News & Blog
Feature announcements, product updates, and engineering notes from the NetDefense team.
remote_access_policy: A Remote-Access Ceiling the Cloud Can't Raise
NDAgent v1.15.0 adds remote_access_policy, a device-local ceiling on remote sessions — full, readonly, or disabled — that no operator account, platform compromise, or AI agent can raise remotely, because the value lives only in the device's own configuration.
Secure by Default: Config Pushes That Grant Privileges Are Now Rejected Out of the Box
NDAgent v1.14.0 flips reject_dangerous_snippets on by default for new installations — a device now refuses privilege-granting configuration pushes unless its operator explicitly opts out, locally.
How to Manage Multiple OPNsense Firewalls: Your Options in 2026
A practical, vendor-neutral look at the real options for managing a fleet of OPNsense firewalls in 2026 — from manual per-box administration to OPNcentral, DynFi Manager, infrastructure-as-code, and hosted platforms.
Read-Only Remote Access to Your Firewall's WebAdmin
Grant auditors, NOC staff, or MSSP customers complete read-only visibility into your managed firewall — see everything, change nothing.
Upgrade OPNsense Firmware Without a Maintenance Window
NetDefense can now upgrade OPNsense firmware across your fleet — minor point releases with zero downtime via split-apply, and major series jumps on a planned window. Schedulable, previewable, and available from NDCLI, the web console, and the MCP server.
Set It and Forget It: NetDefense Now Has a Recurring-Task Scheduler
Schedules are reusable named cadences you attach to the commands you already use — run, sync, and backup — so nightly backups, weekly reboots, and periodic config delivery happen on their own.
How NetDefense Secures the Control Channel to Your Firewalls
A detailed look at how NetDefense makes forging a command to a managed firewall infeasible: asymmetric device identity, a bidirectionally signed task channel, and an operator-gated rebind ceremony — built so that everything but the two private signing keys can only verify, never forge.
Introducing Personal Access Tokens for CI/CD Automation
NDCLI now supports static API tokens for headless authentication in CI/CD pipelines, GitHub Actions, and automated scripts.