[GH-ISSUE #5646] Ghost proxy peers stuck in "Connecting" — not visible in management API or dashboard, cannot be removed #10895

New Issue

saavagebueno · 2026-08-05T01:27:37-04:00

saavagebueno commented

2026-08-05 01:27:37 -04:00

Originally created by @SuperKali on GitHub (Mar 21, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5646

Description

After creating and later removing reverse proxy entries from the NetBird dashboard (web UI), multiple ghost "proxy" peers remain visible in netbird status --detail permanently stuck in "Connecting" status.

These proxy peers:

Are not visible in the management dashboard (Peers section)
Are not returned by the management API (GET /api/peers)
Cannot be removed — no CLI command, API endpoint, or dashboard option exists to delete them
Persist across service restarts (systemctl restart netbird)
Inflate the peer count (showing 6/16 Connected instead of 6/9)

Environment

NetBird version: 0.66.4 (daemon + CLI)
Deployment: Self-hosted (Zitadel IDP)
OS: Linux aarch64 (Ubuntu, kernel 6.8.0)
Interface type: Kernel

Steps to reproduce

Set up a self-hosted NetBird instance
Create reverse proxy entries from the dashboard web UI targeting services on various peers
Later remove/delete those reverse proxy entries from the dashboard
Observe that netbird status --detail still shows proxy peers that were associated with the deleted proxy configurations

Current behavior

netbird status --detail shows 7 ghost proxy peers with hostnames matching the pattern:
proxy---.

Example output:
proxy-XXXXXX-8-9.example.tun:
NetBird IP: 100.71.8.9
Status: Connecting
Connection type: -
ICE candidate (Local/Remote): -/-
Last connection update: 6 days ago
Last WireGuard handshake: -
Transfer status (received/sent) 0 B/0 B

Key observations:

7 proxy peers total: 6 stuck in "Connecting", 1 "Connected"
The proxy peer IDs do not match any peer ID returned by GET /api/peers (17 real peers vs 7 phantom proxies)
All stuck proxies show Latency: 0s, no WireGuard handshake, and 0 B transferred
Last connection update frozen at 6+ days ago for most
After systemctl restart netbird, the proxy peers reappear immediately (re-injected via network map from management/signal server)
No proxy-related API endpoints available (/api/proxies, /api/reverse-proxies, /api/exposed-services all return 404)

Expected behavior

When a reverse proxy entry is deleted from the dashboard, the associated proxy peer should be cleaned up from all clients' network maps
Ghost proxy peers should not persist indefinitely
There should be an API endpoint to list/manage reverse proxy peers (currently no endpoint exists)

Additional context

The reverse proxy entries were created and managed entirely through the dashboard UI, not via netbird expose CLI
No proxy-related entries found in journalctl -u netbird
The proxy peers appear to be injected into the network map by the management server but are not exposed through the standard peers API, making them impossible to manage or remove
Possibly related to #5421 (stale proxy entries preventing peer removal)

Originally created by @SuperKali on GitHub (Mar 21, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5646 ## Description After creating and later removing reverse proxy entries from the **NetBird dashboard** (web UI), multiple ghost "proxy" peers remain visible in `netbird status --detail` permanently stuck in **"Connecting"** status. These proxy peers: 1. Are **not visible** in the management dashboard (Peers section) 2. Are **not returned** by the management API (`GET /api/peers`) 3. **Cannot be removed** — no CLI command, API endpoint, or dashboard option exists to delete them 4. **Persist across service restarts** (`systemctl restart netbird`) 5. Inflate the peer count (showing 6/16 Connected instead of 6/9) ## Environment - **NetBird version:** 0.66.4 (daemon + CLI) - **Deployment:** Self-hosted (Zitadel IDP) - **OS:** Linux aarch64 (Ubuntu, kernel 6.8.0) - **Interface type:** Kernel ## Steps to reproduce 1. Set up a self-hosted NetBird instance 2. Create reverse proxy entries from the **dashboard web UI** targeting services on various peers 3. Later remove/delete those reverse proxy entries from the dashboard 4. Observe that `netbird status --detail` still shows proxy peers that were associated with the deleted proxy configurations ## Current behavior `netbird status --detail` shows 7 ghost proxy peers with hostnames matching the pattern: proxy---. Example output: proxy-XXXXXX-8-9.example.tun: NetBird IP: 100.71.8.9 Status: Connecting Connection type: - ICE candidate (Local/Remote): -/- Last connection update: 6 days ago Last WireGuard handshake: - Transfer status (received/sent) 0 B/0 B **Key observations:** - 7 proxy peers total: **6 stuck in "Connecting"**, 1 "Connected" - The proxy peer IDs do **not match** any peer ID returned by `GET /api/peers` (17 real peers vs 7 phantom proxies) - All stuck proxies show `Latency: 0s`, no WireGuard handshake, and 0 B transferred - `Last connection update` frozen at 6+ days ago for most - After `systemctl restart netbird`, the proxy peers reappear immediately (re-injected via network map from management/signal server) - No proxy-related API endpoints available (`/api/proxies`, `/api/reverse-proxies`, `/api/exposed-services` all return 404) ## Expected behavior - When a reverse proxy entry is deleted from the dashboard, the associated proxy peer should be cleaned up from all clients' network maps - Ghost proxy peers should not persist indefinitely - There should be an API endpoint to list/manage reverse proxy peers (currently no endpoint exists) ## Additional context - The reverse proxy entries were created and managed entirely through the **dashboard UI**, not via `netbird expose` CLI - No `proxy`-related entries found in `journalctl -u netbird` - The proxy peers appear to be injected into the network map by the management server but are not exposed through the standard peers API, making them impossible to manage or remove - Possibly related to #5421 (stale proxy entries preventing peer removal)

saavagebueno added the triage-needed label 2026-08-05 01:27:37 -04:00

saavagebueno commented

2026-08-05 01:27:37 -04:00

@heymoe commented on GitHub (Mar 22, 2026):

