Nexwall Firewall 26.0.0-rc2

A firewall nobody has configured yet switches on, by itself and before any login: Network Protection with the Security rule policy blocking what it detects, Application Control with the Standard profile, DNS Filtering and IP & Geo Blocking with all the Nexwall lists. New connections are blocked when the inspection engine cannot keep up, so nothing passes uninspected. If the license is not known yet because the firewall has no internet, the steps are tried again for about half an hour, then at the next start. The setup wizard can change every choice.

Three ready-made profiles create the Application Control rules for you: Standard (adult content, malware, VPN and proxy anonymizers, peer-to-peer, encrypted DNS that bypasses the DNS filter), School (Standard plus social networks, video hosting and streaming, games, entertainment) and Restricted (School plus online shopping, recreation and sports, remote-desktop tools, cloud file sharing, advertising). Social networks and normal home use stay allowed in Standard. The rules block whole categories of the application catalog, so new applications of a category are covered automatically. Choose the profile in the setup wizard, or from the command line with nexwall-dpi-profile.

The wizard is shown at the first access to a new firewall without asking for the default password first, also when the browser still holds a session of an earlier firewall at the same address. After the security services a new page offers the three profiles, explains what each one blocks and applies it together with all the DNS and IP protection lists.

A new firewall with two network ports uses the second one as its internet connection (WAN) with DHCP: when the modem or router gives an address, the wizard shows it. If the firewall has no internet port configured, the wizard lets you choose the port and then DHCP, a fixed address or PPPoE.

Open https://firewall.nexwall.com.br from the internal network. The firewall answers that name itself, with an entry that follows its internal address, and presents a certificate for it that it downloads from the Nexwall license server. The web interface keeps its own certificate until a valid one is installed and goes back to it if the downloaded one stops being valid. Opening the web interface by its IP address still shows the browser warning: no public authority issues certificates for private addresses.

The DNS Filtering and the IP & Geo Blocking settings show a card with the installed list version, how many lists are on, how many domains, addresses and country blocks they hold, the last check and its result, and a button to check for updates now.

Traffic Analytics shows what DNS Filtering blocked today (total, by hour, most blocked domains) and what the country blocks refused (total, by hour, by country), next to the existing IP blocklist and brute-force charts.

The viewer opens in a window of its own that fills the screen, is titled FIREWALL LOG VIEWER and has the icon of the firewall. After Firewall traffic the tabs are Application Control (DPI), Network Protection (IPS), DNS Protection and IP & Geo Block; Live rule trace and Packet path are followed by a new Dropped Packets tab. The language is chosen with the same icon as the web interface.

The default LAN -> WAN rule now logs, at a limited rate, the traffic it lets through, so the Firewall traffic tab shows allowed traffic as well as blocked traffic.

The company name (when the firewall is registered) and the unit name are shown together as one badge at the right of the top bar, next to the Log Viewer button.

The Enable all switch sits between the search button and the service state, and switches the Nexwall lists on and off. The page lists the Nexwall lists; third-party community lists are shown only when they are already switched on, so they can be switched off.

The volume of every local host comes from the connection tracker of the firewall, so it counts all the traffic, also the part of long transfers that the inspection engine does not look at. The first refresh after a pause shows the inspection figures until a measurement exists.

The language control on the login page and in the setup wizard is a visible button with the current language.

The welcome page no longer advises to disconnect the unit from the internet: the protection lists are downloaded during the setup.

A browser that still held a login of an earlier firewall at the same address went to the login page instead of the wizard of a new firewall.

Setup wizard

On a firewall whose ports were not named by the image, the wizard reported that the WAN zone had no interface.

Setup wizard

A session token without a user made the management API stop answering that request with a crash; it now answers not authorized.

Management API

The cron restart after an IPS change called a wrong path; the telemetry DNS check asked a question the firewall refuses; the updaters of the old application catalog service reported a 404 every day and at every start; two updates of the IPS signatures could write the same file at once. All of them are corrected or removed.

Logging

Without a license, country blocking falls back to the public lists of the underlying component, which are downloaded at every service start and can take a long time. The Nexwall country lists need a license.

Workaround: Activate the license to use the Nexwall lists.

IP & Geo Blocking

Reloading the DNS service with about 1.8 million blocked domains interrupts name resolution for about ten seconds. Lists reload only when they change, normally once a day.

Workaround: Switch off the categories you do not need; the memory warning on the DNS block lists page helps you choose.

DNS Filtering

Web Server Protection (WAF) and Email Protection (MTA) appear as subscriptions, but their features are not available yet.

Licensing

Application Control and Network Protection do not decrypt HTTPS. They recognize applications from the connection, the domain name and the traffic pattern. Web Protection can inspect chosen categories of encrypted traffic (see NXW-2007).

Application Control

Opening the web interface by its IP address (for example https://192.168.1.1) shows a browser certificate warning, because no public authority issues certificates for private addresses.

Workaround: Use https://firewall.lan.nexwall.com.br (the computer must use the firewall as DNS server, the default with DHCP), or http://192.168.1.1, which forwards to it.

Web interface

Blocked domains are counted from the DNS log. A firewall installed before rc2 needs query logging switched on in its DNS settings to show them.

Workaround: Turn on query logging in the DNS settings.

DNS Filtering