* docs: rebuild connecting-from-the-office on Networks
The page walked the legacy Network Routes flow: create a route, assign
distribution groups, and gate the routing-peer policy. Networks is the
current model, and there was no Networks version of this use case
anywhere in the docs.
Rewritten around the Networks building blocks: the posture check hangs
off the access policy whose destination is the office resource, so the
route is not distributed while the device is on site. Adds a limits
section (re-evaluation delay after a network change, ranges carry no
identity, platform coverage) and a summary. Drops the three legacy
route-UI screenshots.
* docs: Android reports local network addresses from 0.77.1
PR #7235 landed the Android side of PeerNetworkRange: the client now
parses local interface addresses from the host app's interface
discovery, so NetworkAddresses is no longer empty. First release
containing it is v0.77.1.
Scopes the known limitation to Android clients older than 0.77.1 and
leads with the fix, mirroring how the iOS 0.69.0 note reads. Also
matches the posture check name in the office guide to the screenshot.
* docs: correct client command, alt text and wording in the office guide
netbird routes is a deprecated alias; the command is netbird networks
list. Alt text now describes what each screenshot actually shows, and
the check name, Wi-Fi spelling and description line are consistent.
* docs: use documentation-only public ranges, scope the Android note in the Zero Trust guide
1.0.0.0/24 and 3.0.0.0/23 are allocated space and a reader can copy
them into a Block check, so the public-block examples now use RFC 5737
documentation ranges.
The Zero Trust guide still stated the Android limitation
unconditionally, which contradicted the posture check reference after
0.77.1.
* docs: tighten the office guide and the Android limitation
Scopes the intro claim to what the page's own screenshots show, stops
overstating what netbird networks list reports, restores the
platform-targeting bullet with Android 0.77.1 included, and leads the
Android section with the version scope so it reads correctly under
Known Limitations.
* docs: do not present macOS interface names as cross-platform
utun100 is the macOS default (client/iface/configurer/name_darwin.go);
wt0 is the default everywhere else. The verify section now names both
once, and the summary talks about the local link and the NetBird
interface instead of en0 and utun100.
* docs: add selective internal access behind an exit node use case
Documents the two-routing-peer architecture for combining an exit node
with access to specific internal resources only: a resource peer inside
the data center scoped by policies, and an exit node placed on a segment
with internet-only egress. Names the two shortcuts that do not achieve
this (Block LAN access only covers directly attached subnets; host
forward-chain firewall rules are superseded by NetBird's own allow
rules) and adds verification steps, including the netbird down
requirement when enabling Block LAN access over the CLI on a connected
peer. Cross-links from the routing peer concepts and from How Routing
Peers Work.
* docs: make the single-host example clearly outside the subnet resource
* docs: accept all blocked-connection results and scope the exit-node guarantee
* docs: vendor-neutral egress wording and verify bullet polish
* docs: state what actually happens with multiple separate exit nodes
Replaces the 'does not work: ... no coordinated selection' claim in
Regional Exit Nodes with the verified behavior: separate exit nodes
appear as independent choices in the device's exit node selector, the
client auto-selects the alphabetically first name (metrics and latency
play no part), and there is no failover between exit nodes - a device
whose selected exit node loses its routing peer keeps it selected and
loses internet entirely, even across reconnects. Adds the matching
non-overlapping-distribution-groups caveat to the per-group placement
advice, and aligns 'exit node entry' wording to plain 'exit node'.
* docs: scope multi-exit-node selection behavior to Auto Apply
* docs: deduplicate multi-exit-node caveats
* docs: state the one-auto-applied-exit-node-per-device rule
* docs: clarify Windows client updates need no user admin on the service path
The 'update needs admin' confusion comes from mixing two paths. Clarify both:
- auto-update: accepting a prompted update is installed by the NetBird
service (system privileges), not the logged-in user, so no admin rights
are needed. Only the manual download-link path is a per-machine install
that requires elevation.
- Windows install: silent install/upgrade needs an elevated (SYSTEM)
context, which RMM/MDM tools provide; a standard user gets 1625. Add an
Updating section: the same installer upgrades in place (no separate
update package), pushed via the same RMM/MDM tool; downgrades are blocked.
All claims lab-verified 2026-08-20 (WS2022, v0.76.0 -> v0.77.0).
* docs: qualify elevation context and warn install-only deploy jobs skip upgrades
- Not every deployment configuration runs as SYSTEM; a user-context job
fails with 1625. Say the job must run elevated.
- The GPO deployment script exits when NetBird is already installed, so it
is install-only. Warn that upgrades need an upgrade-capable job.
* docs: correct downgrade behavior per installer and address review on update section
The MSI (WiX MajorUpgrade) blocks downgrades; the NSIS EXE has no version
check and will downgrade. Stop teaching 1603 as a downgrade signature,
add same-installer-type guidance, service-restart warning, rollback path,
Automatic Updates version floors and Latest Version pinning conflict.
Match the page's EXE-first order and <VERSION> placeholder.
* docs: state Force Automatic Updates version scope (server and clients)
* docs: promote update section to top level and fix Automatic Updates note placement
Branch offices with strict egress policies need stable outbound rules
toward main locations. Documents pinning --wireguard-port per peer plus
a static DNAT at the main site, with the no-inbound trade-off stated
and scoped, and cross-links from Incoming ports and the relayed-
connections troubleshooting note.
Exit nodes previously lived only under Use Cases. Add them to the Routes
sidebar group and mention them on the Routes overview. Document that a
default route grants access to everything the routing peer can reach,
with Block LAN access and network isolation as mitigations, and link
How Routing Peers Work back to the exit nodes guide.
