[GH-ISSUE #1976] Linux Client fails to create iptables Masquerade rules in [Synology] #3748

New Issue

saavagebueno · 2026-08-05T00:54:05-04:00

saavagebueno commented

2026-08-05 00:54:05 -04:00

Originally created by @zzecool on GitHub (May 13, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/1976

Describe the problem

Running Native Linux Client version 0.27.5 in Synology.
The iptables version is :

iptables v1.8.3 (legacy): Couldn't load match comment':No such file or directory

and cant change.

The Client fails to address the Routes assigned to him either if it is network range or an exit node.
Dirty fix :

If i manual do :

sudo iptables -t nat -A POSTROUTING -o ovs_bond0 -d 192.168.1.0/24 -j MASQUERADE

I can have access to the 192.168.1.0/24 network

or

sudo iptables -t nat -A POSTROUTING -o ovs_bond0 -j MASQUERADE

If i want to make him an Exit node ( access to internet )

ovs_bond0 is my interface

Now for the FORWARD chain that the Native Client is tryhing to use, the Chain is doesnt exist, if i create it it fails on the next set of rules like this :

2024-05-13T17:12:11+03:00 ERRO client/firewall/create_linux.go:48: failed to create iptables manager: running [/sbin/iptables -t filter -C FORWARD -o wt0 -m mark --mark 0x000007e4 -j ACCEPT --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.

2024-05-13T17:12:11+03:00 ERRO client/internal/engine.go:315: failed creating firewall manager: running [/sbin/iptables -t filter -C FORWARD -o wt0 -m mark --mark 0x000007e4 -j ACCEPT --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory

Try `iptables -h' or 'iptables --help' for more information.

Not only that but there is a mechanism that deletes the FORWARD chain after a while. So maybe the proper appoach would be to check if iptables is iptables v1.8.3 (legacy) and the system is Synology and use the dirty way on the POSTROUTING chain that exists.

for identifying Synology you can use something like this :

# Check script is running on a Synology NAS
if ! /usr/bin/uname -a | grep -i synology >/dev/null; then
    echo "This script is NOT running on a Synology NAS!"
    echo "Copy the script to a folder on the Synology"
    echo "and run it from there."
    exit 1  # Not a Synology NAS
fi

# Get NAS model
model=$(cat /proc/sys/kernel/syno_hw_version)
#modelname="$model"

# Show script version
#echo -e "$script $scriptver\ngithub.com/$repo\n"
echo "$script $scriptver"

# Get DSM full version
productversion=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION productversion)
buildphase=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION buildphase)
buildnumber=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION buildnumber)
smallfixnumber=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION smallfixnumber)
majorversion=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION majorversion)
minorversion=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION minorversion)

# Show DSM full version and model
if [[ $buildphase == GM ]]; then buildphase=""; fi
if [[ $smallfixnumber -gt "0" ]]; then smallfix="-$smallfixnumber"; fi
echo -e "$model DSM $productversion-$buildnumber$smallfix $buildphase\n"

# Print all the results at the end
echo "Model: $model"
echo "DSM Full Version: $productversion-$buildnumber$smallfix $buildphase"
echo "Major Version: $majorversion"
echo "Minor Version: $minorversion"

Another hint is that WGeasy works out of the box even as docker ( bridge mode )

With the following rules :

$ sudo iptables -L -v -n --line-numbers | grep 172.17.0.22     #( wgeasy ip )

Chain DOCKER
43       0     0 ACCEPT     udp  --  !docker0 docker0  0.0.0.0/0            172.17.0.22          udp dpt:51820

sudo iptables -t nat -L | grep 172.17.0.22     #( wgeasy ip )

Chain DEFAULT_POSTROUTING
MASQUERADE  udp  --  172.17.0.22          172.17.0.22          udp dpt:51820
DNAT       udp  --  anywhere             anywhere             udp dpt:51820to:172.17.0.22:51820

Cause in the config we have : AllowedIPs = 0.0.0.0/0

That way client can decide what networks he will route to, as 0.0.0.0/0 is allowed.

