v2.5.3

On-site agents: update recommended. Two fixes. Stopping or restarting an agent could leave a false packet-loss spike in your monitoring history: the restart cut off in-flight measurements and the incomplete results were counted as loss. And a site reaching its UniFi Console, gateway SSH, or modem / ONT pages through an agent by hostname rather than IP could be refused outright, with a misleading SSH error. IP-addressed sites were unaffected by the second. Enrolled agents will prompt to update.

Mostly Monitoring this time: a site whose UniFi Console is unreachable is now readable rather than hidden behind a banner, ISP Health gains Uptime and scores outages against the window you are looking at, and every Monitoring setup action is audited. See the v2.5.0 release notes for what's new in v2.5.0+.

Monitoring

• A site whose console is down is still readable. Losing the UniFi Console used to replace the whole page with a banner. The banner now sits above the page and everything built on stored history keeps working: Live View plays back its timeline, and the WAN chart, gateway CPU/memory/temperature and fabric ingress/egress all fill in. The history was already there; the page just refused to show it without the console.
• ISP Health grades an offline site. The expected ISP speeds come from the UniFi Console, so an unreachable console meant no grade. The last successful read is now remembered per WAN and used when the console cannot answer, labeled as remembered rather than current. A site that has never had a successful read still waits, having nothing to score against.
• Monitoring setup actions are audited. Adding, pausing, deleting and retiming a latency target, saving alert thresholds, turning collection on or off, resetting the InfluxDB connection, running or committing Upstream path discovery: none of these left an audit entry. They all do now. Failed edits say so, too: pause and delete used to swallow errors, so a rejected change looked like a row that simply refused to move.
• A site's own admin can finish that site's InfluxDB setup. Setting up the installation's InfluxDB server stays an instance-wide Admin task; adding one site to a connection that already exists does not. A site admin could previously reach the wizard and never be able to complete it.
• A main site can hand its collection to its on-site agent. Probes, path discovery and SNMP run at the site and this server stands down. For installs where the server is not on the network it monitors. Off by default, and the toggle only appears once an agent is enrolled.

ISP Health

Outages and congestion were scored on absolute counts, so a 15 minute disruption cost the same whether you were looking at 24 hours or 30 days. Both now scale to the window.

• Uptime - New, above the three dimension gauges on the score card, and leading the dimension grades in Export PDF. It counts partial path disruptions, not just total blackouts, so a path that lost most of its targets for ten minutes shows up instead of reading as a clean 100%.
• Outage and congestion penalties are relative to the window. One brief outage no longer takes double digits off a 30 day score, and outages straddling the window edge only count the part inside it. Nine congested hours used to bottom out the curve regardless of window length, quietly costing healthy networks around 30 points on a month view.
• Stability and Congestion on the network cards and hop rows. The two aspects that fed the grade invisibly now sit next to P90 Jitter and Loss%, so a low grade points at its own cause. Where that cause is congestion, the event count jumps to Path & Congestion Events and highlights the entry.
• Packet loss inside your own network is subtracted. Network Optimizer also measures loss to your own gateway. If packets are being lost on your side - a bad cable, a marginal SFP, a saturated uplink to the gateway - that same loss appears in every measurement to the internet. It is now subtracted, matched in time, so your ISP is not graded for a problem inside your own network. A window with no gateway readings grades exactly as before.
• Flat-lined targets stay out of Loaded Loss. A target sitting at 100% loss all window says nothing about behavior under load, but it dominated the average.
• Implausible throughput samples no longer define Loaded Loss. A single bogus WAN rate reading, several times your plan speed, could mark a quiet window as loaded on its own - which is how a counter artifact turned a healthy month into a double digit Loaded Loss figure.
• Faster on long windows. 30 day compute on a large site dropped from roughly 13 seconds to under 7, at the same resolution and with the same results.

Setup

• The status stays current while you watch it. The page used to be a snapshot from load time: fix the problem and nothing changed until a reload. InfluxDB reachability, SNMP poll health, collection state and agent presence now update live, and updates hold off while a custom OID or Monitoring Interfaces edit is in flight rather than tearing the form away mid-edit.
• Collection status reports both collectors. It could read "Agent running" when the agent died an hour ago, and on an agent site it credited this server for work it does not do. A site with an agent now gets a second line for the agent's own state, since the two fail independently.

Upstream path discovery

• Better first-run targets, calmer card. Candidate verification is stricter on a WAN's first run - the run that seeds your monitoring targets - and the card now follows discovery smoothly and lands on the top instead of jumping section to section.

Monitoring Interfaces

• Management VLAN - The VLAN field is relabeled and its help text rewritten. It sets the modem or ONT's management VLAN, not the WAN's own VLAN tag, and is rarely needed.

Multi-Site

• The Sites table updates itself. A site removed by another admin, or your own access being granted or revoked, used to leave the table showing the old list until you navigated away and back.
• A Site Admin can see the Multi-Site tab. It asked for an instance-wide Admin while everything inside it already answers per site, so a site's own admin could reach Multi-Site by link but never see the tab.
• Tightened up several edge cases in the site creation and removal lifecycle.

Settings - Audit Log

• Every event says which site it acted on. Most events - everything done through the normal UI - were written with no site at all, so filtering by the default site returned nothing while other sites worked. Historical rows stay blank and are not backfilled: the site was never recorded, and guessing would put something false in a compliance log. Instance-wide actions like licensing and auth policy stay off a site rather than filing under whichever one happened to be open.
• Every event says what it acted on. An entry used to say a monitoring target had been paused without saying which one. There is now a Target column reading "Latency Target: Test".
• Export CSV/JSON returns the whole log again. Export quietly filtered to the current site and dropped every event with no site of its own - which was most of them.
• Filters match regardless of case. Searching an actor as "Kira" found nothing for a user stored as "kira", and a capitalized Site ID returned an empty log.

