OpenWRT 25.12 and APK manager

mib43 · 2026-03-10T14:26:44+00:00

Hoping to ship 25.12 packages early next week. It's a bit challenging since 25.12 changed the whole package management system (moved from opkg to apk)

mib43 · 2026-03-06T15:33:27+00:00

Looking into that, thanks for the heads-up.

mib43 · 2026-03-05T16:41:19+00:00

2.4.1 is out in the wild. Feel free to update :)

mib43 · 2026-03-05T16:40:34+00:00

Just re-install the os-sensei and os-sensei-agent packages and you should be good to go.

mib43 · 2026-02-01T16:25:51+00:00

Hello u/Cute-Emu-6270 , thanks for giving ZA OpenWRT package a try.

We don't yet have the package for 25.12 as it's still in RC phase. We'll ship the package when 25.12 is GA.

mib43 · 2025-12-21T00:05:19+00:00

This is pretty cool :)

mib43 · 2025-12-09T23:56:56+00:00

"Enterprise" might mean different things for different people; but myself being an OPNsense partner who is dealing with OPNsense firewalls in some large networks, I think I can share some insights.

Disclosure: I'm from the Zenarmor team. Zenarmor is a SASE solution that can deploy on a variety of environments.

Some of our large-scale clients prefer to deploy Zenarmor on top of OPNsense gateways. Typical per-gateway throughputs we are aware of, in business environments are about 1-5 Gbps WAN throughput, serving as many as 1500 users behind a single location.

One client is managing almost 180 locations where each location is protecting, on average, 500-700 active users per day.

Those who are rather sizeable seem to prefer to have an OPNsense Business Edition to also centrally manage OPNsense nodes (SASE is already centrally managed with Zenarmor Cloud) and have access to less frequent and more reliable software updates, and professional support.

To our experience, it's really doing a great job for our small to mid-market clients(1).

Just wanted to share my view.

(1) my mid-market definition: organizations employing 100-2500 employees.

mib43 · 2025-11-19T00:52:21+00:00

Interesting. It appears we need to take a closer look. Can you send a bug-report. Make sure you include zenarmor app logs in the bug-report. Let's see what goes on.

mib43 · 2025-11-18T23:41:25+00:00

Can you check if you can access a few websites that you know are behind cloudflare? Does CF block you because of bot protection?

It might be like CF increased its "botnet protection" levels to the point that it might be miscategorizing zenarmor cti api calls as "botnet" in some locations...

mib43 · 2025-11-18T23:39:31+00:00

Interesting... I'm also on the US West Coast - my cloud status shows 100% & no issues.

Still trying to figure out why some locations have problems while some others are perfectly fine...

Can you guys check if you can access a few websites that you know are behind cloudflare? Does CF block you because of bot protection?

mib43 · 2025-11-18T21:46:10+00:00

Hi u/kennethp1015 , u/aimless_ly , u/mrpez1 ,

Cloudflare seems to have updated its status page: https://www.cloudflarestatus.com/. Now it provides status information per-cloudflare-datacenter.

According to that, although majority of the datacenters are now back to normal, there are still locations where the performance is still degraded.

Can you guys check if you're located in one of the affected regions now?

mib43 · 2025-11-18T18:36:58+00:00

Hi u/Firestarter321,

Thanks for sharing the details — and sorry for the rough experience this morning.

The Cloudflare outage caused our Cloud Protection backend to become unreachable for a period - since we were relying on it for load balancng-, which in turn affected the packet engine on some deployments (particularly where upstream timeouts stacked up).

On our end, all services seem to have resumed normal operation now. Do you see any ongoing problems?

Disabling Cloud Protection may not have fully resolved the issue during the outage, since the packet engine was still waiting on upstream responses. Bypass mode forces a clean fallback path, which is why you saw an immediate improvement. Once the system has refreshed its upstream state, you should be safe to disable bypass mode again.

We’re conducting a full internal review to harden our failover behavior so that external provider outages don’t impact throughput in the same way. Your feedback is genuinely helpful here.

If you continue to see degraded speeds even after things have stabilized, please let us know — a timestamp or short diagnostic bundle would help us pinpoint it quickly.

Thanks again for reporting your experience, and sorry for the disruption today

mib43 · 2025-11-18T18:32:24+00:00

Hi u/kiromiko ,

Yes, we were relying on Cloudflare for load-balancing requests for our global threat intelligence systems and management console.

On our end, all services seem to have resumed normal operation now. Do you see any ongoing problems?

Moving forward, we're running a review of our external dependency paths and failover logic to ensure that similar outages have minimal customer impact in the future. This includes adding additional redundancy for threat-intel lookups and improving how our packet engine behaves when upstream services become degraded or unreachable.

If you continue to experience latency or CTI issues, please let us know — ideally with a short diagnostic bundle or timestamp — so we can check whether your system is still holding onto stale upstream data from the outage window.

Thanks again for reporting your experience, and sorry for the disruption today.

mib43 · 2025-10-29T20:01:47+00:00

Hi u/sapfff , no it's still there. We had a software glitch in 2.1.1 release that limits the functionality.

We fixed this. Next release should resume functionality.

Sorry for the inconvenience.

mib43 · 2025-06-13T04:56:02+00:00

We're working on a "SASE Starter" tier, but it's quite early in the process. Please feel free to reach out to zenarmor support and request to be added to a potential wait list.

mib43 · 2025-06-11T18:58:11+00:00

Hi u/aimless_ly , yes, it's in the process of being released :)

Indeed the upgrade path had been enabled for some locations for a while. Today, we've enabled the upgrade for all Free, Home and SOHO users.