Originally created by @zzecool on GitHub (May 13, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/1976 **Describe the problem** Running Native Linux Client version 0.27.5 in Synology. The iptables version is : `iptables v1.8.3 (legacy): Couldn't load match comment':No such file or directory` and cant change. ------------------------------------------------------------------------------------------------------------------- The Client fails to address the Routes assigned to him either if it is network range or an exit node. Dirty fix : If i manual do : `sudo iptables -t nat -A POSTROUTING -o ovs_bond0 -d 192.168.1.0/24 -j MASQUERADE` I can have access to the 192.168.1.0/24 network or `sudo iptables -t nat -A POSTROUTING -o ovs_bond0 -j MASQUERADE` If i want to make him an Exit node ( access to internet ) ovs_bond0 is my interface -------------------------------------------------------------------------------------------------------------------- Now for the FORWARD chain that the Native Client is tryhing to use, the Chain is doesnt exist, if i create it it fails on the next set of rules like this : ``` 2024-05-13T17:12:11+03:00 ERRO client/firewall/create_linux.go:48: failed to create iptables manager: running [/sbin/iptables -t filter -C FORWARD -o wt0 -m mark --mark 0x000007e4 -j ACCEPT --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory Try `iptables -h' or 'iptables --help' for more information. 2024-05-13T17:12:11+03:00 ERRO client/internal/engine.go:315: failed creating firewall manager: running [/sbin/iptables -t filter -C FORWARD -o wt0 -m mark --mark 0x000007e4 -j ACCEPT --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory Try `iptables -h' or 'iptables --help' for more information. ``` Not only that but there is a mechanism that deletes the FORWARD chain after a while. So maybe the proper appoach would be to check if iptables is iptables v1.8.3 (legacy) and the system is Synology and use the dirty way on the POSTROUTING chain that exists. for identifying Synology you can use something like this : ``` # Check script is running on a Synology NAS if ! /usr/bin/uname -a | grep -i synology >/dev/null; then echo "This script is NOT running on a Synology NAS!" echo "Copy the script to a folder on the Synology" echo "and run it from there." exit 1 # Not a Synology NAS fi # Get NAS model model=$(cat /proc/sys/kernel/syno_hw_version) #modelname="$model" # Show script version #echo -e "$script $scriptver\ngithub.com/$repo\n" echo "$script $scriptver" # Get DSM full version productversion=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION productversion) buildphase=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION buildphase) buildnumber=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION buildnumber) smallfixnumber=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION smallfixnumber) majorversion=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION majorversion) minorversion=$(/usr/syno/bin/synogetkeyvalue /etc.defaults/VERSION minorversion) # Show DSM full version and model if [[ $buildphase == GM ]]; then buildphase=""; fi if [[ $smallfixnumber -gt "0" ]]; then smallfix="-$smallfixnumber"; fi echo -e "$model DSM $productversion-$buildnumber$smallfix $buildphase\n" # Print all the results at the end echo "Model: $model" echo "DSM Full Version: $productversion-$buildnumber$smallfix $buildphase" echo "Major Version: $majorversion" echo "Minor Version: $minorversion" ``` Another hint is that WGeasy works out of the box even as docker ( bridge mode ) With the following rules : ``` $ sudo iptables -L -v -n --line-numbers | grep 172.17.0.22 #( wgeasy ip ) Chain DOCKER 43 0 0 ACCEPT udp -- !docker0 docker0 0.0.0.0/0 172.17.0.22 udp dpt:51820 ``` ``` sudo iptables -t nat -L | grep 172.17.0.22 #( wgeasy ip ) Chain DEFAULT_POSTROUTING MASQUERADE udp -- 172.17.0.22 172.17.0.22 udp dpt:51820 DNAT udp -- anywhere anywhere udp dpt:51820to:172.17.0.22:51820 ``` Cause in the config we have : AllowedIPs = 0.0.0.0/0 That way client can decide what networks he will route to, as 0.0.0.0/0 is allowed.

saavagebueno added the bug client waiting-feedback synology acl labels 2026-08-05 00:54:06 -04:00

saavagebueno closed this issue

2026-08-05 00:54:06 -04:00

saavagebueno commented

2026-08-05 00:54:06 -04:00

@zzecool commented on GitHub (May 21, 2024):

It will be best for a Dev to actually try SYnology on his self to verify everything related.

For that task he can easily use this : https://github.com/vdsm/virtual-dsm

This is a virtual Synology Server running isolated in Docker, so you can test anything you want about itables without any fear of breaking the machine.

You may hijack the mechanism that handles the iptables, or find other more clever way.

Fingers crossed.

@zzecool commented on GitHub (May 21, 2024): It will be best for a Dev to actually try SYnology on his self to verify everything related. For that task he can easily use this : https://github.com/vdsm/virtual-dsm This is a virtual Synology Server running isolated in Docker, so you can test anything you want about itables without any fear of breaking the machine. You may hijack the mechanism that handles the iptables, or find other more clever way. Fingers crossed.

saavagebueno commented

2026-08-05 00:54:06 -04:00

@mlsmaycon commented on GitHub (May 22, 2024):

Hello @zzecool thanks for reporting this issue and sharing the virtual dsm project. We will have a look at it and report soon.

