Turn "Commercial License" into a plain nav group and add an "Overview"
child pointing at /selfhosted/enterprise, above "Getting Started". This
matches the pattern already used by Networks, Cloud Marketplaces,
Observability, and Troubleshooting, where the section index page is
reachable as its own "Overview" link rather than only via the group
label.
The Wails 3 desktop app links GTK 4.10+ (GtkFileDialog) and WebKitGTK 6.0,
verified against the shipped v0.75.0 netbird-ui binary. The previously
documented floor of Debian 12 / Ubuntu 22.04 is below that: both ship
WebKitGTK 6.0 but only GTK 4.8 and 4.6, where the app starts and then
crashes on the first file dialog.
- Document the real floor per distribution and mark RHEL 9, Amazon Linux 2
and Amazon Linux 2023 as CLI only.
- Name the GTK 4 and WebKitGTK 6.0 packages in the install commands, since
netbird-ui does not declare them as dependencies.
- Note that EPEL provides webkitgtk6.0 on RHEL/AlmaLinux/Rocky 10.
- Remove libappindicator from the RPM install lines. The tray is a D-Bus
StatusNotifierItem and does not link libappindicator; keep the GNOME
extension step, which is still required for the tray to appear.
- Note that Linux netbird-ui packages are x86_64 only.
The NetBird iOS app can now collect a debug bundle from Settings ->
Troubleshoot. Update the iOS troubleshooting page to use it and route
reports to Community Support, or NetBird Support for paying customers.
Also reference the iOS method from the canonical Debug bundle section
and update the iOS card on the client troubleshooting hub.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* new: Windows GPO deployment guide under MDM for Deployment
* new: point GPO guide at the full policy key reference
* new: bold the example-posture disclaimer in GPO guide
* new: grammar and readability pass on GPO guide
* new: clarify AUTOSTART=0 vs Disable Autostart policy
* new: address review feedback on GPO guide install script and pinning
* docs: add geo-based exit node routing use case to exit nodes page
Full tunnel outside a country via a Country and Region posture check on a
0.0.0.0/0 Network resource's access policy; split tunnel inside. Warns
against the Peers-page exit node variant, where the posture check only
blocks traffic after the default route installs and in-country devices
lose internet. Lab-verified (lab-2026-07-22-geo-exit-node).
* docs: drop unverified route-appearance delay claim
* docs: revert unintended package-lock churn from local npm install
* docs: clarify why the Peers-page exit node cannot be posture-gated
* docs: compress the exit-node posture warning to one line
* docs: rename step 2 heading to Create the Network Resource
* docs: drop incorrect ICMP peer-policy requirement from geo use case
Verified live: with the resource access policy alone (peer policy to the
routing peer disabled), internet forwarding through the Networks exit
node keeps working. The ICMP-minimum note applies to network-routes
exit nodes, not the Networks resource path.
* docs: explain why match-ALL DNS matters in the geo use case
Without it a full-tunnel device leaks its location via DNS to the local
resolver (verified: zero port-53 packets on the tunnel until the
match-ALL nameserver is set); with it, split-tunnel devices reach the
same nameserver directly and keep resolving.
* docs: grammar and readability pass on the geo exit node section
* docs: refer to Routes instead of Peers page in the posture warning
* docs: state the example's goal explicitly before the setup groups
* docs: name the network after its location, the resource internet-egress
* docs: make the resource group optional in the geo use case
* docs: note the API marks the fields required, defaults are current behavior
* docs: name the GeoLite2 database and link self-hosted setup
* Add an Updating section to the pfSense install guide
Document upgrading in place: re-fetch the latest netbird and
pfSense-pkg-NetBird .pkg files from the latest GitHub release and re-run
pkg add -f on both (no pkg delete first, -f upgrades in place), then
netbird service restart and netbird status -d to verify. Matches the
Installation section's step style and the <RELEASE_TAG>/<VERSION>/<ARCH>
placeholders, and the Updating-before-Uninstallation layout used on the
Linux and Synology pages.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Point the pfSense upgrade step at the downloaded filenames
Mirror the Installation step wording so the pkg add commands use the
exact filenames downloaded from the release, which have independent
NetBird and pfSense package versions.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* docs: add Enterprise Commercial License overview page
Add a public, shareable overview of the NetBird Enterprise Commercial
License for teams evaluating self-hosted NetBird. Answers the questions
prospects ask most: in-place migration from the open source Community
Edition, zero-downtime control-plane upgrades via active-active HA,
control-plane behavior at scale, single-tenant boundaries and the
options for serving multiple customers, and how evaluation works.
Clarifies that the Cloud "Business plan" and the self-hosted commercial
license are different products, and lists what the license unlocks
(HA, SCIM, EDR/MDM integrations, traffic-flow logging, standard support).
Served at /selfhosted/enterprise and linked from the Self-Host sidebar.
* docs: qualify connection continuity by deployment topology
The single-server upgrade answer claimed all established connections
survive a restart. That holds only when Relay runs externally. In the
default combined deployment, netbird-server bundles Management, Signal,
and Relay, so recreating it restarts Relay and active relayed sessions
reconnect. Clarify that direct peer-to-peer connections continue either
way, while relayed-session continuity depends on whether Relay is
external or restarted with the combined server.