Adaptive SQM

• Larger download burst - New per-WAN setting raising the download burst from roughly 40 µs of line time to 1 ms, so senders arriving in clumps are not clipped by the shaper. Helps downloads that fall short of full speed, especially to Wi-Fi clients and from distant servers. Upload is unaffected. (#1009, thanks @Optic00)
• On by default for WANs configured from here on. Existing configurations keep what they have, so no deployed connection changes behavior on upgrade.
• Trying it on a connection you already run takes two steps: tick Larger download burst on the WAN, then deploy Adaptive SQM again. The setting lives in the script on your gateway, so ticking it alone changes nothing until you redeploy.

Performance Tweaks

• Firmware gate raised to UniFi OS 5.1.28. Verified on the bench: 5.1.28 changes nothing the tweaks depend on.

Deployment

• Non-standard reverse-proxy port - Installs fronting Network Optimizer with a reverse proxy on a port other than 443 can declare it with REVERSE_PROXIED_PORT, and the speed test link, results callback, nginx configuration and CORS allow-list all pick it up consistently. Deployments that do not set it behave exactly as before.
• A local health check stays on the local listener. With a canonical hostname configured, http://127.0.0.1:8042/api/health was redirected to the public hostname, so a check that never needed to leave the box depended on public DNS and the proxy being reachable from inside the host. Installers and process supervisors could report a healthy install as failed. Browser traffic is still redirected as before. (#1091, thanks @Jason-Morcos)
• macOS keeps its privacy approvals across updates. The native installer signed the app in a way that gave it a new identity on every rebuilt install, so macOS treated a routine update as a different app and the approvals you had granted stopped applying. (#1090, thanks @Jason-Morcos)

On-site agent

• A stop no longer plants a false loss spike. See the note at the top; this is the fix worth updating an agent for.
• A hostname whose DNS answer includes a placeholder address is reachable again. The agent only connects to addresses inside its own site, and a resolver returning :: alongside the real address got the whole name refused.
• SNMP configuration reaches a reconnecting agent immediately, instead of the agent polling with stale settings until the next refresh.
• **The LAN...

v2.5.2

⚠️ On-Site Agent update recommended for this release. The agent gained a self-healing watchdog for a rare failure where it could go silent for hours while its process stayed alive, plus disk-backed result spooling and probe isolation. Enrolled agents below 2.5.2 will show an Update agent prompt in the Multi-Site agent list. One-time for this release; sites running fine today aren't at risk, but the fix is worth taking.

More fixes and refinements on top of v2.5.1, with smarter ISP Health scoring for PPPoE connections. See the v2.5.1 release notes for what's new in v2.5.0+

• Coming Soon - a hosted Network Optimizer, for people who don't have a home server or don't want to set up the infrastructure. $15/month for up to 3 sites, with a 14 day free trial and enterprise-grade security. The commercial hosted plan is $25/month per site, adding full management and consulting - see pricing and licensing. The on-site agent runs on your gateway, so the only thing you give up is LAN speed testing. WAN speed testing is included, with some data limits.

Multi-Site

• On-Site Agent self-heals a wedged async I/O engine - an agent went dark for hours while its process stayed alive: the gateway's kernel lost an epoll wakeup, freezing .NET's socket event loop so every async operation timed out while the network was fine. The agent now runs a loopback canary that detects this (a 127.0.0.1 connect can't time out for network reasons), spools its backlog to disk, and exits for systemd or Docker to relaunch. Recovery in about 3 minutes instead of indefinite silence, with no data lost - and that same spool now carries the backlog across deliberate restarts and updates too. Real WAN or server outages never trip it.
• One hung probe can't freeze the rest - the incident took every target dark from a single stuck pipe read. Each probe now gets a hard deadline, and a probe whose output can't be read is recorded as a gap rather than as a fabricated 100% loss. This hardening applies to server-side probing as well.
• LAN speed test relights with the agent - on native installs the speed test nginx stopped whenever the agent stopped and never came back without a manual start. It now follows every agent start automatically.

Monitoring

ISP Health

• PPPoE connections are scored for what they actually cost - a PPPoE session terminates on a BNG, and the BNG usually sits deeper in the network than the OLT or DSLAM, so your first hop is further out through no fault of the line. ISP Health now detects the session from the gateway itself and widens what it expects across latency, jitter, RTT stability, loaded loss and loaded latency, on top of your access medium's own expectations. The latency allowance is tuned per medium (2 ms on PON, 1 ms where the BNG is typically a local hop), and the jitter and stability allowances are composed so they count on a quiet line and fade on one that is already noisy. The header reads Scored as GPON (PPPoE), so a widened threshold is never invisible.
• Bufferbloat is still called out on PPPoE - the loaded-latency allowance is deliberately small. The BNG's per-subscriber shaper is a bufferbloat source, and a line that buffers badly should still grade down for it rather than be told it's normal - that's what Adaptive SQM is for.

Network Performance

• Access network technology asks only for the medium - PPPoE is no longer offered in Upstream path discovery. It isn't an access medium: it rides GPON, DSL or Active Ethernet, and choosing it meant giving up that medium's tuned thresholds for a generic band. Pick what the session rides and the session itself is detected for you. Connections already set to PPPoE move to the detected medium where the first upstream device identifies one.

Live View

• WAN chart hover and crosshair behave - the crosshair now only tracks inside the plot area, hover-hold reads the real plot rectangle instead of a stale estimate, and a leftover hover state can no longer freeze the chart mid-redraw.

Fixes

• Nothing trusts the UniFi Console until it answers - a failed console request was cached as though it were real data, so the app could briefly believe your site had no devices or no networks, and ISP Health would score in that window without expected WAN speeds or PPPoE detection, then cache that for 15 minutes. Most likely right after a restart, when the first request is the one that fails.
• Export PDF fixes - the Score Breakdown claimed "No data for this dimension in the window." under ISP Network despite printing its score right above, and the summary line named your access technology twice ("DOCSIS (DOCSIS (Cable))").

Installation

Windows: Download the MSI installer below

Docker (Upgrade):

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c "cd /opt/network-optimizer && docker compose pull && docker compose up -d"

For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.

v2.5.1

Quick fixes for v2.5.0. The full v2.5.0 notes are included below - if you're coming from v2.4.x or earlier, that's the whole picture in one place.

