Ozark-Connect/NetworkOptimizer v2.10.4 on GitHub

On-Site Agent update (the v2.10.3 Agent, unchanged in v2.10.4): if your On-Site Agent never comes online on a host whose IPv6 doesn't work, or sits behind a reverse proxy that closes its connection, update it so it falls back to IPv4 and reconnects within seconds. If you updated on v2.10.3, you're set. If you skipped v2.10.1, the update also applies Automatic Blocking Exceptions on a gateway Agent. If you skipped v2.10.0, its Agent also adds WAN Flood Protection (UniFi OS 6.0.x EA), blocking without reprovisioning, and LAN speed test hosting on the gateway, plus link speeds that follow a renegotiation (SNMP) and packet loss testing (WAN Speed Tests) on any Agent. Press Run It for Me under your site in Settings - Multi-Site, or run the upgrade command yourself.

LAN Speed Test results under each device, with search, a model filter, and batch runs for sites with a lot of gear, an On this page index on long pages, a setting for a main site that has no UniFi Console of its own, Managed SSH Key sign-in for cellular modems, and Firmware Rollout fixes for offline and re-meshing access points, plus Security Audit and monitoring fixes for sites reached through an On-Site Agent. See the v2.10.0, v2.10.1, v2.10.2, and v2.10.3 release notes for what's new in v2.10.0+.

Coming Soon

Change Control - a history of every configuration change on your sites, with who made it, what it did to your Security Audit, and Roll Back, and an incident lists the changes from the two hours before it. Try it now in v2.11.0-preview8.

LAN Speed Test

Results under each device in UniFi Device Speed Test and Other Device Speed Test, with how long ago the test ran, so testing one device after another no longer means scrolling to the bottom of the card and back (thanks @suburbazine). A result older than a day drops off its row.
Search, a model filter, and Run Selected in UniFi Device Speed Test - find a device by name, model, or IP, narrow to a model family (U7-Pro also covers the U7-Pro-Max and U7-Pro-Outdoor), then check the devices you want and Run Selected tests them one after another (thanks @suburbazine).
Fix: a failed test filled the alert with raw iperf3 output for both directions. It shows the error on one line now ("unable to connect to server (Connection refused)"), with the raw output under Raw output.
USW-Pro-48-PoE excluded from speed tests - the first-generation model ships without iperf3, so it could never pass (thanks @suburbazine).
Also: both device tables fit a phone screen without scrolling sideways.

Multi-Site

No UniFi Console at this site - for an install whose main site only hosts your other sites: check it under the main site in Settings - Multi-Site, and Network Optimizer stops trying to reach a Console that isn't there, stops showing that site as disconnected, and hides the Dashboard cards that need a Console (thanks @suburbazine). Its scheduled Security Audit, Adaptive SQM learning, and gateway WAN speed tests are skipped; server-side WAN speed tests and LAN speed tests keep running.
Fix: settings saved to the wrong site - for a user with access to only some sites, or in a browser tab left on one site after another tab switched sites, Security Audit settings, the client speed test target, and the Dashboard layout were read and saved against another site, usually the main site.
Fix: a Site Admin couldn't save the Dashboard layout unless they were also an Admin of the whole install. Edit Layout opened, then saving was refused, and Add to Dashboard on Monitoring - Live View was refused the same way.
Fix: some checks ran from the Network Optimizer server instead of the site's On-Site Agent - a custom OID's Test button polled from the server on a main site whose On-Site Agent handles its collection. Hostname lookups for a speed test's network path and a latency target's LAN check asked the server's DNS too, so a LAN-only or split-horizon name resolved wrongly or not at all.

Monitoring

Cable Modem Stats

Fix: Vodafone Station sign-in failed (native macOS installs, thanks @nexusct for the report).

Cellular Stats

Sign in with the site's Managed SSH Key - a GL-iNet or MikroTik router can use the key instead of a password: tick Use for this modem under Managed SSH Key in the modem's form (Settings - Cellular Modem (5G/LTE)), and install the public key on the router.

Monitoring Interfaces

Fix: a deploy blocked because the address was already in use gave no reason - the form reopened with a suggested Alias IP and nothing else, so pressing Deploy again deployed the alias. On a site reached through its On-Site Agent, that check also ran from the Network Optimizer server, where the address never answered, so it never blocked. It pings from the site's On-Site Agent now.

Firmware Rollout

Fix: an offline device failed as Device Stuck Offline and dropped the rest of its model from the rollout, such as a guest's unplugged mesh plug. A device still offline when its turn comes is skipped now, and each model's canary is a device that's online (thanks @suburbazine). If a canary goes offline before its turn, the rest of that model waits for the next rollout.
Fix: a mesh access point that changed uplinks during the rollout failed its upgrade and dropped the rest of its model (thanks @suburbazine).
Fix: a model could upgrade without its canary passing - the same model in its other color after the canary failed, or every device of a model whose canary was skipped. Neither runs now until a canary passes.

Wi-Fi Optimizer - Client Stats

Fix: Client Stats broke on the 1W and 1M filters.

Security Audit

Fix: third-party DNS went undetected on a site reached through its On-Site Agent (Multi-Site) - the Pi-hole, AdGuard Home, and Technitium checks, a custom management URL, and the NextDNS and ControlD checks ran from the Network Optimizer server, where the site's LAN never answered, and a split-horizon management URL resolved to its public address. They run through the site's On-Site Agent now.

Alerts & Schedule

Fix: a WAN outage alert's link opened a Network Performance category where every target was up. It opens the category that went down now, and the recovery alert follows its outage.

Threat Intelligence

Fix: ICMP traffic showed as port 0 in an IP's Destinations Accessed and Sources Targeting This IP, with no service. Port Ranges and Services name the protocol now, and so do GRE and other protocols without ports.

Installation

Windows: Download the MSI installer below

Docker (Upgrade):

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c 'cd /opt/network-optimizer && docker compose pull && docker compose up -d && docker image prune -f'

For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.