, telemetry), applies per-destination QoS, probes internet paths (IPv4 vs IPv6), and blocks slow routes at the firewall so the console uses the fastest path.

Disclaimer: This is an independent community project. It is not affiliated with, endorsed by, or supported by Firewalla Inc. It modifies network behavior on your Firewalla device using scripts, QoS rules, and internal APIs. Use at your own risk. You are solely responsible for any impact to your network, device stability, security, or warranty. Firewalla may change internal behavior at any time, which could break this software without notice.

• Live dashboard — bandwidth, connections, latency, server roles
• Server classification — PlayFab, Xbox Live, CDN, telemetry, etc.
• Traffic policies — Balanced / Competitive / Download (DSCP via CAKE)
• Route efficiency — ping all path candidates, rank Azure datacenter regions
• Path enforcement — iptables DROP on slow alternate IPs for Xbox traffic
• Dual-stack — IPv4 + IPv6 (Warzone and modern titles use IPv6 heavily)
• Session advisor — local heuristics, learning, lobby prediction, bandwidth spike detection
• Warzone Lobby Sentinel — autonomous cheater-lobby detection + optional packet shield (warzone-lobby-sentinel/)
• Packet shield — drops tiny inbound flood packets (≤79B) without throttling normal Warzone UDP
• Flood guard — defend/harden modes with per-source limits on game ports (matchmaking / kick spikes)

┌─────────────┐   HTTP :9378    ┌──────────────────────┐   on-box scripts   ┌──────┐
│  Dashboard  │──────────────▶│  array-firewalla-api │───────────────────▶│ Xbox │
│  (Node.js)  │  Bearer token │  on Firewalla Gold   │  QoS + snapshots   └──────┘
└─────────────┘               │  gaming-tools/       │
                              └──────────────────────┘
                                      ▲
                                      │ localhost netbot bridge
                               official Firewalla netbot API

The dashboard never opens SSH to Firewalla. All remote operations go through array-firewalla-api on the LAN (POST /api/v1/run, /api/v1/netbot, /api/v1/tools/update).

See docs/ARCHITECTURE.md for details.

Examples in this repo use fictional addresses — replace with your LAN values in gaming.conf and dashboard env:

WAN latency probes use the public hostname one.one.one.one (configurable via WAN_PROBE_HOST / wanProbeHost).

Install array-firewalla-api on the box. After bootstrap, SSH is not required for the dashboard or deploy scripts.

See array-firewalla-api → scripts/bootstrap-firewalla-api-once.sh (one-time only), then verify:

curl -sS http://A.A.A.A:9378/api/health

From a host on your LAN (with FIREWALLA_API_TOKEN set):

FIREWALLA_API_URL=http://A.A.A.A:9378 ./scripts/push-firewalla-tools-api.sh

Edit /home/pi/gaming-tools/gaming.conf on Firewalla (App console or one-time shell access) — set XBOX_IP, XBOX_MAC, LAN_IF.

Smoke test via API:

curl -sS -H "Authorization: Bearer $FIREWALLA_API_TOKEN" \
  -X POST "http://A.A.A.A:9378/api/v1/run" \
  -d '{"script":"gaming-snapshot.sh","args":["B.B.B.B"],"sudo":false}' | head -c 500

sudo FIREWALLA_API_URL=http://A.A.A.A:9378 FIREWALLA_API_TOKEN=<your-token> XBOX_IP=B.B.B.B ./scripts/install-dashboard.sh
# Open http://C.C.C.C:9377/

Docker alternative:

FIREWALLA_API_URL=http://A.A.A.A:9378 FIREWALLA_API_TOKEN=<your-token> XBOX_IP=B.B.B.B docker compose up -d

Full guide: docs/INSTALL.md

We built this as a community tool and would love Firewalla to review it for accuracy, safety, and possible product integration.

Start here: docs/FIREWALLA-REVIEW.md

Contact options:

1. GitHub Issue on firewalla/firewalla — official open-source repo (AGPL-3.0); best for engineering visibility
2. Email help@firewalla.com with subject Community: Xbox Gaming Monitor review
3. Forum post: forum.firewalla.com (Tips & Tricks / Feature Requests)
4. GitHub Issues on this repo for bugs and feedback

This project is separate from firewalla/firewalla (the core OS at /home/pi/firewalla). Our scripts install under /home/pi/gaming-tools/ and do not patch core. Long-term, a native integration could live in extension/ or similar — see docs/FIREWALLA-REVIEW.md.

• Route enforcement adds iptables/ipset DROP rules in FORWARD for Xbox source IPs only
• QoS uses mangle POSTROUTING DSCP marks; works with Firewalla CAKE diffserv3
• Competitive bandwidth: dynamic (Firewalla allocates) or static Mbps caps on Xbox only via ingress policing
• Xbox buffers: normal / light / desync / kick / max tc police burst (Xbox-only); desync/kick also widen NIC rings on eth0–eth2
• Packet shield: in-match protection drops inbound UDP/TCP ≤79 bytes (kick probes); normal Warzone packets pass unchanged
• Flood guard: defend (per-source game-port limits) or harden (aggressive kick mitigation) — use sparingly; prefer packet shield in-match
• DNS: off by default; when enabled, redirects DNS queries only from XBOX_IP/MAC — does not change DHCP or global Firewalla DNS (fixes laptop/other-device timeout issues)
• Scripts are read-only on Firewalla except for explicit QoS/enforcement sync commands
• No Firewalla OS or app modification required — files live in /home/pi/gaming-tools/

MIT — see LICENSE