A trusted web address with its own certificate for every firewall, quiet logs on a busy firewall, and the remaining system log errors fixed.
Release candidateRelease date:
Overview
Nexwall Firewall 26.0.0-rc4 gives every firewall a trusted web address with a certificate of its own, so the administrator's browser opens the web interface without a warning, and it keeps the system log and the console quiet on a busy firewall. It builds on a firewall that protects the network from the first start, with editable Application Control profiles, a setup wizard that works without a login and a Log Viewer with live rule tracing.
This is a release candidate: use it to evaluate and to test in the lab, not as the only protection of a production network.
Version
26.0.0-rc4
Status
Release candidate
Platform
x86-64, UEFI boot
Base system
OpenWrt 25.12.5, kernel 6.12
Interface languages
English, Spanish, Brazilian Portuguese
Licensed features
Trial included
What is new
The features below are new in this release.
New
A trusted web address, one certificate for each firewall
Every firewall answers at https://firewall.lan.nexwall.com.br and at https://<serial>.lan.nexwall.com.br (the serial number in lower case) with a Let's Encrypt certificate that belongs to that firewall alone. The firewall creates its own private key, which never leaves it, requests the certificate through the Nexwall license server and renews it 28 days before it expires. Until a certificate is installed, or if it becomes invalid, the web interface keeps its own certificate and stays reachable. The computer must use the firewall as DNS server (the default with DHCP).
New
The address on port 80
http://<LAN address> and http://firewall.lan open a short page that forwards to the trusted address when the computer can reach it and shows the direct link when it cannot.
Improvements and changes
Improved
Quiet logs
The default LAN -> WAN rule no longer logs the traffic it allows, and the firewall console shows errors only (the system log and the Log Viewer keep every line). Application Control logs at most 5 blocked connections per second. Allowed traffic stays visible in Flows, Top talkers and Traffic analytics, or by turning logging on in a rule. A firewall that had the earlier setting is switched back at the update.
Improved
New blocking rules are logged
A new firewall rule that drops or rejects starts with logging on, at a limited rate, so what it blocks appears in the Log Viewer. A rule that allows starts with logging off.
Resolved issues
FixedNXW-1017
Cloud backup requests in the log
The Dashboard asked every few seconds for the list of cloud backups and logged an error each time on a firewall without cloud backup. The request now answers that there are none, and the Dashboard card is hidden and stops asking.
Backup
FixedNXW-1018
Warning about /etc/firewall.user
The firewall configuration pointed to a file that did not exist and logged a warning at every start; the file is now part of the image.
Logging
FixedNXW-1019
Errors of the port 80 page in the log
The page on port 80 wrote an error line for every unknown address it was asked for.
Logging
Known issues
Known issueNXW-2001
Country blocking without a license
Without a license, country blocking falls back to the public lists of the underlying component, which are downloaded at every service start and can take a long time. The Nexwall country lists need a license.
Workaround: Activate the license to use the Nexwall lists.
IP & Geo Blocking
Known issueNXW-2002
Large DNS list selections
Reloading the DNS service with about 1.8 million blocked domains interrupts name resolution for about ten seconds. Lists reload only when they change, normally once a day.
Workaround: Switch off the categories you do not need; the memory warning on the DNS block lists page helps you choose.
DNS Filtering
Known issueNXW-2003
Additional subscriptions
Web Server Protection (WAF) and Email Protection (MTA) appear as subscriptions, but their features are not available yet.
Licensing
Known issueNXW-2004
Encrypted traffic
Application Control and Network Protection do not decrypt HTTPS. They recognize applications from the connection, the domain name and the traffic pattern. Web Protection can inspect chosen categories of encrypted traffic (see NXW-2007).
Application Control
Known issueNXW-2005
Web interface by IP address
Opening the web interface by its IP address (for example https://192.168.1.1) shows a browser certificate warning, because no public authority issues certificates for private addresses.
Workaround: Use https://firewall.lan.nexwall.com.br (the computer must use the firewall as DNS server, the default with DHCP), or http://192.168.1.1, which forwards to it.
Web interface
Known issueNXW-2006
DNS block statistics
Blocked domains are counted from the DNS log. A firewall installed before rc2 needs query logging switched on in its DNS settings to show them.
Workaround: Turn on query logging in the DNS settings.
DNS Filtering
Component versions
The versions below make up the image. Most of them are pinned by checksum, so the image always contains exactly these versions. The signature bundle, the application catalog and the threat lists are not part of the image: they are downloaded and refreshed daily.