This is likely related to #5421 that you referenced and #5398 which I believe was the first issue to report this bug. It was fixed in v0.66.0 but It's unclear if the fix retroactively clears the ghosts entries but that seems to be a no in your case.

I personally ran into this issue and before the fix and I was able to manually delete the ghost entries by removing them from the targets table in the store.db sqlite3 database Netbird server / management uses.

The general steps to remove the ghost entries manually would look something like:

get access to the store.db file
use sqlite3 to "edit" the contents of the store.db (example command: sqlite3 store.db). Install sqlite3 if needed
view a list of existing targets: select * from targets; . Might be good idea to change the output mode to table or column first: .mode column so you can see what each piece of data is.
remove the ghosts: delete from targets where id=###; (replace ### with the ghost target id number)
repeat 4 until all ghosts are gone
exit sqlite3: .quit

The tricky part might be step 1 depending on how familiar you are with docker and linux. Some options might be: convert the docker volumes to bind mounts OR exec a shell into the netbird-server (or management) container. I'm sure there might be other options but those are the ones off the top of my head. I personally went the bind mount way just for easier access and backups of all the Netbird data in general.

Definitely make a backup of your working deployment before you do any of this.

@heymoe commented on GitHub (Mar 22, 2026): This is likely related to #5421 that you referenced and #5398 which I believe was the first issue to report this bug. It was fixed in v0.66.0 but It's unclear if the fix retroactively clears the ghosts entries but that seems to be a no in your case. I personally ran into this issue and before the fix and I was able to manually delete the ghost entries by removing them from the targets table in the store.db sqlite3 database Netbird server / management uses. The general steps to remove the ghost entries manually would look something like: 1) get access to the store.db file 2) use sqlite3 to "edit" the contents of the store.db (example command: `sqlite3 store.db`). Install sqlite3 if needed 3) view a list of existing targets: `select * from targets;` . Might be good idea to change the output mode to table or column first: `.mode column` so you can see what each piece of data is. 4) remove the ghosts: `delete from targets where id=###;` (replace ### with the ghost target id number) 5) repeat 4 until all ghosts are gone 6) exit sqlite3: `.quit` The tricky part might be step 1 depending on how familiar you are with docker and linux. Some options might be: convert the docker volumes to bind mounts OR exec a shell into the netbird-server (or management) container. I'm sure there might be other options but those are the ones off the top of my head. I personally went the bind mount way just for easier access and backups of all the Netbird data in general. Definitely make a backup of your working deployment before you do any of this.

saavagebueno commented

2026-08-05 01:27:37 -04:00

@SuperKali commented on GitHub (Mar 23, 2026):

Confirmed working on v0.66.4 (self-hosted, Docker, Linux aarch64).

A few clarifications that might help others:

The ghost peers are in the peers table, not targets — the table suggested above didn't have a name column in my case. The correct query is:

select id, name from peers where name like 'proxy-%';

To identify which ones are actually ghosts vs legitimate, cross-reference with netbird status --detail (ghosts show Connecting, 0 B transferred, no WireGuard handshake) and with the services table — only one proxy peer per active service should exist:

select id, name, enabled from services;

Then delete only the ghosts, keeping any connected one:

delete from peers where name like 'proxy-%' and id != '<id_to_keep>';

After docker restart netbird-management and systemctl restart netbird on the clients, the ghost peers are gone and the peer count is correct. The management server recreates legitimate proxy peers automatically.

@SuperKali commented on GitHub (Mar 23, 2026): Confirmed working on v0.66.4 (self-hosted, Docker, Linux aarch64). A few clarifications that might help others: **The ghost peers are in the `peers` table, not `targets`** — the table suggested above didn't have a `name` column in my case. The correct query is: ```sql select id, name from peers where name like 'proxy-%'; ``` To identify which ones are actually ghosts vs legitimate, cross-reference with `netbird status --detail` (ghosts show `Connecting`, 0 B transferred, no WireGuard handshake) and with the `services` table — only one proxy peer per active service should exist: ```sql select id, name, enabled from services; ``` Then delete only the ghosts, keeping any connected one: ```sql delete from peers where name like 'proxy-%' and id != '<id_to_keep>'; ``` After `docker restart netbird-management` and `systemctl restart netbird` on the clients, the ghost peers are gone and the peer count is correct. The management server recreates legitimate proxy peers automatically.

saavagebueno commented

2026-08-05 01:27:37 -04:00

@SuperKali commented on GitHub (Mar 30, 2026):

The problem still persists; I don't know how to solve it once and for all.

