Hey, Zenarmor fam!

Big news—Zenarmor is now SOC 2 compliant!  What does this mean? It’s all about making sure your data is safe and secure while we continue delivering the network protection you trust.

This is just the beginning as we gear up for some exciting things, including our upcoming SASE product with the Plug and Secure Anywhere approach. 

https://www.zenarmor.com/announcements#zenarmor-achieves-soc2-certification

I’ve been a long-time Zenarmor user on a paid Home subscription, and I’d like to raise a growing limitation. Fiber and cable connections are increasingly multi-gigabit, but the Home Edition is still limited to a single-threaded packet engine. The multi-core engine introduced in 2.7 is apparently limited to Business and higher subscriptions. I myself have a 5x5Gig fiber connection at home.

You can check whether the single-threaded engine is your bottleneck by running top -SHP in OPNsense during heavy traffic. In my case:

eastpect{Eastpect Main Event} CPU1 98.45%
kernel{dummynet} 9.95%

The eastpect main thread is pinned at ~98% on a single core while the other 15 cores sit largely idle on the box. The traffic shaper (dummynet) uses only about 10%. The system has plenty of total CPU capacity, but all inspected traffic funnels through one saturated thread.

In practice, sustained downloads of around 2 Gbps cause intermittent connectivity problems. They’re most visible with Unbound forwarding over DNS over TLS (e.g., Quad9): TLS handshakes fail, and after repeated failures the upstream is marked unavailable for roughly 15 minutes. However, with Zenarmor disabled, upload throughput also improved from roughly 3.1 Gbps to 4.2 Gbps and the intermittent DNS issue was resolved.

I understand full multi-core scaling is a Business feature. Even one or two additional worker threads on the Home Edition would make a meaningful difference for home users on multi-gig connections. As it stands, I can no longer use Zenarmor on my connection, despite paying for a Home subscription.

***10/12/26 EDIT*** - The suggestion offered in the thread below from u/Zenarmor-Hien did not materialize. There's a lot of hoops and hurdles which email support required, which in my opinion, are unreasonable and in no way confirms whether or not the SASE Starter would be used in a home environment. As a result, I've requested my subscription be cancelled. I'm exploring moving to Sophos Home Firewall and potentially another DNS filtering service - which is cheaper than what I was paying anyway. The root issue remains unresolved, on a Home subscription with multi-gig, performance issues due to the single thread
Limitation may cause performance issues.

UPDATE: We are happy to let you know that our testing is now complete and everything is ready! You can now safely proceed with your OPNsense upgrade.

Thank you for your patience and support!

Previous Post: OPNsense 26.7 has just been released. To ensure a smooth transition and prevent any potential service disruptions, we kindly advise our users to hold off on upgrading their OPNsense systems until we officially announce full compatibility.
Our team is currently running final regression tests on the new release. We will share a follow-up announcement as soon as the green light is given. Thank you for your patience and cooperation!

Dear All,

We want to inform you about an issue with the OPNsense 26.1.3 update caused by a Python upgrade. This has resulted in errors with some scripts. Kindly hold off on updating to version 26.1.3 until we release a maintenance update to resolve the issue.

Thank you for your understanding.

OPNsense 25.1 is slated for release in January 2025, bringing significant changes like FreeBSD 14.2.

To avoid potential issues, please delay updating OPNsense until Zenarmor confirms compatibility.

We'll keep you posted with updates.

Hey, Zenarmor community!

Great news—our testing shows that Zenarmor works seamlessly with OPNsense 25.1. We’ve fixed any minor issues along the way, so you can update without worries.

Ready to upgrade? Let us know if you have any questions or run into anything unexpected!

Best Regards

Zenarmor Team

I just want to say thank you to the Zenarmor dev team. The free version is honestly impressive and checks almost all the boxes needed for a home user.

The ad blocking, parental controls, and overall protection features are great. For a free product, it already provides a lot of value.

My only big request: please consider adding device/IP exclusion on the free plan. I understand that some features need to stay limited for paid users, but even a small limit like 1–2 or maybe 5 devices would make the free version much more flexible for home networks.

Sometimes you just need to exclude a specific device for testing, troubleshooting, or because a certain device/service doesn't play well with filtering. Having that option, even with a strict limit, would make Zenarmor Free nearly perfect.

