[GH-ISSUE #5862] Reverse Proxy: OR logic for access control rules and reusable auth/policy profiles #11198

New Issue

saavagebueno · 2026-08-05T01:28:51-04:00

saavagebueno commented

2026-08-05 01:28:51 -04:00

Originally created by @matlantin on GitHub (Apr 12, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5862

Is your feature request related to a problem? Please describe.

I'm self-hosting NetBird as a replacement for Cloudflare's tunnels and security features. When configuring access control on exposed services, I need to allow traffic from specific countries (e.g. France, Belgium) OR from trusted internal CIDR ranges (e.g. the IP of an exit node).

From what I experienced, access control rules of different types (Country and CIDR Block) are evaluated with AND logic: a connection must satisfy all configured "Allow Only" rules to be permitted. This makes it impossible to express "allow if from France OR Belgium OR from my VPN range" — adding a CIDR allowlist silently overrides country rules blocking all IPs outside that CIDR regardless of their country.

Cloudflare achieves this through Security Rules with explicit boolean operators ((ip.geoip.country eq "FR") or
(ip.geoip.country eq "BE") or (ip.src in {100.64.0.0/10})).

Describe the solution you'd like

Two related improvements:

OR logic between access control rules
Allow rules of different types (Country, CIDR Block) to be combined with OR logic, not just AND. A possible UI approach would be to group rules into logical blocks where conditions within a group are OR-evaluated, and groups themselves can be AND-evaluated. At minimum, a simple "match any / match all" toggle at the rule set level would be
sufficient.
Expected behavior example:

Allow if country = FR OR country = BE OR IP in 100.64.0.0/10
Currently this requires three separate "Allow Only" entries but behaves as AND across types.

Reusable access control policies and authentication methods

Currently, access control rules and authentication methods (SSO config, password, headers) must be configured individually per service. When managing many exposed services, this creates significant maintenance overhead: updating a shared policy (e.g. adding a new allowed country or rotating a shared secret) requires editing every service one by one.
The solution would be to introduce named, reusable Access Control Policies and Authentication Profiles that can be created once and assigned to multiple services. Changes to a shared policy would propagate automatically to all services using it.

Describe alternatives you've considered

Removing CIDR rules entirely and relying only on country rules: loses the ability to grant access to trusted peers regardless of geographic location.
Handling OR logic at the Traefik layer (custom middleware): possible but requires manually injecting configuration outside of NetBird's management plane, breaking the unified management model.
Staying on Cloudflare: defeats the purpose of self-hosting with NetBird as the single access layer.

Additional context
This is particularly relevant for self-hosters who want to use NetBird's reverse proxy as a full Cloudflare replacement with geo-blocking. The current AND-only evaluation model is not documented explicitly, making the behavior surprising: adding a CIDR allowlist silently breaks previously working country-based rules.
The reusable policies request is similar to how Cloudflare handles WAF Custom Rulesets or how Traefik handles reusable middleware — define once, reference many times.