@SuperKali commented on GitHub (Mar 30, 2026): The problem still persists; I don't know how to solve it once and for all.

saavagebueno commented

2026-08-05 01:27:37 -04:00

@SuperKali commented on GitHub (Mar 30, 2026):

I dug into the source code and found the exact reason why ghost proxy peers accumulate.

The bug

CreateProxyPeer in management/internals/shared/grpc/proxy.go always calls peersManager.CreateProxyPeer() without checking for or cleaning up pre-existing proxy peers for the same cluster. Every time the proxy restarts it gets a new timestamped ID (e.g. netbird-proxy-20260329150431) and registers a brand-new record in the peers table — the old ones are never deleted.

There is a cleanupStaleProxies goroutine that runs every 5 minutes, but it only calls proxyManager.CleanupStale() which updates the proxies table. The peers table is never touched:

// proxy.go — runs every 5 min, cleans `proxies` table only
func (s *ProxyServiceServer) cleanupStaleProxies(ctx context.Context) {
    ticker := time.NewTicker(5 * time.Minute)
    // ...
    s.proxyManager.CleanupStale(ctx, 1*time.Hour) // never touches `peers`
}

// CreateProxyPeer — always inserts a new peer, never deletes old ones
func (s *ProxyServiceServer) CreateProxyPeer(...) {
    // ...
    err := s.peersManager.CreateProxyPeer(ctx, accountID, key, cluster)
    // no cleanup of previous proxy peers for the same cluster
}

This means orphaned peers in the peers table accumulate indefinitely with a stale peer_status_connected = 1, because their status is only updated via WireGuard heartbeats — which obviously never come from a peer that no longer exists.

Confirmed in the database

Cross-referencing peers and proxies makes the ghost peers immediately identifiable:

-- Ghost peers: last_seen is older than the active proxy's connected_at
SELECT p.name, p.peer_status_connected, p.peer_status_last_seen
FROM peers p, proxies px
WHERE p.name LIKE 'proxy-%'
  AND px.status = 'connected'
  AND p.peer_status_last_seen < px.connected_at
ORDER BY p.peer_status_last_seen;

In my case this returned 3 ghost peers with last_seen 6+ days old, while the active proxy (proxies.status = connected) had connected_at from a recent restart.

Suggested fix

Two possible approaches:

Option A — clean up in CreateProxyPeer before inserting the new peer:

func (s *ProxyServiceServer) CreateProxyPeer(ctx, accountID, key, cluster) {
    // Delete stale proxy peers for this cluster before creating a new one
    if err := s.peersManager.DeleteStaleProxyPeers(ctx, accountID, cluster); err != nil {
        log.Warnf("failed to cleanup stale proxy peers for cluster %s: %v", cluster, err)
    }
    err := s.peersManager.CreateProxyPeer(ctx, accountID, key, cluster)
    // ...
}

Option B — extend CleanupStale to also remove orphaned proxy peers from the peers table when no active proxy exists for their cluster.

Workaround (until fixed)

DELETE FROM peers
WHERE name LIKE 'proxy-%'
  AND peer_status_last_seen < (
    SELECT connected_at FROM proxies
    WHERE status = 'connected'
    ORDER BY connected_at DESC LIMIT 1
  );

Followed by docker restart netbird-management. The management server will recreate legitimate proxy peers automatically on the next proxy heartbeat.

@SuperKali commented on GitHub (Mar 30, 2026): I dug into the source code and found the exact reason why ghost proxy peers accumulate. ### The bug `CreateProxyPeer` in `management/internals/shared/grpc/proxy.go` always calls `peersManager.CreateProxyPeer()` without checking for or cleaning up pre-existing proxy peers for the same cluster. Every time the proxy restarts it gets a new timestamped ID (e.g. `netbird-proxy-20260329150431`) and registers a brand-new record in the `peers` table — the old ones are never deleted. There is a `cleanupStaleProxies` goroutine that runs every 5 minutes, but it only calls `proxyManager.CleanupStale()` which updates the `proxies` table. The `peers` table is never touched: ```go // proxy.go — runs every 5 min, cleans `proxies` table only func (s *ProxyServiceServer) cleanupStaleProxies(ctx context.Context) { ticker := time.NewTicker(5 * time.Minute) // ... s.proxyManager.CleanupStale(ctx, 1*time.Hour) // never touches `peers` } // CreateProxyPeer — always inserts a new peer, never deletes old ones func (s *ProxyServiceServer) CreateProxyPeer(...) { // ... err := s.peersManager.CreateProxyPeer(ctx, accountID, key, cluster) // no cleanup of previous proxy peers for the same cluster } ``` This means orphaned peers in the `peers` table accumulate indefinitely with a stale `peer_status_connected = 1`, because their status is only updated via WireGuard heartbeats — which obviously never come from a peer that no longer exists. ### Confirmed in the database Cross-referencing `peers` and `proxies` makes the ghost peers immediately identifiable: ```sql -- Ghost peers: last_seen is older than the active proxy's connected_at SELECT p.name, p.peer_status_connected, p.peer_status_last_seen FROM peers p, proxies px WHERE p.name LIKE 'proxy-%' AND px.status = 'connected' AND p.peer_status_last_seen < px.connected_at ORDER BY p.peer_status_last_seen; ``` In my case this returned 3 ghost peers with `last_seen` 6+ days old, while the active proxy (`proxies.status = connected`) had `connected_at` from a recent restart. ### Suggested fix Two possible approaches: **Option A** — clean up in `CreateProxyPeer` before inserting the new peer: ```go func (s *ProxyServiceServer) CreateProxyPeer(ctx, accountID, key, cluster) { // Delete stale proxy peers for this cluster before creating a new one if err := s.peersManager.DeleteStaleProxyPeers(ctx, accountID, cluster); err != nil { log.Warnf("failed to cleanup stale proxy peers for cluster %s: %v", cluster, err) } err := s.peersManager.CreateProxyPeer(ctx, accountID, key, cluster) // ... } ``` **Option B** — extend `CleanupStale` to also remove orphaned proxy peers from the `peers` table when no active proxy exists for their cluster. ### Workaround (until fixed) ```sql DELETE FROM peers WHERE name LIKE 'proxy-%' AND peer_status_last_seen < ( SELECT connected_at FROM proxies WHERE status = 'connected' ORDER BY connected_at DESC LIMIT 1 ); ``` Followed by `docker restart netbird-management`. The management server will recreate legitimate proxy peers automatically on the next proxy heartbeat.