Fixes in v2.5.1

• Monitoring - Live View - The Port Statistics table renders on multi-device sites again. The device filter and its Clear filter control are now scoped to the tab in view (Gateways & Switches vs APs), and a stale saved filter that hid every device is dropped instead of leaving the table blank.
• Monitoring - ISP Health - Partial-loss detection now weighs every monitored internet destination, not just the two rows the waterfall displays, so the same event reads the same at every site - and several regional endpoints of one provider count as one network, not several. Long outage waterfalls collapse to their first and last rows with the hidden middle a click away.
• Security Audit - Firewall: Internet Block Bypassed no longer flags return-only allow rules (RESPOND_ONLY, or legacy ESTABLISHED/RELATED) or rules aimed at a non-external zone - neither can carry new internet traffic (#1076, thanks @jimstrang for the report and the fix).

Everything below is v2.5.0, republished:

Identity, SSO and RBAC. Security that scales to your install: stay with a single administrator, or add roles, MFA and SSO as you need them.

This release adds accounts, roles, per-site access, MFA and passkeys, single sign-on and an audit log - none of it required to keep running the way you do today.

Identity, SSO and RBAC

• Accounts with roles - Admin, Operator or Viewer, globally or per site, so someone can watch a site without being able to change it.
• Per-site access - grant a person one site, several, or all of them.
• MFA and passkeys - sign in with a passkey, or require an authenticator app for a given role. Recovery codes included.
• Single sign-on - add an OpenID Connect or SAML 2.0 provider, with the redirect and metadata URLs ready to paste. New accounts are either created on first sign-in or required to exist already; roles are set on this side.
• Audit Log - every change recorded with who, where, and whether it succeeded, kept for a year, filterable and exportable. It records whether or not you set up any of the above.
• The UI follows your role - controls you cannot use are hidden or read-only, rather than failing when you click them.

Managed SSH Key

• Generate or upload a keypair per site in Settings - Connection, instead of shelling into the container to place a key file.
• Install on gateway puts it on a Cloud Gateway in a couple of clicks, which is the one place UniFi Network cannot place a key for you.

Monitoring

• Chart tooltips list every series, ordered to match how the lines sit on the plot, with a dot on each line at the point you are reading. Across Network Performance, Device Stats, SFP Stats, CM Stats, Cellular Stats, Starlink Stats and ONT Stats.
• New data streaming in no longer pulls the tooltip away.
• ISP Health's latency chart gets all of the above, plus its own series filter: click a chip to isolate one provider, click again for all, Ctrl-click to drop just one.
• A clear-filter control on the chip rows, to get every series back in one click.
• ISP Network hops show their address - hover a hop for the IP it answered on and its reverse-DNS name, so you can line our reading up against your own traceroute (#1070, thanks @cypherstream).
• An outage now shows as a gap on the ISP Health chart instead of the line running through it.
• SFP Stats temperature - a temperature line could double back on itself after an outage.
• WAN Live Chart - clicking the timeline inside the last minute parks the cursor where you put it instead of jumping back to live.
• Packet Loss Events - following a loss event from ISP Health opens the Investigate card every time, not just after the first page load.
• Switches that offset their ifXTable index report traffic again - affected ports read as zero and the switch eventually dropped out of polling. This is specific to legacy UniFi Network devices that index this way, the US-8 being the known case (#1071, thanks @jimstrang for the report and the walk data).

WAN Speed Test

• A path-analysis retry loop could pin the server - a narrow combination to land on, but anyone who did had a pegged server and no idea what was doing it. Retries are now bounded per result.

Alerts & Schedule

• Acknowledge All followed by Resolve All works in one click, instead of resolving one alert per click and appearing stuck.

Security Audit

• UniFi domain-group firewall destinations resolve instead of being reported as unresolved (#1063, thanks @jimstrang).

On-Site Agent

• This release ships a new agent build carrying the SNMP fix above. The update is optional: it only matters if you have legacy UniFi Network devices like the US-8. Nothing prompts you, and enrolled agents keep working as they are.

Installation

Windows: Download the MSI installer below

Docker (Upgrade):

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c "cd /opt/network-optimizer && docker compose pull && docker compose up -d"

For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.

v2.5.0

Identity, SSO and RBAC. Security that scales to your install: stay with a single administrator, or add roles, MFA and SSO as you need them.

This release adds accounts, roles, per-site access, MFA and passkeys, single sign-on and an audit log - none of it required to keep running the way you do today.

Identity, SSO and RBAC

• Accounts with roles - Admin, Operator or Viewer, globally or per site, so someone can watch a site without being able to change it.
• Per-site access - grant a person one site, several, or all of them.
• MFA and passkeys - sign in with a passkey, or require an authenticator app for a given role. Recovery codes included.
• Single sign-on - add an OpenID Connect or SAML 2.0 provider, with the redirect and metadata URLs ready to paste. New accounts are either created on first sign-in or required to exist already; roles are set on this side.
• Audit Log - every change recorded with who, where, and whether it succeeded, kept for a year, filterable and exportable. It records whether or not you set up any of the above.
• The UI follows your role - controls you cannot use are hidden or read-only, rather than failing when you click them.

Managed SSH Key

• Generate or upload a keypair per site in Settings - Connection, instead of shelling into the container to place a key file.
• Install on gateway puts it on a Cloud Gateway in a couple of clicks, which is the one place UniFi Network cannot place a key for you.

Monitoring

• Chart tooltips list every series, ordered to match how the lines sit on the plot, with a dot on each line at the point you are reading. Across Network Performance, Device Stats, SFP Stats, CM Stats, Cellular Stats, Starlink Stats and ONT Stats.
• New data streaming in no longer pulls the tooltip away.
• ISP Health's latency chart gets all of the above, plus its own series filter: click a chip to isolate one provider, click again for all, Ctrl-click to drop just one.
• A clear-filter control on the chip rows, to get every series back in one click.
• ISP Network hops show their address - hover a hop for the IP it answered on and its reverse-DNS name, so you can line our reading up against your own traceroute (#1070, thanks @cypherstream).
• An outage now shows as a gap on the ISP Health chart instead of the line running through it.
• SFP Stats temperature - a temperature line could double back on itself after an outage.
• WAN Live Chart - clicking the timeline inside the last minute parks the cursor where you put it instead of jumping back to live.
• Packet Loss Events - following a loss event from ISP Health opens the Investigate card every time, not just after the first page load.
• Switches that offset their ifXTable index report traffic again - affected ports read as zero and the switch eventually dropped out of polling. This is specific to legacy UniFi Network devices that index this way, the US-8 being the known case (#1071, thanks @jimstrang for the report and the walk data).

