Zenarmor 2.7 introduces nine new features that expand access to the full Zenarmor stack and enhance its capabilities: organization management available on all editions, multi-core 10G throughput on OPNsense, direct peer connections on Zero-Trust Networks, two additional Unified Secure subscription tiers, full-stack SASE on OpenWRT, exemptions from gateway SSO enforcement, support for Active Directory and LDAP in organization policies, and two onboarding enhancements that reduce initial setup friction.
Two requests have come up most often this year. Smaller teams sought the management structure and feature set available in higher tiers, while high-bandwidth OPNsense deployments aimed to utilize more of their hardware. Zenarmor 2.7 addresses both needs. Now, all editions include organizations and endpoint protection; the new Unified Secure and Unified Secure Plus tiers reduce costs for advanced features, and multi-core processing enhances inspection across all cores for 10G links.
What is New
Organization Management for Every Edition
Most relevant to: Home labs, small offices, and lean IT teams managing more than one box, plus anyone evaluating Zenarmor before committing a budget.
The Zenconsole organization structure is now available on Free, Home, SOHO, and Business, so any user can group gateways and endpoints under one account, apply policy across them, and run Zero-Trust networking from a single dashboard. This capability was previously available only in the SSE, ZTNA, and SASE subscription tiers. The endpoint application follows the same path and is available on every edition as well. This means that everyone can try Zenarmor on their endpoint and benefit from the same level of security they have grown accustomed to when protected by a gateway, now, while roaming away from the network.
Multi-Core 10G Support on OPNsense
Most relevant to: Business and higher tier subscribers running OPNsense, and anyone who wants to push the Zenarmor engine further across high bandwidth links.
Modern firewall hardware ships with cores to spare, and on a 10G link every one of them counts. Packet processing in Zenarmor 2.7 runs across multiple cores on OPNsense for Business and higher subscriptions, so inspection scales with the whole appliance rather than with a single core. Deep inspection keeps pace at 10G and beyond, busy hours no longer translate into dropped sessions or bypassed traffic, and there is capacity left over for the traffic growth that tends to show up a year later. For most teams, this is throughput sitting inside hardware they already own.
Direct Access Connections on Zero-Trust Networks
Most relevant to: Distributed teams and MSPs running client overlays they would rather not route through a relay.
Overlay networks typically rely on a central coordinator component to remain active to facilitate an initial connection. With Zenarmor 2.7, a new direct access connection type for Zero-Trust Networks is introduced, enabling peers to communicate directly without a coordinator or fallback relay in the path. Once peers are aware of each other, traffic follows the shortest available route, ensuring connectivity even if a coordinator or relay server goes offline. This reduces latency on links that previously routed through relays and significantly narrows the overlay's failure domain. For those managing site-to-site connections essential during work hours, this addition minimizes the risk of network outages caused by a single point of failure.
Unified Secure and Unified Secure Plus Editions
Most relevant to: Mid-market buyers consolidating point products, and organizations that need advanced capability without an enterprise tier.
Zenarmor 2.7 introduces Unified Secure and Unified Secure Plus, two plans that combine advanced security, Zero-Trust networking, and endpoint protection into one subscription, now more affordable than before. This means features once limited to higher-priced plans are now accessible to organizations that previously couldn't afford them. Selecting a plan now depends on your specific needs rather than sacrificing features.
Full-Stack SASE on Linux and OpenWRT
Most relevant to: ISPs and MSPs shipping their own CPE, retail and branch sites on small hardware, and appliance builders.
Historically, small router hardware had limited features. Zenarmor 2.7 changes this by offering stable Linux TUN support for OpenWRT, enabling the full SASE stack on platforms that previously couldn't support it reliably. Features like inspection, policy enforcement, and Zero-Trust connectivity now work on affordable OpenWRT devices, allowing branches or retail outlets to access the same level of protection as rack-mounted gateways. For service providers, this means turning existing CPE into a security enforcement point rather than a device that's hard to manage.
Traffic Exemptions from SSO Enforcement
Most relevant to: Organizations enforcing gateway SSO alongside printers, servers, IoT devices, and internal traffic that cannot authenticate.
