Merge branch 'main' into profile-ownership

.github/workflows/wasm-build-validation.yml

@@ -66,7 +66,7 @@ jobs:
 
           echo "Size: ${SIZE} bytes (${SIZE_MB} MB)"
 
-          if [ ${SIZE} -gt 62914560 ]; then
+          if [ ${SIZE} -gt 73400320 ]; then
-            echo "Wasm binary size (${SIZE_MB}MB) exceeds 60MB limit!"
+            echo "Wasm binary size (${SIZE_MB}MB) exceeds 70MB limit!"
             exit 1
           fi

client/embed/embed.go

@@ -12,11 +12,10 @@ import (
 	"sync"
 
 	"github.com/sirupsen/logrus"
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	wgnetstack "golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
@@ -256,10 +255,10 @@ func New(opts Options) (*Client, error) {
 	}
 
 	if opts.Performance.PreallocatedBuffersPerPool != nil {
-		wgdevice.SetPreallocatedBuffersPerPool(*opts.Performance.PreallocatedBuffersPerPool)
+		wgbackend.SetPreallocatedBuffersPerPool(*opts.Performance.PreallocatedBuffersPerPool)
 	}
 	if opts.Performance.MaxBatchSize != nil {
-		wgdevice.SetMaxBatchSizeOverride(*opts.Performance.MaxBatchSize)
+		wgbackend.SetMaxBatchSizeOverride(*opts.Performance.MaxBatchSize)
 	}
 
 	return &Client{
@@ -651,7 +650,7 @@ func (c *Client) getEngine() (*internal.Engine, error) {
 	return engine, nil
 }
 
-func (c *Client) getNet() (*wgnetstack.Net, netip.Addr, error) {
+func (c *Client) getNet() (*wgbackend.NetstackNet, netip.Addr, error) {
 	engine, err := c.getEngine()
 	if err != nil {
 		return nil, netip.Addr{}, err

client/firewall/iface.go

@@ -1,10 +1,9 @@
 package firewall
 
 import (
-	wgdevice "golang.zx2c4.com/wireguard/device"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // EnvForceUserspaceFirewall forces the use of the userspace packet filter even when
@@ -20,5 +19,5 @@ type IFaceMapper interface {
 	IsUserspaceBind() bool
 	SetFilter(device.PacketFilter) error
 	GetDevice() *device.FilteredDevice
-	GetWGDevice() *wgdevice.Device
+	GetWGDevice() *wgbackend.Device
 }

client/firewall/uspfilter/filter.go

@@ -19,7 +19,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/firewall/firewalld"
@@ -31,6 +30,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbid "github.com/netbirdio/netbird/client/internal/acl/id"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
@@ -121,7 +121,7 @@ type Iface interface {
 	Name() string
 	Address() wgaddr.Address
 	SetFilter(device.PacketFilter) error
-	GetWGDevice() *wgdevice.Device
+	GetWGDevice() *wgbackend.Device
 }
 
 // InterfaceAllower opens the NetBird interface in the host firewall so it

client/firewall/uspfilter/filter_filter_test.go

@@ -5,17 +5,17 @@ import (
 	"net/netip"
 	"testing"
 
-	"go.uber.org/mock/gomock"
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
+	"go.uber.org/mock/gomock"
 
 	fw "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/mocks"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
@@ -791,10 +791,10 @@ func setupRoutedManager(tb testing.TB, network string) *Manager {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 

client/firewall/uspfilter/filter_routeacl_test.go

@@ -4,17 +4,17 @@ import (
 	"net/netip"
 	"testing"
 
