Nexwall Firewall 26.0.0-rc1

The first start guides you through everything a new firewall needs: the administrator password, the name of the firewall, how it connects to the internet (automatic DHCP by default, fixed IP address or PPPoE), remote access and the security services. After the setup the firewall protects the network without further configuration.

• The WAN interface and the address it received are shown during the setup.
• The default name is FIREWALL.
• The security services are switched on by default; the countries or regions to block are chosen on the last pages.
• A language icon on every page, also on the login page, changes the language and the choice is remembered.
• Nothing is applied until you finish the setup.

Inline intrusion prevention that inspects forwarded traffic and blocks attacks before they reach your servers and users. The page that was called IPS / IDS is now Network Protection (IPS), and the default action for detected threats is Block. You can switch to Detect only and turn alert logging on or off.

• The signature bundle combines three sources in policy tiers: the Snort community rules (4,017 rules), a converted open rule set (51,873 rules) and rules written by Nexwall Labs. It is built on Nexwall servers, signed, and refreshed daily.
• The firewall verifies every bundle, validates it with Snort before installing it and rolls back to the previous one if it does not load.
• A signatures card shows the bundle in use and lets you update it on demand.
• Queues and analysis threads follow the number of CPU cores.
• When the license no longer allows the service, the page shows a banner and inspection is suspended instead of failing silently.

Signature updates need a license; the trial includes them. The open sources used are redistributed under their own licenses.

Recognizes the applications and services crossing the firewall and lets you block, re-prioritize or report them. The traffic classification engine is Netify Agent 5.2.8 with Nexwall's own plugins, and enforcement is applied in the firewall as nftables rules that are validated before they replace the running ones.

• A Nexwall application catalog is delivered daily. The first build knew about 1,500 applications with about 26,000 domain rules, 783 network rules and 26 soft dissectors, compared with 199 applications in the open list shipped with the engine, so far fewer flows stay Unknown.
• A Settings tab shows the catalog status and lets you update now or choose the automatic update frequency.
• Rules can act on a single application or on a whole category.
• Enforcement is tied to a short-lived feature token from the license service. If the token cannot be renewed, enforcement is suspended within seconds and a banner says so; it resumes when the service is back.
• Traffic statistics per application are available while the license is active.

Nexwall now builds and serves its own block lists. A firewall downloads them from Nexwall, checks the signature and the checksum of every file and applies them locally, instead of reading lists from third-party servers.

• Twelve DNS categories, about 3.2 million entries in total: advertising and tracking, adult content, filter bypass, crypto mining, drugs, gambling, malware (core and extended), phishing, piracy, ransomware and scams.
• Two IP lists: known attackers and botnet command servers.
• Each list shows a readable title, the number of entries and a confidence level, so you can decide what to switch on.
• The lists are rebuilt every day; the firewall checks every 30 minutes and reloads its DNS service only when something changed.
• A sensible set of categories is switched on by default and your own choices are kept when you update. A selection made with the earlier categories is migrated.

The Nexwall lists need a license; the trial includes them. They are built only from sources whose licenses allow redistribution.

Large lists need memory. The DNS block lists page now shows how much memory the switched-on categories need compared with the memory installed, and warns you when they would use more than a fifth of it (an error above a third).

• As a guide, every blocked domain takes about 75 bytes.

Country blocking now uses address lists built by Nexwall from the public registry allocation data (five regional internet registries), split by country and published in the same signed bundle as the other lists. The firewall loads them from local files in seconds, instead of downloading a list per country every time the service starts.

• IPv4 (about 179,000 blocks) and IPv6 (about 70,000 blocks) are covered.
• Registry data shows where an address block was allocated, not always where it is used today.

A new viewer for the firewall's logs, opened from the Logs page in its own window. Logs are stored locally for 30 days and the viewer follows the interface language and theme.

• Thirteen tabs: firewall, IP and geo blocking, intrusion prevention, application control, DNS filtering, VPN, high availability, reverse proxy, authentication, administrator activity, system and more.
• Every blocked line tells you the reason; a rule with logging turned on is logged under its own name.
• Click a value to filter by it, and export the result to CSV.
• Live rule tracing shows which rule accepted, rejected or dropped a packet, including blocks by application control; the trace link on each firewall row starts it.
• The viewer runs only while it is enabled.

Established connections that need no inspection can bypass most of the packet processing. The fast path is selective: traffic that Network Protection or Application Control must see stays on the inspected path, and connection counters keep working. It is off by default and is one switch on both the Application Control and Network Protection settings pages.

• Packet steering spreads network processing across the CPU cores; it is on by default for new multi-core installations.
• Larger network card buffers are on by default for new installations. Small default buffers dropped bursts in tests.
• The connection tracking table scales with installed memory (32 entries per MiB, at least 65,536).
• Application Control instances are sized from the CPU count (half of the cores, one to four); Network Protection uses one thread per CPU.

A new page shows what the inspection engines are doing: how busy the traffic classification and intrusion prevention engines are and how much load they put on the machine. Use it to see whether a machine is sized correctly.

