diff --git a/client/cmd/login.go b/client/cmd/login.go
index 3ac2118051e..675b5fdf801 100644
--- a/client/cmd/login.go
+++ b/client/cmd/login.go
@@ -109,6 +109,24 @@ func doDaemonLogin(ctx context.Context, cmd *cobra.Command, providedSetupKey str
 		loginRequest.OptionalPreSharedKey = &preSharedKey
 	}
 
+	// set the new config
+	cfg, err := client.GetConfig(ctx, &proto.GetConfigRequest{
+		ProfileName: activeProf.Name,
+		Username:    username,
+	})
+	if err != nil {
+		return fmt.Errorf("get config from daemon: %v", err)
+	}
+
+	req := setupSetConfigReqForLogin(cfg, activeProf.Name, username)
+	if _, err := client.SetConfig(ctx, req); err != nil {
+		if st, ok := gstatus.FromError(err); ok && st.Code() == codes.Unavailable {
+			log.Warnf("setConfig method is not available in the daemon")
+		} else {
+			return fmt.Errorf("call service setConfig method: %v", err)
+		}
+	}
+
 	var loginErr error
 
 	var loginResp *proto.LoginResponse
@@ -383,3 +401,28 @@ func setEnvAndFlags(cmd *cobra.Command) error {
 
 	return nil
 }
+
+func setupSetConfigReqForLogin(cfg *proto.GetConfigResponse, profileName, username string) *proto.SetConfigRequest {
+	var req proto.SetConfigRequest
+	req.ProfileName = profileName
+	req.Username = username
+
+	req.ManagementUrl = managementURL
+	req.AdminURL = adminURL
+
+	req.RosenpassEnabled = &cfg.RosenpassEnabled
+	req.RosenpassPermissive = &cfg.RosenpassPermissive
+	req.DisableAutoConnect = &cfg.DisableAutoConnect
+	req.ServerSSHAllowed = &cfg.ServerSSHAllowed
+	req.NetworkMonitor = &cfg.NetworkMonitor
+	req.DisableClientRoutes = &cfg.DisableClientRoutes
+	req.DisableServerRoutes = &cfg.DisableServerRoutes
+	req.DisableDns = &cfg.DisableDns
+	req.DisableFirewall = &cfg.DisableFirewall
+	req.BlockLanAccess = &cfg.BlockLanAccess
+	req.DisableNotifications = &cfg.DisableNotifications
+	req.LazyConnectionEnabled = &cfg.LazyConnectionEnabled
+	req.BlockInbound = &cfg.BlockInbound
+
+	return &req
+}
diff --git a/client/proto/daemon.pb.go b/client/proto/daemon.pb.go
index 841e3c0f777..34230a5b472 100644
--- a/client/proto/daemon.pb.go
+++ b/client/proto/daemon.pb.go
@@ -7,14 +7,15 @@
 package proto
 
 import (
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	_ "google.golang.org/protobuf/types/descriptorpb"
 	durationpb "google.golang.org/protobuf/types/known/durationpb"
 	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
-	reflect "reflect"
-	sync "sync"
-	unsafe "unsafe"
 )
 
 const (
@@ -1064,6 +1065,7 @@ type GetConfigResponse struct {
 	DisableClientRoutes   bool   `protobuf:"varint,18,opt,name=disable_client_routes,json=disableClientRoutes,proto3" json:"disable_client_routes,omitempty"`
 	DisableServerRoutes   bool   `protobuf:"varint,19,opt,name=disable_server_routes,json=disableServerRoutes,proto3" json:"disable_server_routes,omitempty"`
 	BlockLanAccess        bool   `protobuf:"varint,20,opt,name=block_lan_access,json=blockLanAccess,proto3" json:"block_lan_access,omitempty"`
+	DisableFirewall       bool   `protobuf:"varint,21,opt,name=disable_firewall,json=disableFirewall,proto3" json:"disable_firewall,omitempty"`
 	unknownFields         protoimpl.UnknownFields
 	sizeCache             protoimpl.SizeCache
 }
@@ -1238,6 +1240,13 @@ func (x *GetConfigResponse) GetBlockLanAccess() bool {
 	return false
 }
 
+func (x *GetConfigResponse) GetDisableFirewall() bool {
+	if x != nil {
+		return x.DisableFirewall
+	}
+	return false
+}
+
 // PeerState contains the latest state of a peer
 type PeerState struct {
 	state                      protoimpl.MessageState `protogen:"open.v1"`
@@ -4698,7 +4707,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\fDownResponse\"P\n" +
 	"\x10GetConfigRequest\x12 \n" +
 	"\vprofileName\x18\x01 \x01(\tR\vprofileName\x12\x1a\n" +
-	"\busername\x18\x02 \x01(\tR\busername\"\xb5\x06\n" +
+	"\busername\x18\x02 \x01(\tR\busername\"\xe0\x06\n" +
 	"\x11GetConfigResponse\x12$\n" +
 	"\rmanagementUrl\x18\x01 \x01(\tR\rmanagementUrl\x12\x1e\n" +
 	"\n" +
@@ -4723,7 +4732,8 @@ const file_daemon_proto_rawDesc = "" +
 	"disableDns\x122\n" +
 	"\x15disable_client_routes\x18\x12 \x01(\bR\x13disableClientRoutes\x122\n" +
 	"\x15disable_server_routes\x18\x13 \x01(\bR\x13disableServerRoutes\x12(\n" +
-	"\x10block_lan_access\x18\x14 \x01(\bR\x0eblockLanAccess\"\xde\x05\n" +
+	"\x10block_lan_access\x18\x14 \x01(\bR\x0eblockLanAccess\x12)\n" +
+	"\x10disable_firewall\x18\x15 \x01(\bR\x0fdisableFirewall\"\xde\x05\n" +
 	"\tPeerState\x12\x0e\n" +
 	"\x02IP\x18\x01 \x01(\tR\x02IP\x12\x16\n" +
 	"\x06pubKey\x18\x02 \x01(\tR\x06pubKey\x12\x1e\n" +
diff --git a/client/proto/daemon.proto b/client/proto/daemon.proto
index 5b27b4d9850..3bf86873ca8 100644
--- a/client/proto/daemon.proto
+++ b/client/proto/daemon.proto
@@ -252,6 +252,8 @@ message GetConfigResponse {
   bool disable_server_routes = 19;
 
   bool block_lan_access = 20;
+
+  bool disable_firewall = 21;
 }
 
 // PeerState contains the latest state of a peer
diff --git a/client/server/server.go b/client/server/server.go
index e6de608c529..052809362f2 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -1127,6 +1127,7 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 	disableClientRoutes := cfg.DisableClientRoutes
 	disableServerRoutes := cfg.DisableServerRoutes
 	blockLANAccess := cfg.BlockLANAccess
+	disableFirewall := cfg.DisableFirewall
 
 	return &proto.GetConfigResponse{
 		ManagementUrl:         managementURL.String(),
@@ -1147,6 +1148,7 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		DisableClientRoutes:   disableClientRoutes,
 		DisableServerRoutes:   disableServerRoutes,
 		BlockLanAccess:        blockLANAccess,
+		DisableFirewall:       disableFirewall,
 	}, nil
 }