Remove obvious comments

client/internal/dns/host_windows.go

@@ -6,8 +6,10 @@ import (
 	"fmt"
 	"io"
 	"net/netip"
+	"os"
 	"os/exec"
 	"slices"
+	"strconv"
 	"strings"
 	"syscall"
 	"time"
@@ -36,6 +38,15 @@ const (
 	gpoDnsPolicyRoot            = `SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\DnsPolicyConfig`
 	gpoDnsPolicyConfigMatchPath = gpoDnsPolicyRoot + `\NetBird-Match`
 
+	dnsPolicyConfigCatchAllPath    = `SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig\NetBird-CatchAll`
+	gpoDnsPolicyConfigCatchAllPath = gpoDnsPolicyRoot + `\NetBird-CatchAll`
+
+	nrptCatchAllNamespace = "."
+
+	// envDisableCatchAllNRPT turns off the catch-all NRPT rule, restoring the
+	// previous behavior where the OS is free to query other adapters' resolvers.
+	envDisableCatchAllNRPT = "NB_DISABLE_DNS_CATCHALL_NRPT"
+
 	dnsPolicyConfigVersionKey           = "Version"
 	dnsPolicyConfigVersionValue         = 2
 	dnsPolicyConfigNameKey              = "Name"
@@ -318,6 +329,12 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 
 	r.updateState(stateManager)
 
+	if config.RouteAll {
+		if err := r.addDNSCatchAllPolicy(config.ServerIP); err != nil {
+			return fmt.Errorf("add dns catch-all policy: %w", err)
+		}
+	}
+
 	if err := r.updateSearchDomains(searchDomains); err != nil {
 		return fmt.Errorf("update search domains: %w", err)
 	}
@@ -388,6 +405,29 @@ func (r *registryConfigurator) addDNSMatchPolicy(domains []string, ip netip.Addr
 	return ruleIndex, nil
 }
 
+func (r *registryConfigurator) addDNSCatchAllPolicy(ip netip.Addr) error {
+	if parseBoolEnv(envDisableCatchAllNRPT) {
+		log.Infof("%s is set, not forcing all DNS queries through %s", envDisableCatchAllNRPT, ip)
+		return nil
+	}
+
+	if err := r.configureDNSPolicy(dnsPolicyConfigCatchAllPath, []string{nrptCatchAllNamespace}, ip); err != nil {
+		return fmt.Errorf("configure catch-all DNS policy: %w", err)
+	}
+
+	if r.gpo {
+		if err := r.configureDNSPolicy(gpoDnsPolicyConfigCatchAllPath, []string{nrptCatchAllNamespace}, ip); err != nil {
+			return fmt.Errorf("configure gpo catch-all DNS policy: %w", err)
+		}
+		if err := refreshGroupPolicy(); err != nil {
+			log.Warnf("failed to refresh group policy: %v", err)
+		}
+	}
+
+	log.Infof("added catch-all NRPT rule: all DNS queries now resolve exclusively through %s", ip)
+	return nil
+}
+
 func (r *registryConfigurator) configureDNSPolicy(policyPath string, domains []string, ip netip.Addr) error {
 	if err := removeRegistryKeyFromDNSPolicyConfig(policyPath); err != nil {
 		return fmt.Errorf("remove existing dns policy: %w", err)
@@ -530,6 +570,14 @@ func (r *registryConfigurator) removeDNSMatchPolicies() error {
 		merr = multierror.Append(merr, fmt.Errorf("remove GPO base entry: %w", err))
 	}
 
+	if err := removeRegistryKeyFromDNSPolicyConfig(dnsPolicyConfigCatchAllPath); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove local catch-all entry: %w", err))
+	}
+
+	if err := removeRegistryKeyFromDNSPolicyConfig(gpoDnsPolicyConfigCatchAllPath); err != nil {
+		merr = multierror.Append(merr, fmt.Errorf("remove GPO catch-all entry: %w", err))
+	}
+
 	for i := 0; i < r.nrptEntryCount; i++ {
 		localPath := fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i)
 		gpoPath := fmt.Sprintf("%s-%d", gpoDnsPolicyConfigMatchPath, i)
@@ -594,6 +642,20 @@ func refreshGroupPolicy() error {
 	return nil
 }
 