@mlsmaycon commented on GitHub (May 22, 2024): Hello @zzecool thanks for reporting this issue and sharing the virtual dsm project. We will have a look at it and report soon.

saavagebueno commented

2026-08-05 00:54:06 -04:00

@mlsmaycon commented on GitHub (May 22, 2024):

Actually, can you confirm if it works on userspace mode too? see steps to enabled here: https://github.com/netbirdio/netbird/issues/1983#issuecomment-2125059066

@mlsmaycon commented on GitHub (May 22, 2024): Actually, can you confirm if it works on userspace mode too? see steps to enabled here: https://github.com/netbirdio/netbird/issues/1983#issuecomment-2125059066

saavagebueno commented

2026-08-05 00:54:06 -04:00

@zzecool commented on GitHub (May 22, 2024):

Hello @zzecool thanks for reporting this issue and sharing the virtual dsm project. We will have a look at it and report soon.

@mlsmaycon Yes that will be great. The underlying mechanism in Synology not only deleting the FORWARD chain, it flushes every rule that has been added manually not by using their GUI firewall rule. The think is that this tool is useless for our case as it doesnt support masquerade etc.

Lets hope for a clean solution but a dirty will also be acceptable.

@zzecool commented on GitHub (May 22, 2024): > Hello @zzecool thanks for reporting this issue and sharing the virtual dsm project. We will have a look at it and report soon. @mlsmaycon Yes that will be great. The underlying mechanism in Synology not only deleting the FORWARD chain, it flushes every rule that has been added manually not by using their GUI firewall rule. The think is that this tool is useless for our case as it doesnt support masquerade etc. Lets hope for a clean solution but a dirty will also be acceptable.

saavagebueno commented

2026-08-05 00:54:06 -04:00

@seehma commented on GitHub (Jun 18, 2024):

Hi, this ticket is now one month old. was there any progress? we also have a similar usecase and it would be cool to make it via our internal syno nas. regards m.

@seehma commented on GitHub (Jun 18, 2024): Hi, this ticket is now one month old. was there any progress? we also have a similar usecase and it would be cool to make it via our internal syno nas. regards m.

saavagebueno commented

2026-08-05 00:54:06 -04:00

@fear commented on GitHub (Jul 31, 2024):

+1 from me :). Having the same Problem

@fear commented on GitHub (Jul 31, 2024): +1 from me :). Having the same Problem

saavagebueno commented

2026-08-05 00:54:06 -04:00

@martijnw1986 commented on GitHub (Oct 11, 2024):

My Synology NAS is the only always-on Linux cliënt in my home. I've been pulling my hairs out for two days why I can't access my home network. I don't want to buy new hardware just because there's an issue with Netbird on Synology but if this doesn't get resolved, it seems like the only option.

@martijnw1986 commented on GitHub (Oct 11, 2024): My Synology NAS is the only always-on Linux cliënt in my home. I've been pulling my hairs out for two days why I can't access my home network. I don't want to buy new hardware just because there's an issue with Netbird on Synology but if this doesn't get resolved, it seems like the only option.

saavagebueno commented

2026-08-05 00:54:06 -04:00

@Christopher87R commented on GitHub (Nov 30, 2024):

Any update on this issue?
It seems that Nidbrid does not make any iptables entries at all.

@Christopher87R commented on GitHub (Nov 30, 2024): Any update on this issue? It seems that Nidbrid does not make any iptables entries at all.

saavagebueno commented

2026-08-05 00:54:06 -04:00

@nazarewk commented on GitHub (Apr 28, 2025):

Hello @zzecool,

We're currently reviewing our open issues and would like to verify if this problem still exists in the latest NetBird version.

Could you please confirm if the issue is still there?

We may close this issue temporarily if we don't hear back from you within 2 weeks, but feel free to reopen it with updated information.

Thanks for your contribution to improving the project!

@nazarewk commented on GitHub (Apr 28, 2025): Hello @zzecool, We're currently reviewing our open issues and would like to verify if this problem still exists in the [latest NetBird version](https://github.com/netbirdio/netbird/releases). Could you please confirm if the issue is still there? We may close this issue temporarily if we don't hear back from you within **2 weeks**, but feel free to reopen it with updated information. Thanks for your contribution to improving the project!

saavagebueno commented

2026-08-05 00:54:06 -04:00

@mlsmaycon commented on GitHub (Jun 1, 2025):

closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.

@mlsmaycon commented on GitHub (Jun 1, 2025): closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.

saavagebueno commented

2026-08-05 00:54:07 -04:00

@MarkSteadAus commented on GitHub (Oct 25, 2025):

I can confirm on the current version (0.59.8) NetBird does not create any iptables entries at all.
No packets are routed to/from the wt0 interface so communication is impossible.
It is using the userspace interface and the tun module is installed/active.

