Ozark-Connect/NetworkOptimizer v2.10.0 on GitHub

On-Site Agent update (optional): v2.10.0's Agent matters in five cases. On your UniFi Gateway, it adds WAN Flood Protection, and with Automatic Blocking on, it applies blocks without reprovisioning the gateway. On an Agent that collects SNMP, it keeps a port's link speed current when the link renegotiates. On an Agent that runs WAN Speed Tests, it adds packet loss testing. On your UniFi Gateway, it can also host the LAN speed test. Open Settings - Multi-Site, expand your site, and press Run It for Me under the upgrade command, or run the upgrade command yourself. If you updated on v2.10.0-preview9, you're set.

Threat Intelligence goes from watching to blocking. A Web Application Firewall for your self-hosted apps, Automatic Blocking on your gateway, the WAF, and Cloudflare, WAN Flood Protection that keeps a flood at your public IP (even one from a single machine) from taking your gateway down, and a Security Audit check for something UniFi Network allows out of the box: every VLAN reaching your gateway's SSH and web UI. WAN Speed Test measures packet loss now too, idle and under load, and a new alert catches a WAN port that drops below its usual speed.

What you missed on v2.9.x

AP Agent on more hardware - older MIPS access points (U6-Lite, U6-Mesh, UAP-AC-Pro) and UniFi gateways with built-in Wi-Fi now get live client telemetry, and Roam works on the latter.
Rename a client or set its fixed IP from Client Performance, straight to your UniFi Console.
Firmware Rollout - roll out a build before your Console is offered it, share UniFi OS builds between sites, and schedule Autopilot by day and hour.
Apply Recommended Channels - Channel Recommendation moves your access points to its plan for you.
PostgreSQL on SSD for UniFi Network 11.0.81 on a UCG-Fiber or UCG-Max, and SNMPv3 polling works.

See the v2.9.3, v2.9.2, and v2.9.1 release notes for the full detail.

Threat Intelligence

Web Application Firewall

Threat Intelligence - Web Application Firewall - your gateway's IPS sees packets; it can't see inside HTTPS requests: the bots probing everything you self-host for .env files and cloud credentials, or a real exploit attempt (injection, path traversal, command execution) against the community apps you run. netopt-waf can. It is the OWASP CRS firewall in NetworkOptimizer-Proxy, the Traefik reverse proxy in front of Network Optimizer and whatever else you self-host, and its events land in Threat Intelligence and your alerts like IPS events do. On Docker, turn it on with the waf compose profile.
Windows - the MSI ships netopt-waf with its Traefik. Set TRAEFIK_WAF_MODE to detect under HKLM\SOFTWARE\Ozark Connect\Network Optimizer and restart the service.
Start in Detection Only - run it a week, clear false positives with Add Exclusion (no restart), then switch to Blocking from the Mode card.
Uploads over 10 MB get a 401 from Traefik before the WAF sees them, so a photo sync or a backup on a route behind waf fails with no event. The proxy README's Large uploads shows the waf-uploads middleware with a bigger cap for those routes.

Automatic Blocking

Automatic Blocking - sources the WAF and attack pattern detection flag are blocked on your gateway, the WAF, and optionally Cloudflare, with longer bans for repeat offenders. Every site starts in Detection Only, which writes nothing to your gateway on its own; Turn On Recommended switches it to Blocking with the profile that fits what the site exposes (Home or Self-Hosting, with Business and Lockdown to pick), and Protection Setup on the Overview walks you through the rest.
No reprovisioning - with an On-Site Agent on your gateway, blocks apply there in seconds without reprovisioning it, and the Network List in UniFi Network catches up overnight. Without one, or if that agent goes offline, the Network List carries every change.
Shared between your sites - a source one site blocks is blocked at all of them. Settings - Multi-Site sets each site, or all of them at once.
Public Block Lists - Spamhaus DROP by default and eight more to turn on, with an optional outbound block that stops an infected device reaching its botnet's command server on the first packet. With several sites, ThreatFox and Q-Feeds need a key on just one of them. Without an On-Site Agent on your gateway, UniFi Network holds only part of the larger lists, and the card marks which.
Public Block List alerts - a device reaching, or trying to reach, an address on a command-server list raises an alert, and Attack Sequences lists every contact under Public Block List Contacts.
Block and Release any public IP from its details. The Blocking tab lists everything blocked, each source linked to its details.

WAN Flood Protection

WAN Flood Protection - a flood of unsolicited traffic can max out your gateway's CPU, stalling internet access, inter-VLAN traffic, and the UniFi apps it runs. With an On-Site Agent on your gateway, Network Optimizer finds a flood's sources within seconds and drops them at the WAN, before the firewall touches them. In testing, that cut CPU load by about three quarters and kept latency normal.
From one source or many - UDP and TCP SYN floods, reflection floods off DNS, NTP, and other amplification services, and floods aimed at your port forwards. Start in Detection Only from Settings - Security & Alerts, see what it would have dropped on the Blocking tab, then switch to Protecting.

