On-Site Agent update (optional, the v2.11.0-preview11 Agent, unchanged in preview12-14): upgrade it so that Path Localization's traces from an On-Site Agent use 5 probes per hop (an older Agent still traces, at 3): open Settings - Multi-Site, expand your site, and press Run It for Me under the upgrade command. If you haven't updated since before preview6, this one also lets the agent automatically roll back a Change Control change that inadvertently cuts the site off from Network Optimizer, and reconnect within seconds behind a reverse proxy that closes its connection.
Fourteenth preview of v2.11.0. See the v2.11.0-preview1 notes for all of the details on Change Control, and the v2.11.0-preview13 notes for what came before this one.
Mostly Set Up Zones: rename a zone on the board, delete one the move empties, and a narrower Allow Internal to Servers. Change Control's lockout checks and Fix it for me now read firewall policies the way the Security Audit does, Re-address Networks asks you to acknowledge clients with no DHCP lease, and Review Plan shows when the gateway is provisioning. Plus the v2.10.6 work since preview13: bundled nginx security updates, and an Upstream Path Discovery fix for UniFi cellular WANs.
Change Control
Migrate / Restore - Set Up Zones
- Rename a zone on the board with the pencil on any column but UniFi's built-in zones and Unassigned. The policies the plan names after a zone follow the new name.
- Delete this zone on a zone of yours that the move empties: the plan deletes it and moves its policies, names unchanged, to the zone its first network goes to. Untick it to keep the empty zone, and its policies are copied as before.
- Allow Internal to Servers is a row in Exceptions - it opened the whole Server Services port group (SSH, RDP, SMB, and more), even where your own rule reached the zone on one port. It is unticked now when your rule already reaches the zone, or the Servers zone is one you built.
- Also fixed: Back from Review Plan lost your moves, renames, and exceptions; a zone-wide allow into a zone, such as a resolver allow on port 53, stayed on the emptied zone, so the plan flagged a DNS lockout; exceptions read "Only if you assign Cameras to a zone" after you renamed that zone (Protect), or under By purpose with your own IoT zone; By purpose added an allow between two zones that your own rule already covered; a policy got a second, identical copy when a network joined a zone renamed in UniFi Network; and Drop here flickered while you dragged.
Review Plan
- Lockout and internet-cut checks read firewall policies the way the Security Audit does, so IP groups, address ranges, source ports, and "all but" sources count now, and a block on every port but the management ports is no longer a lockout.
- Re-address Networks: clients with no DHCP lease need acknowledging before Apply. They stay on the old subnet until they ask DHCP again or you change them, and the count beside Review Plan jumps to the No DHCP Lease card.
- Gateway provisioning beside Apply - shows while the gateway applies a change, then Gateway ready. On desktop it is on the tab row too, and on Changes once you pick one site.
- Also fixed: Back went to the task Migrate / Restore opened with, not the one you picked; after an apply, Back from an Edit or Set Up Zones plan went to Changes; emptying a zone with Threat Intelligence on it asked for a tick per Threat Intelligence policy; and going Back and building a plan again left the earlier plan behind as a Draft, in Edit, Set Up Zones, and Re-address Networks.
Changes
- View Plan beside View Diff on a change Network Optimizer applied from a plan.
Security Audit
- Fix: Fix it for me could copy a block on an unrelated app as the DoH fix, or count a DNAT rule that isn't a UDP port 53 redirect as DNS coverage.
Monitoring - Network Performance
- Fix: "Couldn't identify the first upstream device" in Upstream Path Discovery on a UniFi cellular WAN (also coming in v2.10.6) - the modem has no L2 neighbor to find, and discovery says so now. A UDR-5G-Max's WAN is also set to Cellular, as a U5G-Max's already was.
Fixes
- Bundled nginx updated for six CVEs (also coming in v2.10.6) - the Windows MSI moves to nginx 1.30.6, and the speed test and On-Site Agent Docker images pick up nginx's current security fixes.
Installation
Preview builds use a rolling :preview tag that always gets the latest features and fixes. Set it once and future builds arrive on pull.
Docker (assuming you've installed already through the normal procedures listed in v2.10.5 or other releases):
image: ghcr.io/ozark-connect/network-optimizer:preview
image: ghcr.io/ozark-connect/speedtest:previewdocker compose pull && docker compose up -dWindows: download the MSI installer below
macOS (native, recommended for accurate speed tests vs Docker Desktop). Same command for every preview build. The branch is rebuilt when a release ships, so the reset is what keeps a later update from stopping on a diverged branch - it discards local changes to the checkout:
cd NetworkOptimizer && git fetch origin && git checkout release/2.11 && git reset --hard origin/release/2.11 && ./scripts/install-macos-native.shProxmox (assuming you've already installed via the LXC script listed in v2.10.5 or other releases):
pct exec <CT_ID> -- bash -c 'cd /opt/network-optimizer && sed -i -e "s#network-optimizer:latest#network-optimizer:preview#" -e "s#speedtest:latest#speedtest:preview#" docker-compose.yml && docker compose pull && docker compose up -d && docker image prune -a -f'For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.
Something broke on this preview, or need a hand switching to it? Tell me in #previews on the Network Optimizer Discord. Confirmed bugs and feature requests go to GitHub Issues.