@MarkSteadAus commented on GitHub (Oct 25, 2025): I can confirm on the current version (0.59.8) NetBird does not create any iptables entries at all. No packets are routed to/from the wt0 interface so communication is impossible. It is using the userspace interface and the tun module is installed/active.

saavagebueno commented

2026-08-05 00:54:07 -04:00

@crazy-matt commented on GitHub (Dec 10, 2025):

@mlsmaycon I can confirm the issue is still there on v0.60.7. Found those logs:

2025-12-09T22:30:29Z INFO client/firewall/create_linux.go:70: creating an iptables firewall manager
2025-12-09T22:30:29Z WARN client/firewall/create_linux.go:49: failed to create native firewall: init firewall: router init: create containers: add static nat rules: add outbound masquerade rule: running [/sbin/iptables -t nat -A NETBIRD-RT-NAT -m mark --mark 0x1bd21 ! -o lo -j MASQUERADE --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
2025-12-10T07:01:02Z INFO client/internal/statemanager/manager.go:412: cleaning up state iptables_state
2025-12-10T07:01:36Z INFO client/firewall/create_linux.go:70: creating an iptables firewall manager
2025-12-10T07:01:36Z WARN client/firewall/create_linux.go:49: failed to create native firewall: init firewall: router init: create containers: add static nat rules: add outbound masquerade rule: running [/sbin/iptables -t nat -A NETBIRD-RT-NAT -m mark --mark 0x1bd21 ! -o lo -j MASQUERADE --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory
Try `iptables -h' or 'iptables --help' for more information.
2025-12-10T12:07:31Z INFO client/internal/statemanager/manager.go:412: cleaning up state iptables_state
2025-12-10T12:07:34Z INFO client/firewall/create_linux.go:70: creating an iptables firewall manager
2025-12-10T12:07:34Z WARN client/firewall/create_linux.go:49: failed to create native firewall: init firewall: router init: create containers: add static nat rules: add outbound masquerade rule: running [/sbin/iptables -t nat -A NETBIRD-RT-NAT -m mark --mark 0x1bd21 ! -o lo -j MASQUERADE --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory
Try `iptables -h' or 'iptables --help' for more information.

@crazy-matt commented on GitHub (Dec 10, 2025): @mlsmaycon I can confirm the issue is still there on v0.60.7. Found those logs: ``` 2025-12-09T22:30:29Z INFO client/firewall/create_linux.go:70: creating an iptables firewall manager 2025-12-09T22:30:29Z WARN client/firewall/create_linux.go:49: failed to create native firewall: init firewall: router init: create containers: add static nat rules: add outbound masquerade rule: running [/sbin/iptables -t nat -A NETBIRD-RT-NAT -m mark --mark 0x1bd21 ! -o lo -j MASQUERADE --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory Try `iptables -h' or 'iptables --help' for more information. 2025-12-10T07:01:02Z INFO client/internal/statemanager/manager.go:412: cleaning up state iptables_state 2025-12-10T07:01:36Z INFO client/firewall/create_linux.go:70: creating an iptables firewall manager 2025-12-10T07:01:36Z WARN client/firewall/create_linux.go:49: failed to create native firewall: init firewall: router init: create containers: add static nat rules: add outbound masquerade rule: running [/sbin/iptables -t nat -A NETBIRD-RT-NAT -m mark --mark 0x1bd21 ! -o lo -j MASQUERADE --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory Try `iptables -h' or 'iptables --help' for more information. 2025-12-10T12:07:31Z INFO client/internal/statemanager/manager.go:412: cleaning up state iptables_state 2025-12-10T12:07:34Z INFO client/firewall/create_linux.go:70: creating an iptables firewall manager 2025-12-10T12:07:34Z WARN client/firewall/create_linux.go:49: failed to create native firewall: init firewall: router init: create containers: add static nat rules: add outbound masquerade rule: running [/sbin/iptables -t nat -A NETBIRD-RT-NAT -m mark --mark 0x1bd21 ! -o lo -j MASQUERADE --wait]: exit status 2: iptables v1.8.3 (legacy): Couldn't load match `mark':No such file or directory Try `iptables -h' or 'iptables --help' for more information. ```

saavagebueno commented

2026-08-05 00:54:07 -04:00

@crazy-matt commented on GitHub (Dec 10, 2025):

For anyone finding this issue on a google search, extending the boot-up task documented here as below worked:

#!/bin/sh

TAG="Netbird Init"
log() {
  /usr/syno/bin/synologset1 sys "$1" 0x11100000 "$TAG: $2"
}

# Create the necessary file structure for /dev/net/tun
if [ ! -c /dev/net/tun ]; then
  if [ ! -d /dev/net ]; then
    mkdir -m 755 /dev/net
  fi
  mknod /dev/net/tun c 10 200
  chmod 0755 /dev/net/tun
fi

# Load the tun module if not already loaded
if ! lsmod | grep -q "^tun\s"; then
  insmod /lib/modules/tun.ko
  log info "tun module loaded"
fi

