WatchGuard Firebox T25 — login, gateway address and status lights
Open a browser on a device connected to your WatchGuard Firebox T25 and go to 10.0.1.1.
The documented default login is admin with the password readwrite.
Before you reset anything: a lost admin password on this model cannot be recovered. A factory reset is the only way back in and it erases the entire configuration.
The WatchGuard Firebox T25 is a firewall router from WatchGuard, in UK use 2022-2025 (end of sale). This page covers the four things people actually come looking for: its settings address, how its login works, what its lights mean and how to reset it safely.
What is the WatchGuard Firebox T25 gateway address?
The WatchGuard Firebox T25 settings page is at 10.0.1.1. Type that into the address bar of a browser — not into a search box, which will just search for the number instead of opening the page.
Your device has to be connected to the WatchGuard Firebox T25 itself for this to work — over its Wi-Fi or by cable. On mobile data, or connected to a different network, the address goes nowhere.
On interface 1, the one labelled 1/LAN, and the web interface is on port 8080 over HTTPS — so the address is https://10.0.1.1:8080. WatchGuard would rather you took a DHCP lease than set a static address: "when you connect to the Firebox, it will assign an IP address on the 10.0.1.0/24 network". Interfaces 2, 3 and 4 do come up on 10.0.2.1, 10.0.3.1 and 10.0.4.1, but with the DHCP server switched off, so they will not hand you anything. The alternate trusted addresses you may see quoted — 10.0.32.1 and 10.0.24.1 — belong to the M5600, M5800 and M4800 and have nothing to do with a T25.
What is the default username and password for the WatchGuard Firebox T25?
Documented fixed default
The manufacturer publishes a single default login for the WatchGuard Firebox T25, so we can show it:
- Username
admin- Password
readwrite
WatchGuard says "log in with the user name admin and the passphrase readwrite". It calls these passphrases rather than passwords throughout, and there is a second built-in account: status, the read-only monitoring one. A factory reset re-creates both with their default passphrases. The certificate is self-signed so your browser will complain, and WatchGuard tells you outright that you "can safely ignore certificate warnings".
This only works if nobody has changed it. On a unit that has been in service for a while, someone should have, and if they did then no published default will help you.
What do the lights on the WatchGuard Firebox T25 mean?
Here is what each light on the WatchGuard Firebox T25 is telling you, and what to do about it.
| Light | What it means | What to do |
|---|---|---|
| Powersolid green | The Firebox is powered on. | |
| Statussolid | There is a management connection to the device. It lights for 30 seconds after you connect with the web interface or the CLI, and while WatchGuard System Manager is polling the unit. | |
| Modesolid green | The device can reach the external network and send traffic. | |
| Modeflashing green | The device cannot send traffic to the external network. | Start at the WAN: check interface 0 has a lease or a valid static address, then check the device upstream of it. |
| Attnsolid amber | Lit when you start the device with the Reset button held, and it stays solid once the reset is complete. | During a factory reset this is your cue to power the unit off and on again to finish the job. |
| Attnflashing amber | A reset is in progress. | Release the Reset button now, then wait for the light to go solid. |
| Failoversolid | A WAN failover has moved traffic from the primary external interface to the backup. It goes out again once the primary comes back. | Your primary line is down. The site is still up on the backup, but find out why before the backup fails too. |
| 2.4GHzsolid | The 2.4GHz wireless interface is enabled. T25-W only. | |
| 2.4GHzflashing | Data is being sent and received on 2.4GHz. The blink gets faster as traffic increases. T25-W only. | |
| 5GHzsolid | The 5GHz wireless interface is enabled. T25-W only. | |
| 5GHzflashing | Data is being sent and received on 5GHz. T25-W only. | |
| Port 1000solid amber | That port has a 1000 Mbps link. | |
| Port 1000flashing amber | Data is being sent and received at 1000 Mbps. The blink gets faster as traffic increases. | |
| Port 10/100solid green | That port has a 10 or 100 Mbps link. | If you expected gigabit, check the patch lead first. Remember interfaces 1 to 4 are full duplex only. |
| Port 10/100flashing green | Data is being sent and received at 10 or 100 Mbps. |
How do you reset a WatchGuard Firebox T25?
What you lose. WatchGuard enumerates it precisely, and one item on the list surprises people: "any saved backup images are deleted from the Firebox". So a reset can destroy the very restore point you were relying on. Beyond that it clears all firewall policies, branch office and mobile VPN configuration along with their shared secrets, VLANs, multi-WAN and failover settings, proxies, subscription service policies and authentication settings. Interface 0 comes back as an external DHCP client, interface 1 as trusted on 10.0.1.1 with DHCP serving, and the admin and status accounts return to their default passphrases. The unit will not pass any traffic until you have run a setup wizard.
- There is a reset button on the rear, next to the network ports and the power switch. It is a normal press button rather than a recessed one, so you do not need a pin. The procedure is a power-on-with-button-held sequence and it needs two power cycles: power off; press and hold Reset; power on while still holding; keep holding until the Attn light on the front starts to flash; release; wait until Attn stays lit and stops flashing; power off; power on again. WatchGuard is emphatic about that last pair of steps — "you must complete the second reboot at the end to restart your device before you can connect to it".
- Hold it for From power-on until the Attn light begins to flash. WatchGuard defines this by the light rather than in seconds, so we publish no second count..
- Release, and give the unit a few minutes to restart before trying to connect.
Copy the configuration off the box before you reset it. A backup stored on the Firebox itself does not survive.
A reboot is not a reset. A normal restart keeps every setting. Only the power-on-with-Reset-held sequence clears them.
What if you cannot get into the WatchGuard Firebox T25 at all?
A lost password cannot be recovered on this model. There is no backdoor, no master password and no way for the manufacturer to retrieve it.
No. WatchGuard documents no passphrase recovery route, and is direct about what that means: "if you do not know the configuration passphrase, or if a power interruption causes damage to the Fireware, you can use the Quick Setup Wizard or Web Setup Wizard to build your configuration again or restore a saved configuration". The Hardware Guide repeats it. There is a serial console and a Fireware CLI, but WatchGuard documents those for configuration and troubleshooting, not for getting back in. If you have lost the T25 passphrase and have no saved configuration file, you are rebuilding from scratch — which is exactly why the backup-deletion behaviour of a reset matters so much on this model.
That leaves two options, in this order: find whoever set the unit up and ask them, or factory reset it and rebuild the configuration from scratch. Restoring a configuration backup does not help, because the backup contains the same password you do not know.
Where this comes from
- Firebox T25 Hardware Guide — Model-specific source for the indicator set, the reset procedure and the full-duplex restriction.
- Firebox T25 Quick Start Guide — Source of the admin / readwrite passphrase.
- About Fireware factory-default settings — The 10.0.1.1/24 trusted interface, port 8080, and what a reset restores.
- Fireware recovery procedures — The deletion of on-box backup images, and the absence of any passphrase recovery route.
- WatchGuard end-of-life policy and dates — End of sale 1 December 2025, end of life 1 July 2031, migration path Firebox T125.