* docs: standardize on "NetBird client" over "agent" for the client software
* docs: address review feedback
- fix "a software" grammar and use lowercase "NetBird client"
- define routing peer as a peer whose client bridges, keeping peer and client distinct
- correct kernel-space claim: the kernel WireGuard data path is what runs in the kernel
- clarify which address the application uses to reach the SOCKS5 proxy from a separate container
* docs: add exit node enforcement section (Auto Apply + disableNetworks)
Adds 'Enforcing the Exit Node on Managed Devices' to the exit nodes
use-case page: the Auto Apply + disableNetworks recipe, the
deploy-before-users-touch-it ordering caveat, the disableUpdateSettings
mix-up, and the honest boundary (netbird down is not gated). Adds a
reciprocal note under the MDM page's key notes. Lab-verified on Linux
(service flag) and macOS (managed preferences + GUI) with client
v0.77.0.
* docs: use American English variant (afterwards -> afterward)
* docs: tighten enforcement wording (selection-scoped claim, page idiom)
* Improve CrowdSec setup, recovery, monitoring, and access-log documentation
* Refine CrowdSec dashboard recovery and access-log field documentation
* Image and API ref update
* Api ref fix
* Probe both api/.env
* docs: add QUIC UDP/443 relay transport to Ports & Firewalls
Add UDP/443 (QUIC) alongside TCP/443 (WebSocket) on the relay service
entry, list the current relay above the legacy TURN one, relabel the
TURN entry as legacy, and tighten its fallback note to lead with the
older-client case.
* docs: fix punctuation in relay IPv4 note
* Added needed account settings to the migration column and added more
dependencies.
* Export libpq when installing with homebrew.
* Update migrate-sqlite-to-postgresql.mdx
Add a "Updating Billing Information and Payment Method" section to the
Plans & Billing page covering the path from Settings > Plans & Billing >
Manage Plan into the Stripe billing portal, where users can change their
payment method and use "Update information" to edit company name, billing
address, billing email, and tax information.
Note that this is NetBird Cloud specific functionality — self-hosted
deployments are not billed through the Stripe billing portal.
* fix: correct ICE candidate field semantics in troubleshooting docs
The ICE candidate (Local/Remote) field shows the selected pair only, so
every relayed connection reads -/- on both peers, even when STUN worked
and srflx candidates were gathered (symmetric NAT case). Lab-verified on
client 0.76.3 against NetBird Cloud.
- relayed-connections: fix the relay/relay sample to -/-; reword the
candidate table (the '-' row named one cause for a symptom with two);
replace the 'weaker side' heuristic, which cannot work when both sides
show '-', with a client-log method that splits the two causes; mark
'relay' as the legacy TURN fallback path
- troubleshooting-client: replace the 0.27.4 status sample with 0.76.3
output (Direct/Routes fields are gone; Relay server address and
Networks exist now) and update the field explanations to match
* docs: show Networks line with routed subnet and exit node in status sample
Verified output: a client's status -d lists the routes a routing peer
serves it under that peer's block (Networks: 0.0.0.0/0, 10.0.0.0/24),
while the trailing summary Networks line stays '-' unless this device
routes something itself. Adds a Networks field explanation.
* docs: accuracy and readability pass on status field docs
- status sample: kernel WireGuard interface implies Linux, so the sample
host is linux/amd64 now
- clearer table cells (candidate pair, not connection; per-row P2P
implications) and untangled the log-reading sentence
- consistent phrasing in the Relay server address and Networks field
explanations
* docs: expand srflx and prflx abbreviations in the candidate table
srflx (server-reflexive) and prflx (peer-reflexive) were used without
ever being expanded anywhere in the help pages.
* docs: mark turn.netbird.io as fallback-only on Ports & Firewalls
Since v0.29.0 (relay integration, #2244) clients relay through
*.relay.netbird.io and contact TURN only when that relay is unreachable
or the remote peer runs an older client. The rule stays recommended as
the last relay path.
* docs: include bare relay.netbird.io in the fallback-only note
Clients bootstrap against relay.netbird.io before being assigned a
regional *.relay.netbird.io host, so both belong in the reference.
* docs: trim the keep-this-rule advice from the fallback note
* docs: call the TURN relay legacy in the fallback note
Matches the 'Legacy fallback' wording in the relayed-connections
candidate table.
* docs: srflx plus failed checks does not skip the firewall steps
A gathered srflx candidate proves STUN discovery only; the failed
connectivity checks can still be a host firewall or a destination-scoped
egress policy, so clear Steps 4-5 on both peers before concluding
symmetric NAT.
* docs: fix self-hosted SCIM Tenant URL and explain duplicate users
The embedded Entra SCIM page showed the NetBird Cloud Tenant URL
(api.netbird.io) on a self-hosted page; a reader who copies it points
Entra at Cloud and provisioning silently fails. Use the reader's own
management domain instead.
Add a section explaining why externalId must map to objectId: NetBird
matches users by stable ID, not email, so a mailNickname externalId
creates a same-email duplicate of an existing sign-in user. Includes
remediation for accounts that already have duplicates.
* docs: safer duplicate-user remediation via integration reset
Address review feedback: don't tell operators a SCIM-created account is safe
to delete based on origin alone. Recommend deleting the integration to clear
the synced accounts (sign-in accounts are untouched), then reconfiguring with
externalId=objectId and re-provisioning. If removing a single account, verify
ownership and migrate peers/access first.
TechHutTV
braginini
Jack Carter
Brandon Hopkins
Viktor Liu
netbirddev
PizzaLovingNerd
Arnd