If an inspection queue stops issuing verdicts, new connections would wait forever. A watchdog checks every minute, detects a stuck or badly backed-up queue, writes a report with the details, logs it and restarts the engine that owns the queue. The longest outage before recovery is about one to two minutes.

A firewall registers itself with the license server: no code is typed. It starts in a 30-day trial that includes Application Control, Network Protection, DNS Filtering, IP & Geo Blocking and VPN Extended, and the trial ends when your reseller applies a subscription. The Licensing page lists the subscriptions that are active and the ones that are not, including the additional Web Server Protection (WAF) and Email Protection (MTA), and has a Synchronize with server button. The license component updates itself from the signed feed and downloads large data sets reliably.

The web interface, the license component and the traffic-engine plugins are published to a signed Nexwall feed. Every file is pinned by its SHA-256 checksum in the firmware build, so an image always contains exactly the version it was built with.

The firewall platform includes the functions you expect from a complete firewall.

• Zones, policies, port forwarding, NAT, multiple WAN with failover and QoS.
• VPN: IPsec tunnels and OpenVPN remote access, both tested in this release.
• Authentication against a remote Active Directory, tested in this release.
• High availability, reverse proxy with certificates, captive portal and DNS category filtering through a cloud resolver.
• Monitoring with real-time graphs and Checkmk checks, configuration backup and central management.

The name of the firewall is shown at the right of the top bar, next to the Log Viewer button.

The DNS Filtering and the IP & Geo Blocking pages have an Enable all switch at the top right of the lists. A new firewall switches all the Nexwall lists on by itself when they arrive, if its memory allows it.

A new installation no longer starts with an empty forward rules list. It starts with two rules: LAN -> WAN, which allows your internal networks to reach the internet, and DROP DEFAULT, which closes that path and logs what it drops.

• DROP DEFAULT cannot be deleted or moved; it always stays the last forward rule.
• A rule you add is placed above it automatically, so it takes effect.

Existing firewalls keep their current configuration.

The description of output rules now says what they are: rules for traffic that the firewall itself starts, such as updates, DNS, license checks and VPN connections. Every zone already allows this traffic, so you only need output rules to restrict it.

The interface carries the Nexwall design and is available in English, Spanish and Brazilian Portuguese; tabs follow the chosen language. The Threat Shield tables show titles, entry counts and confidence for every list, and the pages for the licensed features say clearly when a license is missing.

The traffic shown in the Monitor (daily traffic, top talkers, live flows) now matches the interface counters. In a test with a 36 MB download the Monitor showed 35.99 MB against 36.33 MB on the interface; before it showed 14 KB.

The product, the image file names, the host name (Nexwall) and the service endpoints use Nexwall names. Registration, inventory, backup, telemetry, updates and licenses are served from Nexwall hosts.

Threat Shield no longer reads block lists from third-party servers or from a mirror. Everything comes from the signed Nexwall bundle.

A firewall that was reinstalled kept its old registration on the license server and could not get its license or its downloads (IPS signatures, lists). Your reseller can now reset the device in the license panel, and the firewall registers again by itself.

Licensing

Opening the Log Viewer restarted the web server under the request that asked for it and the browser reported a network error. Enabling it again no longer restarts anything, and the first time the page waits for the web server.

Logging

The page raised an error when an interface address was stored as 192.168.1.1/24. Addresses are now read in every form and interfaces without a usable IPv4 address are skipped.

Web interface

A plugin of the traffic engine crashed the engine again and again right after it started. The cause was found with a symbolized backtrace and fixed.

Application Control

A plugin queue spun without waiting and kept the engine at 100% of a core. It now waits for work like the other plugins.

Application Control

A plugin could lock the engine against itself. The call path was changed so the engine no longer blocks.

Application Control

Downloads of big data sets from the license service were cut silently at 1 MiB and timed out after 30 seconds. They now accept up to 64 MiB and have ten minutes to complete.

Licensing

A fixed, very high connection tracking limit could exhaust memory on small machines under heavy load. The limit is now derived from the installed memory.

Performance

Small default network card buffers dropped traffic bursts and kept throughput low in tests. Larger buffers and packet steering are now on by default for new installations.

Networking

Without a license, country blocking falls back to the public lists of the underlying component, which are downloaded at every service start and can take a long time. The Nexwall country lists need a license.

Workaround: Activate the license to use the Nexwall lists.

IP & Geo Blocking

Reloading the DNS service with about 1.8 million blocked domains interrupts name resolution for about ten seconds. Lists reload only when they change, normally once a day.

Workaround: Switch off the categories you do not need; the memory warning on the DNS block lists page helps you choose.

DNS Filtering

Web Server Protection (WAF) and Email Protection (MTA) appear as subscriptions, but their features are not available yet.

Licensing

Application Control and Network Protection do not decrypt HTTPS. They recognize applications from the connection, the domain name and the traffic pattern. Web Protection can inspect chosen categories of encrypted traffic (see NXW-2007).

Application Control