NetBird Client Policies
Group Policy template for NetBird client MDM-managed settings. Values are written under HKLM\Software\Policies\NetBird and consumed by the netbird daemon at startup and every 1-minute reload tick.
NetBird
NetBird Client 0.40+
Management URL
URL of the NetBird management server. Format: https://host[:port]. When set, users cannot override this value via UI or CLI.
Pre-shared key
WireGuard pre-shared key used as an additional symmetric secret on every peer-to-peer tunnel. Secret value.
Disable auto-connect
When enabled, the NetBird tunnel does not auto-connect at daemon startup. Equivalent to --disable-auto-connect.
Disable autostart
When enabled, the NetBird GUI is prevented from registering itself as an OS autostart entry on fresh installs, and any existing OS autostart entry registration is removed on the next GUI launch (Windows Registry Run key, macOS Login Item, Linux .desktop). Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings.
Disable client routes
When enabled, this client will not consume routes advertised by routing peers. Equivalent to --disable-client-routes.
Disable server routes
When enabled, this client will not act as a routing peer for other clients. Equivalent to --disable-server-routes.
Block inbound
When enabled, the client firewall blocks all inbound peer traffic on the WireGuard interface. Equivalent to --block-inbound.
Allow server SSH
When enabled, this client accepts incoming SSH sessions via NetBird SSH. Equivalent to --allow-server-ssh.
Enable Rosenpass
Enables Rosenpass post-quantum key exchange on WireGuard tunnels. Both peers must support it.
Rosenpass permissive
When enabled, the client falls back to plain WireGuard if a peer does not support Rosenpass; otherwise it refuses the connection.
WireGuard port
UDP port used by the local WireGuard interface. Allowed range: 1-65535.
Split tunnel
Restrict the NetBird tunnel to or from a chosen list of application package names. Choose either the allow mode (only the listed apps route through NetBird) or the disallow mode (the listed apps bypass NetBird; everything else routes through). The mode is mutually exclusive — only one can be active at a time. Android-only at the daemon level; Windows/macOS/iOS clients ignore this policy.
Allow only listed apps (everything else bypasses)
Disallow listed apps (everything else routes)
Disable update settings
When enabled, blocks every configuration change from the client UI and from the CLI (netbird up / login / setconfig). The Settings view stays viewable but read-only. Equivalent to --disable-update-settings.
Disable profiles
When enabled, the client UI/CLI cannot list, create, switch or remove NetBird connection profiles. Equivalent to --disable-profiles.
Disable networks
When enabled, the client UI/CLI cannot list, select or deselect NetBird networks (the corresponding daemon RPCs return Unavailable). Equivalent to --disable-networks.
Disable advanced view
When enabled, the client UI hides the advanced-view section of the new UI revision. Tristate at the daemon: 1 (enabled) hides the section; 0 (disabled) explicitly shows it; not configured leaves the UI's default behavior in place. MDM is the sole source — no equivalent CLI flag exists.
Disable metrics collection
When enabled, the client does not collect or report local usage metrics.
Management URL:
https://api.netbird.io:443
Pre-shared key:
WireGuard UDP port:
Mode:
Package names (comma-separated):