Originally created by @matlantin on GitHub (Apr 12, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5862 **Is your feature request related to a problem? Please describe.** I'm self-hosting NetBird as a replacement for Cloudflare's tunnels and security features. When configuring access control on exposed services, I need to allow traffic from specific countries (e.g. France, Belgium) OR from trusted internal CIDR ranges (e.g. the IP of an exit node). From what I experienced, access control rules of different types (Country and CIDR Block) are evaluated with AND logic: a connection must satisfy all configured "Allow Only" rules to be permitted. This makes it impossible to express "allow if from France OR Belgium OR from my VPN range" — adding a CIDR allowlist silently overrides country rules blocking all IPs outside that CIDR regardless of their country. Cloudflare achieves this through Security Rules with explicit boolean operators ((ip.geoip.country eq "FR") or (ip.geoip.country eq "BE") or (ip.src in {100.64.0.0/10})). **Describe the solution you'd like** Two related improvements: 1. OR logic between access control rules Allow rules of different types (Country, CIDR Block) to be combined with OR logic, not just AND. A possible UI approach would be to group rules into logical blocks where conditions within a group are OR-evaluated, and groups themselves can be AND-evaluated. At minimum, a simple "match any / match all" toggle at the rule set level would be sufficient. Expected behavior example: - Allow if country = FR OR country = BE OR IP in 100.64.0.0/10 - Currently this requires three separate "Allow Only" entries but behaves as AND across types. 2. Reusable access control policies and authentication methods Currently, access control rules and authentication methods (SSO config, password, headers) must be configured individually per service. When managing many exposed services, this creates significant maintenance overhead: updating a shared policy (e.g. adding a new allowed country or rotating a shared secret) requires editing every service one by one. The solution would be to introduce named, reusable Access Control Policies and Authentication Profiles that can be created once and assigned to multiple services. Changes to a shared policy would propagate automatically to all services using it. **Describe alternatives you've considered** - Removing CIDR rules entirely and relying only on country rules: loses the ability to grant access to trusted peers regardless of geographic location. - Handling OR logic at the Traefik layer (custom middleware): possible but requires manually injecting configuration outside of NetBird's management plane, breaking the unified management model. - Staying on Cloudflare: defeats the purpose of self-hosting with NetBird as the single access layer. **Additional context** This is particularly relevant for self-hosters who want to use NetBird's reverse proxy as a full Cloudflare replacement with geo-blocking. The current AND-only evaluation model is not documented explicitly, making the behavior surprising: adding a CIDR allowlist silently breaks previously working country-based rules. The reusable policies request is similar to how Cloudflare handles WAF Custom Rulesets or how Traefik handles reusable middleware — define once, reference many times.

saavagebueno added the feature-request label 2026-08-05 01:28:51 -04:00

saavagebueno commented

2026-08-05 01:28:51 -04:00

@wtrucci commented on GitHub (May 2, 2026):

+1
AND logic isn't very convenient or useful. In the case of a self-hosted setup, if I want to restrict access from a specific country and a specific CIRD, I need to use OR logic; otherwise, no connections will be allowed.
The documentation doesn't clearly specify which logic is used, but I believe OR should be used instead of AND in the proxy service under the “Allow Only” rules.

@wtrucci commented on GitHub (May 2, 2026): +1 AND logic isn't very convenient or useful. In the case of a self-hosted setup, if I want to restrict access from a specific country and a specific CIRD, I need to use OR logic; otherwise, no connections will be allowed. The documentation doesn't clearly specify which logic is used, but I believe OR should be used instead of AND in the proxy service under the “Allow Only” rules.

saavagebueno commented

2026-08-05 01:28:52 -04:00

@michelkroon commented on GitHub (May 16, 2026):

+1
I'm experiencing the same issue. Nowhere in the documentation can ben found what logic is used when evaluating the rules. Would really love the option to choose between AND/OR logic based on my needs.

@michelkroon commented on GitHub (May 16, 2026): +1 I'm experiencing the same issue. Nowhere in the documentation can ben found what logic is used when evaluating the rules. Would really love the option to choose between AND/OR logic based on my needs.

saavagebueno commented

2026-08-05 01:28:52 -04:00

@baldygeraldy commented on GitHub (May 21, 2026):

Following as i have the same. These requests would make the product much much better

@baldygeraldy commented on GitHub (May 21, 2026): Following as i have the same. These requests would make the product much much better

saavagebueno commented

2026-08-05 01:28:52 -04:00

@stephen-cornwell commented on GitHub (May 29, 2026):

+1 from me too.

OR logic would be the best win, though I'd settle for either:

Allow / Deny rules which short circuit the flow.
A "bypass rules for CIDR" option in the Access Controls form.