# Netbird workaround for missing libxt_mark.so
# Issue https://github.com/netbirdio/netbird/issues/1976
TIMEOUT=120
ELAPSED=0
INTERVAL=5
NETBIRD_CIDR="100.64.0.0/16"

while [ $ELAPSED -lt $TIMEOUT ]; do
  if ip link show wt0 >/dev/null 2>&1; then
    iptables -t nat -A POSTROUTING -s ${NETBIRD_CIDR} -o bond0 -j MASQUERADE
    log info "Netbird iptables rules applied successfully after ${ELAPSED}s"
    exit 0
  fi

  sleep $INTERVAL
  ELAPSED=$((ELAPSED + INTERVAL))
done

log warn "Netbird wt0 interface not found after ${TIMEOUT}s"
exit 1

@crazy-matt commented on GitHub (Dec 10, 2025): For anyone finding this issue on a google search, extending the boot-up task documented [here](https://docs.netbird.io/get-started/install/synology#reboot-script) as below worked: ``` #!/bin/sh TAG="Netbird Init" log() { /usr/syno/bin/synologset1 sys "$1" 0x11100000 "$TAG: $2" } # Create the necessary file structure for /dev/net/tun if [ ! -c /dev/net/tun ]; then if [ ! -d /dev/net ]; then mkdir -m 755 /dev/net fi mknod /dev/net/tun c 10 200 chmod 0755 /dev/net/tun fi # Load the tun module if not already loaded if ! lsmod | grep -q "^tun\s"; then insmod /lib/modules/tun.ko log info "tun module loaded" fi # Netbird workaround for missing libxt_mark.so # Issue https://github.com/netbirdio/netbird/issues/1976 TIMEOUT=120 ELAPSED=0 INTERVAL=5 NETBIRD_CIDR="100.64.0.0/16" while [ $ELAPSED -lt $TIMEOUT ]; do if ip link show wt0 >/dev/null 2>&1; then iptables -t nat -A POSTROUTING -s ${NETBIRD_CIDR} -o bond0 -j MASQUERADE log info "Netbird iptables rules applied successfully after ${ELAPSED}s" exit 0 fi sleep $INTERVAL ELAPSED=$((ELAPSED + INTERVAL)) done log warn "Netbird wt0 interface not found after ${TIMEOUT}s" exit 1 ```

saavagebueno referenced this issue

2026-08-05 01:12:48 -04:00

[GH-ISSUE #3748] Windows on ARM Native support #7391

saavagebueno referenced this issue

2026-08-05 01:14:40 -04:00

[GH-ISSUE #3748] Windows on ARM Native support #7809

saavagebueno referenced this issue

2026-08-05 01:15:20 -04:00

[GH-ISSUE #3748] Windows on ARM Native support #7943

Sign in to join this conversation.

