Nexwall Firewall 26.1.3

When a rule with "Show a block page" blocks a website category, the person sees a page in Portuguese, Spanish or English (the language of the browser) with the category, the rule and a reference code, instead of a connection error. The page is offered for the categories the web proxy can open (together up to 500,000 domains, the smallest lists first); large lists such as adult content keep the plain block, so nothing is ever opened up. If the check that serves the page is down, the request fails: it is never let through. The reference code is also written to the log.

The pages that pass through the web proxy are read and given a score from 0 to 100 for adult content, violence, drugs, gambling, hate speech and self-harm. A page whose score reaches the threshold of the profile is replaced by a block page that shows the subject and the score, or is only recorded, as you choose. Three profiles come ready (School is strict, Private is moderate, Work is light) and are set by the Standard, School and Restricted choices of the setup wizard; the Content filter tab of Web Protection shows them and lets you change the threshold, the subjects and where pages are read. Pages that talk about a subject for study, health or news, and pages that offer help, score lower. It reads words, not pictures, and only pages the proxy can open (websites without encryption and the categories it decrypts).

A file that passes the antivirus can be sent to the Nexwall sandbox, a safe machine where it is opened and watched. With the hold option the download waits for the verdict (between 15 and 300 seconds, you choose) and a file judged malicious is blocked with a page that explains why; a verdict already known is answered at once. Each firewall has its own limits: 60 files an hour, 500 files and 500 MB a day, 20 MB per file and 2 at the same time (a trial gets half). It works while the license of the firewall includes it, and the settings, the status and the verdicts are in Web Protection and in Threat Analytics.

The menu now has two analytics pages after the Dashboard. Threat Analytics tells what was stopped: the story from block, antivirus and sandbox to the advanced layers, the devices at risk, the web categories, the top sources and reasons and a table of events, kept for 35 days, with an executive report in PDF that is free in every plan. Traffic Analytics tells where the traffic goes: total, busiest hour, top application and device, traffic by hour and ranked lists of devices, applications, remote hosts and protocols that you can follow with a click, for today, 7 or 30 days. The Monitor no longer has the Daily traffic tab.

One blue family in light and dark mode: a pale blue menu and top bar in light mode, a navy interface in dark mode, a blue accent, and a page, card and table style that is the same everywhere. The top bar has the page path, a search (Ctrl+K), the language, help, the status center with the alerts of the firewall and the unit chip with the health dot, serial number, version, uptime and license. Every page opens with its tabs, then one paragraph that says what the page is for; the pages of the Policy section have tighter table rows, the side panels follow the density of the menu, and Firewall Rules and Zones & Policies have a column of summary cards on the right (rules by action, busiest zone pairs, tags that filter the list with a click). The Dashboard shows the protection of the firewall in one view and the traffic of today, 7 or 30 days. The Web Protection settings have an engine monitor, rules are deleted from a three-dots menu so that it is harder to do by mistake, and the Monitor tabs follow the same design.

In the rule editor every category can be blocked, allowed or inspected on its own. The blocked column and the allowed column each have an "inspect all" switch and a tick for every category: blocking is decided from the server name without opening the connection, and inspecting is what opens a category in the web proxy, for the antivirus, the content filter and the certificate checks in the allowed column, or for the block page in the blocked column. A category that is blocked and not inspected costs the proxy nothing.

QUIC (HTTP/3) carries web traffic over UDP, where no proxy can read it. The new switch "Block QUIC (HTTP/3)" in the Web Protection settings (on by default) refuses UDP port 443 for the clients of the rules that filter the web, so their browsers use HTTPS over TCP at once and the block pages, SafeSearch, the antivirus and the content filter apply to everything. The refusal now reaches the client at once (see the fixes), so there is no wait before the browser falls back.

The pages of Application Control, Network Protection (IPS), Web Protection and the antivirus show a badge that is green only when the service is running (its process is up and bound to what it needs); a service that is switched on but not running turns red. The reading comes from the firewall itself (processes and traffic queues) and is the same one the Dashboard uses.

The Remote Access (OpenVPN) page lists the latest builds of the Nexwall VPN clients for your users: Windows (64-bit Intel / AMD, ARM64 and 32-bit), Android, and Linux packages for Debian and Ubuntu (64-bit Intel / AMD and ARM64). The macOS client is not published yet. The clients are test builds and are not code-signed.