@stephen-cornwell commented on GitHub (May 29, 2026): +1 from me too. OR logic would be the best win, though I'd settle for either: - Allow / Deny rules which short circuit the flow. - A "bypass rules for CIDR" option in the Access Controls form.

saavagebueno commented

2026-08-05 01:28:52 -04:00

@Xandar31 commented on GitHub (Jun 7, 2026):

+1
I'm also looking for some way to group the Access Control.
In general for my services it's always the same, like enforce crowdsec, restrict the countrys to a few one and CIDRs.
It would be nice to create like a "Posture Checks" and add this to the reverse proxy service as access control

@Xandar31 commented on GitHub (Jun 7, 2026): +1 I'm also looking for some way to group the Access Control. In general for my services it's always the same, like enforce crowdsec, restrict the countrys to a few one and CIDRs. It would be nice to create like a "Posture Checks" and add this to the reverse proxy service as access control

saavagebueno commented

2026-08-05 01:28:52 -04:00

@wtrucci commented on GitHub (Jun 8, 2026):

+1 from me too.

OR logic would be the best win, though I'd settle for either:

Allow / Deny rules which short circuit the flow.

A "bypass rules for CIDR" option in the Access Controls form.

Exactly, OR logic is right not AND...

@wtrucci commented on GitHub (Jun 8, 2026): > +1 from me too. > > OR logic would be the best win, though I'd settle for either: > > * Allow / Deny rules which short circuit the flow. > * A "bypass rules for CIDR" option in the Access Controls form. Exactly, OR logic is right not AND...

saavagebueno commented

2026-08-05 01:28:52 -04:00

@GrapeFruitStudioUK commented on GitHub (Jun 9, 2026):

+1 This has just bitten me that this is AND only which is counter intuitive. For self hosting I believe OR as the default would be more useful as like others I am trying to restrict by country and internal IP scope.

@GrapeFruitStudioUK commented on GitHub (Jun 9, 2026): +1 This has just bitten me that this is AND only which is counter intuitive. For self hosting I believe OR as the default would be more useful as like others I am trying to restrict by country and internal IP scope.

saavagebueno commented

2026-08-05 01:28:52 -04:00

@azerioxal commented on GitHub (Jun 12, 2026):

I would like to add that this would also be something I would love to have work with the new 'NetBird-Only Access' feature. Restricting something to NetBird only when not coming from a list of allowed subnets.

@azerioxal commented on GitHub (Jun 12, 2026): I would like to add that this would also be something I would love to have work with the new 'NetBird-Only Access' feature. Restricting something to NetBird only when not coming from a list of allowed subnets.

saavagebueno commented

2026-08-05 01:28:52 -04:00

@m1g0r3ng commented on GitHub (Jun 13, 2026):

+1 Services are accessible with one rule or the other, but not both, and echoing NetBird-Only access as an option would be great too for robustness

@m1g0r3ng commented on GitHub (Jun 13, 2026): +1 Services are accessible with one rule or the other, but not both, and echoing NetBird-Only access as an option would be great too for robustness

saavagebueno commented

2026-08-05 01:28:52 -04:00

@drake5000 commented on GitHub (Jul 16, 2026):

I would like to join the feature request as well

@drake5000 commented on GitHub (Jul 16, 2026): I would like to join the feature request as well

saavagebueno commented

2026-08-05 01:28:52 -04:00

@krahlos commented on GitHub (Jul 23, 2026):

+1 for reusable Access Control Policies (part 2). I often set the same country blocklist per service by hand and every list change means editing every exposed service. Something like a named policy defined once and referenced by many services (like Traefik's GeoBlock plugin) would be nice.

@krahlos commented on GitHub (Jul 23, 2026): +1 for reusable Access Control Policies (part 2). I often set the same country blocklist per service by hand and every list change means editing every exposed service. Something like a named policy defined once and referenced by many services (like Traefik's [GeoBlock](https://plugins.traefik.io/plugins/62947313ffc0cd18356a97ca/geo-block) plugin) would be nice.

Sign in to join this conversation.