WAN Speed Test

• A path-analysis retry loop could pin the server - a narrow combination to land on, but anyone who did had a pegged server and no idea what was doing it. Retries are now bounded per result.

Alerts & Schedule

• Acknowledge All followed by Resolve All works in one click, instead of resolving one alert per click and appearing stuck.

Security Audit

• UniFi domain-group firewall destinations resolve instead of being reported as unresolved (#1063, thanks @jimstrang).

On-Site Agent

• This release ships a new agent build carrying the SNMP fix above. The update is optional: it only matters if you have legacy UniFi Network devices like the US-8. Nothing prompts you, and enrolled agents keep working as they are.

Installation

Windows: Download the MSI installer below

Docker (Upgrade):

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c "cd /opt/network-optimizer && docker compose pull && docker compose up -d"

For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.

v2.4.0

This release answers a question UniFi Network could never answer before: exactly why did that device reboot? Plus a guided tour of what's new, an ISP Health report you can hand your ISP, and read-only gateway interface diagnostics with a WAN lease countdown.

What you missed on v2.3.1

• One-click Device Monitoring toggles - ONT, Cable Modem, Cellular, Starlink and Monitoring Interfaces each got a Disable/Enable switch.
• Sharper ISP Health scoring - per-technology RTT stability grading, path witness absolution, and AWS path-end targets.
• Speed test results link into Live View at the moment the test ran.
• Multi-Site onboarding picks the site during UniFi Console onboarding.
• CyberSecure upgrade advisory when the gateway's Suricata engine has an update waiting.

See the v2.3.1 release notes and the v2.3.0 release notes for the full detail.

Guided Tours

• A short walkthrough after you upgrade - land on the Dashboard and Network Optimizer offers a tour of what's new, spotlighting each feature where it lives. Later means later, not "ask me again tomorrow". Replay any tour, or turn them off entirely, in the new Guided Tours card in Settings - Application.

Dashboard

• Why a UniFi Network Device restarted - hover the uptime on a Dashboard device card for the reason behind the current boot: firmware upgrade, commanded restart, lost power, a hang, or a kernel panic, with the evidence behind it. Reasons are read from the device itself and backfilled, so devices that rebooted before this release get answers too.
• Coming Soon - firmware / UniFi app upgrade orchestration, taking into account historic WAN and LAN activity patterns, device topology, preferred speed of rollout, and more.

Monitoring

ISP Health

• Export PDF - the whole scorecard for the window on screen, naming the WAN and ISP it scored. Ready to attach when you open a ticket.
• Category filter pills for Path & Congestion Events - narrow the feed to the kind of event you're chasing. (#1050)

Live View

• The timeline shows the clients that were connected then - scrubbing back used to show only who is connected right now. Clients are rebuilt from the telemetry for the moment you're viewing, on the device they were actually attached to, and keep their names even after weeks away.

Network Tools

• Inspect a gateway interface - read one interface live off the gateway: link state, addresses with the DHCP lease as a countdown, SFP diagnostics, and resolved neighbors. An ISP that quietly stops renewing gives no warning, and UniFi Network never shows how long your lease is good for. (#1054, thanks @cypherstream for the idea and the command)

Alerts & Schedule

• Device Offline now fires, and the new Device Recovered closes it out - the seeded Device Offline rule never had anything publishing to it. Both events now publish as a paired cycle and ship enabled, so an outage announces itself and then tells you when it's over.
• An upgrade no longer looks like an outage - devices UniFi reports as upgrading, provisioning or adopting are never announced as offline, and an outage that turns out to be an upgrade closes as recovered.
• Device Restarted - a new rule whose severity follows the reason: quiet when someone meant it, a warning when nobody did.

Security Audit

• Return-traffic rules are no longer flagged - established and related return rules are deliberate, and are now classified as intentional exceptions. (#1056, thanks @jimstrang)

Performance Tweaks

• SFP 2.5G mode retries at boot - the SGMII+ mode set retries instead of warning once and giving up, so a port that comes up slow gets another chance. (#1053, thanks @Optic00)
• UniFi OS 5.1.27 supported - community tested and verified.

Multi-Site

• On-gateway agents get the right upgrade command in the agent list, instead of instructions that don't apply to a gateway.
• The native installer refuses to run on a UniFi OS gateway - that's the wrong install for that box, and it now says so.

Fixes

• Uptime reads "1 day, 2 hours" instead of "1 days".
• Client WAN Test max box shows both directions of the bottleneck link when it lands on the AP feeding a Wi-Fi client.

Installation

Windows: Download the MSI installer below

Docker (Upgrade):

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c "cd /opt/network-optimizer && docker compose pull && docker compose up -d"

For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.

v2.3.1

More Monitoring depth and multi-site polish. Speed-test results now replay in Live View, ISP Health grades latency stability per access technology, and every Device Monitoring integration gets a Disable/Enable toggle. See v2.3.0 release notes for what's new in v2.3.0+.

Optional On-Site Agent update: agent binaries since v2.2.0 detect an unreachable SNMP device in seconds instead of burning full walk timeouts, which also makes SNMP credential self-heal responsive on agent sites. Only agents still on 2.1.0 are affected - if yours relay SNMP monitoring, re-run the agent install script whenever convenient. Agents on 2.2.0 or newer already have this, and 2.1.0 otherwise keeps working fine. Note: please disregard the incorrect command for on-gateway upgrade given in Settings->Multi-Site, use the correct gateway installation/upgrade script.

