OPNexus Deutsch Install

← Back to home

Releases

Every minor version gets a bird-of-prey name; patch versions carry fixes and small improvements. The most important changes per version are listed here, the full text is in the changelog.

Current versionRollout-Zielversion

1.32.1 „Merlin“23 Oct 2026

Fix: rollouts now detect the target version for the Business edition and when switching the release type (core package opnsense-business/-devel); before, the gate stopped them by mistake. Plus a clearer plan hint about alias names.

Release 1.32.1 →

1.32 „Merlin“

  • 1.32.1 · Release23 Oct 2026Rollout-Zielversion – Fix: rollouts now detect the target version for the Business edition and when switching the release type (core package opnsense-business/-devel); before, the gate stopped them by mistake. Plus a clearer plan hint about alias names.
  • 1.32.0 · Release23 Oct 2026Konfiguration als Code – Export rules, aliases, NAT, groups, hierarchy and site variables as YAML and import them again with a plan (drafts only, never straight to a firewall; opnexus apply --dry-run for CI). A rollback point (ZFS boot environment) before every firmware update and “Back to previous firmware”; reachability probes in the rollout gate.

1.31 „Vulture“

  • 1.31.1 · Release23 Oct 2026Passwort-Reset repariert – Fix: opnexus password and the 2FA reset crashed, they work again.
  • 1.31.0 · Release22 Oct 2026Regeln sicher entfernen – Found rule candidates can be disabled through the usual preview (without a confirmation OPNexus reverts them automatically), deleted and restored later; with protection of the management access, admins only. The update tool also takes the newer CLI of the target release (only with a verified signature).

1.30 „Owl“

  • 1.30.0 · Release22 Oct 2026Regeln aufräumen und nachvollziehen – The rule analysis lists unused, shadowed and duplicate rules as candidates, and every rule has a change history (changed through OPNexus or directly on the firewall).

1.29 „Caracara“

  • 1.29.0 · Release22 Oct 2026Rechte sichtbar und Härtung – Missing API rights are shown and reported, gateway alerts can be switched off per gateway; hardening around session cookies, SSO, webhooks and the firewall interface, extended Grafana dashboard.

1.28 „Sparrowhawk“

  • 1.28.0 · Release21 Oct 2026Gleiches nur einmal – Adopting from a firewall now links identical rules, aliases and NAT entries to the existing central object instead of creating duplicates. Plus reworked tooltips.

1.27 „Buzzard“

  • 1.27.2 · Release21 Oct 2026Update-Werkzeug – Update tool validates the proxy before switching, heals the 1.27.0 compose file and detects a crash-looping proxy
  • 1.27.1 · Release21 Oct 2026Proxy-Fix – Fix: the proxy did not start with the new compose file (empty OPNEXUS_GUI_SITES)
  • 1.27.0 · Release21 Oct 2026Firewall-Oberfläche – Open the firewall interface through OPNexus (also behind NAT), separate secure origin, cookie hardening

1.26 „Kite“

  • 1.26.0 · Release21 Oct 2026Regel-Analyse – Rule analysis: which rule matches source, destination and port – pf-accurate, with confidence; MCP tool

1.25 „Goshawk“

  • 1.25.0 · Release21 Oct 2026Flotten-Rollout – Staged rollouts with health gates, recurring maintenance windows, self-verifying scheduled maintenance

1.24 „Merlin“

  • 1.24.0 · Release21 Oct 2026Bestand und Alarme – Adopt existing setup (aliases, NAT), gateway, resource and service alerts, new notification channels, ARM images

1.23 „Harrier“

  • 1.23.11 · Release20 Oct 2026Signaturprüfung im Updater – New: click-updates now verify the signature of the release images before switching.
  • 1.23.10 · Release20 Oct 2026Signierte Images – New: the release images are signed with cosign, and “opnexus update” verifies the signatures before switching.
  • 1.23.9 · Release20 Oct 2026Klarere Update-Hinweise – Improved: the update card now names the actual reason on installs without release images.
  • 1.23.8 · Release20 Oct 2026Klarere Update-Hinweise – Improved: on source-built installs the update card now shows only the relevant note instead of the updater instructions.
  • 1.23.7 · Release20 Oct 2026Versionsprüfung im Webinterface – New: the new-version check is set up with a switch in the settings – no .env change needed any more.
  • 1.23.6 · Release20 Oct 2026Versionsprüfung im Webinterface – New: the new-version check is set up with a switch in the settings – no .env change needed any more.
  • 1.23.5 · Release20 Oct 2026VIP-Ursache behoben – Fix: the actual root cause of the VIP problem in 1.23.4 is fixed – OPNexus now sends the interface with VIP edits, otherwise OPNsense removes the CARP VIP on apply. Also clearer instructions for one-click updates.
  • 1.23.4 · Release20 Oct 2026VIP-Fix und CARP-Überwachung – Fix: editing the description of a CARP VIP could deactivate the VIP live. OPNexus now verifies the live state after VIP changes and warns per VHID when a VIP is not active.
  • 1.23.3 · Release20 Oct 2026SSO und Tunnel-Ratgeber – SSO tested with Keycloak and Authelia (username from userinfo); S3 offsite verified with MinIO, Garage, RustFS and Versity; new guide on the management tunnel.
  • 1.23.2 · Release20 Oct 2026SSO-Fix – SSO login works with Keycloak and Entra ID (default scopes fixed); S3 and OIDC tested against real servers.
  • 1.23.1 · Release20 Oct 2026Sicherheit – Security fixes from an independent review: complete separation of duties, SSO login bound to the browser, management tunnel without forwarding, more secrets hidden in the backup change view.
  • 1.23.0 · Release20 Oct 2026Sicherheitsbericht – Security posture in daily use: a dashboard card, alerts for critical findings and a printable security report.