Branches Tags

main

claude/agent-network-test-cases-p743vw

android/gui-integration

revert/component-types

feat-post_quantum_ml_kem

ice-stun-wg-demux

dependabot/npm_and_yarn/proxy/web/npm_and_yarn-b39864987c

agent-network-setup-poc

dependabot/go_modules/aws-sdk-8f849ebaed

dependabot/github_actions/actions-a940c7c866

dependabot/go_modules/otel-e34c790afd

dependabot/go_modules/testcontainers-de325c0dd6

dependabot/go_modules/wireguard-dbd6b95108

dependabot/go_modules/pion-5f703e1eca

dependabot/go_modules/gorm-2271c8195b

fix-login-needed-check

dependabot/go_modules/google.golang.org/grpc-1.82.1

fix/ui-gtk3-support

enterprise-traefik-and-migration-fixes

disambiguate_p2p_metrics

revert/component-types-hookup

embedded-vnc

feature/ios-ssh

docs/agent-network-docs-update

dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.106.3

dependabot/go_modules/github.com/pion/stun/v3-3.1.5

fix-ssh-authorized-users-multi-rule

peer-acl-multi-source

reverse-proxy-crowdsec-appsec

reverse-proxy-allow-match-or

client-local-metrics

lazy-conn-per-peer

lazy-conn-rosenpass

dependabot/go_modules/github.com/gopacket/gopacket-1.7.0

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.6

dependabot/go_modules/github.com/pires/go-proxyproto-0.15.0

dependabot/go_modules/github.com/jackc/pgx/v5-5.10.0

dependabot/go_modules/github.com/oapi-codegen/runtime-1.6.0

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.4

dependabot/go_modules/github.com/pkg/sftp-1.13.11

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.20.0

ssh-windows-privilege-check

fix/explicit-cors-handling

fix/remove-math-rand

test/gui-memory-leak-fix

fix/ui-status-dispatch

install-script-ui-dependencies

fix/grpc-get-network-map

fix/subscribe-status-coalesce

fix/tray-menu-item-leak

fix/windows-tray-race

feature/changeset

worktree-dns-route-qtype-fallthrough

mdm_integration

mlsmaycon-patch-2

feat/agent-network-ollama

proxy-tunnel-cache-ttl-env

coderabbitai/utg/1e5b0a5

grpc-acl

test/battery-drain

components-impl-drop-indexes-use-xids-no-resource-policy-map

fix/nmap-relevant-groups

e2e-guardrail-blocks-unselected-model

fix/lazyconn-cold-start-allowed-ips

vertex-guardrails-model-access-e2e

add-atomic-cache-ops

refactor/relay-foreign-cache

ci/trigger-release-tests

feature/kimi-3-agent-networks-dns-warmup

feature/dns-lazy-conn-warmup

daemon-ipc-acl

feature/ui-translation-key-parity-check

refactor/relay-foreign-cache-tests

fix/lazyconn-idle-keep-wg-peer

dmitri-propagate-auth-grant-types-on-combined

0.74.7-branch

diagnose-empty-vs-corrupt-state

windows-sleep-detector

fix/cli-up-wait-for-daemon

rp_key_persistency

feature/native-grpc

0.74.6-branch

0.74.6-branch-sync

0.74.5-branch-sync

0.74.4-branch

fix/remove-stale-peers-removal

fix/remove-stale-proxy-logic

fix/nsis-preserve-autostart-on-upgrade

refactor/peer-event-bus

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.3

dependabot/go_modules/github.com/pkg/sftp-1.13.10

components-impl-drop-indexes

fix-reset-aggregation-window-flake

dependabot/go_modules/github.com/pion/dtls/v3-3.1.5

0.74.x

fix/relay-states-lock

update-process-pkg

update-gopsutil-v4

fix/relay_states_lock

increase-sysinfo-timeout

dependabot/go_modules/github.com/Azure/go-ntlmssp-0.1.1

dependabot/go_modules/github.com/eko/gocache/store/redis/v4-4.2.6

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.3

fix/fail-to-create-upnp-port-mapping-on-opnsense-firewall