+func parseBoolEnv(key string) bool {
+	val := os.Getenv(key)
+	if val == "" {
+		return false
+	}
+
+	parsed, err := strconv.ParseBool(val)
+	if err != nil {
+		log.Warnf("failed to parse %s=%q: %v", key, val, err)
+		return false
+	}
+	return parsed
+}
+
 func closer(closer io.Closer) {
 	if err := closer.Close(); err != nil {
 		log.Errorf("failed to close: %s", err)

client/internal/dns/host_windows_test.go

@@ -94,6 +94,106 @@ func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
 	assert.False(t, exists, "NRPT rule 2 should NOT exist after reducing to 75 domains")
 }
 
+func TestNRPTCatchAllRule(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	defer cleanupRegistryKeys(t)
+	cleanupRegistryKeys(t)
+
+	testIP := netip.MustParseAddr("100.64.0.1")
+	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
+	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
+	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
+	require.NoError(t, err, "Should create test interface registry key")
+	testKey.Close()
+	defer func() {
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, interfacePath)
+	}()
+
+	cfg := &registryConfigurator{guid: testGUID}
+
+	matchOnly := HostDNSConfig{
+		ServerIP: testIP,
+		Domains:  []DomainConfig{{Domain: "example.com", MatchOnly: true}},
+	}
+	primary := HostDNSConfig{
+		ServerIP: testIP,
+		RouteAll: true,
+		Domains:  []DomainConfig{{Domain: "example.com", MatchOnly: true}},
+	}
+
+	require.NoError(t, cfg.applyDNSConfig(matchOnly, nil))
+	exists, err := registryKeyExists(dnsPolicyConfigCatchAllPath)
+	require.NoError(t, err)
+	assert.False(t, exists, "catch-all rule should not exist for a match-only config")
+
+	require.NoError(t, cfg.applyDNSConfig(primary, nil))
+	exists, err = registryKeyExists(dnsPolicyConfigCatchAllPath)
+	require.NoError(t, err)
+	require.True(t, exists, "catch-all rule should exist when RouteAll is set")
+
+	k, err := registry.OpenKey(registry.LOCAL_MACHINE, dnsPolicyConfigCatchAllPath, registry.QUERY_VALUE)
+	require.NoError(t, err)
+
+	names, _, err := k.GetStringsValue(dnsPolicyConfigNameKey)
+	require.NoError(t, err)
+	assert.Equal(t, []string{nrptCatchAllNamespace}, names, "catch-all rule should match the root namespace")
+
+	servers, _, err := k.GetStringValue(dnsPolicyConfigGenericDNSServersKey)
+	require.NoError(t, err)
+	assert.Equal(t, testIP.String(), servers, "catch-all rule should list only our resolver")
+
+	opts, _, err := k.GetIntegerValue(dnsPolicyConfigConfigOptionsKey)
+	require.NoError(t, err)
+	assert.EqualValues(t, dnsPolicyConfigConfigOptionsValue, opts)
+	k.Close()
+
+	require.NoError(t, cfg.applyDNSConfig(matchOnly, nil))
+	exists, err = registryKeyExists(dnsPolicyConfigCatchAllPath)
+	require.NoError(t, err)
+	assert.False(t, exists, "catch-all rule should be removed when RouteAll is cleared")
+
+	require.NoError(t, cfg.applyDNSConfig(primary, nil))
+	require.NoError(t, cfg.restoreHostDNS())
+	exists, err = registryKeyExists(dnsPolicyConfigCatchAllPath)
+	require.NoError(t, err)
+	assert.False(t, exists, "catch-all rule should be removed on restore")
+}
+
+func TestNRPTCatchAllRuleDisabledByEnv(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping registry integration test in short mode")
+	}
+
+	defer cleanupRegistryKeys(t)
+	cleanupRegistryKeys(t)
+
+	t.Setenv(envDisableCatchAllNRPT, "true")
+
+	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
+	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
+	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
+	require.NoError(t, err, "Should create test interface registry key")
+	testKey.Close()
+	defer func() {
+		_ = registry.DeleteKey(registry.LOCAL_MACHINE, interfacePath)
+	}()
+
+	cfg := &registryConfigurator{guid: testGUID}
+	config := HostDNSConfig{
+		ServerIP: netip.MustParseAddr("100.64.0.1"),
+		RouteAll: true,
+	}
+
+	require.NoError(t, cfg.applyDNSConfig(config, nil))
+
+	exists, err := registryKeyExists(dnsPolicyConfigCatchAllPath)
+	require.NoError(t, err)
+	assert.False(t, exists, "catch-all rule should not be installed when disabled by env")
+}
+
 func registryKeyExists(path string) (bool, error) {
 	k, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.QUERY_VALUE)
 	if err != nil {

management/server/group.go

@@ -7,7 +7,6 @@ import (
 	"slices"
 
