diff --git a/client/firewall/manager/forward_rule.go b/client/firewall/manager/forward_rule.go
index 5c2666596..aba277c12 100644
--- a/client/firewall/manager/forward_rule.go
+++ b/client/firewall/manager/forward_rule.go
@@ -2,14 +2,14 @@ package manager
 
 import (
 	"fmt"
-	"net"
+	"net/netip"
 )
 
 // ForwardRule todo figure out better place to this to avoid circular imports
 type ForwardRule struct {
 	Protocol          Protocol
 	DestinationPort   Port
-	TranslatedAddress net.IP
+	TranslatedAddress netip.Addr
 	TranslatedPort    Port
 }
 
diff --git a/client/internal/message_convert.go b/client/internal/message_convert.go
index 769d3159b..6141bcee6 100644
--- a/client/internal/message_convert.go
+++ b/client/internal/message_convert.go
@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"net/netip"
 
 	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
 	mgmProto "github.com/netbirdio/netbird/management/proto"
@@ -46,14 +47,18 @@ func convertPortInfo(portInfo *mgmProto.PortInfo) *firewallManager.Port {
 	return nil
 }
 
-func convertToIP(rawIP []byte) (net.IP, error) {
+func convertToIP(rawIP []byte) (netip.Addr, error) {
 	if rawIP == nil {
-		return nil, errors.New("input bytes cannot be nil")
+		return netip.Addr{}, errors.New("input bytes cannot be nil")
 	}
 
 	if len(rawIP) != net.IPv4len && len(rawIP) != net.IPv6len {
-		return nil, fmt.Errorf("invalid IP length: %d", len(rawIP))
+		return netip.Addr{}, fmt.Errorf("invalid IP length: %d", len(rawIP))
 	}
 
-	return rawIP, nil
+	if len(rawIP) == net.IPv4len {
+		return netip.AddrFrom4([4]byte(rawIP)), nil
+	}
+
+	return netip.AddrFrom16([16]byte(rawIP)), nil
 }