All releases / 26.1.0
Web Protection: websites by category with optional inspection of encrypted traffic, an antivirus for downloads, one-choice profiles for home, school and company, SafeSearch and YouTube restrictions, and a traffic and applications view in the Log Viewer.
Nexwall Firewall 26.1.0 adds Web Protection to the firewall. A single choice in the setup wizard (Standard, School or Restricted) now protects applications and websites together: unwanted website categories are blocked, categories that stay allowed but deserve a look are inspected inside the encrypted traffic and every download is scanned for viruses. Search engines and YouTube can be forced into their safe modes for children. The Log Viewer shows the applications and websites used, and the traffic reports are kept for 35 days. The system partition is larger, the firewall has swap, and removing the storage can no longer erase it by accident.
The features below are new in this release.
Choose from 59 website categories (adult content, gambling, drugs, social networks, streaming, games, malware, phishing and more, 5.4 million domains in the first catalog) and apply them to your internal networks or to chosen devices. The lists come from the Nexwall license server and are refreshed every week; only the categories your rules use are installed on the firewall. Blocked websites are logged and shown in the Log Viewer.
For the categories you choose, the firewall opens the encrypted connection through its web proxy, checks the website certificate (expired, self-signed, wrong name, unknown authority) and scans what is downloaded. Each firewall creates its own certificate authority, which you install on the devices that are inspected; banking, financial, government and education sites are never opened. A guard removes the redirect by itself if the proxy stops answering, so the network keeps working.
Files downloaded through inspected connections (and plain web downloads of the same devices) are scanned by ClamAV and by YARA rules. An infected file is replaced by a block page and logged. You decide what happens with files that are too large and when the scanner is not available (allow or block). The ClamAV signatures are downloaded automatically to the storage disk; the YARA rules (3,435 at release) come from the license server.
The Standard, School and Restricted profiles of the setup wizard now create the website rules as well: the categories to block, the categories to inspect, the antivirus and the family options. The wizard shows exactly what each profile does. Rules created by a profile are marked and can be edited.
A rule can force Google, Bing and DuckDuckGo into their safe search and put YouTube in Strict (for children) or Moderate mode, for the devices of that rule. It works through DNS and also catches devices that use another DNS server. The School profile turns on SafeSearch and YouTube Strict.
A new tab lists the connections with the application, website name, source, destination, bytes in each direction and duration. It records only while the Log Viewer is open and starts with the connections that are open at that moment, so the system log is not filled with traffic records.
The Subscription page lists Web Protection, Antivirus / Sandbox and Advanced Threat Protection together with Application Control, Network Protection, DNS Filtering, IP & Geo Blocking and VPN Extended (the Security Bundle), and Workspace Protection (ZTNA), Web Server Protection (WAF) and Email Protection (MTA) as separate subscriptions. Resellers hold a pool of licenses and apply them to firewalls; a license can be moved to another firewall.
The hourly traffic reports per device, application, protocol and website used to live in memory and disappeared at every restart. They are now stored on the data disk and kept for 35 days.
The system partition is 1 GB instead of 300 MB and the boot partition 64 MB, and space is reserved on the disk for a second system copy, which prepares the safe two-slot updates planned for the next release.
The firewall now uses compressed memory swap and, on disks of 16 GB or more, a swap file on the data disk, so the antivirus, the web proxy and the intrusion prevention can run together on 4 GB.
Removing the storage now detaches it and keeps the partition and its data. Erasing the partition is a separate choice that must be ticked, and the dialog lists what uses the storage (antivirus signatures, Log Viewer history, traffic reports, swap). The antivirus is switched off when its storage goes away.
Blocked traffic now appears in the Application Control tab of the Log Viewer; it was missing because of a leading space in the logged text.
Browsers that try to use QUIC (UDP 443) on inspected networks fall back to the inspected TLS connection, so inspection and the antivirus cannot be bypassed that way.