Monitoring

• Device Monitoring Disable/Enable toggles - ONT, Cable Modem, Cellular Modem, and Starlink Device Monitoring each get a one-click Disable/Enable toggle in Settings, so you can pause polling without losing the saved config; the Dashboard cards respect it (#1044, #1046, #1047, thanks @Optic00).
• The Flaky monitoring targets advisory no longer counts loss from a gateway or shared-fabric outage against a target's averages.

Live View

• Speed-test results replay in Live View - the date/time on every speed-test result detail now links into historic playback, paused just before the test, so you can watch the traffic light up the maps. (#1039)
• Near-present playback fixes - scrubbing close to now no longer shows every device offline or throughput stuck, an On-Site Agent test appears on the maps right away instead of minutes later, and resuming playback after sitting on the page starts at the parked instant. (#1039, #1041)

ISP Health

• Per-technology latency stability grading - each hop's RTT wander is now graded against a band for its access technology instead of a one-size ratio: fiber's sub-millisecond wander no longer reads as a fault, and Starlink is judged against its own normal. (#1040)
• Path witness absolution - a hop's wander is forgiven when a destination proven to route through it shows a steadier end-to-end path, so ICMP-deprioritizing core routers don't drag the grade down. (#1040)
• Cleaner ISP names - legal-entity suffixes (LLC, L.C, L.P) are trimmed from provider names on the ISP card.

Network Performance

• AWS regional path-end targets - Upstream path discovery probes the AWS regional endpoints, latency-ranks them, and surfaces the five best as monitorable Internet targets, tracked by hostname so AWS IP rotation doesn't break them. Unchecked regions are remembered and not re-suggested. (#1040)
• Via column - Path-end Internet hosts now show the farthest transit ASN they connect through, or "peered" when the path is provably transit-free. (#1040)
• Custom targets as path witnesses - a user-added Custom target, whether a known-stable CMTS ping or a more distant endpoint, now contributes its steadiness to ISP Health for the hops it crosses, without being treated as an internet destination. (#1040)
• Smarter default filter - the chart filter defaults to ISP when the site has no LAN targets.

ONT Stats

• Luleey LL-XS2510 covered - the Realtek ONT Stick (HTTP) provider already handles this 2.5G XPON stick (stock Realtek firmware under its own branding); now locked in with tests and docs. (#1043, thanks @Optic00)
• Optics in the custom ONT contract - the Network Optimizer Custom (HTTP JSON) contract gains an optional optics section (RX/TX power, temperature, voltage) for modules whose DDM the gateway can't read. It fills only the fields the gateway leaves blank on SFP Stats; standalone configs chart it here. (#1036)

Monitoring Interfaces

• Disable/Enable toggle - pause a monitoring interface (all gateway artifacts torn down, survives reboots) while keeping its saved config, then bring it back with one click. (#1042, thanks @Optic00)

Dashboard

• CyberSecure engine upgrade advisory - the gateway's device card now notes when a CyberSecure (Suricata) engine upgrade is available.

Multi-Site

• Site picker during Console onboarding - the Add Site wizard's Console step now offers the same Site field and "List Sites" button as Settings, for consoles hosting more than one UniFi site.
• Configuration highlight - the site whose Configuration panel is open is now highlighted in the Sites list.

Fixes

• Stray speed-test results - client speed-test results (OpenSpeedTest and iperf3) arriving with an unprovisioned site slug are dropped instead of landing in the main site's results.
• UniFi Console Connection - fixed a crash during connect and errors from requests on an already-disposed client.
• On-Site Agent offline - agent sites now show "waiting for agent" instead of an SSH error.
• Adaptive SQM on multi-site - deployment status reloads when you switch sites, and the SmartQ settle timer is keyed per site so two sites can't collide.
• Threat Intelligence - client names are cached per site, so names no longer bleed between sites.
• On-Site Agent uninstall - reliably stops the agent process across all install modes.

Installation

Windows: Download the MSI installer below

Docker (Upgrade):

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c "cd /opt/network-optimizer && docker compose pull && docker compose up -d"

For other platforms (Synology, QNAP, Unraid, native Linux) or new installations, see the Deployment Guide.

v2.3.0

Two headliners this release: new ONT monitoring providers (a Zyxel GPON-SFP stick and a vendor-neutral HTTP JSON provider you can attach to an SFP module), and continued Multi-Site work for multi-location and MSP deployments, most notably agent tunnels no longer silently breaking behind a reverse proxy. Plus sharper ISP Health Transit scoring and better device names on the maps.

See the v2.2.0 release notes for what came before this.

ONT Device Monitoring

• Zyxel GPON-SFP PMG3000 (HTTP) provider - Read-only optics, line status, and temperature for the Zyxel PMG3000-D20B GPON-SFP stick on ONT Stats. (#1033, thanks @Optic00)
• Network Optimizer Custom (HTTP JSON) provider - Point it at any endpoint serving vendor-neutral PON stats and it feeds ONT Stats and alerts like a built-in provider. In Attach to SFP Module mode the PON data (link status, FEC/BIP errors) merges onto that module in SFP Stats, so a PON-over-SFP setup shows as one device instead of two.
• Nokia ONT works on more firmware - Sends browser headers and falls back to a page-walk auth flow, so ONT stats now populate on T-Fiber/Metronet CLEI variants that previously 401'd. (#929, thanks to the testers who helped figure this out)
• Smoother setup - Selecting a provider prefills the ONT Host with the address that device ships on, and the ONT form and Add-a-Site wizard no longer linger on stale state.