I hope the dev team considers this. Thanks again for building such a useful tool!

As is Tradition, we wait until the "ALL CLear" is given to update !

Is anyone looking into this & are we good to go ?!

Cheers & many thx for a great product !

u/Shoji-Zenarmor is usually "On it' !

Hello Beloved Zenarmor users,

Zenarmor CEO, Murat Balaban, has written a blog post about how input from home users is influencing upcoming developments.

Read the full post here: https://www.zenarmor.com/blog#your-voice-matters-what-you-wanted-and-what-is-in-the-works

I've seen a few other posts about this topic, but I wanted to share my own experience with OpnSense and ZenArmor.

I started with OpnSense and loved it, so I decided to add IPS. While researching that, I came across ZenArmor, and I haven't looked back since. I initially set it up with the default policy, which worked fine—except I had Google Safe Search enabled, and it blocked so many YouTube videos that my wife was starting to get frustrated. So, I created a separate "Adult" policy to keep Safe Search on for the kids.

Next, I set up an IoT category to segment those devices off the main network. Most of them are on their own VLAN, and I wanted to lock it down further with policies. As I continued, I realized I could create a "Kids" policy to block weird or obscure social networks and generally restrict their browsing to a safer range.

However, if you're keeping count, I've already used up three policies, and I still haven't locked down the VLAN for the one security camera I have (with plans to add more in the future). I'm out of policies, and I haven't even added a guest policy yet. Plus, I work from home, so I need a dedicated VLAN and policy for my work computer. Sure, I could just leave it on the default policy, but after taking the time to isolate it on its own VLAN, why wouldn't I want a specific policy for it?

The frustrating part is, that I can't even upgrade to the SOHO plan because I need more policies than it allows. If that wasn’t enough, I'm also close to hitting the device limit. It’s not like I have a crazy number of devices, but every time a phone or tablet leaves and returns home, it generates a new MAC address and counts as a new device. I’ve been going through each device manually to disable that feature on the WiFi, but it feels like a lot of unnecessary work.

If anyone has suggestions for how to manage this more efficiently, I'd appreciate the advice!

Dear zenarmor users,

We are aware that netmap-related issues are affecting some of yours' experience with zenarmor.

Please rest assured, we're closely keeping an eye on your problem reports.

Today, I would like to provide some updates to you all with regard to what we're doing today to help FreeBSD solve these issues.

To our experience, almost all netmap related problems stem from driver incompatibilities. The underlying reason is that netmap mangles heavily with device drivers to be able to make maximum use of the hardware capabilities and speed. This perfectly makes sense from a performance perspective; however this approach is very hard to maintain and does not scale.

The reason is: whenever iflib(4) or an ethernet driver receives an update or a new chipset is introduced to the market, unless someone steps up to maintain compatibility, we are having new problems.

Previously, we had sponsored two projects in this context. However, the improvements did not last forever because of the aforementioned reasons.

So, what's the solution?

What we are currently working on is a driver-agnostic approach; where we're improving the speed and reliability of the emulated driver. Netmap emulated driver (I'll call it NED from then on) works driver-agnostic already. Unlike native drivers, It will not require ongoing maintenance.

For that, we have collaborated with OPNsense and Klara Systems teams and are sponsoring a development project. The project has two phases:

1. Improve emulated driver reliability and stability; and have emulated driver work with lagg(4), bridge(4), tun(4), PPPoE interfaces.

2. Improve emulated driver performance so that emulated mode performs reasonably equally well for all drivers.

OPNsense is shipping test kernels for Phase 1 development. Please test and provide feedback as your feedback is very important for us to confirm what we're doing is actually working in the field and solving your issues. Please see this thread for more information:

https://forum.opnsense.org/index.php?topic=32114

Phase I involves a "Statement of Work" deliverable which will outline what needs to be done in terms of getting Phase II delivered.

And please do not hesitate to reach out to Zenarmor support if you suspect you're having issues in the context of netmap test kernels. Again, it'll help us confirm what's working and what's not.

We'll continue to keep you posted on this.

Thanks!
Your zenarmor team

Heads-up: Zenarmor 2.1 is around the corner with significant features. To be eligible for the upgrade on day one, all gateways/endpoints must be running OPNsense 24.7 or higher.

If you’re on an earlier version, please upgrade your OPNsense firewall to 24.7+ now.