Component
Version
Notes
Image
26.0.0-rc4
x86-64, UEFI, compressed disk image
Firmware sources
v26.0.0-rc4
Commit of the public firewall repository the image is built from
Base system
OpenWrt 25.12.5
Linux kernel 6.12, nftables 1.1
Web interface
1.3.12
English, Spanish, Brazilian Portuguese
License component
1.6.0
Updates itself from the signed feed
Traffic classification engine
5.2.8 (release 6)
Netify Agent with Nexwall plugins
Traffic engine plugins
1.0.1
Five plugins, built for engine release 6
Intrusion prevention engine
Snort 3.10.0.0
With the Nexwall gate plugin 1.0.1
Intrusion signatures
daily bundle
Community, converted open rules and Nexwall Labs; 2026.10.02.1 at release
Application catalog
daily bundle
2026.10.02.1 at release
Threat lists
2026.10.02.3
12 DNS categories, 2 IP lists, country lists; rebuilt daily
Release track
How this release came together, from the first image to the release candidate.
First image
Nexwall branding, naming and licensing files; the baseline image booted in a virtual machine.
Nexwall sources
The web interface, monitoring, captive portal and Checkmk checks are built from Nexwall repositories; Application Control enforcement and its statistics were added; services moved to Nexwall hosts; the DNS & DHCP address bug was fixed.
First Nexwall-only image
Booted with the new interface and Portuguese translation; an IPsec tunnel to a third-party firewall, a remote Active Directory and OpenVPN remote access were configured and worked.
Traffic engine 5.2.8 and Nexwall plugins
The engine was upgraded and the flow, statistics and HTTP-sink plugins were verified end to end on a running unit.
Application Control actions
The action plugin was tested live; a crash loop and a busy-wait that used a whole CPU core were found and fixed, and labels were confirmed end to end.
Catalog, accounting and logs
The Nexwall application catalog, the traffic accounting fix, the Log Viewer with live rule tracing and the stalled-queue watchdog were built and tested.
Signed feed and licensed services
The signed update feed, feature tokens for Application Control, statistics and Network Protection, the intrusion signature service and the Network Protection gate plugin.
Performance, threat feeds and defaults
Inspection threads, fast path, packet steering, larger buffers and the Engine monitor; Network Protection naming and Block default; daily refresh of signatures and catalog; Threat Shield feeds, geo-blocking and the memory warning; the default firewall rules; web interface 1.3.6; the release candidate image.
Guided setup and licensing by module
Setup wizard with network and security steps, subscriptions by module, registration without a code, enable-all switches, Log Viewer fix, web interface 1.3.7 and license component 1.6.0.
Secure by default and trusted web address
Application Control profiles, protection from the first start, wizard before login, certificate for firewall.nexwall.com.br, Log Viewer rework, DNS and country analytics, web interface 1.3.9.
Fixes after testing rc2
Signature installation, wizard skip without login, editable profile rules, any interface for new Application Control rules, logging of blocked applications and of new firewall rules, Dropped Packets live trace, web interface 1.3.10.
A certificate for each firewall, quiet logs
Per-unit web certificates with the trusted address firewall.lan.nexwall.com.br, the port 80 page, quieter logs and console, cloud backup list without errors, web interface 1.3.12.
Requirements
x86-64 processor, UEFI firmware with Secure Boot off.
At least two network interfaces (one for the internal network, one for the internet).
2 GB of memory with the default threat categories; 4 GB or more if you switch on the adult, advertising and extended malware lists.
Internet access to updates.nexwall.com.br, license.nexwall.com.br and services.nexwall.com.br for updates, licenses, threat feeds and registration.
Installing and upgrading
The release is an installable disk image for virtual machines and appliances. Check its SHA-256 first.
After the first start the internal interface answers on 192.168.1.1. Change the administrator password on the first login.
Firewalls running an earlier internal build are not upgraded in place by this release candidate; install the image on a test machine and compare.
Do not restore a configuration backup taken on an older internal build: its traffic engine settings use another format.
To check the file on Linux run sha256sum on it; on Windows run Get-FileHash with -Algorithm SHA256 in PowerShell. The result must equal the SHA-256 in the Downloads table.
The administration guide is at https://docs.nexwall.com.br.
The LAN -> WAN and DROP DEFAULT rules, packet steering and larger network card buffers are part of the default configuration. A firewall installed earlier keeps the settings it has. Add the two rules by hand on an existing firewall and keep DROP DEFAULT at the end of the list.
A firewall that is reinstalled while it is assigned to a customer needs its device reset by the reseller before it can get its license again.
Check the file before you use it: the SHA-256 of the downloaded file must equal the value above.
Open source and licenses
Nexwall Firewall is built on open source software, among them OpenWrt, the Linux kernel, nftables, Snort 3, Netify Agent and nDPI, dnsmasq, banIP, adblock and VictoriaMetrics. The firewall and the operator tools are published under their original licenses, and the license texts and notices are shipped with the image and available on request. The Threat Shield lists are built from open sources whose licenses allow redistribution, and the notice that lists them is part of every bundle.