The plots show packet loss instead of the delivery rate, and the WAN uplinks and Performance pages offer 1 hour (the default), 6, 12 and 24 hours, 7 and 30 days. Every plot is a card with the current, peak and average value of each series above the line, and the lines are smoothed without rounding off the peaks: for long windows each point is the highest value of its step (the lowest for free memory), so a short spike of CPU, memory, load or packet loss is still visible. The history is kept for 7 days, or a year when the firewall has a data disk.

A new tab lists all the web traffic the proxy handled, allowed or blocked, with block pages, files stopped by the antivirus or the sandbox, content blocks and requests the proxy refused; a check adds the messages of the services. Alerts of the intrusion prevention engine and the proxy requests are now sent to the Log Viewer.

Besides the disk image, the release comes as an installer ISO: write it to a USB stick (for example with Rufus) and start the appliance from it. The installer checks its image, offers only internal disks (never the USB stick), asks you to type INSTALL before it erases a disk, writes the image and reads it back from the disk to compare it. The appliance must start in UEFI mode.

Check for updates now finds the packages of the firewall, shows no error the first time, and installs them. The package index of the update server was incomplete and the image trusted a different key from the one that signs the updates; both are fixed, so any later fix can reach the firewalls from this page.

The number of rules on the Dashboard is now the number of rules loaded for the chosen policy, the same as on the IPS Settings tab (before it counted the rules of the catalog that only raise an alert).

With many connections the statistics window of the traffic engine could be read as one second or less, which showed a rate several times too high, or an empty list. The window is now at least ten seconds and measured to the millisecond.

Traffic to a site the application catalog does not know is listed under the domain of the site (for example example.com) instead of "Unknown". The catalog also has a Nexwall application, so the traffic of the firewall to its own services is classified.

The Sandbox stage says whether the sandbox is working, not enabled on this firewall, or not in the plan. Only Advanced Threat Protection and Collective Defense are marked as coming.

Two causes of the engine standing still were found with core dumps from a lab firewall under load and are fixed: two threads waiting for each other inside two of the Nexwall plugins, and the capture thread ending when the kernel dropped a queued packet. A watchdog now checks the engine every minute and, if it stands still, takes the engine out of the path (traffic keeps flowing without analysis) and restarts it, with a cooldown and a limit of restarts per hour. The default when the engine cannot keep up is to let traffic through, not to block it.

Some sites (streaming services and other CDNs) answer the client and the proxy with different addresses. The proxy used to refuse such an intercepted connection with an error 409, and the site did not load. It now sends the connection to the address the client chose, as it already did for plain HTTP, without caching it.

The WAN zone now logs what it rejects (at most 10 lines a minute), so the Firewall traffic tab shows blocked traffic and not only the allowed one.

The "port unreachable" answer of a rejected connection, and the messages that path MTU discovery needs, were swallowed by the traffic engine queue. They now pass, so a browser whose QUIC is refused changes to HTTPS in a few milliseconds instead of after a timeout.

The proxy could run out of open files (a limit of 1,024) and the antivirus connection was switched off for minutes after a burst of failures. The limit is now 16,384, up to 256 files can be scanned at the same time and the scanner connection is retried after 10 seconds.

A tunnel no longer pins the route to its peer to the internet link that happened to be the default when the tunnel came up. On a firewall with two internet links a stale route of that kind could cut the license, the updates and the threat lists.

Application Control has an engine switch, Web Protection turns the engine on when it needs it, and the Dashboard and the pages show the real state of Network Protection (IPS) and Application Control. The traffic of the Top talkers card and Traffic Analytics counts the same flows.

A firewall that nobody has configured now starts with the Standard profile applied to the web as well: the website categories of the profile, the Work content filter and, when the license and the storage allow it, the antivirus. The setup wizard can change every choice afterwards.

A firewall started without running the setup wizard now has its WAN on the second network card (eth1), asking for an address by DHCP, in the wan zone. On virtual machines the card was not yet visible when the default was decided, so the WAN was missing; a second step later in the same start fixes it for units that were never configured.

The addresses that SafeSearch and YouTube Restricted Mode use are kept out of the analysis engine and of the inspection, and the DNS answers them with plain addresses, so Google, Bing and YouTube open in their restricted modes even when Application Control blocks streaming or social networks for the same devices.

The system log uses the whole width and height of the page, with the search, the number of rows and the options in one row above it.