Monitoring - ISP Health

• Your direct peering now shows up in Transit Health - Internet targets reached directly over your ISP's peering/IX are graded as a synthetic IX Peering entry instead of dragging Transit against a neutral fill, each peer scored on its own so one flapping peer doesn't crater it. (#1031)
• More accurate Transit scoring - Transit Health is now a plain involvement-weighted average (no more neutral-100 blend inflating it), jitter is scored at P90 instead of P95 to stop double-counting bursts, and a transit ASN is no longer penalized for jitter when a destination proven to route through it looks clean. Off-path networks scoring low now carry a tooltip explaining they may just be deprioritizing ICMP. (#1028, #1034)

Monitoring - Live View

• Better names and throughput on the LAN Flow Map - UniFi Device Bridge clients (e.g. a Protect camera bridged onto the LAN) now show their friendly name and real throughput on the 2D/3D maps and in Client Performance, and name-less clients use UniFi's display name instead of a raw MAC. Works in historic playback too. (#1027)

Multi-Site

• Reverse proxies no longer silently break the agent tunnel - The canonical-host redirect no longer catches the agent's gRPC stream, which could redirect the tunnel to death behind a reverse proxy while REST heartbeats kept the agent falsely green. A down tunnel now correctly reads as offline. (#1032)
• Agent setup polish - A LAN speed test toggle in the default-site token flow, a dismiss X on the expanded site config row, and an installer that self-remediates AppArmor-confined nginx and adds a --uninstall flag. (#1035)

Fixes

• Duplicate Health Issues entries - A load-vs-refresh race could double every Health Issues entry (the "(2)" badges); refreshes are now serialized. (#1026)
• Spurious console-connection error - A reconnect mid-login no longer surfaces a "Cannot access a disposed object" error; it degrades to the normal retry. (#1026)
• Technitium DNS detection - Now prefers Technitium's /api/status endpoint. (#1023, thanks @jimstrang)

Installation

Windows: Download the MSI installer below

Docker:

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c "cd /opt/network-optimizer && docker compose pull && docker compose up -d"

For other platforms (Synology, QNAP, Unraid, native Linux), see the Deployment Guide.

v2.2.0

The headline: the On-Site Agent can now run directly on the site's UniFi gateway, so a monitoring-only site doesn't need a separate box for it. Plus a synced Live View timeline, sharper ISP/Transit loss, two Security Audit false-positive fixes, and SNMP credential self-healing.

What's New

Catching up the v2.1 line, in case you're coming from v2.0.x (see the v2.1.0 / v2.1.1 notes for detail):

• Multi-Site, rounded out - self-healing UniFi Console connections, first-class alerts when a console or On-Site Agent drops, and a real site lifecycle (add, disable, remove) - enough to run every network you touch from one instance.
• Native Starlink monitoring - a live dashboard card with an obstruction sky map, a dedicated Starlink Stats tab with history, and ISP Health scoring built on what only the dish knows. Works at external sites over the agent tunnel.
• Monitor duplicate management IPs - two devices answering at the same address on different WANs (classically an ONT and a Starlink dish both at 192.168.100.1) can now both be monitored, via a per-interface alias IP on the gateway.
• Nokia XS-010X-Q ONT support - reads optical power and device info over the ONT's web interface, with a temperature alert and configurable thresholds.
• Channel optimizer on a real scale - the optimizer never moves an AP onto a measurably-worse channel, and channel scores are now readable.

Multi-Site

The On-Site Agent can now run directly on the site's UniFi gateway - any current UniFi OS gateway (UCG, UXG, UDM, UDR, EFG lines). Monitoring-only by design: hosting a speed-test server on the router would compete with the data plane. The Set up agent wizard generates a third one-liner alongside Docker and bare metal. It installs to /data (persists on UniFi OS) with a systemd unit tuned for a shared router: in practice it uses ~50 MB, held under a memory limit as a safety backstop, so it stays well clear of routing and IPS. Free memory is the only check; there's no model gate. Re-running the command upgrades in place, and --uninstall gives clean teardown. It survives UniFi OS firmware upgrades untouched - the systemd unit and files sit on the persistent overlay, so there is nothing to re-run.

• Speed-test surfaces adapt - a gateway-resident agent hosts no speed-test listener, so the LAN, WAN, and client speed-test pages explain how to add a separate agent box for testing instead of pointing at the router.

Monitoring

ISP Health

• Outages that began before the view window - an outage already in progress when a view opened was clipped to its recovery tail and mislabeled as a path-wide ISP outage with its duration collapsed to seconds. Detection now reaches back before the window start, so an outage is classified and timed consistently across views.

Live View

• Synced timeline playback - scrubbing the timeline moves the 3D/2D map, the WAN chart cursor, the Port Statistics table, and the stat cards to the same instant, with uniform keyboard steps and no jump when resuming playback.
• Click the WAN chart to seek - clicking the WAN live chart scrubs the whole timeline to that instant, with a Historic badge and a play/pause control while off the live edge. Tap-for-tooltip is preserved on touch devices.
• ISP/Transit loss accuracy - the WAN chart Loss series and the map's WAN globes share one combined ISP+Transit loss figure, and loss is no longer dropped between sampling windows or when a probe cycle times out under load, so sustained loss shows for its full duration.

3D LAN Flow Map

• Property-relative sizing - devices, pipes, particle streams, and WAN globes scale with the property, so fixed-size objects no longer tower over shrunken buildings on large or multi-building sites.
• Link speed tooltips and precise device height - adds link-speed tooltips and accurate device height, and fixes a placement round-trip bug. The capacity changes also improve the 2D LAN Topology Flow Map.
• Full-duplex link load colour - link colour reserves red for both directions loaded; a single saturated direction reads as amber. Applies to the 3D and 2D maps.

ONT Stats

• Nokia ONT resilience - the Nokia XS-010X-Q provider retries transient failures on a fresh connection, so intermittent stat gaps self-recover, and logs the ONT's raw responses so the ones that still fail leave a diagnosable trace.

Setup

• SNMP Community String length warning - UniFi Network accepts a Community String longer than devices reliably support (20 characters), so switches silently drop from polling while the gateway keeps reporting - which reads as "no data from my switches". Setup and Live View now warn with the measured length, the banner auto-appears when the string changes mid-session and auto-dismisses once it's fixed, and a too-long value is never adopted as the polling credential.
• SNMP credential self-heal - a rotated Community String (or changed v3 credentials, or SNMP toggled off and back on) previously needed Monitoring disabled and re-enabled to pick up. The server now detects the fabric-wide poll failure, re-pulls the SNMP config from the UniFi Console, and adopts the change automatically - recovery in about 30-45 seconds on direct sites and within 2 minutes on agent sites.