saavagebueno commented

2026-08-05 01:27:37 -04:00

@pascal-fischer commented on GitHub (Mar 31, 2026):

So the idea is that the peers are added as ephemeral peers. You are correct that on every reboot the proxy will register new peers. The idea is that those are short lived and are being cleaned by the normal ephemeral peer cleanup (which is deleting them after they are disconnected for more than 10 min).

Next time you have some ghost proxy peers can you look into the DB and check for ephemeral, peer_status_connected and peer_status_last_seen

@pascal-fischer commented on GitHub (Mar 31, 2026): So the idea is that the peers are added as ephemeral peers. You are correct that on every reboot the proxy will register new peers. The idea is that those are short lived and are being cleaned by the normal ephemeral peer cleanup (which is deleting them after they are disconnected for more than 10 min). Next time you have some ghost proxy peers can you look into the DB and check for `ephemeral`, `peer_status_connected` and `peer_status_last_seen`

saavagebueno commented

2026-08-05 01:27:37 -04:00

@SuperKali commented on GitHub (Apr 2, 2026):

@pascal-fischer Confirmed in DB:

sqlite3 /var/lib/docker/volumes/netbird_netbird_management/_data/store.db \
  "SELECT name, ephemeral, peer_status_connected, peer_status_last_seen FROM peers WHERE name LIKE 'proxy-%' ORDER BY peer_status_last_seen DESC;"

proxy-d770f5jm9lgs73cvovb0|1|1|2026-04-02 06:07:19  ← active proxy
proxy-d74jv5bm9lgs73efpghg|1|1|2026-03-30 09:46:37  ← ghost, 3 days old

Both ephemeral=1, both peer_status_connected=1.
The ghost peer never got flipped to connected=0, so the 10-min ephemeral cleanup never triggered.

@SuperKali commented on GitHub (Apr 2, 2026): @pascal-fischer Confirmed in DB: ```bash sqlite3 /var/lib/docker/volumes/netbird_netbird_management/_data/store.db \ "SELECT name, ephemeral, peer_status_connected, peer_status_last_seen FROM peers WHERE name LIKE 'proxy-%' ORDER BY peer_status_last_seen DESC;" ``` ```bash proxy-d770f5jm9lgs73cvovb0|1|1|2026-04-02 06:07:19 ← active proxy proxy-d74jv5bm9lgs73efpghg|1|1|2026-03-30 09:46:37 ← ghost, 3 days old ``` Both ephemeral=1, both peer_status_connected=1. The ghost peer never got flipped to connected=0, so the 10-min ephemeral cleanup never triggered.

saavagebueno commented

2026-08-05 01:27:37 -04:00

@pascal-fischer commented on GitHub (Apr 7, 2026):

Hi, great. So we have an issue with the status field that we are aware of. This can also happen with regular peers as there is a race condition. We want to move to a heartbeat approach to recover the connected states. This is something we planned and will be implementing in the near future. I can not give you an exact date yet. Meanwhile cleaning in the database is the only option I fear

@pascal-fischer commented on GitHub (Apr 7, 2026): Hi, great. So we have an issue with the status field that we are aware of. This can also happen with regular peers as there is a race condition. We want to move to a heartbeat approach to recover the connected states. This is something we planned and will be implementing in the near future. I can not give you an exact date yet. Meanwhile cleaning in the database is the only option I fear

saavagebueno commented

2026-08-05 01:27:37 -04:00

@SuperKali commented on GitHub (Apr 7, 2026):

The interesting thing is that you know about it and that it hasn't been forgotten; it's a real problem that needs to be solved as soon as possible.

