Netgate 2100 — login, gateway address and status lights

What is the Netgate 2100 gateway address?

The Netgate 2100 settings page is at 192.168.1.1. Type that into the address bar of a browser — not into a search box, which will just search for the number instead of opening the page.

Your device has to be connected to the Netgate 2100 itself for this to work — over its Wi-Fi or by cable. On mobile data, or connected to a different network, the address goes nowhere.

Over HTTPS on the standard port, and reachable from any of the four rear LAN ports, which are switched and all uplink to the one LAN interface. Netgate itself flags the obvious problem with this address in a UK setting, twice and in bold: if the ISP router on the WAN side is also 192.168.1.1, unplug the Netgate's WAN port before you start and change the LAN address during setup, or you will have the same subnet on both sides.

What is the default username and password for the Netgate 2100?

What do the lights on the Netgate 2100 mean?

Here is what each light on the Netgate 2100 is telling you, and what to do about it.

The WAN and LAN port conventions are inverted relative to each other — left light only means gigabit on the WAN port but 100 Mbps on a LAN port. That is what Netgate publishes, and it is a real trap rather than a documentation error.

How do you reset a Netgate 2100?

What you lose. Netgate describes it as a process that "also attempts to remove any installed packages", and that clause is the one that catches people. As well as all firewall rules and aliases, NAT and port forwards, IPsec, OpenVPN and WireGuard tunnels with their keys and certificates, the certificate authority and everything it issued, VLANs and interface assignments, DHCP scopes and static mappings and traffic shaping, a reset removes every installed package — pfBlockerNG, Suricata, HAProxy, ACME and the rest — along with their configuration. The LAN returns to 192.168.1.1 with admin and pfsense.

1. The reset button is recessed in the rear panel and needs a paperclip, and it only works during boot — Netgate is explicit that "it does not respond when pushed while the system is running". The sequence is: remove power; gently depress the reset button; apply power while keeping it depressed; keep holding for about 30 seconds until the device has booted far enough to check the button; all three front lights flash red rapidly once the reset starts; wait for it to reboot. It comes back on https://192.168.1.1. Netgate adds that "if this procedure fails, connect to the console and perform a factory reset there". There are also two software routes: Diagnostics then Factory Defaults in the web interface, and option 4 in the console menu.
2. Hold it for About 30 seconds, held from the moment power is applied, until all three front lights flash red rapidly..
3. Release, and give the unit a few minutes to restart before trying to connect.

Do not reset this to recover a lost password. The console menu resets the admin account without touching the configuration, which is almost certainly what you want — see recovery.

A reboot is not a reset. A normal reboot keeps every setting, and the reset button does nothing at all while the unit is running. Allow four to five minutes for a full boot; Netgate says so explicitly, and impatient engineers pull the power mid-boot.

What if you cannot get into the Netgate 2100 at all?

Yes, and this is the best recovery story of any firewall in this tier. Both routes need physical console access — Mini-USB on the rear at 115200 baud with hardware flow control disabled — and neither wipes your configuration. The first is console menu option 3, "Reset admin account and password": Netgate says it "can also reset the admin account if it is disabled or expired", it re-creates the account if it was deleted, and it points authentication back at the local database if it had been aimed at RADIUS or LDAP. Note the behaviour changed — older versions reset the password to a default, whereas current versions prompt you to set a new one. If the console itself has been password-protected, the second route is single-user mode: reboot, choose Boot Single User from the loader menu, press Enter for a shell, remount the partitions writable, run /etc/rc.initial.password, then reboot. Netgate is candid that console protection is not real security, because "a knowledgeable person with physical access can still reset the passwords".

If that does not work, a factory reset will always get you in, at the cost of every setting on the unit.