0.74.3-branch

fix/routeselector-atomic-exit-node

netmap_progressive_alignment

nmap/components-impl

dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

dependabot/go_modules/github.com/oapi-codegen/runtime-1.4.2

dependabot/go_modules/github.com/gopacket/gopacket-1.6.1

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.19.0

dependabot/go_modules/github.com/pires/go-proxyproto-0.12.0

fix/signal-watchdog-sync-stop

docs/agent-network

test/affected-logic

fix/revert-ice-filter

refactor/simplify-affected-peers

pascal-filter-policies-by-direction

claude/lock-contention-peer-connect-g8t6au

dmitri-filter-policies-by-direction

refactor/migrate-profiles-to-go

profile-bindings-ios

fix/skip-restart-unchanged-route

fix/mgmt-cache-async-resolve

refactor/wails-update-105

client_lifetime_serialization_refactor

fix/browser-ssh-2

fix/ipv6-and-netstack-accept-loop

fix/browser-ssh

profile-id-name-test

refactor/mgmt-bootstrap

feat/getting-started-unified-wizard

socket-grpc-permissions

fix/mysql-index-migration

windows-dns-firewall

tests/enable-race-on-tests

ui-refactor-gtk3

feature/affected-peers-grpc

profile-id

lazyconn-first-packet-fix-v2

claude/focused-gates-VMTgb

ui-tray-linux-leftclick

fix/ctx-enrichment

daemon-owner

feature/android-client-ssh

worktree-accept-ra-forwarding

nmap/combined-deploy

task/align_protobuff_toolset

feature/session-extend

add-json-yaml-flags

refactor/ephemeral-cleanup

claude/webtransport-relay-wasm-mUjY9

claude/vnc-udp-feasibility-6KB1U

fix/wgport-config

e2e-windows-dns-combined

fix/login-cmd-root-flags

feat/reseller-openapi-spec

github-issue-resolver

add-steamos-support

fix-darwin-uninstaller

flutter-test

ci/freebsd-pkg-bootstrap

cached-serial-check-on-sync

fix-mgmt-cache-bypass-overlay

revert-easyjson-5938

revert-ice-5820

revert-firewalld-5928

refactor/permissions-manager

revert-dns-5935-systemd-resolved

revert-dns-5935-5945

revert-dns-5945-mgmt-cache

feature/log-most-busy-peers

prototype/ui-wails

coderabbitai/utg/8ae8f20

feature/use-peer-fqdn-on-https

release/0.68.3

add-slack-channel

claude/rdp-token-passthrough-eNcqW

transparent-proxy

fix/macos-stale-route-eexist

crowdsec-selfhosted

fix/remove-otel-units

entire/checkpoints/v1

fix/getting-started

feat/static-connectors-combined-server

feature/use-local-keys-embedded

feature/fleetdm

set-env-only-if-not-fork

feature/expose-has-channel

fix/connection-status-race

fix/filter-cgnat-cni-ice-candidates

feature/check-cert-locker-before-acme

test/proxy-fixes

test/proxy-mtu

prototype/ui-tauri

test/proxy-speed

fix-reused-ports

feat/migrate-to-embedded-idp

feature/add-serial-to-proxy-merged

deploy/proxy-serial

test/connection

feature/disable-legacy-port

feature/flag-to-disable-legacy-port

test/perftest

fix/http-redirect

poc-token-command

dn-reverse-proxy

prototype/reverse-proxy-rename

prototype/reverse-proxy-logs-pagination

feature/client-metrics

prototype/reverse-proxy-clusters

debug-dns-route

fix/win-dns-batch

add-extra-route-logs

job-stream-notify-disconnection-eof

deploy/secrets-manager

trigger-proxy-update

bug/update-ios-client-code-build-tags

sync-client-netmap-serial

log/conn-disconn

nmap/compaction-deploy

ci-win-test

feature/disk-encryption-check

wasm-debug

swap-dns-prio

fix/dex-config

feature/migrate-auto-groups-to-table

nmap/compaction

dex-nocgo-stub