@SuperKali commented on GitHub (Apr 7, 2026): The interesting thing is that you know about it and that it hasn't been forgotten; it's a real problem that needs to be solved as soon as possible.

saavagebueno commented

2026-08-05 01:27:38 -04:00

@arjones852 commented on GitHub (Apr 30, 2026):

This is still an issue. Can confirm as a new user that started at version 0.69, I have 6 ghost peers in my list that started me down the rabbit hole of what are these and why are they there.

@arjones852 commented on GitHub (Apr 30, 2026): This is still an issue. Can confirm as a new user that started at version 0.69, I have 6 ghost peers in my list that started me down the rabbit hole of what are these and why are they there.

saavagebueno commented

2026-08-05 01:27:38 -04:00

@SuperKali commented on GitHub (Apr 30, 2026):

The issue is still present with latest version on my side

@SuperKali commented on GitHub (Apr 30, 2026): The issue is still present with latest version on my side

saavagebueno commented

2026-08-05 01:27:38 -04:00

@towerplease commented on GitHub (May 30, 2026):

Can confirm this issue on the latest version (0.71.4)

@towerplease commented on GitHub (May 30, 2026): Can confirm this issue on the latest version (0.71.4)

saavagebueno commented

2026-08-05 01:27:38 -04:00

@dapru commented on GitHub (Jun 8, 2026):

Still an issue with the current version (0.72.2). Noticed it due to connection problems with android clients

@dapru commented on GitHub (Jun 8, 2026): Still an issue with the current version (0.72.2). Noticed it due to connection problems with android clients

saavagebueno commented

2026-08-05 01:27:38 -04:00

@salsugair commented on GitHub (Jun 21, 2026):

Can confirm this issue on the latest version (0.73.1)

@salsugair commented on GitHub (Jun 21, 2026): Can confirm this issue on the latest version (0.73.1)

saavagebueno commented

2026-08-05 01:27:38 -04:00

@Xury46 commented on GitHub (Jun 21, 2026):

I ran into this exact issue as well, I tried editing the store.db but it's encrypted and I decided it wasn't work potentially bricking my network. I would love to have a better way to clean this up.

@Xury46 commented on GitHub (Jun 21, 2026): I ran into this exact issue as well, I tried editing the store.db but it's encrypted and I decided it wasn't work potentially bricking my network. I would love to have a better way to clean this up.

saavagebueno commented

2026-08-05 01:27:38 -04:00

@SuperKali commented on GitHub (Jun 21, 2026):

The issue still persists, hope in a fix soon, proxy table is growing on my side.

@SuperKali commented on GitHub (Jun 21, 2026): The issue still persists, hope in a fix soon, proxy table is growing on my side.

saavagebueno commented

2026-08-05 01:27:38 -04:00

@garrettlaman commented on GitHub (Jun 26, 2026):

This issue seems to cause DNS resolution problems on Android when connecting to Netbird-Only Access services. When an Android client resolves a Netbird-Only Access proxy host, the Netbird resolver returns overlay IP addresses for the ghost proxies in addition to the active proxy.

When connecting to proxied services, apps are using the ghost overlay IP addresses instead of the active proxy IP, effectively breaking proxy functionality on Android.

In my case I'm up to 25 ghost proxies, so each DNS request is returning 25 stale IPs and the 1 active proxy IP, which is never used.

@garrettlaman commented on GitHub (Jun 26, 2026): This issue seems to cause DNS resolution problems on Android when connecting to Netbird-Only Access services. When an Android client resolves a Netbird-Only Access proxy host, the Netbird resolver returns overlay IP addresses for the ghost proxies in addition to the active proxy. When connecting to proxied services, apps are using the ghost overlay IP addresses instead of the active proxy IP, effectively breaking proxy functionality on Android. In my case I'm up to 25 ghost proxies, so each DNS request is returning 25 stale IPs and the 1 active proxy IP, which is never used.

saavagebueno commented

2026-08-05 01:27:38 -04:00

@rwtallant13 commented on GitHub (Jun 27, 2026):

Same issue here and I believe the DNS issues go beyond just on Android. On my Linux system my netbird-only access sites do not load since the DNS returns a unconnected proxy IP.

@rwtallant13 commented on GitHub (Jun 27, 2026): Same issue here and I believe the DNS issues go beyond just on Android. On my Linux system my netbird-only access sites do not load since the DNS returns a unconnected proxy IP.

saavagebueno commented

2026-08-05 01:27:38 -04:00

@Aurel004 commented on GitHub (Jul 1, 2026):

Got 70+ proxy-peers for me, each time Netbird restarts, it creates a new peer

@Aurel004 commented on GitHub (Jul 1, 2026): Got 70+ proxy-peers for me, each time Netbird restarts, it creates a new peer

saavagebueno commented

2026-08-05 01:27:38 -04:00

@SuperKali commented on GitHub (Jul 2, 2026):

@pascal-fischer Do we have enough reports to take on this one?

@SuperKali commented on GitHub (Jul 2, 2026): @pascal-fischer Do we have enough reports to take on this one?

Sign in to join this conversation.