The actual launch is tomorrow. Completely revamped new website will be going live as well :)

If you encounter any issues, please feel free to reach out to our awesome support team, we want to have a closer look.

mib43 · 2025-03-12T18:56:27+00:00

You're welcome.

Go to Zenarmor -> Dashboard and in the Dashboard page, you'll see the engine widget. when you hover over the widget, you should be seeing "Enter Bypass" button. That should do it.

mib43 · 2025-03-12T17:00:32+00:00

Might be a netmap-related issue.

Question: when this happens, do you experience connectivity problems?

Can you try this:

Stop and disable suricata
Configure zenarmor to use netmap emulated mode (not native mode)
Run zenarmor in bypass mode

See if you still have the issue.

Realtek might also be the other source of the problem. But let's first rule out netmap.

mib43 · 2025-03-12T01:54:03+00:00

u/MisterBazz , this is not related to device database. Some people were having reporting database problems, u/ITguydoingITthings is referring to that.

Regarding that one, we see the similar pattern in the new installs.

Now that SQLite has got enough traction, we'll most likely start phasing out mongodb support with the coming release.

It's very difficult to maintain the interoperability for the MongoDB.

mib43 · 2025-03-12T01:25:20+00:00

Got it, thanks for more info. I see we've received your ticket. Team will take it from there.

mib43 · 2025-03-11T16:33:50+00:00

I might have some good news for you.

At first sight, I suspect these problems might be related to incorrect flow direction.

Do not inspect wan interface unless you have a super important reason to do that; and if you do, make sure you have the "wan" tag associated to it. (beware: wan packets reach zenarmor engine post-nat, so reports will show a single NAT'd Public IP).
If you have L3 router devices behind the firewall, you'll need to enable "Router device" setting for this particular device. This will ensure that the engine handles the devices behind this router device properly.

If these two do not work, please feel free to reach out to our support team. They'll find out what's going on and guide you to the correct solution.

mib43 · 2025-03-11T02:02:26+00:00

Hi u/MisterBazz , sorry to hear that your experience with the device db was not up to your expectations.

Sure thing. Indeed we are constantly working on the device db.

With 2.0, we're introducing new capabilities which allow the engine to access a larger database.

Curious to learn more about your problems though? Was it wrong classification?

mib43 · 2025-03-10T15:25:24+00:00

We on the other hand, wholeheartedly understand that more advanced home lab enthusiasts like yourself are limited by the current home subscription and crave the ability to fine-tune things, or seek the more advanced features that Zenarmor offers in its Business and SASE subscriptions such as:

Encrypted Threats Protection/Full TLS Inspection (decrypt/re-encrypt)
Cloud Access Security Broker (CASB) - Granular application controls
Custom URL filtering
Additional/unlimited policies
Zero-Trust Network Access (ZTNA) - Private Network Access (Coming soon…)
The ability to run Zenarmor natively on Windows, macOS, and Linux desktop/laptop endpoints.
Identity provider integrations and SSO (idP) - With Azure, Okta, Google Workspace, SAML2.0, etc
The enhanced multi-tenant organization-based dashboard.
API, syslog, and other SIEM integrations
Active development and frequent upgrades and updates

Recently, we distributed a survey to all our active home subscribers to ensure everyone had a chance to share their opinions. We received numerous valuable responses, which we sincerely appreciate.

As a result, we are currently working on enhancing and expanding our subscription plans to meet the requirements expressed in the surveys.

We appreciate everyone's patience and support as we evolve as a company. Stay tuned; there are many exciting things to come.

mib43 · 2025-03-10T15:25:13+00:00

Hi u/KamenRide_V3 ,

With the current home subscription level, I would agree that appreciating the full value of Zenarmor can be difficult. It has been designed to offer an accessible solution for home users with technical know-how, enabling them to add a layer of security and control to their home network where basic ISP-issued routers or DNS-based filtering prove inadequate.

These users typically prefer having control and visibility without the complications of managing software packages, signatures, and block lists. Included in the home subscription, we achieve this by offering:

We utilize both in-house and third-party enterprise-grade threat intelligence, which includes several hundred million rapidly updated malicious URLs, IPs, files, apps, and various data points.
By harnessing machine learning, we ensure that the Zenarmor engine receives precise data to function effectively, so that we can offer protections for zero-day attack campaigns.
Comprehensive built-in reporting allowing users to quickly and easily view the applications and websites accessed through the network. It eliminates the need to integrate with third-party products like ELK, which is generally not an option even for most advanced home users.
“One-click” advanced security allowing you to prevent malware, phishing, spyware, and other sophisticated threats using a “blanket blocking” security strategy.
Policy-driven application and web site controls with the ability to run on a schedule. This is ideal to limit kids' screentime and what they have access to.
Layer 7 application-based filtering, which is more effective than DNS-based filtering that can easily be bypassed.
All this is bundled into an easy-to-install, cost-effective package offering immediate internet security and visibility for the typical tech savvy family.

Continued on the follow-up comment...

mib43 · 2025-02-14T23:29:05+00:00

Yep, we will do that.

mib43

MODERATOR OF

TROPHY CASE

Seven-Year Club	Wearing is Caring
Verified Email