Mesh PRO installation with Hardware Firewall

Replacing early generation EERO with the Wyze mesh-router-pro. Read through the many posts but still a bit confused on configuration. And doesn’t seem to be any detailed documentation that I can find.

What I have and want to maintain is Spectrum cable modem (currently .6gb likely to move to 1gb in near future) → Hardware firewall with built in DHCP server → 1gb network switch (which in turn connects to wired devices and EERO for wireless devices).
I have the Mesh-Router-Pro 3 station kit.

Can I turn off DHCP server in Mesh Router-Pro and let main DHCP server provide all addresses for network or alternatively let Mesh PRO provide addresses for wireless devices only?

Desired configuration is:

Cable Modem → Hardware firewall / DHCP Server → multiport network switch → 1) wired devices & 2) Mesh wireless router.

Thanks for any feedback.

I’m not sure if it’s possible to disable the DHCP server on the mesh router. I don’t believe it plays well with double NAT.

Is there any reason you don’t want to disable the DHCP server on the firewall, and instead do something like:

Modem > firewall > mesh router > switch.

The mesh router also has a built in firewall, though it is pretty limited.

You can do this, but without switching to bridge mode, you’ll have a double NAT situation. Bridge mode turns off DHCP on the Wyze routers and then they function as a simple AP. Mine won’t work that way since I have them connecting to each other via WIFI. They might work if I could use an ethernet connection.

I’m only using the Mesh for Wyze devices right now and it works in the double NAT arrangement. Can’t say how it would work for other devices or if you need access to other devices on your wired network or from wired to wireless.

Thanks guys for the quick response. I want to keep using the hardware firewall as it is high end with a lot of sophisticated capabilities. I thought I might have had a solution. The firewall allows for up to 5 subnets. So my thinking was that I use one subnet with the wired devices getting DHCP from the firewall and another subnet for the Mesh Pro letting it use it’s DHCP. (You can turn DHCP on/off by subnet on the firewall). But the problem then is possibly two fold 1) All ethernet cables are prewired in walls so the satellite mesh nodes would be restricted to wifi backhaul unless I had a managed switch. and 2) the devices on one subnet would not see the devices on the other subnet.

I could live with 1 but being able to connect to hardwired devices such as NAS and computers with wifi such as smartphones would be a problem.

I need to check and see whether the firewall allows for cross subnet discovery. That would solve most of the problems.

That is only part of your problem. If you aren’t using bridge mode the Wyze Mesh routers treat the rest of your network as the “internet” and you won’t be able to access your WIFI devices from the rest of your network. It is probable that your WIFI devices could access your wired devices since NAT won’t prohibit that, but NAT prevents direct access to any devices behind the Wyze Router. Also, port forwarding only works for ONE device on the Wyze routers, You cannot open multiple ports.

As far as the firewall rules to allow access across subnets, that shouldn’t be a problem. I have a Ubiquiti router with a firewall and I block access from my IoT and Guest subnets to my main subnet, but allow access from the main to the IoT and Guest subnets.

Have you considered looking into a more professional system? UNIFI makes some great APs which may be more suited for your situation.

The Wyze system is intended to be an all in one, and not designed to be used with such a complicated setup.

I’m coming to that conclusion. I am looking into doing a return since all in original boxes, never connected and order was within 30 days. Only wish Wyze would publish specs like this somewhere instead of just having some rather general FAQs. But thanks to both of you for your help. Fingers crossed they will authorize a return.

Just to close the loop here, Wyze has issued a RMA for the Mesh. So will return and look into other solutions. Thanks for the advice.

I’m very happy with my Meraki enterprise grade access points - but they are not inexpensive and do require a management subscription (more $$$).

Thanks. I’ve seen them before. Will check it out.