feature/exclude-terraform-from-rate-limiting

test-freebsd

retries-refactor

coderabbitai/docstrings/b7e98ac

feat/integrate-zitadel

bug/ios-hanging-reconection

zitadel-idp

feat/network-map-serial

refactor/get-account-no-users

feat/auto-upgrade

feature/report-high-pat-id

feature/temporary-access-for-resource

fix/nmap-fwrules

dont-restart-dns

prototype/ui

update-gomobile

go-dns-for-ice

wasm-ldflags

test-ldflags

wasmbuild-test

feature/networks-s2s

vk/compare-nmaps

dbg/bothmaps

reorder-dns-shutdown

fix/relay-reconnection-race

fix/nmap-exitnodes

vk/debug/nmap-both

move-licensed-code

feat/better-daemon-connection-lost-message

feat/auto-update-2

test/timings

refactor/getaccount-raw

tests/nmap-getaccount

refactor/nmap

refactor/nmap-limit-buffer

feature/detect-mac-wakeup

feature/extract-modules

quick-setings

feat/sync-limiter

feature/store-cache-impl

fix-install-version

feature/store-metrics

feature/metrics-on-store

feature/use-gorm-cache

loadtest-signal

unsymmetrical-squash

refactor/reducate-signaling

test/update-reduce

feature/store-cache

feature/remote-debug

cli-ws-proxy-backend-addr

feat/mgmt-map-serial

snyk-fix-d9d0081a4c7f9137bdb59d0d50a141a2

snyk-fix-7415cea5a11acd66753540ca2c598c63

job-yml-update

feature/android-allow-selecting-routes

fix/up-sequence

fix/dns-hash-update

snyk-fix-967adae9863f17f108ce8948d9117b8d

log/getaccount-by-peer

signal-suppressor

dns-exit-node

feature/auto-updates

feature/cache-srv-key

merged-fixes

fix/missed-offers-and-debug

debug-and-fixes

poc-wasm-clean-backend-s2s

test/remote-debug

debug-api

fix/remove-gpo-if-empty

fix/test-freebsd

fix/mysql-setup

fix/remove-logout-btn

handle-existing-domain-user

chore/unify-domain-validation

snyk-fix-c5fafc8a50ce1f29046e25a1fc346185

feat/profile-edit-btn

snyk-fix-a54966211e18d4cf67e5a2757cc006d1

log-short-id

feat/logout-ephemeral

log-checks

batch-wg-ops

nb-interface-default

feat/aws-integration

add/race-test

feature/relay-feature-versioning

fix/systemd-service-logs

poc/preprocessed-map

add-account-onboarding

bind-ipv6

fix/merge-main

logs/peerlogs-addpeer

feature/net-297-network-migration

feature/support-skip-auto-apply-exit-node-routes

set-cmd

set-command-with-cursor

feature/limit-update-channel

stop-using-locking-share

feature/poc-lazy-detection

feature/net-248-removal-of-sync-mutex-locks

test/multiple-peer-logging

preresolve

add-ns-punnycode-support

apply-routes-early

windows-search-domains

fix/connecting-route-filter

feature/management/rest-client/impersonate

debug-local-records

resource-fields-snake-case

test/grpc-rate-limit

traffic-correlation-policy

feature/rest-client-options

feat/events-metrics

feature/buf-cli

test/add-ratelimiter

test/remove-write-lock-on-add-peer

fix/add-peer-semaphore

feature/users-roles-endpoint

mlsmaycon-patch-1

debug-user-role

chore/primary-key-on-networks

feature/update-account-peers-buffer-startup

remove-ubuntu2004-runners

refactor/permissions-no-pat-allowed

ref/logrus-factory

use-conntrack-zone

deploy/permissions-account

feature/lazy-connection-idle

ref/improve-test-cov

restore-pr-3440

test/increase-grpc-timeouts

feat/buffer-account-peers-update

test/networkmapgeneration-changes

feature/base-manager

feature/flow-receiver

chore/benchmark-with-large-runner

refactor/handshake-initiator

client/ui-update-systray-icons

userspace-router

wgwatcher-test

output-if-key-already-exists

