On-Site Agent update (the v2.10.6 Agent): if you updated on v2.10.3-v2.10.5, this one is optional: upgrade it so that Path Localization's traces from an On-Site Agent use 5 probes per hop (an older Agent still traces, at 3). If you skipped v2.10.3, update it if your On-Site Agent never comes online on a host whose IPv6 doesn't work, or sits behind a reverse proxy that closes its connection, so it falls back to IPv4 and reconnects within seconds. If you skipped v2.10.1, the update also applies Automatic Blocking Exceptions on a gateway Agent. If you skipped v2.10.0, its Agent also adds WAN Flood Protection (UniFi OS 6.0.x EA), blocking without reprovisioning, and LAN speed test hosting on the gateway, plus link speeds that follow a renegotiation (SNMP) and packet loss testing (WAN Speed Tests) on any Agent. Press Run It for Me under your site in Settings - Multi-Site, or run the upgrade command yourself.
Path Localization on ISP Health, which traces the route to a degrading destination while it happens and says where the problem first shows up, and Throughput history on Client Performance. Security Audit gets a Console Access check and fixes for some false findings, and signing out now ends the login on the server. See the v2.10.0, v2.10.1, v2.10.2, v2.10.3, v2.10.4, and v2.10.5 release notes for what's new in v2.10.0+.
Coming Soon
- Change Control - a history of every configuration change on your sites, with who made it, what it did to your Security Audit, and Roll Back, and an incident lists the changes from the two hours before it. Try it now in v2.11.0-preview16.
Monitoring
ISP Health
- Path Localization (#1334) - when one destination degrades while the rest of your connection stays clean, Network Optimizer traces the route to it every minute from the vantage that measures it, and says where the problem first shows on the way there, or that it's most likely on the return path into your ISP. A banner at the top names it while it's tracing and gives the verdict after, and each one is a Path & Congestion Events row with a hop table (a bar per trace, so a slowdown that comes and goes shows where it starts), a Re-run in Network Tools, and a link to the target on Network Performance. The PDF carries them too.
- Path Congestion lowers Transit Health - an episode across two or more destination networks now costs Transit Health by how long, how broad, and how deep it ran, and when. A nightly two-hour episode across half your networks costs about 15 to 18 points of Transit Health (about 6 overall), so a site with evening congestion will see its score drop. It shows as a Path Congestion row under Transit Health.
- Traceroute Result in Network Tools reads like the new hop table above: Network (the hop's ASN), Loss, RTT min / avg, and Return hops when the vantage reports them.
Network Performance
- Fix: "Couldn't identify the first upstream device" in Upstream Path Discovery on a UniFi cellular WAN - the modem has no L2 neighbor to find, and discovery says so now. A UDR-5G-Max's WAN is also set to Cellular, as a U5G-Max's already was.
Client Performance - Speed
- Throughput history - the Throughput card gets its own range next to Live, from 1h to 30d: average and peak, the measured WAN share, and the client's speed tests as marks that open their result in Test Results. WAN shows the WAN traffic alone. The page's time filter now heads Speed Tests, the only thing it ever applied to, and follows the card's range.
Security Audit
- Console Access (#1342) - flags API Keys and Local Admin accounts unused for 7+ days, Critical after 30. It runs only when your UniFi Console Connection can read them.
- Fix: ControlD on the gateway was never detected (#1330, thanks @truffshuff), so the DoH finding didn't give it ControlD's neutral treatment.
- Fix: false firewall findings from a Block Invalid rule or an ICMP-only allow - a block on invalid packets only made every allow below it between the same zones a Firewall: Ineffective Allow Rule finding, and one toward the internet could raise the Firewall: Missing findings for UniFi cloud, firmware download, and AFC access. An ICMP or ICMPv6 allow into the Gateway zone above a broader block also read as a Firewall: Rule Order Issue.
- Fix: a scheduled Security Audit saved a low score when the UniFi Console connection dropped partway through - the firewall rules and port profiles it couldn't read were scored as missing, so the score stayed down until the next run. An audit that loses the connection now saves nothing, and a scheduled one tries again a few times before it reports a failure.
Client Speed Test
- Fix: a false New High Score after a device's IP address changed.
Identity
- Signing out ends that login on the server, so a copy of the cookie stops working too. Keep me signed in now stays signed in while you use it, and ends after 30 days unused (was 14).
Performance Tweaks
- UniFi OS 6.0.17 EA on the UCG line - supported, verified against the UCG-Fiber 6.0.17 firmware image.
Fixes
- Bundled nginx updated for six CVEs - the Windows MSI moves to nginx 1.30.6, and the speed test and On-Site Agent Docker images pick up nginx's current security fixes.
Installation
Windows: Download the MSI installer below
Docker (Upgrade):
docker compose pull && docker compose up -dmacOS (native, recommended for accurate speed tests vs Docker Desktop):
git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.shProxmox:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c 'cd /opt/network-optimizer && docker compose pull && docker compose up -d && docker image prune -f'For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.
Need a hand with an install or upgrade, or something not working right? Ask on the Network Optimizer Discord. Confirmed bugs and feature requests go to GitHub Issues.