* docs: describe the commercial PoC as assisted, with 30-day default
"Managed proof of concept" overstated the offer. Per the EULA the
customer installs and runs the stack, with NetBird providing the license
and guidance, and a commercial PoC runs 30 days by default. Reword to
"assisted proof of concept" and state the default duration.
* Expand Issue 8 (NRPT lingering GPO) with GPO-hunt and source-side fixes
Enrich the Windows NRPT lingering-GPO troubleshooting with the deeper
diagnosis and remediation the issue needs: the DnsPolicyConfig registry
check, finding the responsible GPO (gpresult plus a SYSVOL registry.pol
scan), and the source-side fixes (the dummy-rule trick for an empty
lingering container, and guidance when a GPO carries real NRPT rules).
Heading and anchor are unchanged, so existing links keep resolving.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Replace em dash with a period in Issue 8 (house style)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Documentation for GRPC and JSON Sockets
* improve gRPC and HTTP/JSON socket documentation
* Update src/pages/client/grpc-socket.mdx
Co-authored-by: Nicolas Frati <nicofrati@gmail.com>
---------
Co-authored-by: Nicolas Frati <nicofrati@gmail.com>
Step 10 now asks customers to tell us which region their JumpCloud
console is in (US, EU, or India) along with the Client ID and Client
Secret, so the connector is configured against the right endpoint.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The "Policy exists but connection is still blocked" entry told readers to look
for "blocked due to posture" or "no matching policy" entries in Traffic Events.
Those entries do not exist: a failed posture check or group mismatch is resolved
on the management server and never produces a Traffic Event. Drop the bullet;
the remaining checks (policy and posture checks under Access Control, group
membership under Peers) are the accurate guidance.
* Reference the config-file bootstrap workflow from install and peer pages
Link Bootstrap peers via config file from the setup-key sections of the
Linux, Windows, macOS, and Docker install pages, from the Setup Keys
page, and from the Kubernetes routing-peers guide. The page was only
reachable from the sidebar, so this surfaces the unattended deployment
workflow where headless and at-scale enrollment is already discussed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Clarify the Kubernetes example demonstrates setup-key enrollment
The manifest passes a setup key but does not mount a pre-populated
config, so reword the cross-link: the example enrolls with a setup key,
and the bootstrap guide covers the additional config-file step.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Clarify in "Step 3b: Configure access control" that access restrictions
of different types (IP CIDR, country, CrowdSec) are combined with a
logical AND by default: a connection must satisfy all of them.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The per-browser export steps led each bold browser label with an em
dash. Switch to a colon so each bullet reads as a clean
label-then-instruction, consistent with the other bullet lists in the
docs. Wording is otherwise unchanged.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Document the two failure modes when the NetBird CLI SSO login can't bind
its loopback callback port on Windows: bind forbidden (WSAEACCES, port
inside a Hyper-V/winnat reserved range) and address in use
(WSAEADDRINUSE, a stale process). Note that the redirect port is a
configured, IdP-registered set (default 53000, often 54000), not a
single hardcoded value, and cover cases where AV/EDR or other software
blocks the bind invisibly.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Link the existing "WireGuard port conflict on Domain Controllers"
guidance (on /manage/dns/internal-dns-servers) from two pages a
troubleshooting-hub user could not previously reach it from:
- Windows client troubleshooting: a bullet under Windows DNS scenarios
for the "NetBird won't start on a DC" symptom.
- DNS troubleshooting: a note after the AD/DC issue, disambiguating the
client-running-on-the-DC case.
No content duplicated; both are pointers to the one existing section.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Surface the existing /manage/reverse-proxy/troubleshooting page in the
Troubleshooting section: add it to the Connectivity sidebar group, and
move its hub chip from the Self-hosted card to Connectivity & networking
so the hub and sidebar agree.
The page covers reaching services exposed through routing peers, which
is a connectivity concern rather than self-hosted control-plane infra.
No new page and no duplicated content: both are pointers to the one
existing page.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
New /help/recording-a-har-file how-to under Troubleshooting > Report a
bug, covering HAR capture in Chrome, Edge, Firefox, and Safari with the
"preserve log" gotcha and a security warning about tokens in HAR files.
Nest Community/NetBird Support under the Report a bug "Overview" item so
the new page reads as a sibling of the reporting cluster rather than a
fourth flat peer. Cross-link the HAR page from the two support pages and
the Report bugs overview, next to the existing debug-bundle mention.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* docs: lazy connections are no longer experimental
Lazy connections have graduated from experimental status. Remove the
"experimental" framing from the feature guide, the zero-trust use case,
and the CLI flag reference.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* remove outdated routing peer limitation
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Document the community.ansible_netbird collection for managing NetBird
resources (users, groups, setup keys, policies, networks, DNS, posture
checks) declaratively via the REST API. Adds a new Infrastructure as
Code subsection under Self-Host NetBird with room for future entries.