-	"go.uber.org/mock/gomock"
 	"github.com/google/gopacket/layers"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
+	"go.uber.org/mock/gomock"
 
 	fw "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/mocks"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // TestAddRouteFilteringReturnsExistingRule verifies that adding the same route
@@ -180,10 +180,10 @@ func TestBlockInvalidRoutedDualStack(t *testing.T) {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 
@@ -228,10 +228,10 @@ func TestBlockInvalidRoutedIdempotent(t *testing.T) {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 
@@ -291,10 +291,10 @@ func TestBlockRuleNotAccumulatedOnRepeatedEnableRouting(t *testing.T) {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 
@@ -410,10 +410,10 @@ func setupTestManager(t *testing.T) *Manager {
 			}
 		},
 		GetDeviceFunc: func() *device.FilteredDevice {
-			return &device.FilteredDevice{Device: dev}
+			return &device.FilteredDevice{TUN: dev}
 		},
-		GetWGDeviceFunc: func() *wgdevice.Device {
+		GetWGDeviceFunc: func() *wgbackend.Device {
-			return &wgdevice.Device{}
+			return &wgbackend.Device{}
 		},
 	}
 

client/firewall/uspfilter/filter_test.go

@@ -14,7 +14,6 @@ import (
 	"github.com/sirupsen/logrus"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	fw "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
@@ -22,6 +21,7 @@ import (
 	nbiface "github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/netflow"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -34,7 +34,7 @@ type IFaceMock struct {
 	NameFunc        func() string
 	SetFilterFunc   func(device.PacketFilter) error
 	AddressFunc     func() wgaddr.Address
-	GetWGDeviceFunc func() *wgdevice.Device
+	GetWGDeviceFunc func() *wgbackend.Device
 	GetDeviceFunc   func() *device.FilteredDevice
 }
 
@@ -45,7 +45,7 @@ func (i *IFaceMock) Name() string {
 	return i.NameFunc()
 }
 
-func (i *IFaceMock) GetWGDevice() *wgdevice.Device {
+func (i *IFaceMock) GetWGDevice() *wgbackend.Device {
 	if i.GetWGDeviceFunc == nil {
 		return nil
 	}

client/firewall/uspfilter/forwarder/endpoint.go

@@ -5,12 +5,12 @@ import (
 	"strconv"
 	"sync/atomic"
 
-	wgdevice "golang.zx2c4.com/wireguard/device"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 
 	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // PacketCapture captures raw packets for debugging. Implementations must be
@@ -23,7 +23,7 @@ type PacketCapture interface {
 type endpoint struct {
 	logger     *nblog.Logger
 	dispatcher stack.NetworkDispatcher
-	device     *wgdevice.Device
+	device     *wgbackend.Device
 	mtu        atomic.Uint32
 	capture    atomic.Pointer[PacketCapture]
 }

client/firewall/uspfilter/forwarder/forwarder.go

@@ -12,7 +12,6 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
@@ -26,6 +25,7 @@ import (
 	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
 	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 )
 
@@ -43,7 +43,7 @@ const (
 
 // IFace provides the WireGuard device and overlay addresses the forwarder needs.
 type IFace interface {
-	GetWGDevice() *wgdevice.Device
+	GetWGDevice() *wgbackend.Device
 	Address() wgaddr.Address
 }
 

client/iface/bind/control.go

@@ -1,8 +1,7 @@
 package bind
 
 import (
-	wireguard "golang.zx2c4.com/wireguard/conn"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
-
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
@@ -10,6 +9,6 @@ import (
 func init() {
 	listener := nbnet.NewListener()
 	if listener.ListenConfig.Control != nil {
-		*wireguard.ControlFns = append(*wireguard.ControlFns, listener.ListenConfig.Control)
+		*wgbackend.ControlFns = append(*wgbackend.ControlFns, listener.ListenConfig.Control)
 	}
 }

client/iface/bind/endpoint.go

@@ -3,10 +3,10 @@ package bind
 import (
 	"net"
 
-	wgConn "golang.zx2c4.com/wireguard/conn"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
-type Endpoint = wgConn.StdNetEndpoint
+type Endpoint = wgbackend.StdNetEndpoint
 
 func EndpointToUDPAddr(e Endpoint) *net.UDPAddr {
 	return &net.UDPAddr{

client/iface/bind/ice_bind.go

@@ -15,10 +15,10 @@ import (
 	"github.com/pion/transport/v3"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/net/ipv6"
-	wgConn "golang.zx2c4.com/wireguard/conn"
 