Trusted Sources

Trusted Sources - your sites' own public addresses are never blocked and become the WAF's trusted allow list. Kept as Network Lists in UniFi Network, they let a port forward admit only your other sites, even as their WAN addresses change (a + Cloudflare variant covers Cloudflare-proxied hosts).

Top Sources

CrowdSec CTI lookups shared between your sites (Multi-Site) - an address looked up at one site shows its badge at all of them, using your daily quota once.
Fix: internal hosts showed up as Google, Cloudflare, and the like - existing events are corrected on upgrade (#670, thanks @jedis00).
Noise filter categories - Noise, Infrastructure, or Trusted User; only Noise is hidden, and the Security Audit PDF lists the other two in their own tables (#670, thanks @jedis00).

Multi-Stage Attack Sequences

Fix: clients hitting your own egress block policies read as attack chains - they're Monitored now, and alerts name an internal source by its client name and network.
Fix: late replies from servers your devices were using raised "Attack chain" alerts - QUIC from Google and Facebook especially. On consoles that log allowed traffic, those replies no longer fill the timeline either.

Attack Patterns

Fix: content networks and ISP routers showed up as port scans - late replies from servers your devices were using (Amazon, Google, Facebook, Microsoft) and traceroutes at your WAN address from nearby ISPs read as scan sweeps. Neither counts now.
Fix: a LAN device read as a brute force - a device whose connections to several web servers were blocked showed up as a brute force on port 443. A brute force now has to target a few hosts, as a real one does.

Blocked vs Detected

Fix: LAN devices filled Threat Intelligence with "outgoing blocked" flows - those were UniFi Network's predefined Block Invalid Traffic dropping stray packets on connections that had already closed, and they're no longer collected. Internet traffic dropped at your gateway counts as incoming now too, where UniFi Network labeled some of it outgoing.

Security Audit

Firewall: Gateway Management Exposed - flags networks that can reach the gateway's SSH or web UI, which UniFi Network's predefined Internal to Gateway policy allows from every VLAN. If you manage UniFi from a dedicated network, give it the new Management Access purpose so every other network is checked against it.
Fix: Lock Port to UniFi Device recommended on switches that don't offer it - the US-16-XG, USW-Mission-Critical, and US-8 models, and a USW-Flex before switch firmware 7.6.7.
Fix: "Firewall: Missing 5G/LTE Access" with an internet allow for the modem - a rule letting your 5G/LTE modem out to the internet by its MAC or IP only counted if it named carrier domains (#1283, thanks @jimstrang).

WAN Steering

Fix: WAN Steering stopped right after deploying on the UDM line, EFG, and UDM-Beast (thanks @fidiiioo for the platform dumps) - those gateways lack the kernel match our rules used. Rules at 100% now run on every gateway, and a Ratio below 100% uses the match UniFi's own load balancing uses. The page will ask you to redeploy once. Running natively on Linux from source? Rebuild the WAN Steering binary before that redeploy; the Native Deployment Guide has the step.

WAN Speed Test

Packet loss - every test measures loss with the line idle and while it's saturated in each direction, so a line that drops packets only under load shows it. It's on the new Packet Loss chart tab and on each result next to the latency; tests take about 12 seconds longer for the idle measurement.
Not a valid test - when a test lands well under your plan and Monitoring saw enough other traffic on that WAN to explain the gap, the result says so and ISP Health leaves it out. A shortfall Monitoring can't check stays an ordinary result.
Fix: loaded latency and jitter could read the test server's own congestion - they're now checked against a separate host, so a busy server no longer shows up as bufferbloat on your line.

Monitoring

Speed test history in InfluxDB - with InfluxDB connected in Monitoring, every saved WAN and LAN speed test (browser and client-run iperf3 tests too) goes to your site's long-term bucket for Grafana: throughput, latency and jitter, and on WAN tests, packet loss and whether the test was valid. Existing history is copied in once after the upgrade, as far back as the bucket keeps data (a year by default), so expect a short burst of InfluxDB writes. The Storage README has the tags, fields, and a starter Flux query (#1264, thanks @jimstrang).
Delete asks first - in Settings - Monitoring, deleting a cellular modem, cable modem, ONT, or Starlink terminal takes a second click to confirm. Deleting the one open in Edit also closes its form instead of leaving it open.

ISP Health

WAN Speed Tests feed Packet Loss and Loaded Loss - each test's loss joins what Monitoring measures, which fills in Loaded Loss on a line Monitoring rarely catches under load.
Smaller path shifts - a routing change that moves several hops at once is now reported even when each hop only moves a little. One hop moving on its own still needs a bigger step.

