NetBird Release Notes

What's Changed

• [management] fix: device redirect uri wasn't registered by @jnfrati in #6191
• [management] Fence peer status updates with a session token by @mlsmaycon in #6193
• [management] Add metrics for peer status updates and ephemeral cleanup by @mlsmaycon in #6196
• [management] Ensure SessionStartedAt has a default value by @mlsmaycon in #6211
• [proxy] clusters API surfaces type, online status, and capability flags by @mlsmaycon in #6148
• [misc] Update contribution guidelines by @mlsmaycon in #6219
• [client] Bump macOS sleep callback timeout to 20s by @lixmal in #6220
• [doc] Clean up README by @lixmal in #6178
• [proxy] concurrent proxy snapshot apply by @pascal-fischer in #6207
• [management] scope network router update call by @pascal-fischer in #6222
• [client] Fix nil channel panic in external chain monitor stop by @lixmal in #6224

Full Changelog: v0.71.2...v0.71.3

Original source

Release Notes for v0.71.0

What's New

IPv6 overlay addressing

NetBird's overlay is now dual-stack. Every account gets its own IPv6 prefix (default /64, configurable from /48 to /120), and peers can receive both an IPv4 and an IPv6 overlay address. DNS serves AAAA
and reverse PTR records alongside A records, ACLs apply to both families automatically, network routes accept IPv6 CIDRs (with masquerade), exit nodes that route 0.0.0.0/0 get a matching ::/0 route, and
domain routes resolve both A and AAAA.

Rollout is group-gated: new accounts enable IPv6 for the All group by default; existing accounts opt in under Settings > Network. Assignment is also gated on a per-peer capability, so older clients keep
working on IPv4 until they upgrade. Hosts can opt out individually with netbird up --disable-ipv6

Read more in the IPv6 Overlay Addressing announcement and the IPv6 documentation.

#5631 by @lixmal

MFA for local users

Local users (non-IdP) can now enable multi-factor authentication, closing a gap for deployments that don't federate auth through an external provider.

#5804 by @jnfrati

Bring your own proxy (backend ready)

Backend support for per-account reverse-proxy lifecycle has landed: proxy tokens, per-account cluster allow-lists, conflict detection, and one-proxy-per-account enforcement. Full rollout (dashboard, docs) comes
in a later release.

#5627 by @crn4

Client Improvements

Included MTU and SSH auth config in debug bundle by @lixmal.
#6071

Added public key to debug bundle config.txt by @lixmal.
#6092

iOS: structured ResolvedIPs collection for domain routes by @pappz.
#6090

Used unique temp file and clean up on failure when writing ssh config by @lixmal.
#6064

Hardened uspfilter conntrack and shared TCP relay by @lixmal.
#5936

Skipped DNS upstream failover on definitive EDE by @lixmal.
#6089

Fixed --config flag default to point at profile path by @lixmal.
#6122

Bracketed IPv6 in embed listeners, expanded debug bundle by @lixmal.
#6134

Added short flags for status command options by @mlsmaycon.
#6137

Management Improvements

Removed permissions from geolocations API by @pascal-fischer.
#6091

Added update reason to buffered calls by @pascal-fischer.
#6103

Allocated and preserved IPv6 overlay addresses for embedded proxy peers by @lixmal.
#6132

Fixed offline statuses for public proxy clusters by @crn4.
#6133

Bracketed IPv6 reverse-proxy target hosts when building URL Host field by @lixmal.
#6141

Relay Improvements

Preserved non-standard port in WS dialer URL prep by @lixmal.
#6061

Misc

Updated CONTRIBUTING.md by @mlsmaycon.
#6076

Original source

What's New

Client Improvements

Added packet capture to debug bundle and CLI.

#5891

Advertised relay server IP via signal for foreign-relay fallback dial.

#6004

Released Status.mux before invoking notifier callbacks.

#6039

Used ctx.Err() instead of gRPC codes.Canceled to detect shutdown.

#6019

Used atomic write/rename pattern for SSH config.

#5867

Replaced WG interface polling with netlink subscription on Linux.

#5857

Displayed QR code for device auth login URL.

#5415

Bumped go-netroute to v0.4.0 and dropped fork.

#6062

Used fwmark-aware route lookup for raw socket UDP checksum source.

#6070

Management Improvements

Added monitoring for nmap update source.

#6036

Enabled PAT creation during setup.

#6003

Added public IPv4/IPv6 posture checks.

#6038

Tracked pending approval in peer event metadata.

#6040

Fixed proxy reconnect issues.

#6063

Mapped Entra OID claim as Dex user ID.

#6067

Fixed flaky invite token test.

#6077

Proxy Enhancements

Consolidated mapping updates.

#6072

Miscellaneous

Disabled govet inline analyzer.

#6066

Updated discussions and issues templates.