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/rs/xid"
 	log "github.com/sirupsen/logrus"
 
@@ -746,10 +745,6 @@ func validateDeleteGroup(ctx context.Context, transaction store.Store, group *ty
 		return &GroupLinkError{"network router", linkedRouter.ID}
 	}
 
-	if isLinked, linkedService := isGroupLinkedToReverseProxyService(ctx, transaction, group.AccountID, group.ID); isLinked {
-		return &GroupLinkError{"reverse proxy service", linkedService.Domain}
-	}
-
 	if isLinked, linkedPolicy := isGroupLinkedToAgentNetworkPolicy(ctx, transaction, group.AccountID, group.ID); isLinked {
 		return &GroupLinkError{"agent network policy", linkedPolicy.Name}
 	}
@@ -885,26 +880,6 @@ func isGroupLinkedToNetworkRouter(ctx context.Context, transaction store.Store,
 	return false, nil
 }
 
-// isGroupLinkedToReverseProxyService checks if a group is used as an access group
-// of a private reverse proxy service or as a bearer-auth distribution group.
-func isGroupLinkedToReverseProxyService(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *service.Service) {
-	services, err := transaction.GetAccountServices(ctx, store.LockingStrengthNone, accountID)
-	if err != nil {
-		log.WithContext(ctx).Errorf("error retrieving reverse proxy services while checking group linkage: %v", err)
-		return false, nil
-	}
-
-	for _, svc := range services {
-		if svc.Private && slices.Contains(svc.AccessGroups, groupID) {
-			return true, svc
-		}
-		if svc.Auth.BearerAuth != nil && svc.Auth.BearerAuth.Enabled && slices.Contains(svc.Auth.BearerAuth.DistributionGroups, groupID) {
-			return true, svc
-		}
-	}
-	return false, nil
-}
-
 // isGroupLinkedToAgentNetworkPolicy checks if a group is used as a source group by any
 // agent network policy in the account.
 func isGroupLinkedToAgentNetworkPolicy(ctx context.Context, transaction store.Store, accountID string, groupID string) (bool, *agentNetworkTypes.Policy) {

management/server/group_test.go

@@ -19,7 +19,6 @@ import (
 
 	nbdns "github.com/netbirdio/netbird/dns"
 	agentNetworkTypes "github.com/netbirdio/netbird/management/internals/modules/agentnetwork/types"
-	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/server/groups"
 	"github.com/netbirdio/netbird/management/server/networks"
 	"github.com/netbirdio/netbird/management/server/networks/resources"
@@ -132,16 +131,6 @@ func TestDefaultAccountManager_DeleteGroup(t *testing.T) {
 			"grp-for-agent-network-policy",
 			"agent network policy",
 		},
-		{
-			"reverse proxy private service access group",
-			"grp-for-rp-private",
-			"reverse proxy service",
-		},
-		{
-			"reverse proxy bearer distribution group",
-			"grp-for-rp-bearer",
-			"reverse proxy service",
-		},
 	}
 
 	for _, testCase := range testCases {
@@ -240,12 +229,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 			groupIDs:        []string{"grp-for-agent-network-policy"},
 			expectedReasons: []string{"agent network policy"},
 		},
-		{
-			name:               "reverse proxy services",
-			groupIDs:           []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-			expectedReasons:    []string{"reverse proxy service", "reverse proxy service"},
-			expectedNotDeleted: []string{"grp-for-rp-private", "grp-for-rp-bearer"},
-		},
 		{
 			name:            "successfully delete multiple groups",
 			groupIDs:        []string{"group-1", "group-2"},
@@ -313,65 +296,6 @@ func TestDefaultAccountManager_DeleteGroups(t *testing.T) {
 	}
 }
 