Branches Tags

main

claude/agent-network-test-cases-p743vw

android/gui-integration

revert/component-types

feat-post_quantum_ml_kem

ice-stun-wg-demux

dependabot/npm_and_yarn/proxy/web/npm_and_yarn-b39864987c

agent-network-setup-poc

dependabot/go_modules/aws-sdk-8f849ebaed

dependabot/github_actions/actions-a940c7c866

dependabot/go_modules/otel-e34c790afd

dependabot/go_modules/testcontainers-de325c0dd6

dependabot/go_modules/wireguard-dbd6b95108

dependabot/go_modules/pion-5f703e1eca

dependabot/go_modules/gorm-2271c8195b

fix-login-needed-check

dependabot/go_modules/google.golang.org/grpc-1.82.1

fix/ui-gtk3-support

enterprise-traefik-and-migration-fixes

disambiguate_p2p_metrics

revert/component-types-hookup

embedded-vnc

feature/ios-ssh

docs/agent-network-docs-update

dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.106.3

dependabot/go_modules/github.com/pion/stun/v3-3.1.5

fix-ssh-authorized-users-multi-rule

peer-acl-multi-source

reverse-proxy-crowdsec-appsec

reverse-proxy-allow-match-or

client-local-metrics

lazy-conn-per-peer

lazy-conn-rosenpass

dependabot/go_modules/github.com/gopacket/gopacket-1.7.0

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.6

dependabot/go_modules/github.com/pires/go-proxyproto-0.15.0

dependabot/go_modules/github.com/jackc/pgx/v5-5.10.0

dependabot/go_modules/github.com/oapi-codegen/runtime-1.6.0

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.4

dependabot/go_modules/github.com/pkg/sftp-1.13.11

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.20.0

ssh-windows-privilege-check

fix/explicit-cors-handling

fix/remove-math-rand

test/gui-memory-leak-fix

fix/ui-status-dispatch

install-script-ui-dependencies

fix/grpc-get-network-map

fix/subscribe-status-coalesce

fix/tray-menu-item-leak

fix/windows-tray-race

feature/changeset

worktree-dns-route-qtype-fallthrough

mdm_integration

mlsmaycon-patch-2

feat/agent-network-ollama

proxy-tunnel-cache-ttl-env

coderabbitai/utg/1e5b0a5

grpc-acl

test/battery-drain

components-impl-drop-indexes-use-xids-no-resource-policy-map

fix/nmap-relevant-groups

e2e-guardrail-blocks-unselected-model

fix/lazyconn-cold-start-allowed-ips

vertex-guardrails-model-access-e2e

add-atomic-cache-ops

refactor/relay-foreign-cache

ci/trigger-release-tests

feature/kimi-3-agent-networks-dns-warmup

feature/dns-lazy-conn-warmup

daemon-ipc-acl

feature/ui-translation-key-parity-check

refactor/relay-foreign-cache-tests

fix/lazyconn-idle-keep-wg-peer

dmitri-propagate-auth-grant-types-on-combined

0.74.7-branch

diagnose-empty-vs-corrupt-state

windows-sleep-detector

fix/cli-up-wait-for-daemon

rp_key_persistency

feature/native-grpc

0.74.6-branch

0.74.6-branch-sync

0.74.5-branch-sync

0.74.4-branch

fix/remove-stale-peers-removal

fix/remove-stale-proxy-logic

fix/nsis-preserve-autostart-on-upgrade

refactor/peer-event-bus

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.3

dependabot/go_modules/github.com/pkg/sftp-1.13.10

components-impl-drop-indexes

fix-reset-aggregation-window-flake

dependabot/go_modules/github.com/pion/dtls/v3-3.1.5

0.74.x

fix/relay-states-lock

update-process-pkg

update-gopsutil-v4

fix/relay_states_lock

increase-sysinfo-timeout

dependabot/go_modules/github.com/Azure/go-ntlmssp-0.1.1

dependabot/go_modules/github.com/eko/gocache/store/redis/v4-4.2.6

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.3

fix/fail-to-create-upnp-port-mapping-on-opnsense-firewall

0.74.3-branch

fix/routeselector-atomic-exit-node

netmap_progressive_alignment

nmap/components-impl

dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

dependabot/go_modules/github.com/oapi-codegen/runtime-1.4.2

dependabot/go_modules/github.com/gopacket/gopacket-1.6.1

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.19.0

dependabot/go_modules/github.com/pires/go-proxyproto-0.12.0

fix/signal-watchdog-sync-stop

docs/agent-network

test/affected-logic

fix/revert-ice-filter

refactor/simplify-affected-peers

pascal-filter-policies-by-direction

claude/lock-contention-peer-connect-g8t6au

dmitri-filter-policies-by-direction

refactor/migrate-profiles-to-go

profile-bindings-ios

fix/skip-restart-unchanged-route

fix/mgmt-cache-async-resolve

refactor/wails-update-105

client_lifetime_serialization_refactor

fix/browser-ssh-2

fix/ipv6-and-netstack-accept-loop

fix/browser-ssh

profile-id-name-test

refactor/mgmt-bootstrap

feat/getting-started-unified-wizard

socket-grpc-permissions

fix/mysql-index-migration

windows-dns-firewall

tests/enable-race-on-tests

ui-refactor-gtk3