The update server lacked the package index of the kernel modules, so the check ended with an error until a partial copy was cached. The index is published.

updates

The image was built with a key generated by the build, not the Nexwall key, so package updates signed by Nexwall would be refused. 26.1.3 is built with the Nexwall key. Firewalls on 26.1.2 must be reinstalled with 26.1.3.

updates

The Dashboard counted the alert-only rules of the catalog. It now shows the rules loaded for the chosen policy.

dashboard

The statistics window could be read as zero or one second. It is now at least ten seconds and measured to the millisecond.

monitoring

The Sandbox stage now shows its real state: working, not enabled or not in the plan.

threat-analytics

Without a license, country blocking falls back to the public lists of the underlying component, which are downloaded at every service start and can take a long time. The Nexwall country lists need a license.

Workaround: Activate the license to use the Nexwall lists.

IP & Geo Blocking

Reloading the DNS service with about 1.8 million blocked domains interrupts name resolution for about ten seconds. Lists reload only when they change, normally once a day.

Workaround: Switch off the categories you do not need; the memory warning on the DNS block lists page helps you choose.

DNS Filtering

Web Server Protection (WAF) and Email Protection (MTA) appear as subscriptions, but their features are not available yet.

Licensing

Application Control and Network Protection do not decrypt HTTPS. They recognize applications from the connection, the domain name and the traffic pattern. Web Protection can inspect chosen categories of encrypted traffic (see NXW-2007).

Application Control

Opening the web interface by its IP address (for example https://192.168.1.1) shows a browser certificate warning, because no public authority issues certificates for private addresses.

Workaround: Use https://firewall.lan.nexwall.com.br (the computer must use the firewall as DNS server, the default with DHCP), or http://192.168.1.1, which forwards to it.

Web interface

Blocked domains are counted from the DNS log. A firewall installed before rc2 needs query logging switched on in its DNS settings to show them.

Workaround: Turn on query logging in the DNS settings.

DNS Filtering

Inspected sites show a certificate warning until the firewall's inspection certificate is installed on the device. Applications that pin their certificate fail when inspected.

Workaround: Install the certificate (Web Protection, Inspection) and add pinned applications as exceptions.

Web Protection

The antivirus does not start without the data storage, which holds its signatures (about 300 MB), and it is not active until the first download of the signatures has finished.

Workaround: Check the Storage page; the antivirus page shows the state of each engine.

Web Protection

The family options follow the devices and networks of a rule, not user accounts. There are no schedules or time quotas yet, and a device that uses a VPN or a mobile network is outside the firewall.

Web Protection

Inspection of encrypted traffic uses one web proxy process, so it is limited to about one processor core, and the speed it reaches has not been measured yet. Only the categories that you list are inspected.

Workaround: Inspect only the categories you need, and keep large downloads and streaming out of the inspected list.

Performance

Advanced Threat Protection and Antivirus / Sandbox (its sandbox part) and Workspace Protection (ZTNA) appear in the license, but only the antivirus part of Antivirus / Sandbox is available in this release.

Licensing

Connections that ended before the Log Viewer was opened are not recorded. The tab lists the connections that are open at that moment and everything after.

Logging

A device that has not installed the inspection certificate sees a certificate warning, not the block page, when it opens a blocked https site. The site is still blocked. Plain http sites show the page without the certificate.

Workaround: Install the certificate on the devices (Web Protection, Inspection), or use a rule without a block page: the connection is then reset.

Web Protection

Images and video are not judged, the text of social networks arrives as data and not as a page, and pages sent in an encoding other than plain or gzip are not read. A word list can also make mistakes in both directions; the mode that only records, and the threshold, exist for that.

Workaround: Start with the mode that only records, look at the events, then block. Use categories, SafeSearch and YouTube Restricted Mode for social networks.

Web Protection

On a port that the web proxy does not handle, or while the proxy is stopped, the traffic engine decides after the first packets of a connection, so a tiny answer such as a redirect can reach the device before the reset. The rest of the connection is blocked.

Workaround: Block the ports you do not need with firewall rules.

Web Protection

A device that connects to an address it resolved elsewhere (its own DNS over HTTPS, a hard-coded address) can reach a site of a blocked category when the name is not visible: the blocking by DNS does not apply to it.

Workaround: Block DNS over HTTPS (category "Encrypted DNS") and make the clients use the firewall for DNS.

Web Protection

With the antivirus, the inspection, the intrusion prevention and Application Control on a busy network, a 4 GB system uses its swap and the system can stop the antivirus engine for a while. The antivirus fails open and the Dashboard shows it as not running.

Workaround: Give the firewall 8 GB when all the protections run on a busy network.

system