Blocked traffic was logged but did not show in the Application Control tab of the Log Viewer (it did show in Firewall traffic), because of a leading space in the logged text. It shows now.
The hourly traffic reports were kept in memory and disappeared when the firewall restarted, and only as many days fitted in 1% of the memory. They are now on the data disk and kept for 35 days.
Removing the storage deleted the partition and everything on it. It now only detaches the storage; deleting the partition is a separate choice that must be ticked.
The writable part of the system partition was about 213 MB, which filled up when services such as the antivirus were added. The system partition is now 1 GB. Firewalls installed with an earlier image keep their size.
Without a license, country blocking falls back to the public lists of the underlying component, which are downloaded at every service start and can take a long time. The Nexwall country lists need a license.
Workaround: Activate the license to use the Nexwall lists.
Reloading the DNS service with about 1.8 million blocked domains interrupts name resolution for about ten seconds. Lists reload only when they change, normally once a day.
Workaround: Switch off the categories you do not need; the memory warning on the DNS block lists page helps you choose.
Web Server Protection (WAF) and Email Protection (MTA) appear as subscriptions, but their features are not available yet.
Application Control and Network Protection do not decrypt HTTPS. They recognize applications from the connection, the domain name and the traffic pattern. Web Protection can inspect chosen categories of encrypted traffic (see NXW-2007).
Opening the web interface by its IP address (for example https://192.168.1.1) shows a browser certificate warning, because no public authority issues certificates for private addresses.
Workaround: Use https://firewall.lan.nexwall.com.br (the computer must use the firewall as DNS server, the default with DHCP), or http://192.168.1.1, which forwards to it.
Blocked domains are counted from the DNS log. A firewall installed before rc2 needs query logging switched on in its DNS settings to show them.
Workaround: Turn on query logging in the DNS settings.
Inspected sites show a certificate warning until the firewall's inspection certificate is installed on the device. Applications that pin their certificate fail when inspected.
Workaround: Install the certificate (Web Protection, Inspection) and add pinned applications as exceptions.
The antivirus does not start without the data storage, which holds its signatures (about 300 MB), and it is not active until the first download of the signatures has finished.
Workaround: Check the Storage page; the antivirus page shows the state of each engine.
The family options follow the devices and networks of a rule, not user accounts. There are no schedules or time quotas yet, and a device that uses a VPN or a mobile network is outside the firewall.
Inspection of encrypted traffic uses one web proxy process, so it is limited to about one processor core, and the speed it reaches has not been measured yet. Only the categories that you list are inspected.
Workaround: Inspect only the categories you need, and keep large downloads and streaming out of the inspected list.
Advanced Threat Protection and Antivirus / Sandbox (its sandbox part) and Workspace Protection (ZTNA) appear in the license, but only the antivirus part of Antivirus / Sandbox is available in this release.
Connections that ended before the Log Viewer was opened are not recorded. The tab lists the connections that are open at that moment and everything after.
The versions below make up the image. Most of them are pinned by checksum, so the image always contains exactly these versions. The signature bundle, the application catalog and the threat lists are not part of the image: they are downloaded and refreshed daily.