SFP Stats

Attach a Realtek ONT stick to its SFP module - Settings - ONT Device Monitoring now offers Attach to SFP Module for Realtek ONT Stick (HTTP), as it already did for Network Optimizer Custom (HTTP JSON). The stick's PON state, ONU ID, registration, and OLT join its module on SFP Stats as one card, and its optics only fill what the host device's DDM can't read (#1274, thanks @gpborges).
Both temperatures - when the host device reads DDM and the attached ONT reports its own sensor with a different reading, the Dashboard card shows SFP Temp and ONT Temp (they can sit well apart). SFP Alert Thresholds then lets that module choose which one the PON temperature alert checks.
Refresh works for SFP ONTs - on the Dashboard's ONT Stats card, Refresh reads the module from your UniFi Console and polls its attached ONT right away instead of waiting for the next collection cycle. An attached one also gets ONT Settings next to SFP Monitoring (thanks @gpborges for the layout).

ONT Stats

Fix: Realtek ONT sticks never showed their PON status - the ONU state (O5) was read but not used, so the PON Status row was missing, a healthy stick got an orange dot, and ONT: PON Link Down could not fire (#1273, thanks @gpborges).
Uptime and firmware from Realtek sticks - read from the stick's admin/status.asp, so ONT Uptime fills in and a new Firmware column shows the version.
Registered and OLT - the PON Status table on ONT Stats and SFP Stats gains Registered and OLT columns, with the OLT vendor decoded ("Nokia (ALCL)"), and the Dashboard card shows both. On Realtek sticks these come from the DFP-34X-2IY3 SFU firmware; the 2C2 page doesn't serve them.
Network Optimizer Custom (HTTP JSON) - the contract gains optional olt_vendor_id and sfp_fw_version fields, which fill the same OLT and Firmware columns. olt_model and olt_version (the OLT's OMCI equipment ID and software version) add the model to the OLT readout ("Calix E7 (CALX)") and an OLT Version column.

Network Tools

Other sites as targets (Multi-Site) - Run a Probe lists each of your other sites' latest WAN address under Other Sites, taken from Trusted Sources, so you can ping or traceroute between sites to trace an inter-site problem without looking up and pasting the address.

Live View

Fix: Live View drained phone batteries - the maps and the WAN chart kept drawing off screen and in background tabs.
Fix: Bandwidth Hogs lost rows on a quiet network, and the map below it jumped.
Also fixed in playback: an offline wired client showed "Port N" and a rate that barely moved; link speed showed today's value at every instant, in the maps and Port Statistics; a client stayed on the map after its port went down; and a mesh access point stayed under today's parent at every instant, even one when it was meshed to another.

SNMP

Fix: a port's link speed lagged up to 5 minutes after it renegotiated (a PC waking on LAN), and faster traffic was thrown out meanwhile.

On-Site Agent

Fix: an On-Site Agent on a UniFi gateway that stopped reporting took three minutes to restart itself - about a minute now, and the restart no longer raises a UniFi Console: Connection Failed alert for a Console that was fine.

Multi-Site

LAN speed test on your UniFi Gateway's Agent - add --lan-speed-test to the On a UniFi gateway command under Set up agent in Settings - Multi-Site to host the LAN speed test on the gateway itself: up to 10 Gbps on the EFG and UDM-Beast, 2.5-5 Gbps on the UXG/UCG-Fiber class with IPS on, and 1-2.5 Gbps on the UDR7 and other IPQ5332 gateways. If you run it on a UDM-series gateway, let us know what LAN speed test throughput you see.
Faster Agent speed tests - the page takes your location over HTTPS, then runs the test over plain HTTP on port 24080, which roughly doubles throughput on less capable hosts. Open 24080 alongside 24443 if the host has a firewall.

Alerts & Schedule

WAN: Link Speed Degraded - fires when a gateway WAN port negotiates below its usual speed or at half duplex (a gigabit line stuck at 100 Mbps), and WAN: Link Speed Recovered closes it when the port is back. Both are on by default. The usual speed is the fastest the port reached over the past week, or what your plan speed needs if that's higher.
ONT: Management Unresponsive - fires when an attached ONT's page stops answering while its SFP module still reads light. On once an ONT is attached to an SFP module.
ONT: Rebooted - fires when an ONT's uptime goes backwards. Off by default, and only providers that report uptime (Realtek ONT sticks and Network Optimizer Custom) can trip it.

Config Optimizer

WAN Link Speed Keeps Dropping - a WAN port that keeps falling below its usual speed gets a recommendation to set its link speed manually in UniFi Network, or to check the cable if it's already set. It reads the port's link speed history, which starts with this release, so it shows up once the port has dropped more than once since.