Security Audit

• Missing Isolation false positive when a narrow block precedes a broad block - a port-specific block (e.g. a DoT block) ahead of an all-traffic block made the isolation check fail and report the pair as unisolated. Partial-block rules are now transparent to the evaluation, so a broad block behind a narrow one still satisfies isolation, while an allow ahead of a broad block is still flagged as a bypass. (fixes #1010, thanks @jimstrang for the repro)
• Raw-MAC policy sources recognized - UniFi's newer raw source MAC restriction now parses alongside the older client-based shape, so a one-device allow ahead of a zone-wide deny is classified as an intentional exception instead of a rule-order warning. Also fixes a cross-zone eclipse false positive. (fixes #1011, thanks @jimstrang for the sample policy JSON)

Performance Tweaks

• UniFi OS 5.1.26 supported - the firmware gate that disables deploying new tweaks on untested versions now allows UniFi OS 5.1.26, verified statically compatible and confirmed in the field. (thanks @mark0263 for confirming)

Fixes

• Duplicate default agent names - new agents were named count+1, which collided after deletions (a site with a sole "Agent 2" minted a second "Agent 2"). Default names now take the first free number.
• Site switcher kept a stale client pinned on Client Performance - switching sites carried the pinned client along, pinning the new site's page to a client from the old site. The switcher now drops it (tab and range selections still carry).
• Client identity for off-site viewers - the agent's client-identity probe gained Private Network Access support for Chromium browsers enforcing public-to-private fetch rules at sites, so own-device identity resolves where the browser previously blocked it.

Installation

Windows: Download the MSI installer below

Docker:

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c "cd /opt/network-optimizer && docker compose pull && docker compose up -d"

For other platforms (Synology, QNAP, Unraid, native Linux), see the Deployment Guide.

v2.1.1

A focused round of ONT monitoring, Starlink handling, and Wi-Fi channel improvements. See the v2.1.0 notes for the bigger picture.

Monitoring

ONT Stats

• Nokia XS-010X-Q support - reads optical power and device info over its web interface (thanks @jakerobb for the traces).
• ONT temperature alert - fires when a monitored ONT reports a temperature over the limit.
• ONT Alert Thresholds - a new card to set the ONT temperature and RX-power limits.

SFP Stats

• Empty RX / TX / Temp columns now explain themselves: the module isn't reporting DDM. If it's an ONT, monitor it directly instead.

Monitoring Interfaces

• Selecting a Starlink WAN now steers you to native Starlink Stats instead of a monitoring interface, detected by ISP rather than WAN name (thanks @Optic00).

Alerts & Schedule - Rules

• Threshold shortcuts - the SFP, ONT, and Device temperature rules link straight to the card that configures their limits.
• The SFP power alerts are renamed SFP: RX Power Low and SFP: TX Power High (they cover Active Ethernet and other optical modules, not just PON).

Wi-Fi Optimizer - Channels

• The optimizer never moves an AP onto a measurably-worse channel, and channel scores are now on a real, readable scale.

Fixes

• LAN flow map - corrected the throughput direction shown for hypervisor/server nodes.
• Multi-site - new default alert rules now enable on secondary sites that already run the matching monitoring.
• UI tables - action buttons stay readable on row hover and inside nested cards.

Coming soon

• Multi-WAN ISP Health and Monitoring - a lot of the groundwork landed here; full support is likely the next minor release.

Installation

Windows: Download the MSI installer below

Docker:

docker compose pull && docker compose up -d

macOS (native, recommended for accurate speed tests vs Docker Desktop):

git clone https://github.com/Ozark-Connect/NetworkOptimizer.git && cd NetworkOptimizer && ./scripts/install-macos-native.sh
# or if you already have it cloned
cd NetworkOptimizer && git pull && ./scripts/install-macos-native.sh

Proxmox:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/Ozark-Connect/NetworkOptimizer/main/scripts/proxmox/install.sh)"
# or if you just need to update
pct exec <CT_ID> -- bash -c "cd /opt/network-optimizer && docker compose pull && docker compose up -d"

For other platforms (Synology, QNAP, Unraid, native Linux), see the Deployment Guide.

v2.1.0

On-Site Agent update (optional): this release includes a small agent update that fixes one minor bug - client speed tests run from an external site could log the IPv4-mapped (::ffff:) form of a client's address instead of its real IP. It's not critical, so update the agent on your external sites whenever it's convenient (re-run the install script, or use the in-app update prompt).

Network Optimizer has been in production for a bit over seven months and runs on roughly 15,000 networks today - mostly power users looking after their own home and other important sites. But the tooling has always punched above that weight class. Deep monitoring, ISP Health, security auditing, alerting - these are the things you want when you manage networks for a living, not just when you manage your own.

v2.1 is where that becomes practical. Multi-Site gets self-healing console connections, first-class alerts when a UniFi Console or On-Site Agent drops, and a real site lifecycle (add, pause, remove) - enough to run every network you touch from one instance. Beyond Multi-Site, 2.1 adds native Starlink dish monitoring, support for two monitorable modem/ONT devices sharing one management IP across different WANs, and a round of Wi-Fi Optimizer and client-identification fixes.

For what came before, see v2.0.0 and the v2.0.1 / v2.0.2 patches.

What's New

• Multi-Site, rounded out - Built on a single-site core with 7+ months in production, Multi-Site now has the operational pieces to run on day to day - connections that recover on their own, alerts when a console or agent goes offline, and a full site lifecycle - making Network Optimizer a viable way to manage many networks, not just your own. Still off by default and free for personal use on up to 3 sites.
• Native Starlink monitoring - First-class health for Starlink dishes: a live dashboard card with an obstruction sky map, a dedicated Monitoring tab with history, and ISP Health scoring built on what only the dish knows. Works at external sites over the agent tunnel too.
• Monitor duplicate management IPs - Two devices that answer at the same IP on different WANs (a common one is an ONT or cable modem sharing 192.168.100.1 with a Starlink dish on another WAN) can now both be monitored, using a per-interface alias IP on the gateway.
• Self-healing console connections - A UniFi Network restart, upgrade, or brief outage no longer takes your console connection down. Previously it stayed down until you re-saved the connection in Settings or restarted Network Optimizer; now it re-validates and recovers on its own, usually within a minute.