Branches Tags

main

claude/agent-network-test-cases-p743vw

android/gui-integration

revert/component-types

feat-post_quantum_ml_kem

ice-stun-wg-demux

dependabot/npm_and_yarn/proxy/web/npm_and_yarn-b39864987c

agent-network-setup-poc

dependabot/go_modules/aws-sdk-8f849ebaed

dependabot/github_actions/actions-a940c7c866

dependabot/go_modules/otel-e34c790afd

dependabot/go_modules/testcontainers-de325c0dd6

dependabot/go_modules/wireguard-dbd6b95108

dependabot/go_modules/pion-5f703e1eca

dependabot/go_modules/gorm-2271c8195b

fix-login-needed-check

dependabot/go_modules/google.golang.org/grpc-1.82.1

fix/ui-gtk3-support

enterprise-traefik-and-migration-fixes

disambiguate_p2p_metrics

revert/component-types-hookup

embedded-vnc

feature/ios-ssh

docs/agent-network-docs-update

dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/s3-1.106.3

dependabot/go_modules/github.com/pion/stun/v3-3.1.5

fix-ssh-authorized-users-multi-rule

peer-acl-multi-source

reverse-proxy-crowdsec-appsec

reverse-proxy-allow-match-or

client-local-metrics

lazy-conn-per-peer

lazy-conn-rosenpass

dependabot/go_modules/github.com/gopacket/gopacket-1.7.0

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.6

dependabot/go_modules/github.com/pires/go-proxyproto-0.15.0

dependabot/go_modules/github.com/jackc/pgx/v5-5.10.0

dependabot/go_modules/github.com/oapi-codegen/runtime-1.6.0

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.4

dependabot/go_modules/github.com/pkg/sftp-1.13.11

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.20.0

ssh-windows-privilege-check

fix/explicit-cors-handling

fix/remove-math-rand

test/gui-memory-leak-fix

fix/ui-status-dispatch

install-script-ui-dependencies

fix/grpc-get-network-map

fix/subscribe-status-coalesce

fix/tray-menu-item-leak

fix/windows-tray-race

feature/changeset

worktree-dns-route-qtype-fallthrough

mdm_integration

mlsmaycon-patch-2

feat/agent-network-ollama

proxy-tunnel-cache-ttl-env

coderabbitai/utg/1e5b0a5

grpc-acl

test/battery-drain

components-impl-drop-indexes-use-xids-no-resource-policy-map

fix/nmap-relevant-groups

e2e-guardrail-blocks-unselected-model

fix/lazyconn-cold-start-allowed-ips

vertex-guardrails-model-access-e2e

add-atomic-cache-ops

refactor/relay-foreign-cache

ci/trigger-release-tests

feature/kimi-3-agent-networks-dns-warmup

feature/dns-lazy-conn-warmup

daemon-ipc-acl

feature/ui-translation-key-parity-check

refactor/relay-foreign-cache-tests

fix/lazyconn-idle-keep-wg-peer

dmitri-propagate-auth-grant-types-on-combined

0.74.7-branch

diagnose-empty-vs-corrupt-state

windows-sleep-detector

fix/cli-up-wait-for-daemon

rp_key_persistency

feature/native-grpc

0.74.6-branch

0.74.6-branch-sync

0.74.5-branch-sync

0.74.4-branch

fix/remove-stale-peers-removal

fix/remove-stale-proxy-logic

fix/nsis-preserve-autostart-on-upgrade

refactor/peer-event-bus

dependabot/go_modules/goauthentik.io/api/v3-3.2026050.3

dependabot/go_modules/github.com/pkg/sftp-1.13.10

components-impl-drop-indexes

fix-reset-aggregation-window-flake

dependabot/go_modules/github.com/pion/dtls/v3-3.1.5

0.74.x

fix/relay-states-lock

update-process-pkg

update-gopsutil-v4

fix/relay_states_lock

increase-sysinfo-timeout

dependabot/go_modules/github.com/Azure/go-ntlmssp-0.1.1

dependabot/go_modules/github.com/eko/gocache/store/redis/v4-4.2.6

dependabot/go_modules/github.com/eko/gocache/lib/v4-4.2.3

fix/fail-to-create-upnp-port-mapping-on-opnsense-firewall

0.74.3-branch

fix/routeselector-atomic-exit-node

netmap_progressive_alignment

nmap/components-impl

dependabot/go_modules/github.com/jackc/pgx/v5-5.9.2

dependabot/go_modules/github.com/oapi-codegen/runtime-1.4.2

dependabot/go_modules/github.com/gopacket/gopacket-1.6.1

dependabot/go_modules/github.com/coreos/go-oidc/v3-3.19.0

dependabot/go_modules/github.com/pires/go-proxyproto-0.12.0

fix/signal-watchdog-sync-stop

docs/agent-network

test/affected-logic

fix/revert-ice-filter

refactor/simplify-affected-peers

pascal-filter-policies-by-direction

claude/lock-contention-peer-connect-g8t6au

dmitri-filter-policies-by-direction

refactor/migrate-profiles-to-go

profile-bindings-ios

fix/skip-restart-unchanged-route

fix/mgmt-cache-async-resolve

refactor/wails-update-105

client_lifetime_serialization_refactor

fix/browser-ssh-2

fix/ipv6-and-netstack-accept-loop

fix/browser-ssh

profile-id-name-test

refactor/mgmt-bootstrap

feat/getting-started-unified-wizard

socket-grpc-permissions

fix/mysql-index-migration

windows-dns-firewall

tests/enable-race-on-tests

ui-refactor-gtk3