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
@@ -36,7 +36,7 @@ type receiverCreator struct {
 	iceBind *ICEBind
 }
 
-func (rc receiverCreator) CreateReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxOffload bool, msgPool *sync.Pool) wgConn.ReceiveFunc {
+func (rc receiverCreator) CreateReceiverFn(pc wgbackend.BatchReader, conn *net.UDPConn, rxOffload bool, msgPool *sync.Pool) wgbackend.ReceiveFunc {
 	return rc.iceBind.createReceiverFn(pc, conn, rxOffload, msgPool)
 }
 
@@ -48,7 +48,7 @@ func (rc receiverCreator) CreateReceiverFn(pc wgConn.BatchReader, conn *net.UDPC
 // without port, in the format of 127.1.x.x where x.x is the last two octets of the peer address. We try to avoid to
 // use the port because in the Send function the wgConn.Endpoint the port info is not exported.
 type ICEBind struct {
-	*wgConn.StdNetBind
+	*wgbackend.StdNetBind
 
 	transportNet transport.Net
 	address      wgaddr.Address
@@ -74,7 +74,7 @@ type ICEBind struct {
 }
 
 func NewICEBind(transportNet transport.Net, address wgaddr.Address, mtu uint16) *ICEBind {
-	b, _ := wgConn.NewStdNetBind().(*wgConn.StdNetBind)
+	b, _ := wgbackend.NewStdNetBind().(*wgbackend.StdNetBind)
 	ib := &ICEBind{
 		StdNetBind:       b,
 		transportNet:     transportNet,
@@ -90,11 +90,11 @@ func NewICEBind(transportNet transport.Net, address wgaddr.Address, mtu uint16)
 	rc := receiverCreator{
 		ib,
 	}
-	ib.StdNetBind = wgConn.NewStdNetBindWithReceiverCreator(rc)
+	ib.StdNetBind = wgbackend.NewStdNetBindWithReceiverCreator(rc)
 	return ib
 }
 
-func (s *ICEBind) Open(uport uint16) ([]wgConn.ReceiveFunc, uint16, error) {
+func (s *ICEBind) Open(uport uint16) ([]wgbackend.ReceiveFunc, uint16, error) {
 	s.closedChanMu.Lock()
 	defer s.closedChanMu.Unlock()
 
@@ -190,7 +190,7 @@ func (b *ICEBind) ReceiveFromEndpoint(ctx context.Context, ep *Endpoint, buf []b
 	}
 }
 
-func (b *ICEBind) Send(bufs [][]byte, ep wgConn.Endpoint) error {
+func (b *ICEBind) Send(bufs [][]byte, ep wgbackend.Endpoint) error {
 	b.endpointsMu.Lock()
 	conn, ok := b.endpoints[ep.DstIP()]
 	b.endpointsMu.Unlock()
@@ -206,7 +206,7 @@ func (b *ICEBind) Send(bufs [][]byte, ep wgConn.Endpoint) error {
 	return nil
 }
 
-func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxOffload bool, msgsPool *sync.Pool) wgConn.ReceiveFunc {
+func (s *ICEBind) createReceiverFn(pc wgbackend.BatchReader, conn *net.UDPConn, rxOffload bool, msgsPool *sync.Pool) wgbackend.ReceiveFunc {
 	s.muUDPMux.Lock()
 	defer s.muUDPMux.Unlock()
 
@@ -218,7 +218,7 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 	}
 	s.createOrUpdateMux()
 