Multi-Site

• Disable / Remove Site - A new section in each site's Configuration panel (Settings - Multi-Site). Disable stops that site's monitoring and console connection immediately and hides it from the site switcher, keeping all data so you can re-enable it in place later. Remove is permanent and behind a double confirmation: it deletes the site, its database, and its agent enrollments, and frees the license seat. InfluxDB buckets are deliberately left in place (removing them needs the admin token, which is never stored), and the confirmation tells you so. Both actions are blocked for the default site and the site you're currently viewing.
• Clearer feedback during site creation - The provisioning spinner now actually shows while a new site is being built, so you can see it working instead of wondering whether your click registered, and a re-entrancy guard swallows the double-click that could previously create a duplicate "-2" copy.
• Add Site lands on the form - The + card on the Sites page now scrolls the add form into view with the name field focused, instead of just opening the settings tab.
• Live site switcher - The switcher rebuilds in every open browser tab when sites are created, renamed, enabled, disabled, or removed, instead of waiting for a page reload. It also gained keyboard support: Escape closes it, Up/Down move through sites, Enter or Space selects.

Monitoring

Starlink Dish / Terminal Monitoring

• Starlink Stats dashboard card - A live panel centered on the obstruction sky map, rendered from the dish's own 123x123 SNR grid so blockages appear exactly where they sit in the sky. Alongside it: sky-obstruction percentage, dish-side packet loss, power draw, negotiated Ethernet speed, uptime, GPS fix, last outage, and any active dish alerts. Present by default with a configure prompt when no dish is set up, matching the Cable Modem and ONT cards.
• Starlink Stats monitoring tab - A new tab to the right of Cellular Stats with history charts for power draw, dish ping-drop rate, sky obstruction, outage seconds, GPS satellite count, and alignment offset. Supports multiple dishes.
• ISP Health scoring for satellite WANs - For any WAN set to the Satellite access technology, Starlink becomes the Physical Link source, scored on sky obstruction, dish-to-ground packet loss, and outage burden, with caps for thermal shutdown, tilt, water intrusion, and persistently low SNR. A slow-negotiated Ethernet link is surfaced as advice rather than counted against the ISP.
• Set it up under Settings - Starlink Monitoring - Add and manage dishes (host defaults to 192.168.100.1, port 9200) with a connection test. No credentials needed, since the dish's local API is unauthenticated. We deliberately leave latency and throughput out of this feature: the monitoring pipeline already measures RTT and WAN speed with better fidelity, so Starlink Stats tracks only what the dish uniquely reports.

General

• Show or hide hardware stat tabs per site - The CM Stats, ONT Stats, Cellular Stats, and Starlink Stats tabs each get a "Show this tab in Monitoring" toggle in their Settings section. All stay visible by default; hiding one just drops it from the Monitoring nav for that site, so a site that only has a cable modem isn't carrying tabs it can't use. Switching to a site that hides your current tab lands you on the default tab instead of a stranded one.
• Stat cards link only when there's something to view - The Cable Modem Stats, ONT Stats, Cellular Stats, and Starlink Stats dashboard cards are whole-card links only when a device is actually configured. With nothing to show, the card keeps its own Configure button instead of bouncing you to an empty tab.
• Cleaner jumps between Settings and Monitoring - A link icon next to each hardware monitoring card title (Cable Modem, ONT, Cellular, Starlink) opens the matching tab, and ONT Device Monitoring now explains when an SFP ONT should be read off the gateway port via Set ONT on the SFP Stats tab instead.

Monitoring Interfaces

• Alias IP for duplicate management IPs - Monitoring Interfaces can now poll a device through an alias IP, so two devices sharing the same management address on different WANs (for example an ONT and a Starlink dish both answering at 192.168.100.1) can both be monitored at once. Set an alias on one interface and the gateway translates for it (policy routing plus DNAT out that interface's own path), while the other device keeps the plain address and UniFi's own native dashboards stay untouched. Deploys are gated by subnet-overlap and mark/table ownership checks so it never collides with UniFi's own routing, and each interface holds a stable MAC across gateway reboots. Verified on real dual-WAN hardware.

UniFi Console Connection

• API key connections self-heal after a Network restart or upgrade - While the UniFi Network application restarts, upgrades, or wedges, its proxy answers with 401/403 even though your API key is still valid. The client used to read that as a revoked key and permanently stop calling the console, so Wi-Fi Optimizer, Config Optimizer, Security Audit, Threat Intelligence, and SNMP detection all went dark until you re-saved the connection in Settings or restarted Network Optimizer. It now re-validates the key instead (throttled to one probe a minute, so a genuinely revoked key stays cheap) and recovers on its own within a minute of the console coming back.
• Reverse-proxied consoles recover from gateway errors - Connections through a reverse proxy now self-heal on 502, 503, and 504 the same way they already did on 401 and 403.
• The default site auto-reconnects after a transient outage - A brief blip no longer leaves the main site's console connection down until you touch it.

Alerts & Schedule - Rules

• UniFi Console connection alerts - New console.connection_failed (Warning) and console.connection_restored (Info) event types, per site, armed only after a first successful connection so setup-time failures never alert. A 30-minute failure cooldown keeps a flapping console upgrade to a single alert.
• On-Site Agent alerts - New agent.offline (Warning) fires when an enrolled agent has been continuously offline for 3 minutes, paired with agent.reconnected (Info). Judged by the same live definition the UI uses, so routine agent redeploys and brief tunnel bounces stay silent, and single-site installs without an agent never see rules they can't use. Both sets deliver through your existing Notification Channels.

Wi-Fi Optimizer

• Wi-Fi-less gateways no longer show up as empty access points - A UXG-Fiber (or any gateway without integrated Wi-Fi) could appear in the Wi-Fi Optimizer as an access point with zero clients and then trip a false "Significant Load Imbalance," because some firmware reports phantom radio entries for radio-less gateways. Gateway Wi-Fi capability is now decided by model against a curated list of the gateways that genuinely have Wi-Fi, so gateway-only hardware ...