feature/affected-peers-grpc

profile-id

lazyconn-first-packet-fix-v2

claude/focused-gates-VMTgb

ui-tray-linux-leftclick

fix/ctx-enrichment

daemon-owner

feature/android-client-ssh

worktree-accept-ra-forwarding

nmap/combined-deploy

task/align_protobuff_toolset

feature/session-extend

add-json-yaml-flags

refactor/ephemeral-cleanup

claude/webtransport-relay-wasm-mUjY9

claude/vnc-udp-feasibility-6KB1U

fix/wgport-config

e2e-windows-dns-combined

fix/login-cmd-root-flags

feat/reseller-openapi-spec

github-issue-resolver

add-steamos-support

fix-darwin-uninstaller

flutter-test

ci/freebsd-pkg-bootstrap

cached-serial-check-on-sync

fix-mgmt-cache-bypass-overlay

revert-easyjson-5938

revert-ice-5820

revert-firewalld-5928

refactor/permissions-manager

revert-dns-5935-systemd-resolved

revert-dns-5935-5945

revert-dns-5945-mgmt-cache

feature/log-most-busy-peers

prototype/ui-wails

coderabbitai/utg/8ae8f20

feature/use-peer-fqdn-on-https

release/0.68.3

add-slack-channel

claude/rdp-token-passthrough-eNcqW

transparent-proxy

fix/macos-stale-route-eexist

crowdsec-selfhosted

fix/remove-otel-units

entire/checkpoints/v1

fix/getting-started

feat/static-connectors-combined-server

feature/use-local-keys-embedded

feature/fleetdm

set-env-only-if-not-fork

feature/expose-has-channel

fix/connection-status-race

fix/filter-cgnat-cni-ice-candidates

feature/check-cert-locker-before-acme

test/proxy-fixes

test/proxy-mtu

prototype/ui-tauri

test/proxy-speed

fix-reused-ports

feat/migrate-to-embedded-idp

feature/add-serial-to-proxy-merged

deploy/proxy-serial

test/connection

feature/disable-legacy-port

feature/flag-to-disable-legacy-port

test/perftest

fix/http-redirect

poc-token-command

dn-reverse-proxy

prototype/reverse-proxy-rename

prototype/reverse-proxy-logs-pagination

feature/client-metrics

prototype/reverse-proxy-clusters

debug-dns-route

fix/win-dns-batch

add-extra-route-logs

job-stream-notify-disconnection-eof

deploy/secrets-manager

trigger-proxy-update

bug/update-ios-client-code-build-tags

sync-client-netmap-serial

log/conn-disconn

nmap/compaction-deploy

ci-win-test

feature/disk-encryption-check

wasm-debug

swap-dns-prio

fix/dex-config

feature/migrate-auto-groups-to-table

nmap/compaction

dex-nocgo-stub

feature/exclude-terraform-from-rate-limiting

test-freebsd

retries-refactor

coderabbitai/docstrings/b7e98ac

feat/integrate-zitadel

bug/ios-hanging-reconection

zitadel-idp

feat/network-map-serial

refactor/get-account-no-users

feat/auto-upgrade

feature/report-high-pat-id

feature/temporary-access-for-resource

fix/nmap-fwrules

dont-restart-dns

prototype/ui

update-gomobile

go-dns-for-ice

wasm-ldflags

test-ldflags

wasmbuild-test

feature/networks-s2s

vk/compare-nmaps

dbg/bothmaps

reorder-dns-shutdown

fix/relay-reconnection-race

fix/nmap-exitnodes

vk/debug/nmap-both

move-licensed-code

feat/better-daemon-connection-lost-message

feat/auto-update-2

test/timings

refactor/getaccount-raw

tests/nmap-getaccount

refactor/nmap

refactor/nmap-limit-buffer

feature/detect-mac-wakeup

feature/extract-modules

quick-setings

feat/sync-limiter

feature/store-cache-impl

fix-install-version

feature/store-metrics

feature/metrics-on-store

feature/use-gorm-cache

loadtest-signal

unsymmetrical-squash

refactor/reducate-signaling

test/update-reduce

feature/store-cache

feature/remote-debug

cli-ws-proxy-backend-addr

feat/mgmt-map-serial

snyk-fix-d9d0081a4c7f9137bdb59d0d50a141a2

snyk-fix-7415cea5a11acd66753540ca2c598c63

job-yml-update

feature/android-allow-selecting-routes

fix/up-sequence

fix/dns-hash-update

snyk-fix-967adae9863f17f108ce8948d9117b8d

log/getaccount-by-peer

signal-suppressor

dns-exit-node

feature/auto-updates

feature/cache-srv-key

merged-fixes

fix/missed-offers-and-debug

debug-and-fixes

poc-wasm-clean-backend-s2s

test/remote-debug

debug-api

fix/remove-gpo-if-empty

fix/test-freebsd

fix/mysql-setup

fix/remove-logout-btn

handle-existing-domain-user

chore/unify-domain-validation

snyk-fix-c5fafc8a50ce1f29046e25a1fc346185

feat/profile-edit-btn

snyk-fix-a54966211e18d4cf67e5a2757cc006d1

log-short-id

feat/logout-ephemeral

log-checks

batch-wg-ops

nb-interface-default

feat/aws-integration

add/race-test

feature/relay-feature-versioning

fix/systemd-service-logs

poc/preprocessed-map

add-account-onboarding

bind-ipv6

fix/merge-main

logs/peerlogs-addpeer

feature/net-297-network-migration

feature/support-skip-auto-apply-exit-node-routes

set-cmd

set-command-with-cursor

feature/limit-update-channel

stop-using-locking-share