Performance Tweaks

UniFi OS 6.0.13 EA on the UCG line - supported, verified against the UCG-Fiber 6.0.13 firmware image.

Client Performance

Fix: application icons never loaded, and some applications (GeForce Now, Discord, DNS over HTTPS, and more than 200 others) showed as "Application N".

Wi-Fi Optimizer - Overview

Fix: Re-pair Uplink on an MLO mesh link said "Already on the best parent (signal unknown)" - it never read the link's signal, and it stopped watching before the access point finished moving to a better parent. It now waits for the move and shows the signal it lands on.
Fix: an access point with several mesh children crammed them side by side on its card - they stack now, with arrows (or a swipe) to page through them.

Firmware Rollout

UniFi auto-update warning on the Autopilot Configuration card - the warning the wizard shows when UniFi Network's own auto-update can collide with a rollout now shows there too, with its Turn Off button.
Fix: UniFi Network stuck starting after a UniFi OS update (sites with Gateway SSH) - some UniFi OS updates bring the Console back without UniFi Network, and starting it from the Console does nothing. Firmware Rollout used to count that update as done; it now restarts UniFi Network, reboots the Console only if the restart doesn't bring it back, and raises a Critical alert if neither does.
Fix: no Early Access in the wizard when Early Access Release Channels was off in UniFi Network's Device Updates & Settings, even with UniFi OS and the UniFi Network application on Early Access.
Fix: a UniFi OS install over Gateway SSH died with the SSH session (On-Site Agent sites) - an agent tunnel drop mid-install stopped the write, and the step read Refused with no reason. The install now runs on the gateway on its own, a dropped session is checked against the gateway's own log, a chosen build the Console offers itself falls back to the Console's update command, and the report says why when it does fail.
Fix: a Console that would not change channel was planned from the wrong channel - with a Console account that cannot change update channels, Autopilot set to Release Candidate planned the UniFi Network application from the Early Access offer. That surface is now left out of the plan with a note saying why, and the UniFi Network step declines a build from another channel, as UniFi OS already did.
Fix: a small site could upgrade every access point at once - a site with a few APs could put them all in one wave and lose Wi-Fi until they came back. A rollout now always leaves an access point up, even when one fails to come back.
The Firmware Rollout Started alert resolves itself when the rollout completes, so you don't have to.
Also fixed: End Soak Early left a dash in the report's CPU and Mem columns for a device or Console already measured long enough.

Settings

Save follows you down the page - on desktop, a card's Save stays in view while you work through a long card, and shows whether the save went through. Leaving Settings with unsaved changes asks first.
Fix: a large backup failed - Full Export in Data Management stopped with "The JSON value ... is too large", and both buttons paused before their spinner showed.

Fixes

Fix: the ./logs folder every compose file mounts stayed empty - the daily log file Windows installs always had lands there now (and in the install folder on macOS and native Linux), seven days kept, so a log outlives a container rebuild. On macOS the unrotated stdout.log is no longer written; tail the dated file instead.
Fix: the password reset script failed on native Linux with "no such table: AdminSettings", and left Network Optimizer stopped. It reads the right database now (#1286, thanks @th3cube).
Fix: "No WAN Connections Detected" in Adaptive SQM - on a site where two WAN networks in UniFi Network have the same WAN IP stored, Adaptive SQM found no WANs, and WAN Speed Test's gateway test said the UniFi Console was unreachable (#1291, thanks @silkybf for the report and logs).
Fix: "failed to download Ookla speedtest (HTTP 000)" in Adaptive SQM - when the gateway could not reach Ookla's download site, Adaptive SQM deployed without its speed test instead of trying the backup download. If you saw it, press Deploy Settings once (#1295, thanks @eroc1990 for the report).
Fix: setting up an authenticator app failed with "Unauthorized" on the Security page once you'd been signed in more than a few minutes. A wrong code also no longer closes the setup, and disabling the authenticator no longer signs you out.
Fix: a session signed out by Sign out everywhere could still act for a few minutes - it could change the password or two-factor settings and get a fresh sign-in back. The same applied to a disabled account's session.
Fix: USW Pro Max 24 and 48 switches (and their PoE models) were offered as LAN Speed Test targets - they ship without iperf3, like the 16-port models that were already left out.
Also fixed: a site whose Console connection dropped and came back could stop moving its Firmware Rollout and stop Threat Intelligence collection until Network Optimizer restarted.

Device Support

U7 Industrial, USW Industrial DIN 8, USW Industrial DIN 8 PoE, and USW Industrial DIN 2.5G 8 PoE support.

Installation

Windows: Download the MSI installer below

Docker (Upgrade):

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c 'cd /opt/network-optimizer && docker compose pull && docker compose up -d && docker image prune -f'

For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.