feature/affected-peers-grpc

profile-id

lazyconn-first-packet-fix-v2

claude/focused-gates-VMTgb

ui-tray-linux-leftclick

fix/ctx-enrichment

daemon-owner

feature/android-client-ssh

worktree-accept-ra-forwarding

nmap/combined-deploy

task/align_protobuff_toolset

feature/session-extend

add-json-yaml-flags

refactor/ephemeral-cleanup

claude/webtransport-relay-wasm-mUjY9

claude/vnc-udp-feasibility-6KB1U

fix/wgport-config

e2e-windows-dns-combined

fix/login-cmd-root-flags

feat/reseller-openapi-spec

github-issue-resolver

add-steamos-support

fix-darwin-uninstaller

flutter-test

ci/freebsd-pkg-bootstrap

cached-serial-check-on-sync

fix-mgmt-cache-bypass-overlay

revert-easyjson-5938

revert-ice-5820

revert-firewalld-5928

refactor/permissions-manager

revert-dns-5935-systemd-resolved

revert-dns-5935-5945

revert-dns-5945-mgmt-cache

feature/log-most-busy-peers

prototype/ui-wails

coderabbitai/utg/8ae8f20

feature/use-peer-fqdn-on-https

release/0.68.3

add-slack-channel

claude/rdp-token-passthrough-eNcqW

transparent-proxy

fix/macos-stale-route-eexist

crowdsec-selfhosted

fix/remove-otel-units

entire/checkpoints/v1

fix/getting-started

feat/static-connectors-combined-server

feature/use-local-keys-embedded

feature/fleetdm

set-env-only-if-not-fork

feature/expose-has-channel

fix/connection-status-race

fix/filter-cgnat-cni-ice-candidates

feature/check-cert-locker-before-acme

test/proxy-fixes

test/proxy-mtu

prototype/ui-tauri

test/proxy-speed

fix-reused-ports

feat/migrate-to-embedded-idp

feature/add-serial-to-proxy-merged

deploy/proxy-serial

test/connection

feature/disable-legacy-port

feature/flag-to-disable-legacy-port

test/perftest

fix/http-redirect

poc-token-command

dn-reverse-proxy

prototype/reverse-proxy-rename

prototype/reverse-proxy-logs-pagination

feature/client-metrics

prototype/reverse-proxy-clusters

debug-dns-route

fix/win-dns-batch

add-extra-route-logs

job-stream-notify-disconnection-eof

deploy/secrets-manager

trigger-proxy-update

bug/update-ios-client-code-build-tags

sync-client-netmap-serial

log/conn-disconn

nmap/compaction-deploy

ci-win-test

feature/disk-encryption-check

wasm-debug

swap-dns-prio

fix/dex-config

feature/migrate-auto-groups-to-table

nmap/compaction

dex-nocgo-stub

feature/exclude-terraform-from-rate-limiting

test-freebsd

retries-refactor

coderabbitai/docstrings/b7e98ac

feat/integrate-zitadel

bug/ios-hanging-reconection

zitadel-idp

feat/network-map-serial

refactor/get-account-no-users

feat/auto-upgrade

feature/report-high-pat-id

feature/temporary-access-for-resource

fix/nmap-fwrules

dont-restart-dns

prototype/ui

update-gomobile

go-dns-for-ice

wasm-ldflags

test-ldflags

wasmbuild-test

feature/networks-s2s

vk/compare-nmaps

dbg/bothmaps

reorder-dns-shutdown

fix/relay-reconnection-race

fix/nmap-exitnodes

vk/debug/nmap-both

move-licensed-code

feat/better-daemon-connection-lost-message

feat/auto-update-2

test/timings

refactor/getaccount-raw

tests/nmap-getaccount

refactor/nmap

refactor/nmap-limit-buffer

feature/detect-mac-wakeup

feature/extract-modules

quick-setings

feat/sync-limiter

feature/store-cache-impl

fix-install-version

feature/store-metrics

feature/metrics-on-store

feature/use-gorm-cache

loadtest-signal

unsymmetrical-squash

refactor/reducate-signaling

test/update-reduce

feature/store-cache

feature/remote-debug

cli-ws-proxy-backend-addr

feat/mgmt-map-serial

snyk-fix-d9d0081a4c7f9137bdb59d0d50a141a2

snyk-fix-7415cea5a11acd66753540ca2c598c63

job-yml-update

feature/android-allow-selecting-routes

fix/up-sequence

fix/dns-hash-update

snyk-fix-967adae9863f17f108ce8948d9117b8d

log/getaccount-by-peer

signal-suppressor

dns-exit-node

feature/auto-updates

feature/cache-srv-key

merged-fixes

fix/missed-offers-and-debug

debug-and-fixes

poc-wasm-clean-backend-s2s

test/remote-debug

debug-api

fix/remove-gpo-if-empty

fix/test-freebsd

fix/mysql-setup

fix/remove-logout-btn

handle-existing-domain-user

chore/unify-domain-validation

snyk-fix-c5fafc8a50ce1f29046e25a1fc346185

feat/profile-edit-btn

snyk-fix-a54966211e18d4cf67e5a2757cc006d1

log-short-id

feat/logout-ephemeral

log-checks

batch-wg-ops

nb-interface-default

feat/aws-integration

add/race-test

feature/relay-feature-versioning

fix/systemd-service-logs

poc/preprocessed-map

add-account-onboarding

bind-ipv6

fix/merge-main

logs/peerlogs-addpeer

feature/net-297-network-migration

feature/support-skip-auto-apply-exit-node-routes

set-cmd

set-command-with-cursor

feature/limit-update-channel

stop-using-locking-share