fix/relay-reconnection

feature/port-forwarding-client-codecleaning

detached2

test/callbacks-nil-iceconninfo

refactor/optimize-peer-expiration

enable-udp-port-for-docker-template

fix/relay-update

feature/apply-posture-netmap

fix/group-update-existing-resource

conntrack-stats

upgrade-okta-sdk

multi-price

test/conn-stat

set-min-parallel-tests-for-management

dns-interceptor

debug-dns

router-dns

add-static-system-info

debug-0.29.4

debug-0.33.0

account-refactoring

relay/2800_quic

route-get-account-refactoring

test/seed-random-routes

feature/get-account-refactoring

test/reconnect-race-condition

refactor/get-account-usage

feature/add-session-id-to-update-channel

improve-ipv4conn

fix/async-pion-event-handling

debug

add-offload

feature/validate-group-association-debug

fix/limit-conn-for-sqlite

test/engine-iface

test/transaction-for-jwt-sync

fix/engine-stop-in-foreground

feature/add-mysql-support

test-migration

refactor/header-size-values

relay/eliminate-gob

test/signal-dispatcher-with-relay

relay/debug

validate-icon

feature/ipv6-support

use-pre-expanded-peers-map

feature/use-signal-dispatcher

validate/peer-status

add-read-write-times

fix/sync-peer-race

feature/relay-status

netmap

evaluate/network-map-hash

fix/lower-dns-resolve-interval-on-fail

feature/relay

fix/go-mod-version

upgrade-nftables

synology-userspace-mode

fix/use-ip-for-default-routes-on-darwin

fix/proxy_close

enable-release-workflow-on-pr

deploy/peer-performance

feature/permanent-turn

feature/permanent-turn-proxy

deploy/posture-check-sqlite

feature/optimize_sqlite_save

debug-ios-behavior

fix/delete-route-only-after-adding

tshoot/windows-logger

remove-new-routing

refactor/eliminate-repo-dependency

add-arm-to-ci

refactor-demo-account-object

test/abc2

test/abc

send-ssh-rosenpass-config-meta

refactor-demo

ensure-schedule-never-runs-non-positive

feature/peer-validator-groupmgm

feature/peer-validator-fix

fix/include-active-dashboard-users

fix/handle-canceling-schedule

fix/geo-download

debug-google-workspace

yury/resolve-ip-to-location

feature/extend-sysinfo

sqlite-async-peer-status

yury/add-postgresql-store

fix/route

test-build

posture-checks-poc

debug-keycloak-idp

poc/netstack

for-pascal-tmp

peer-logout-management

manual-peer-logout

detached

chore/refactor-management

test/dns-bind

fix/enforce-acl-for-containers

yury/use-sync-map-in-updatechannel

fix/events-key-handling

filter-cache-on-load-account

fix/user-expiration

handle-user-context-cancellation

nb-client-k8s-statefulset

fake-addr

fix/iptables_in_docker

ebpf-debug

update-getting-started-flow-use-postgres

fix/peer_list_notification

feature/device-authentication-with-client-secret

feature/keep_alive

feat-groups-from-jwt

separate_proxy_from_wgconfig

fix/wg_conn

wg_conn_fix

wg_bind_parallel_processing

fix-rollback-get-acls

proxy_cfg_cleanup

performance-improvement-rego

update-lock-log-level

feat-client-side-acl

refactor/move_grpcserver_logic_to_account_manager

feature/event-storage

feature/update-idp-redeeming-invite

feature/api-peer-info

return-groupminimum-setupkey

feature/interface-bind

documentation_enhancement

fix-peer-registration

ssh

users_cache

pass-client-caller

client_caller_type

revert-283-feat-fix-windows-installer

periodic-peer-updates

ebpf

braginini/wasm

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DYNR/netbird#11198