#6073

New Contributors

@lotheac made their first contribution in #5867

@alexsavio made their first contribution in #5857

@typhoon1217 made their first contribution in #5415

Full Changelog: v0.70.4...v0.70.5

Original source

What's Changed

• [management] removed legacy network map code by @crn4 in #5565
• [management] Add Microsoft AD FS support for embedded Dex identity providers by @bcmmbaga in #6008
• [management] Handle single-string JWT group claim from IdPs by @bcmmbaga in #6014
• [client] Don't mark management disconnected on transient job stream errors by @pappz in #6005
• [relay] evict foreign client cache on disconnect by @pappz in #6015
• [self-hosted] fix(getting-started): Infinite healthcheck loop with existing traefik by @WalidDevIO in #5871
• [management] Drop netmap calculation on peer read by @bcmmbaga in #6006
• [client] Use WinRT COM for Windows toasts by @lixmal in #6013

New Contributors

• @WalidDevIO made their first contribution in #5871

Full Changelog: v0.70.0...v0.70.1

Original source

Release Notes for v0.70.0

What's New

Client signatures

We've updated our Windows and MacOS installers and binary signatures. This means your users might be prompted again, but we expect minimum impact for most organizations.

Client Improvements

Suppressed ICE signaling.

#5820

Prefer systemd-resolved stub over file mode regardless of resolv.conf header.

#5935

Trusted wg interface in firewalld to bypass owner-flagged chains.

#5928

Added TTL-based refresh to management DNS cache via handler chain.

#5945

Increased gRPC health check timeout to 5s.

#5961

Improved test stability and reliability:

#5953

#5951

#5950

Management Improvements

Replaced mailru/easyjson with netbirdio/easyjson fork.

#5938

Checked policy changes before database updates.

#5405

Propagated context changes to upstream middleware.

#5956

Added changeable PAT rate limiting.

#5946

Excluded already expired peers from expiration job.

#5970

Unified peer-update test timeout via constant.

#5952

Proxy Enhancements

Set session cookie path to root.

#5915

Self-Hosted Improvements

Added reverse proxy retention fields to combined YAML.

#5930

Used cscli lapi status for CrowdSec readiness check in installer.

#5949

Infrastructure & Misc

Updated sign pipeline version.

#5981

Updated release pipeline version.

#5995

New Contributors

@alsruf36 made their first contribution in #5915

Full Changelog: v0.69.0...v0.70.0

Original source

Release Notes for v0.69.0

What's New

Reverse Proxy IP Reputation Integration

Now you can use CrowdSec to block malicious traffic based on IP reputation on your exposed service in the reverse proxy.

This feature requires self-hosted installations to add another container to their deployment. See instructions in the reverse proxy migration documentation.

For Cloud users, support is coming soon.

Learn more about here.

macOS p2p connectivity improvements

We've improved macOS p2p connectivity with a better routing exclusion mechanism to avoid loops. Now the client doesn't add /32 routes per remote candidate addresses avoiding limitations on accessing remote peer's local addresses via tunnel connections. Learn more about this change.

To use the old behavior run:

sudo netbird service reconfigure --service-env "NB_USE_LEGACY_ROUTING=true"

Client Improvements

Added PCP support. This change adds support for the PCP protocol to the client to improve the rate of P2P connectivity.

#5219

Added --disable-networks flag to block network selection for users.

#5896

Fixed clearing service env vars with --service-env "".

#5893

Guarded against container DNAT bypass of ACL rules in iptables.

#5697

Populated NetworkAddresses on iOS for posture checks.

#5900

Reconnected conntrack netlink listener on error.

#5885

Replaced exclusion routes with scoped default + IP_BOUND_IF on macOS.

#5918

Fixed incorrect SSH client config combining Host and Match directives.

#5903

Fixed WGIface.Close deadlock when DNS filter hook re-enters GetDevice.

#5916

Management Improvements

Enforced peer or peer groups requirement for network routers.

#5894

Reused single cache store across all management server consumers.

#5889

Fixed lint error on Google Workspace integration.

#5907

Proxy Enhancements

Added CrowdSec IP reputation integration for reverse proxy.

#5722

Added direct redirect to SSO.

#5874

Infrastructure Improvements

Updated sign pipeline version to v0.1.2.

#5884

Added CrowdSec LAPI container to self-hosted setup script.

#5880

New Contributors

@MichaelUray made their first contribution in #5900

@jnfrati made their first contribution in #5907

Full Changelog: v0.68.3...v0.69.0

Original source

What's Changed

• [management] network map tests by @mlsmaycon in #5795
• [management] use sql null vars by @pascal-fischer in #5844
• [client] Use native firewall for peer ACLs in userspace WireGuard mode by @lixmal in #5668
• [misc] update dashboards by @pascal-fischer in #5840
• [management] update account delete with proper proxy domain and service cleanup by @pascal-fischer in #5817
• [management] allow local routing peer resource by @pascal-fischer in #5814
• [management] enable access log cleanup by default by @pascal-fischer in #5842
• [client] Update RaceDial to accept context for improved cancellation by @pappz in #5849
• [management] add domain and service cleanup migration by @pascal-fischer in #5850
• [client] Fix Android internet blackhole caused by stale route re-injection on TUN rebuild by @pappz in #5865
• [client] Fix/grpc retry by @pappz in #5750
• [client] Fix DNS resolution with userspace WireGuard and kernel firewall by @lixmal in #5873

Full Changelog

v0.68.1...v0.68.2

Original source