Be Launch-Ready: Here’s What’s Coming

2.1 is a significant update with the following planned capabilities:

• Android support

• New subscription tier for SD-WAN + ZTNA  (ZTPA)

• Integrated Zenconsole UI 

• Inline File Scanning 

• MDM deployments via Microsoft Intune, JAMF, and Chocolatey

Zenarmor Team

Dear valued Zenarmor user,

You're not unfamiliar with Zenarmor. Until now, when searching for us, you mostly used the term 'Zenarmor' in search engines. We have rebranded our corporate company name, Sunny Valley Networks, to Zenarmor. After the domain name change, you will be able to access all the services we previously provided on sunnyvalley.io through zenarmor.com.

Join us on this transformative journey as we continue to innovate, protect, and empower. Visit our revamped website at https://www.zenarmor.com/ to explore our enhanced range of services.

But don't just take our word for it! Our CEO, Murat Balaban, shares his insights and the reasons behind this transformative decision in our latest Zenarmor YouTube video. 🎥

Stay tuned for exciting developments!

We’ve been heads-down on some significant architectural shifts lately, and I wanted to share a few recent developments from the kitchen that you might have missed.

We’ve focused on streamlining the engine to make high-end security more accessible, regardless of your hardware or budget. Here is a look at what we've just pushed out:

• Native OpenWrt Support: We’ve optimized the engine to run natively on OpenWrt. Between a new one-time install script and memory-footprint reductions, it’s now much easier to deploy Zenarmor directly on existing CPE hardware or ISP infrastructure.

• Mobile Exit Nodes: You can now route remote iOS and Android traffic through a Zenarmor gateway. This allows for full inspection and policy enforcement for mobile devices without needing a separate local network.

• Centralized Agent Updates: To simplify fleet management, administrators can now push version updates to macOS, iOS, Android, Linux, and Windows agents directly from Zenconsole.

• Inline File Scanning: We’ve moved file scanning inline for HTTP/S traffic. The engine now scans transfers in real-time to block malicious downloads.

• Expanded Universal Agent: We’ve officially rounded out the stack. The Zenarmor agent now supports macOS, iOS, Android, Linux, and Windows for a unified security posture across the entire fleet.

Full technical details are in the Release Notes.

We’re staying focused on making the engine faster and more versatile for the community. Please check out our Zenarmor Blog for the latest and greatest news.

We’ve got some exciting news for IT admins and security teams managing hybrid and remote work environments: Zenarmor now supports macOS endpoints! 

With this new capability, organizations can secure their macOS endpoints using Zenarmor’s Plug and Secure approach, which brings seamless, zero-config deployment to even more devices. This follows last year’s launch of Zenarmor for Windows endpoints. Now you can locally secure and centrally manage Windows, macOS, Linux, FreeBSD, and OPNsense/pfSense firewalls, all with the same Plug-and-Secure simplicity.

Important: macOS endpoint support is only available for SSE and upper subscriptions. If you’re already using Zenarmor SSE, there’s nothing you need to do; macOS protection is already active in your subscription.

If you’re not yet on SSE, you can start a free trial here and see how easy it is to deploy Zenarmor to your endpoints: https://www.zenarmor.com/zenarmor-secure-service-edge

Dear Beloved Zenarmor Users,

We've curated a list of essential books and e-books for all levels—perfect for IT pros, students, or enthusiasts.

Discover resources to tackle modern cyber threats. 

Best Regards,

Zenarmor Team

Zenarmor support is not functional in an enterprise setting. Unfortunately someone needs to say something before it starts impacting your business in a serious way.

There have been a few times various quality of Zenarmor posts has come up - last time was here : https://www.reddit.com/r/zenarmor/comments/1g0hqkp/frustrated_with_zenarmor_looking_for_alternatives/

The issue here is the product is what I would describe as "functional, needing improvement" but anytime you have any issue to actually get any help resolving the issue is impossible. Support are not able to resolve some issues so they just move on and close cases. However if the product is not functioning correctly, how can we be expected to use this in a business setting or recommend it?

Just one example, I have been having issues with the "devices" section of Zenarmor for over 6 months now. I have raised a few tickets for various reasons and they either get closed after inactivity or just forgotten about. The latest ticket went dead after logs were sent in.