1.22 „Peregrine“

  • 1.22.0 · Release20 Oct 2026Variablen – Site variables: {{NAME}} placeholders in rules, aliases and NAT, filled per firewall. One object for many sites with different networks; nothing is sent if a value is missing.

1.21 „Osprey“

  • 1.21.0 · Release20 Oct 2026Fernzugriff – Management tunnel: manage firewalls behind NAT or CGNAT. The firewall dials out over WireGuard to a hub on the OPNexus server; nothing has to be reachable from the internet.

1.20 „Lilli“

  • 1.20.0 · Release20 Oct 2026Anmeldung – Single sign-on with your identity provider (OIDC), roles from groups, and separation of duties: operators prepare, only admins roll out.

1.19 „Lanner“

  • 1.19.0 · Release20 Oct 2026Backups – Scheduled backups with an encrypted offsite copy to S3-compatible storage, full backup and restore of OPNexus itself, an Operator role, audit export to syslog/webhook and rule usage: which rules no longer match anything?

1.18 „Kestrel“

  • 1.18.0 · Release19 Oct 2026Automation – API tokens for scripts, CI and AI assistants, Prometheus metrics, a read-only MCP endpoint and the new security posture: a 0–100 score per firewall from hardening and rule-hygiene checks.

1.17 „Imperial“

  • 1.17.0 · Release19 Oct 2026Maintenance – Scheduled maintenance with automatic CARP switchover: hand over to the partner, update, switch back – plus a backup before the update and a notification when a plan did not run.

1.16 „Hobby“

  • 1.16.0 · Release10 Oct 2026Setup – A setup assistant right after installation: your own password, two-factor and connecting your first firewall – with instructions for the API key. Plus “opnexus password” for a new admin password.

1.15 „Gyrfalcon“

  • 1.15.0 · Release10 Oct 2026Updates – One-click updates from the web interface – with progress and automatic rollback, through an optional, isolated updater container.

1.14 „Eagle“

  • 1.14.0 · Release9 Oct 2026Diagnostics – Ping, traceroute, port check and DNS from the firewall, plus VXLAN and GIF tunnels.

1.13 „Buzzard“

  • 1.13.0 · Release9 Oct 2026Host system – Tunables, cron, syslog and snapshots, LAGG, bridge, GRE and gateway groups – plus a cluster comparison with an alert.

1.12 „Condor“

  • 1.12.0 · Release9 Oct 2026Network – New area with preview, a backup before every change and a self-lockout guard. Rules created by hand can be adopted.

1.11 „Merlin“

  • 1.11.1 · Release9 Oct 2026Bug fixes – Fixes from live testing on real firewalls: certificates, VPN, ACME, alerts, mobile layout.
  • 1.11.0 · Release7 Oct 2026Security – Sessions end on password change, SMTP verifies certificates, firewalls over HTTPS only, more audit entries.

1.10 „Lanner“

  • 1.10.0 · Release5 Oct 2026Updates – Release images, opnexus update and rollback, optional new-version notice.

1.9 „Kite“

  • 1.9.0 · Release4 Oct 2026Operations – Versioned schema migrations – upgrades without hand-editing the database.

1.8 „Harris“

  • 1.8.0 · Release4 Oct 2026Usability – Accessibility: WCAG 2.2 AA contrast, keyboard operation, screen-reader labels.

1.7 „Goshawk“

  • 1.7.0 · Release4 Oct 2026Security – Secure transport: HTTPS proxy, pinned firewall certificates, two-factor sign-in.

1.6 „Peregrine“

  • 1.6.0 · Release4 Oct 2026Usability – A calmer interface: hints as tooltips, log size limit.

1.5 „Osprey“

  • 1.5.0 · Release19 Sep 2026Usability – Multilingual: the entire interface in German and English.

What comes next: roadmap → · Full changelog →