-func TestDefaultAccountManager_DeleteGroupUnlinkedFromReverseProxyService(t *testing.T) {
-	am, _, err := createManager(t)
-	require.NoError(t, err, "Failed to create account manager")
-
-	_, account, err := initTestGroupAccount(am)
-	require.NoError(t, err, "Failed to init testing account")
-
-	deletableGroups := []*types.Group{
-		{
-			ID:        "grp-rp-bearer-disabled",
-			AccountID: account.Id,
-			Name:      "Group only in a disabled bearer auth",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-		{
-			ID:        "grp-rp-nonprivate-access",
-			AccountID: account.Id,
-			Name:      "Group only in a non-private service's access groups",
-			Issued:    types.GroupIssuedAPI,
-			Peers:     make([]string, 0),
-		},
-	}
-	for _, group := range deletableGroups {
-		require.NoError(t, am.CreateGroup(context.Background(), account.Id, groupAdminUserID, group))
-	}
-
-	// Disabled bearer auth and stale access groups on a non-private service
-	// are inert configuration and must not block group deletion.
-	services := []*rpservice.Service{
-		{
-			ID:        "rp-svc-bearer-disabled",
-			AccountID: account.Id,
-			Domain:    "bearer-disabled.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            false,
-					DistributionGroups: []string{"grp-rp-bearer-disabled"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-nonprivate-access",
-			AccountID:    account.Id,
-			Domain:       "nonprivate.services.example.com",
-			Private:      false,
-			AccessGroups: []string{"grp-rp-nonprivate-access"},
-		},
-	}
-	for _, svc := range services {
-		require.NoError(t, am.Store.CreateService(context.Background(), svc))
-	}
-
-	for _, group := range deletableGroups {
-		err = am.DeleteGroup(context.Background(), account.Id, groupAdminUserID, group.ID)
-		assert.NoError(t, err, "group %s is not referenced by an active reverse proxy gate and should be deletable", group.ID)
-	}
-}
-
 func TestDefaultAccountManager_DeleteGroupLinkedToFlowGroup(t *testing.T) {
 	am, _, err := createManager(t)
 	require.NoError(t, err)
@@ -501,22 +425,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		Peers:     make([]string, 0),
 	}
 
-	groupForRPPrivate := &types.Group{
-		ID:        "grp-for-rp-private",
-		AccountID: "account-id",
-		Name:      "Group for private reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
-	groupForRPBearer := &types.Group{
-		ID:        "grp-for-rp-bearer",
-		AccountID: "account-id",
-		Name:      "Group for bearer reverse proxy service",
-		Issued:    types.GroupIssuedAPI,
-		Peers:     make([]string, 0),
-	}
-
 	routeResource := &route.Route{
 		ID:     "example route",
 		Groups: []string{groupForRoute.ID},
@@ -573,8 +481,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForUsers)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForIntegration)
 	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForAgentNetworkPolicy)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPPrivate)
-	_ = am.CreateGroup(context.Background(), accountID, groupAdminUserID, groupForRPBearer)
 
 	agentNetworkPolicy := &agentNetworkTypes.Policy{
 		ID:           "example agent network policy",
@@ -587,52 +493,6 @@ func initTestGroupAccount(am *DefaultAccountManager) (*DefaultAccountManager, *t
 		return nil, nil, err
 	}
 
-	// The decoy services are created first so the linkage check has to scan
-	// past services that do not reference the groups under test.
-	rpServices := []*rpservice.Service{
-		{
-			ID:           "rp-svc-private-decoy",
-			AccountID:    accountID,
-			Domain:       "private-decoy.services.example.com",
-			Private:      true,
-			AccessGroups: []string{"unrelated-group"},
-		},
-		{
-			ID:        "rp-svc-bearer-decoy",
-			AccountID: accountID,
-			Domain:    "bearer-decoy.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{"unrelated-group"},
-				},
-			},
-		},
-		{
-			ID:           "rp-svc-private",
-			AccountID:    accountID,
-			Domain:       "private.services.example.com",
-			Private:      true,
-			AccessGroups: []string{groupForRPPrivate.ID},
-		},
-		{
-			ID:        "rp-svc-bearer",
-			AccountID: accountID,
-			Domain:    "bearer.services.example.com",
-			Auth: rpservice.AuthConfig{
-				BearerAuth: &rpservice.BearerAuthConfig{
-					Enabled:            true,
-					DistributionGroups: []string{groupForRPBearer.ID},
-				},
-			},
-		},
-	}
-	for _, svc := range rpServices {
-		if err := am.Store.CreateService(context.Background(), svc); err != nil {
-			return nil, nil, err
-		}
-	}
-
 	acc, err := am.Store.GetAccount(context.Background(), account.Id)
 	if err != nil {
 		return nil, nil, err