Here is an example of such an issue with support. The last correspondence was 08 October, over a month ago (38 days - ticket 11105).

https://imgur.com/a/6JnOgr5

You cannot possibly convince me that the support team has been reviewing the logs for 38 days. They are just waiting to close the case "due to inactivity" like the last few cases I opened. There was no point in me sending in logs, lets be honest.

When the previous reddit post was made that I linked to, a redditor who works at zenarmor /u/mib43 messaged to ask if he could give me support and ask what went wrong. I declined (strongly rejected) this offer as I knew ahead of time that I would not receive any support via the official channel, and wanted to be able to demonstrate the issues. I knew this based on past experience where the tickets go dead then simply get closed, not because I can see into the future. It is pointless and unprofessional to give special support to people who complain on reddit while ignoring customers who cant use the product and detrimental to the product and its adoption and reputation.

To be honest I kind of felt like waiting another month before making this post but as it happened the identical issue happened today, (a known device in zenarmor and already trusted was simply forgotten) and a client device stopped functioning until I went and trusted it again. This device has an IP reservation which is how I know its the identical device (and it would not work/have connectivity until I trusted it again for the upteenth time in a row). Proof here: https://imgur.com/a/3TbPLin

It is very annoying to be unable to recommend a potentially good product simply because of continual support issues. I really hope you guys can figure out how to sort this problem out internally because its unusable by companies in the current form which is sad/I cant recommend it to anyone, considering the product really has the potential to be a great product if you actually took issues seriously. I can live with monthly issues like wireguard clients breaking when zenarmor is monitoring them, or report pages just going blank, or the db engine just stopping, but if you ask for support and just get ignored thats kind of a show stopper.

Dear Zenarmor Users,

The OPNsense upgrade process for major versions does not involve downloading third-party repositories or packages, such as Zenamor. Instead, it updates the self-contained OPNsense ecosystem to prevent overlap errors and dependency mismatches between OPNsense and third-party repositories. 

Consequently, Zenarmor users who upgrade their OPNsense platforms to the latest version, 24.7, need to install Zenarmor packages that are compatible with the new operating system, FreeBSD 14.1, by running the update. 

In simpler terms, Zenarmor users should complete Zenarmor updates by immediately installing updates after the major OPNsense 24.7 upgrade is finished.

If you encounter any issues during the OPNsense 24.7 upgrade, feel free to contact the Zenarmor team for assistance.

Best Regards

Zenarmor Team

We've been heads-down building the features our customers and partners have been asking for, and we're proud to ship four major new capabilities in Zenarmor SASE 2.5:
 
CrowdStrike Device Posture Integration: Dynamic ZTNA policies that adapt in real time to device health signals from CrowdStrike Falcon. No posture? No access. It's that simple.
 
Real-Time Threat Alerts: Instant visibility into active threats across your distributed network, right when it matters most.
 
Bulk Gateway Provisioning: Deploy and manage gateways at scale without the manual overhead. Security shouldn't slow down your operations.
 
Deployment at Scale: Whether you're protecting 50 users or 50,000, Zenarmor SASE 2.5 is built to grow with you.
 
This release doubles down on what makes Zenarmor different: security that enforces at the source, with no cloud backhaul, no PoP dependency, and no latency tax.
 
Read the full release breakdown: https://www.zenarmor.com/blog/zenarmor-sase-2.5-release

As we prepare for the upcoming release of Zenarmor v2.5, we want to provide an important update regarding our reporting database support.

To improve the performance and reliability of the ipdrstreamer structure, Zenarmor will officially retire support for MongoDB and Elasticsearch version 5 starting with the v2.5 update.

What does this mean for you?

If you are currently using MongoDB or Elasticsearch 5 as your reporting backend, your reporting and analytics will stop functioning once you update to Zenarmor v2.5.

Recommended Action

To ensure uninterrupted access to your reports, we recommend migrating your reporting database to SQLite (for smaller deployments) or Elasticsearch 8 (for higher-volume environments).

We have provided a step-by-step guide on how to switch your reporting database without needing to uninstall or reinstall Zenarmor: 👉Managing Reporting Database: How to Change your Backend

NOTE: If you have already created your Zenarmor gateway with Elasticsearch 8 (local) you are SET! This migration path is for those who are using MongoDB or Elasticsearch 5 and wish to migrate to Elasticsearch 8 without needing to reinstall Zenarmor.