feature/poc-lazy-detection

feature/net-248-removal-of-sync-mutex-locks

test/multiple-peer-logging

preresolve

add-ns-punnycode-support

apply-routes-early

windows-search-domains

fix/connecting-route-filter

feature/management/rest-client/impersonate

debug-local-records

resource-fields-snake-case

test/grpc-rate-limit

traffic-correlation-policy

feature/rest-client-options

feat/events-metrics

feature/buf-cli

test/add-ratelimiter

test/remove-write-lock-on-add-peer

fix/add-peer-semaphore

feature/users-roles-endpoint

mlsmaycon-patch-1

debug-user-role

chore/primary-key-on-networks

feature/update-account-peers-buffer-startup

remove-ubuntu2004-runners

refactor/permissions-no-pat-allowed

ref/logrus-factory

use-conntrack-zone

deploy/permissions-account

feature/lazy-connection-idle

ref/improve-test-cov

restore-pr-3440

test/increase-grpc-timeouts

feat/buffer-account-peers-update

test/networkmapgeneration-changes

feature/base-manager

feature/flow-receiver

chore/benchmark-with-large-runner

refactor/handshake-initiator

client/ui-update-systray-icons

userspace-router

wgwatcher-test

output-if-key-already-exists

fix/relay-reconnection

feature/port-forwarding-client-codecleaning

detached2

test/callbacks-nil-iceconninfo

refactor/optimize-peer-expiration

enable-udp-port-for-docker-template

fix/relay-update

feature/apply-posture-netmap

fix/group-update-existing-resource

conntrack-stats

upgrade-okta-sdk

multi-price

test/conn-stat

set-min-parallel-tests-for-management

dns-interceptor

debug-dns

router-dns

add-static-system-info

debug-0.29.4

debug-0.33.0

account-refactoring

relay/2800_quic

route-get-account-refactoring

test/seed-random-routes

feature/get-account-refactoring

test/reconnect-race-condition

refactor/get-account-usage

feature/add-session-id-to-update-channel

improve-ipv4conn

fix/async-pion-event-handling

debug

add-offload

feature/validate-group-association-debug

fix/limit-conn-for-sqlite

test/engine-iface

test/transaction-for-jwt-sync

fix/engine-stop-in-foreground

feature/add-mysql-support

test-migration

refactor/header-size-values

relay/eliminate-gob

test/signal-dispatcher-with-relay

relay/debug

validate-icon

feature/ipv6-support

use-pre-expanded-peers-map

feature/use-signal-dispatcher

validate/peer-status

add-read-write-times

fix/sync-peer-race

feature/relay-status

netmap

evaluate/network-map-hash

fix/lower-dns-resolve-interval-on-fail

feature/relay

fix/go-mod-version

upgrade-nftables

synology-userspace-mode

fix/use-ip-for-default-routes-on-darwin

fix/proxy_close

enable-release-workflow-on-pr

deploy/peer-performance

feature/permanent-turn

feature/permanent-turn-proxy

deploy/posture-check-sqlite

feature/optimize_sqlite_save

debug-ios-behavior

fix/delete-route-only-after-adding

tshoot/windows-logger

remove-new-routing

refactor/eliminate-repo-dependency

add-arm-to-ci

refactor-demo-account-object

test/abc2

test/abc

send-ssh-rosenpass-config-meta

refactor-demo

ensure-schedule-never-runs-non-positive

feature/peer-validator-groupmgm

feature/peer-validator-fix

fix/include-active-dashboard-users

fix/handle-canceling-schedule

fix/geo-download

debug-google-workspace

yury/resolve-ip-to-location

feature/extend-sysinfo

sqlite-async-peer-status

yury/add-postgresql-store

fix/route

test-build

posture-checks-poc

debug-keycloak-idp

poc/netstack

for-pascal-tmp

peer-logout-management

manual-peer-logout

detached

chore/refactor-management

test/dns-bind

fix/enforce-acl-for-containers

yury/use-sync-map-in-updatechannel

fix/events-key-handling

filter-cache-on-load-account

fix/user-expiration

handle-user-context-cancellation

nb-client-k8s-statefulset

fake-addr

fix/iptables_in_docker

ebpf-debug

update-getting-started-flow-use-postgres

fix/peer_list_notification

feature/device-authentication-with-client-secret

feature/keep_alive

feat-groups-from-jwt

separate_proxy_from_wgconfig

fix/wg_conn

wg_conn_fix

wg_bind_parallel_processing

fix-rollback-get-acls

proxy_cfg_cleanup

performance-improvement-rego

update-lock-log-level

feat-client-side-acl

refactor/move_grpcserver_logic_to_account_manager

feature/event-storage

feature/update-idp-redeeming-invite

feature/api-peer-info

return-groupminimum-setupkey

feature/interface-bind

documentation_enhancement

fix-peer-registration

ssh

users_cache

pass-client-caller

client_caller_type

revert-283-feat-fix-windows-installer

periodic-peer-updates

ebpf

braginini/wasm

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: DYNR/netbird#3748