Gateway SSO functions effectively until it encounters a device with no logged-in user, which was typically handled with a broad policy exception. Zenarmor 2.7 allows administrators to create targeted exemptions based on criteria such as domains, VLAN IDs, interface tags, or LAN-to-LAN traffic between internal devices. This ensures that update servers, license checks, and machine-to-machine communications proceed seamlessly, while user sessions accessing the internet remain authenticated. Local traffic no longer needs to pass through an authentication step it can't fulfill, making the enforcement policy more precise and easier to explain during audits.
Active Directory and LDAP Groups in Organization Policies
Most relevant to: Enterprises, schools, and public sector organizations with established directory infrastructure.
Most organizations already defined their group memberships years ago in Active Directory or LDAP. Zenarmor 2.7 lets gateway policies map directly to existing users and groups, so a policy created for the finance team automatically applies as members join or leave. This eliminates the need for a separate user list and prevents discrepancies between the directory and security policies. Access control now aligns with the familiar structure of your identity system, which auditors often request to review.
Improved Engine Status Alerts in the Endpoint Application
Most relevant to: Help desks supporting endpoint users, and MSPs rolling out the endpoint application at scale.
An installed protection agent that is not running is more problematic than having none at all, since users assume it is active. Now, the endpoint application checks the engine service during the first launch and notifies the user to start it if it's stopped. This ensures the device is protected instantly instead of waiting for the next support ticket.
License Activation Wizard During Zenconsole Registration
Most relevant to: Administrators registering new gateways, and partners onboarding clients.
Zenconsole now brings the license activation wizard forward during gateway registration whenever the key is inactive, so activation happens in the flow where it belongs. New deployments come up licensed the first time.
Improvements Worth Noting
Zenarmor 2.7 also carries a long list of smaller changes. Organization administrators can choose where central reporting data lives, with Australia, Canada, Germany, India, Japan, the Netherlands, Singapore, South Africa, Finland, Sweden, the UK, and Qatar all available, which matters for anyone working under residency obligations.
The REST API has been extended so developers can define Zenarmor policies and configure Zero-Trust Networks programmatically.
Audit logging now covers endpoint applications and OPNsense gateways, capturing logins and logouts, engine status changes, release updates, Zero-Trust network toggles, and instance removals.
The gateway dashboard reports how many untrusted devices have been blocked and links straight through to the Devices > Untrusted page, and Zero-Trust topology updates now reach existing peers as soon as a new peer joins.
Elsewhere across the platform: organization administrators can remove seats from users; the subscriptions checkout summary itemizes cost per line; the Zenconsole interface picked up navigation and accessibility work; the Remote and Local Assets report sorts on bytes in and out; site reclassification requests moved to Profile > Support on Zenconsole; a gateway's previous license is reactivated automatically when a free trial expires; the Internet Security Policies list carries an internet access toggle on each row; the Subscriptions page shows a notification bar when payment is past due; invoices download as PDFs after the 30 day window has passed; and Threat and Activity Alert rules accept a daily frequency.
On the fix side, organization policies no longer appear as manageable on the OPNsense interface after a gateway has been unregistered from Zenconsole, and assigned policy names display correctly after refreshing the Devices page. Zero-Trust charts no longer return a 500 error when selected in custom report views without an active ZTNA license, and interface names wrap properly in the Throughput pane when many interfaces are protected.
Closing Thoughts
Zenarmor 2.7 is a release that reaches in two directions. Organization management, endpoint protection, and the new Unified Secure tiers push capability down to users who were previously priced out. Multi-core processing, OpenWRT support, and direct Zero-Trust connections push it up to faster links, smaller hardware, and networks that have to keep running on their own.
Both directions serve the same idea behind Plug.SASE.Everywhere: protection shouldn't change based on what you can afford or where you choose to deploy it.
Get Started Today
Zenarmor 2.7 is available now. Existing customers can update through Zenconsole and start using these capabilities immediately, and new users can run organization management and endpoint protection on the Free edition without a subscription. For the complete list of changes, see the release notes.