Cross-links from the Automated Setup PAT bootstrap page since the
collection is the natural next step after obtaining the first token.
* docs: add routing peer sizing guide
Add a Sizing Routing Peers page under Networks covering the four-step
sizing method, a per-peer capacity table, the tuning levers that matter,
and how to scale out by sharding load across identical Networks.
Cross-link it from How Routing Peers Work (HA note + related tile) and
the Networks overview, and add it to the docs navigation.
* docs: refine wording in routing peer sizing guide
Generalize the Acme example to remote users, correct the encrypt/decrypt
framing and reach the local network rather than the datacenter, use
'routing peer' instead of 'gateway', and rename the recap to Summary.
* docs: tighten and correct HA behavior in routing peer sizing guide
Correct the high-availability description: a single Network does not
balance load across its peers — different metrics give failover (one
peer carries all), equal metrics give latency-based nearest-peer
selection, which splits traffic by geography but never evenly. Shard
into more Networks to split load deterministically.
Also collapse redundant restatements, drop the secondary worked
example (the capacity table covers it), and slim the commodity-hardware
guidance.
* docs: add 1- and 2-vCPU rows to the routing peer capacity table
Extend the capacity table down to 1 and 2 vCPUs, drop the 'or more' from
the interface column, and adjust the methodology note so the interface
column reads uniformly as the minimum NIC to pair with each size.
* docs: add userspace WireGuard table and when-to-use cases
Add a userspace-mode capacity table showing wireguard-go does not scale
across cores (download plateaus ~6.8 Gbps, only ~4-5 cores used), and
the cases where a routing peer runs userspace: missing/broken/conflicting
kernel module, no TUN device (netstack, incl. rootless Docker), non-Linux
peers, and forcing userspace to capture policy IDs and blocked traffic
events. Name the exact benchmark CPU (Xeon Platinum 8375C).
* docs: replace 'sharding' with plain wording in sizing guide
Rename the Scaling out heading and reword the body, description, and
recap to talk about splitting load across more Networks instead of
sharding. Update the in-page anchor link to match the new heading.
* docs: clarify download/upload direction bullets in sizing guide
Lead each direction bullet with Download:/Upload: and say the routing
peer encrypts/decrypts, tying the pulling/pushing distinction to the
capacity table's column names.
* docs: replace 'shard' with plain wording in HA note
* docs: add jumbo frames section to routing peer sizing guide
* docs: align jumbo upload figure with capacity table, mark 16-vCPU line-rate as projection
* docs: use consistent numerals for MTU byte sizes
Adds the how-to under the reorganized /use-cases/remote-access group
(stacked on the Use Cases reorg). Walks through the decision ladder for
two sites sharing one internal IP, ending with the per-site TCP proxy
pattern on each routing peer.
* docs: consolidate scenario guides under /use-cases with redirects
Move 11 pages: feature-nested use cases from manage/networks,
manage/network-routes, manage/reverse-proxy, and the Kubernetes
integration into /use-cases/remote-access, /use-cases/cloud, and
/use-cases/security; the site-to-site decision page becomes
/use-cases/remote-access; the MikroTik guide becomes an install
guide at /get-started/install/mikrotik.
Add one redirect per moved page and flatten existing redirect
chains so every legacy URL resolves in a single hop. The
deprecated Routes site-to-site recipe stays put.
* docs: rebuild sidebar navigation for use-cases reorg
Remove the four nested Use Cases sublists from Manage NetBird;
keep the deprecated Routes recipe as a direct 'Site-to-Site
(legacy)' link. Rebuild USE CASES with Remote Access, Cloud &
Kubernetes, Security groups and a flat Homelab link. Add MikroTik
to Get Started > Platforms.
* docs: rebuild use-case index pages and refresh feature landing links
Turn /use-cases into an "I want to..." scenario finder. Retitle
the site-to-site decision page to Remote Access and point its
links at the new sibling URLs. Add the Kubernetes service and
private-proxy guides to the cloud and security indexes, refresh
the homelab landing links, and update the Networks, Routes,
Reverse Proxy, and Kubernetes landing pages to the new use-case
URLs.
* docs: update internal links to new use-case URLs
Point cross-links across the docs at the consolidated
/use-cases URLs. Links to the deprecated Routes site-to-site
recipe and all image paths under public/docs-static are left
unchanged.
* docs: shorten sidebar label to Site-to-Site
* docs: move Kubernetes into its own Use Cases section
Pull the entire Kubernetes integration out of Manage > Integrations
into a dedicated Kubernetes group under Use Cases at /use-cases/
kubernetes, and move the two Kubernetes cloud guides there too.
Rename the Cloud group (was 'Cloud & Kubernetes'); Integrations
keeps the MDM deployment pages. Add redirects for every moved page
and flatten existing chains.
* docs: drop 'NetBird on' prefix from cloud sidebar labels
* docs: alphabetize Remote Access use cases in sidebar
* ❯ add mikrotik to install index
* docs: fix duplicated word in remote-access link label on TV install pages
---------
Co-authored-by: Brandon Hopkins <brandon@techhut.tv>