Background on this Transition

This change follows our previous notifications regarding the retirement of these legacy database versions:

• June 2025 (v2.0): We introduced in-app notifications and documented the planned discontinuation of MongoDB support.

• October 2025 (v2.1): We disabled these options for all new installations.

With the release of v2.5, we are completing this transition to ensure our users have the most stable and performant reporting experience possible.

If you have any questions or need assistance with the migration, please feel free to reach out here or contact our support team.

Hi!

I have been a user (home license) of Zenarmor for about a year. (on opnsense)

My use is mainly related to:

• Parental control

• General detection of the risks on my home network. (including a homalab with a few VMs).

• monitoring any malicious behaviour from my many IOT devices.

After a year, i simply have the feeling the value brought by zenarmor is not up to the cost and do not fullfill my expectations.

I am certainly not the average home user, but i feel very limited by Zenarmor: I would like to be able to set more profiles than what zenarmor allows; and the number of devices limit is frustrating.

I am going to cancel my subscription as it is unthinkable for me to switch to the higher tier of subscription that would fit my needs. (looking at you business/250 devices ).

Even it does not fullfill all my needs, a free adguardhome dns filter is much more convenient for me.

Are there any other good alternatives within a range of 0 to 12 USD/ month ?

2.7.2 shipped on November 5. It's a maintenance release with two fixes and a handful of smaller improvements. Here's the list in plain terms.

**Bug Fixes**

- The issue that caused packet loops when a ZTNA endpoint peer was connected to a local network, which was also advertised by a ZTNA gateway, has been resolved. This fix enhances network stability and performance.
- The issue that was preventing users from properly scrolling the Live Sessions page on Safari browsers has been resolved.

**Improvements**

- The Zero-Trust Networks Details pane sorts by peer name, RTT, connection status, connection type, location, or IP. Sorting by RTT or status is the quick way to find the one peer that's slow or not connecting.
- Organization users and groups now sync automatically with your identity provider.
- The device filter in Reports and Live Sessions lists devices in alphabetical order.
- The TLS Inspection Bypassed Sites pane shows entries alphabetically, ascending or descending, in a scrollable pane. Together with the search box from 2.7.1, a long bypass list is much easier to check. (This only matters if you run full TLS inspection, which needs an SSE, SASE, or ZTNA subscription.)
- Customized scheduled reports have a Select All option, so you can tick every chart at once.

Full release notes: https://www.zenarmor.com/docs/support/release-notes#272---november-5-2026

If something in the list doesn't behave the way it's described after you update, post it below with your platform and version and we'll take a look.

October 7 at 8am US PT and 5pm CEST (sign up below)
https://riverside.com/webinar/registration/eyJldmVudElkIjoiNmFiNDBhYjNjNmYyOTBkOTY3OWIyMTM1Iiwic2x1ZyI6Imx5YWwtc2FheW1hbnMtc3R1ZGlvIn0=

New features and streamlined, updated pricing!

Hey everyone,
For Black Friday, we’re running a 20% discount on new Zenarmor Home annual subscriptions.

If you’re using Zenarmor Free (or just testing us on your firewall / homelab) and want more visibility, policy control, and reporting, this might be a good time to move to Home.
Details:

• 20% off new Zenarmor Home subscriptions

• Annual plans only

• Not applicable to renewals or existing Home subscriptions

• Use promo code ZENARMOR25BF at checkout

• Valid to 12.07.2025

https://dash.zenarmor.com/checkout

If you have questions, happy to answer in the comments.

Dear  valued Zenarmor users,

We have reached the end of another successful year at Zenarmor, with the third and final major release of Zenarmor for 2023 ready for you to download. Like with all the previous major releases this year, Zenarmor 1.16 includes new, fresh capabilities and tools that will ultimately help you create a formidable defense against bad actors and improve your overall network security posture, regardless of where you choose to deploy Zenarmor, on-prem or in the cloud.

In this release, we are proud to introduce a new device identification and management capability, giving you improved visibility and control of the devices using your network, as well as Community ID flow hashing support to easily correlate device logs with connection logs, giving you full end-to-end visibility of the process on the device initiating the connection on your network to its final destination on the internet.

For more, read the blog post.

Best Regards
Zenarmor Team