feature/poc-lazy-detection

feature/net-248-removal-of-sync-mutex-locks

test/multiple-peer-logging

preresolve

add-ns-punnycode-support

apply-routes-early

windows-search-domains

fix/connecting-route-filter

feature/management/rest-client/impersonate

debug-local-records

resource-fields-snake-case

test/grpc-rate-limit

traffic-correlation-policy

feature/rest-client-options

feat/events-metrics

feature/buf-cli

test/add-ratelimiter

test/remove-write-lock-on-add-peer

fix/add-peer-semaphore

feature/users-roles-endpoint

mlsmaycon-patch-1

debug-user-role

chore/primary-key-on-networks

feature/update-account-peers-buffer-startup

remove-ubuntu2004-runners

refactor/permissions-no-pat-allowed

ref/logrus-factory

use-conntrack-zone

deploy/permissions-account

feature/lazy-connection-idle

ref/improve-test-cov

restore-pr-3440

test/increase-grpc-timeouts

feat/buffer-account-peers-update

test/networkmapgeneration-changes

feature/base-manager

feature/flow-receiver

chore/benchmark-with-large-runner

refactor/handshake-initiator

client/ui-update-systray-icons

userspace-router

wgwatcher-test

output-if-key-already-exists

fix/relay-reconnection

feature/port-forwarding-client-codecleaning

detached2

test/callbacks-nil-iceconninfo

refactor/optimize-peer-expiration

enable-udp-port-for-docker-template

fix/relay-update

feature/apply-posture-netmap

fix/group-update-existing-resource

conntrack-stats

upgrade-okta-sdk

multi-price

test/conn-stat

set-min-parallel-tests-for-management

dns-interceptor

debug-dns

router-dns

add-static-system-info

debug-0.29.4

debug-0.33.0

account-refactoring

relay/2800_quic

route-get-account-refactoring

test/seed-random-routes

feature/get-account-refactoring

test/reconnect-race-condition

refactor/get-account-usage

feature/add-session-id-to-update-channel

improve-ipv4conn

fix/async-pion-event-handling

debug

add-offload

feature/validate-group-association-debug

fix/limit-conn-for-sqlite

test/engine-iface

test/transaction-for-jwt-sync

fix/engine-stop-in-foreground

feature/add-mysql-support

test-migration

refactor/header-size-values

relay/eliminate-gob

test/signal-dispatcher-with-relay

relay/debug

validate-icon

feature/ipv6-support

use-pre-expanded-peers-map

feature/use-signal-dispatcher

validate/peer-status

add-read-write-times

fix/sync-peer-race

feature/relay-status

netmap

evaluate/network-map-hash

fix/lower-dns-resolve-interval-on-fail

feature/relay

fix/go-mod-version

upgrade-nftables

synology-userspace-mode

fix/use-ip-for-default-routes-on-darwin

fix/proxy_close

enable-release-workflow-on-pr

deploy/peer-performance

feature/permanent-turn

feature/permanent-turn-proxy

deploy/posture-check-sqlite

feature/optimize_sqlite_save

debug-ios-behavior

fix/delete-route-only-after-adding

tshoot/windows-logger

remove-new-routing

refactor/eliminate-repo-dependency

add-arm-to-ci

refactor-demo-account-object

test/abc2

test/abc

send-ssh-rosenpass-config-meta

refactor-demo

ensure-schedule-never-runs-non-positive

feature/peer-validator-groupmgm

feature/peer-validator-fix

fix/include-active-dashboard-users

fix/handle-canceling-schedule

fix/geo-download

debug-google-workspace

yury/resolve-ip-to-location

feature/extend-sysinfo

sqlite-async-peer-status

yury/add-postgresql-store

fix/route

test-build

posture-checks-poc

debug-keycloak-idp

poc/netstack

for-pascal-tmp

peer-logout-management

manual-peer-logout

detached

chore/refactor-management

test/dns-bind

fix/enforce-acl-for-containers

yury/use-sync-map-in-updatechannel

fix/events-key-handling

filter-cache-on-load-account

fix/user-expiration

handle-user-context-cancellation

nb-client-k8s-statefulset

fake-addr

fix/iptables_in_docker

ebpf-debug

update-getting-started-flow-use-postgres

fix/peer_list_notification

feature/device-authentication-with-client-secret

feature/keep_alive

feat-groups-from-jwt

separate_proxy_from_wgconfig

fix/wg_conn

wg_conn_fix

wg_bind_parallel_processing

fix-rollback-get-acls

proxy_cfg_cleanup

performance-improvement-rego

update-lock-log-level

feat-client-side-acl

refactor/move_grpcserver_logic_to_account_manager

feature/event-storage

feature/update-idp-redeeming-invite

feature/api-peer-info

return-groupminimum-setupkey

feature/interface-bind

documentation_enhancement

fix-peer-registration

ssh

users_cache

pass-client-caller

client_caller_type

revert-283-feat-fix-windows-installer

periodic-peer-updates

ebpf

braginini/wasm

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DYNR/netbird#10895