On-Site Agent update (the v2.10.7 Agent): optional, for a Multi-WAN site with an On-Site Agent on its UniFi gateway: upgrade it so traces from each WAN vantage run (Path Localization's included) without traceroute installed on the gateway. If you skipped v2.10.6, the update also gives Path Localization's traces 5 probes per hop (an older Agent still traces, at 3). If you skipped v2.10.3, update it if your On-Site Agent never comes online on a host whose IPv6 doesn't work, or sits behind a reverse proxy that closes its connection, so it falls back to IPv4 and reconnects within seconds. If you skipped v2.10.1, the update also applies Automatic Blocking Exceptions on a gateway Agent. If you skipped v2.10.0, its Agent also adds WAN Flood Protection (UniFi OS 6.0.x EA), blocking without reprovisioning, and LAN speed test hosting on the gateway, plus link speeds that follow a renegotiation (SNMP) and packet loss testing (WAN Speed Tests) on any Agent. Press Run It for Me under your site in Settings - Multi-Site, or run the upgrade command yourself.
Fixes for a UniFi Console that stayed disconnected with Monitoring off, Multi-WAN traces from an On-Site Agent on a UniFi gateway, Starlink lower-signal alerts that outlasted the weather, and pages that sometimes stayed blank behind the Web Application Firewall, plus security updates for the Go binaries we ship. See the v2.10.0, v2.10.1, v2.10.2, v2.10.3, v2.10.4, v2.10.5, and v2.10.6 release notes for what's new in v2.10.0+.
Coming Soon
- Change Control - a history of every configuration change on your sites, with who made it, what it did to your Security Audit, and Roll Back, and an incident lists the changes from the two hours before it. Try it now in v2.11.0-preview18.
UniFi Console Connection
- Fix: a UniFi Console that stopped answering stayed disconnected until Network Optimizer restarted - on a site with Monitoring turned off, connected directly rather than through an On-Site Agent.
Monitoring
Traceroute
- Fix: "Source-bound traceroute needs the native traceroute binary (Linux/macOS)" - on every trace from a Multi-WAN vantage on a UniFi gateway's On-Site Agent, Path Localization's included, since UniFi gateways don't ship traceroute. It needs the v2.10.7 Agent, and traces out the default route now show hop names too.
Starlink Stats
- Fix: "dish reports a fault" alerts for lower_signal_than_predicted long after the weather had passed - the dish can raise that code for as long as a day after rain or snow while everything else reads normal, and it capped the dish's Physical Link score in ISP Health. A Starlink alert you had resolved also came back as new after every Network Optimizer restart.
ISP Health
- Access latency reads every access hop - one access hop's slow replies no longer dip your ISP score, while congestion on the access link still counts, and ISP Network shows the result as an Access floor row. On a CGNAT ISP, access hops with private addresses now count toward loaded latency too.
- Fix: a route change showed twice in Path & Congestion Events - as its Path shift and as a Congestion row that lowered Transit Health. A long episode could also open again after a restart, and one that only got slower read as lost packets.
SFP Stats
- Device events on the charts - with only one device's modules shown, the charts mark its reboots, health check actions, and alerts, as on Device Stats.
Security Audit
- A Firewall: Rule Order Issue on an allow matched only by its source port says what it lets past - such as an mDNS reply rule from port 5353 into the Gateway zone, which admits any port and protocol from that port. It now says to set the allow's protocol and destination port (UDP, destination port 5353 for mDNS), and costs 2 points instead of 5, since the potential attacker has to know the port.
Performance Tweaks
- UniFi OS 6.0.17 EA on the UXG line - supported, live-verified on a UXG-Fiber and verified against the UXG-Max 6.0.17 firmware image.
Firmware Rollout
- Clear to Deploy? - while a rollout waits for its start, who is using the WAN right now, across every WAN, so you can decide on Deploy Now right there.
- Fix: the Firmware Rollout Scheduled alert kept the original start after Postpone 24h or Set Time - and so did an open Firmware Rollout Starting Soon alert.
- Fix: a critical alert already open when a rollout was scheduled postponed it every window - until someone acknowledged or resolved it.
Threat Intelligence
Blocking
- Fix: a Critical "reached a listed address" alert for traffic an exception allows - a connection that an Automatic Blocking exception lets through to an address on a public block list still raised the Critical Public Block List alert.
Web Application Firewall
- Fix: a page sometimes stayed blank behind the Web Application Firewall in Block - for example right after switching sites. netopt-waf 1.0.4 fixes it (the Web Application Firewall page offers the update), and a page that can't connect now retries, then offers Reload.
AP Telemetry
- AP Agent updates go out across a large site in one pass - access points update several at a time, and a busy site no longer holds up the others. A server restart in the middle of an update no longer leaves an access point without its AP Agent until the next pass.
Fixes
- Fix: password managers filled your login into Settings forms - such as the InfluxDB, modem, Cloudflare, and sign-in provider fields, and Identity's add-user and reset-password fields.
- Go and Alpine security updates (#1345) - the AP Agent, WAN speed test, and WAN Steering binaries move to Go 1.27 (the Go 1.22 standard library is out of security support), and the speed test image picks up Alpine's fixes for brotli, curl, and expat. Your access points get the rebuilt AP Agent once after the upgrade.
- Also fixed: Disconnect in UniFi Console Connection left its session open on a UniFi OS Console until it expired; a reload or a site switch brought back the time window or investigation a Network Performance link had opened, after you had moved off it; switching sites (Multi-Site) carried the old site's WAN, device, or client selection onto the new one; and alert times in a Webhook digest carried no UTC marker, so a receiver could read them as local time.
Installation
Windows: Download the MSI installer below
Docker (Upgrade):
docker compose pull && docker compose up -dmacOS (native, recommended for accurate speed tests vs Docker Desktop):
git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.shProxmox:
bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c 'cd /opt/network-optimizer && docker compose pull && docker compose up -d && docker image prune -f'For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.
Need a hand with an install or upgrade, or something not working right? Ask on the Network Optimizer Discord. Confirmed bugs and feature requests go to GitHub Issues.