All releases / 26.0.0-rc3
Fixes from testing a freshly installed firewall: signature installation, skipping the wizard, editable profile rules, logging of blocked applications and a live trace of dropped packets.
Nexwall Firewall 26.0.0-rc3 completes the secure-by-default firewall: protections are active from the first start, Application Control profiles can be edited, intrusion signatures are installed automatically, the setup wizard can be skipped without a login, and the Log Viewer shows what the firewall blocks, including a live trace of dropped packets with the rule that stopped each one.
This is a release candidate: use it to evaluate and to test in the lab, not as the only protection of a production network.
Skip wizard works on the first page before any login: the firewall keeps its default password and you log in with it. A firewall whose password was changed but whose wizard was left unfinished shows the login page, and the login leads back into the wizard.
The rules a profile created open in the same window as any other rule: the categories they block are shown and kept, and you can change the interface, the sources, the name and the logging, or add applications.
The internal bridge and every other interface can be chosen for a new rule, also after a profile created rules on it.
What Application Control blocks is logged (rate limited) and shows in the Log Viewer, on new firewalls and whenever a profile is applied.
A new firewall rule starts with logging on (rate limited), so its blocked or allowed traffic shows in the Log Viewer.
The signature updater waited for its own lock when it started the installation step, so the signatures were downloaded but never installed and the IPS page showed no signature information. Only the commands that write take the lock now and the status always answers.
Skip wizard needed a session that does not exist on a new firewall.
Signing out with a session the firewall could not read stopped the request with a crash in the log.
Without a license, country blocking falls back to the public lists of the underlying component, which are downloaded at every service start and can take a long time. The Nexwall country lists need a license.
Workaround: Activate the license to use the Nexwall lists.
Reloading the DNS service with about 1.8 million blocked domains interrupts name resolution for about ten seconds. Lists reload only when they change, normally once a day.
Workaround: Switch off the categories you do not need; the memory warning on the DNS block lists page helps you choose.
Web Server Protection (WAF) and Email Protection (MTA) appear as subscriptions, but their features are not available yet.
Application Control and Network Protection do not decrypt HTTPS. They recognize applications from the connection, the domain name and the traffic pattern. Web Protection can inspect chosen categories of encrypted traffic (see NXW-2007).
Opening the web interface by its IP address (for example https://192.168.1.1) shows a browser certificate warning, because no public authority issues certificates for private addresses.
Workaround: Use https://firewall.lan.nexwall.com.br (the computer must use the firewall as DNS server, the default with DHCP), or http://192.168.1.1, which forwards to it.
Blocked domains are counted from the DNS log. A firewall installed before rc2 needs query logging switched on in its DNS settings to show them.
Workaround: Turn on query logging in the DNS settings.
The versions below make up the image. Most of them are pinned by checksum, so the image always contains exactly these versions. The signature bundle, the application catalog and the threat lists are not part of the image: they are downloaded and refreshed daily.
| Component | Version | Notes |
|---|---|---|
| Image | 26.0.0-rc3 | x86-64, UEFI, compressed disk image |
| Firmware sources | v26.0.0-rc3 | Commit of the public firewall repository the image is built from |
| Base system | OpenWrt 25.12.5 | Linux kernel 6.12, nftables 1.1 |
| Web interface | 1.3.10 | English, Spanish, Brazilian Portuguese |
| License component | 1.6.0 | Updates itself from the signed feed |
| Traffic classification engine | 5.2.8 (release 6) | Netify Agent with Nexwall plugins |
| Traffic engine plugins | 1.0.1 | Five plugins, built for engine release 6 |
| Intrusion prevention engine | Snort 3.10.0.0 | With the Nexwall gate plugin 1.0.1 |
| Intrusion signatures | daily bundle | Community, converted open rules and Nexwall Labs; 2026.10.02.1 at release |
| Application catalog | daily bundle | 2026.10.02.1 at release |
| Threat lists | 2026.10.02.3 | 12 DNS categories, 2 IP lists, country lists; rebuilt daily |
How this release came together, from the first image to the release candidate.
Nexwall branding, naming and licensing files; the baseline image booted in a virtual machine.
The web interface, monitoring, captive portal and Checkmk checks are built from Nexwall repositories; Application Control enforcement and its statistics were added; services moved to Nexwall hosts; the DNS & DHCP address bug was fixed.
Booted with the new interface and Portuguese translation; an IPsec tunnel to a third-party firewall, a remote Active Directory and OpenVPN remote access were configured and worked.
The engine was upgraded and the flow, statistics and HTTP-sink plugins were verified end to end on a running unit.
The action plugin was tested live; a crash loop and a busy-wait that used a whole CPU core were found and fixed, and labels were confirmed end to end.
The Nexwall application catalog, the traffic accounting fix, the Log Viewer with live rule tracing and the stalled-queue watchdog were built and tested.
The signed update feed, feature tokens for Application Control, statistics and Network Protection, the intrusion signature service and the Network Protection gate plugin.
Inspection threads, fast path, packet steering, larger buffers and the Engine monitor; Network Protection naming and Block default; daily refresh of signatures and catalog; Threat Shield feeds, geo-blocking and the memory warning; the default firewall rules; web interface 1.3.6; the release candidate image.
Setup wizard with network and security steps, subscriptions by module, registration without a code, enable-all switches, Log Viewer fix, web interface 1.3.7 and license component 1.6.0.
Application Control profiles, protection from the first start, wizard before login, certificate for firewall.nexwall.com.br, Log Viewer rework, DNS and country analytics, web interface 1.3.9.
Signature installation, wizard skip without login, editable profile rules, any interface for new Application Control rules, logging of blocked applications and of new firewall rules, Dropped Packets live trace, web interface 1.3.10.
The image is published with its checksum when the release is announced.
Nexwall Firewall is built on open source software, among them OpenWrt, the Linux kernel, nftables, Snort 3, Netify Agent and nDPI, dnsmasq, banIP, adblock and VictoriaMetrics. The firewall and the operator tools are published under their original licenses, and the license texts and notices are shipped with the image and available on request. The Threat Shield lists are built from open sources whose licenses allow redistribution, and the notice that lists them is part of every bundle.