| Code | Since | Area | Description | Workaround | Status |
|---|---|---|---|---|---|
NXW-2001 | 26.0.0-rc1 | IP & Geo Blocking | Country blocking without a license Without a license, country blocking falls back to the public lists of the underlying component, which are downloaded at every service start and can take a long time. The Nexwall country lists need a license. | Activate the license to use the Nexwall lists. | Open |
NXW-2002 | 26.0.0-rc1 | DNS Filtering | Large DNS list selections Reloading the DNS service with about 1.8 million blocked domains interrupts name resolution for about ten seconds. Lists reload only when they change, normally once a day. | Switch off the categories you do not need; the memory warning on the DNS block lists page helps you choose. | Open |
NXW-2003 | 26.0.0-rc1 | Licensing | Additional subscriptions Web Server Protection (WAF) and Email Protection (MTA) appear as subscriptions, but their features are not available yet. | – | Open |
NXW-2004 | 26.0.0-rc1 | Application Control | Encrypted traffic Application Control and Network Protection do not decrypt HTTPS. They recognize applications from the connection, the domain name and the traffic pattern. Web Protection can inspect chosen categories of encrypted traffic (see NXW-2007). | – | Open |
NXW-2005 | 26.0.0-rc2 | Web interface | Web interface by IP address Opening the web interface by its IP address (for example https://192.168.1.1) shows a browser certificate warning, because no public authority issues certificates for private addresses. | Use https://firewall.lan.nexwall.com.br (the computer must use the firewall as DNS server, the default with DHCP), or http://192.168.1.1, which forwards to it. | Open |
NXW-2006 | 26.0.0-rc2 | DNS Filtering | DNS block statistics Blocked domains are counted from the DNS log. A firewall installed before rc2 needs query logging switched on in its DNS settings to show them. | Turn on query logging in the DNS settings. | Open |
NXW-2007 | 26.1.0 | Web Protection | Inspection needs the firewall certificate on the devices Inspected sites show a certificate warning until the firewall's inspection certificate is installed on the device. Applications that pin their certificate fail when inspected. | Install the certificate (Web Protection, Inspection) and add pinned applications as exceptions. | Open |
NXW-2008 | 26.1.0 | Web Protection | The antivirus needs the data storage The antivirus does not start without the data storage, which holds its signatures (about 300 MB), and it is not active until the first download of the signatures has finished. | Check the Storage page; the antivirus page shows the state of each engine. | Open |
NXW-2009 | 26.1.0 | Web Protection | SafeSearch and YouTube options apply to devices only The family options follow the devices and networks of a rule, not user accounts. There are no schedules or time quotas yet, and a device that uses a VPN or a mobile network is outside the firewall. | – | Open |
NXW-2010 | 26.1.0 | Performance | Throughput of the inspection is not measured Inspection of encrypted traffic uses one web proxy process, so it is limited to about one processor core, and the speed it reaches has not been measured yet. Only the categories that you list are inspected. | Inspect only the categories you need, and keep large downloads and streaming out of the inspected list. | Open |
NXW-2011 | 26.1.0 | Licensing | Advanced Threat Protection and Workspace Protection have no features yet Advanced Threat Protection and Antivirus / Sandbox (its sandbox part) and Workspace Protection (ZTNA) appear in the license, but only the antivirus part of Antivirus / Sandbox is available in this release. | – | Open |
NXW-2012 | 26.1.0 | Logging | The traffic and applications tab starts when the Log Viewer is opened Connections that ended before the Log Viewer was opened are not recorded. The tab lists the connections that are open at that moment and everything after. | – | Open |
NXW-2013 | 26.1.2 | Web Protection | The block page on an encrypted website needs the firewall certificate on the device A device that has not installed the inspection certificate sees a certificate warning, not the block page, when it opens a blocked https site. The site is still blocked. Plain http sites show the page without the certificate. | Install the certificate on the devices (Web Protection, Inspection), or use a rule without a block page: the connection is then reset. | Open |
NXW-2014 | 26.1.2 | Web Protection | The content filter reads words, not pictures Images and video are not judged, the text of social networks arrives as data and not as a page, and pages sent in an encoding other than plain or gzip are not read. A word list can also make mistakes in both directions; the mode that only records, and the threshold, exist for that. | Start with the mode that only records, look at the events, then block. Use categories, SafeSearch and YouTube Restricted Mode for social networks. | Open |
NXW-2015 | 26.1.2 | Web Protection | A very small answer of a blocked site can arrive before the connection is reset On a port that the web proxy does not handle, or while the proxy is stopped, the traffic engine decides after the first packets of a connection, so a tiny answer such as a redirect can reach the device before the reset. The rest of the connection is blocked. | Block the ports you do not need with firewall rules. | Open |
NXW-2016 | 26.1.2 | Web Protection | A blocked category is enforced by name only for connections the engine can read A device that connects to an address it resolved elsewhere (its own DNS over HTTPS, a hard-coded address) can reach a site of a blocked category when the name is not visible: the blocking by DNS does not apply to it. | Block DNS over HTTPS (category "Encrypted DNS") and make the clients use the firewall for DNS. | Open |
NXW-2017 | 26.1.2 | system | Tight memory on 4 GB with everything running With the antivirus, the inspection, the intrusion prevention and Application Control on a busy network, a 4 GB system uses its swap and the system can stop the antivirus engine for a while. The antivirus fails open and the Dashboard shows it as not running. | Give the firewall 8 GB when all the protections run on a busy network. | Open |