| Component | Version | Notes |
|---|---|---|
| Image | 26.1.0 | x86-64, UEFI, compressed disk image |
| Firmware sources | main 437eb59 | Commit of the public firewall repository the image is built from; the release tag follows |
| Base system | OpenWrt 25.12.5 | Linux kernel 6.12, nftables 1.1 |
| Web interface | 1.5.0 | English, Spanish, Brazilian Portuguese |
| License component | 1.7.1 | Updates itself from the signed feed; knows the new license modules |
| Web Protection | 0.5.0 | Categories, profiles, inspection, antivirus control, SafeSearch and YouTube options |
| Web Protection services | 1.1.0 | Scanning service, proxy connector and guard, licensed |
| Web proxy | Squid 7.1 | Inspection of encrypted traffic, one certificate authority per firewall |
| Antivirus | ClamAV 1.4.3, YARA 4.5.0 | Signatures downloaded by the firewall; YARA rules from the license server |
| Website categories | 2026.10.06.1 | 59 categories, 5.4 million domains (UT1, CC BY-SA 4.0); refreshed weekly |
| YARA rules | 2026.10.06.1 | 3,435 rules from open collections and Nexwall; refreshed weekly |
| Traffic classification engine | 5.2.8 (release 6) | Netify Agent with Nexwall plugins |
| Traffic engine plugins | 1.0.1 | Five plugins, built for engine release 6 |
| Intrusion prevention engine | Snort 3.10.0.0 | With the Nexwall gate plugin 1.0.1 |
| Intrusion signatures | daily bundle | Community, converted open rules and Nexwall Labs; 2026.10.02.1 at release |
| Application catalog | daily bundle | 2026.10.02.1 at release |
| Threat lists | 2026.10.02.3 | 12 DNS categories, 2 IP lists, country lists; rebuilt daily |
How this release came together, from the first image to the release candidate.
Nexwall branding, naming and licensing files; the baseline image booted in a virtual machine.
The web interface, monitoring, captive portal and Checkmk checks are built from Nexwall repositories; Application Control enforcement and its statistics were added; services moved to Nexwall hosts; the DNS & DHCP address bug was fixed.
Booted with the new interface and Portuguese translation; an IPsec tunnel to a third-party firewall, a remote Active Directory and OpenVPN remote access were configured and worked.
The engine was upgraded and the flow, statistics and HTTP-sink plugins were verified end to end on a running unit.
The action plugin was tested live; a crash loop and a busy-wait that used a whole CPU core were found and fixed, and labels were confirmed end to end.
The Nexwall application catalog, the traffic accounting fix, the Log Viewer with live rule tracing and the stalled-queue watchdog were built and tested.
The signed update feed, feature tokens for Application Control, statistics and Network Protection, the intrusion signature service and the Network Protection gate plugin.
Inspection threads, fast path, packet steering, larger buffers and the Engine monitor; Network Protection naming and Block default; daily refresh of signatures and catalog; Threat Shield feeds, geo-blocking and the memory warning; the default firewall rules; web interface 1.3.6; the release candidate image.
Setup wizard with network and security steps, subscriptions by module, registration without a code, enable-all switches, Log Viewer fix, web interface 1.3.7 and license component 1.6.0.
Application Control profiles, protection from the first start, wizard before login, certificate for firewall.nexwall.com.br, Log Viewer rework, DNS and country analytics, web interface 1.3.9.
Signature installation, wizard skip without login, editable profile rules, any interface for new Application Control rules, logging of blocked applications and of new firewall rules, Dropped Packets live trace, web interface 1.3.10.
Per-unit web certificates with the trusted address firewall.lan.nexwall.com.br, the port 80 page, quieter logs and console, cloud backup list without errors, web interface 1.3.12.
Website categories with a license-server catalog, inspection of encrypted traffic with its own certificate authority, the antivirus (ClamAV and YARA), profiles that apply all of it, SafeSearch and YouTube restrictions, the traffic and applications view, persistent traffic reports, a larger system partition with swap, and licenses as a bundle with add-ons.
| File | Size | SHA-256 |
|---|---|---|
nexwall-26.1.0-x86-64-generic-squashfs-combined-efi.img.gz | 106.5 MB (106,500,204 bytes) | 5d7bb14f8123996d93b92e2cd107dfd782537b10fda1b231710b99546b90cf38 |
Check the file before you use it: the SHA-256 of the downloaded file must equal the value above.
Nexwall Firewall is built on open source software, among them OpenWrt, the Linux kernel, nftables, Snort 3, Netify Agent and nDPI, dnsmasq, banIP, adblock and VictoriaMetrics. The firewall and the operator tools are published under their original licenses, and the license texts and notices are shipped with the image and available on request. The Threat Shield lists are built from open sources whose licenses allow redistribution, and the notice that lists them is part of every bundle.