-	return func(bufs [][]byte, sizes []int, eps []wgConn.Endpoint) (n int, err error) {
+	return func(bufs [][]byte, sizes []int, eps []wgbackend.Endpoint) (n int, err error) {
 		msgs := getMessages(msgsPool)
 		for i := range bufs {
 			(*msgs)[i].Buffers[0] = bufs[i]
@@ -229,13 +229,13 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 		var numMsgs int
 		if runtime.GOOS == "linux" || runtime.GOOS == "android" {
 			if rxOffload {
-				readAt := len(*msgs) - (wgConn.IdealBatchSize / wgConn.UdpSegmentMaxDatagrams)
+				readAt := len(*msgs) - (wgbackend.IdealBatchSize / wgbackend.UdpSegmentMaxDatagrams)
 				//nolint:staticcheck
 				_, err = pc.ReadBatch((*msgs)[readAt:], 0)
 				if err != nil {
 					return 0, err
 				}
-				numMsgs, err = wgConn.SplitCoalescedMessages(*msgs, readAt, wgConn.GetGSOSize)
+				numMsgs, err = wgbackend.SplitCoalescedMessages(*msgs, readAt, wgbackend.GetGSOSize)
 				if err != nil {
 					return 0, err
 				}
@@ -278,8 +278,8 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 				s.activityRecorder.record(addrPort)
 			}
 
-			ep := &wgConn.StdNetEndpoint{AddrPort: addrPort} // TODO: remove allocation
+			ep := &wgbackend.StdNetEndpoint{AddrPort: addrPort} // TODO: remove allocation
-			wgConn.GetSrcFromControl(msg.OOB[:msg.NN], ep)
+			wgbackend.GetSrcFromControl(msg.OOB[:msg.NN], ep)
 			eps[i] = ep
 		}
 		return numMsgs, nil
@@ -363,7 +363,7 @@ func (s *ICEBind) parseSTUNMessage(raw []byte) (*stun.Message, error) {
 
 // receiveRelayed is a receive function that is used to receive packets from the relayed connection and forward to the
 // WireGuard. Critical part is do not block if the Closed() has been called.
-func (c *ICEBind) receiveRelayed(buffs [][]byte, sizes []int, eps []wgConn.Endpoint) (int, error) {
+func (c *ICEBind) receiveRelayed(buffs [][]byte, sizes []int, eps []wgbackend.Endpoint) (int, error) {
 	closedChan := c.currentClosedChan()
 
 	select {
@@ -375,7 +375,7 @@ func (c *ICEBind) receiveRelayed(buffs [][]byte, sizes []int, eps []wgConn.Endpo
 		}
 		copy(buffs[0], msg.Buffer)
 		sizes[0] = len(msg.Buffer)
-		eps[0] = wgConn.Endpoint(msg.Endpoint)
+		eps[0] = wgbackend.Endpoint(msg.Endpoint)
 
 		if isTransportPkg(buffs, sizes[0]) {
 			if ep, ok := eps[0].(*Endpoint); ok {

client/iface/bind/ice_bind_close_test.go

@@ -6,7 +6,8 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/require"
-	wgConn "golang.zx2c4.com/wireguard/conn"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // startReceivers runs every receive function the way wireguard-go's device
@@ -14,7 +15,7 @@ import (
 // calling Bind.Close, closeBindLocked waits on exactly that WaitGroup while
 // holding device.net, so a receive function that never returns wedges the
 // device and every goroutine that needs the same lock.
-func startReceivers(fns []wgConn.ReceiveFunc) *sync.WaitGroup {
+func startReceivers(fns []wgbackend.ReceiveFunc) *sync.WaitGroup {
 	wg, _ := startReceiversEntered(fns)
 	return wg
 }
@@ -23,18 +24,18 @@ func startReceivers(fns []wgConn.ReceiveFunc) *sync.WaitGroup {
 // function has been called at least once. A receive function that has been
 // entered is either inside its blocking receive or about to be, which is a
 // stronger signal to synchronise on than a bare sleep.
-func startReceiversEntered(fns []wgConn.ReceiveFunc) (*sync.WaitGroup, <-chan struct{}) {
+func startReceiversEntered(fns []wgbackend.ReceiveFunc) (*sync.WaitGroup, <-chan struct{}) {
 	var wg sync.WaitGroup
 	var entered sync.WaitGroup
 	wg.Add(len(fns))
 	entered.Add(len(fns))
 
 	for i := range fns {
-		go func(fn wgConn.ReceiveFunc) {
+		go func(fn wgbackend.ReceiveFunc) {
 			defer wg.Done()
 			buffs := [][]byte{make([]byte, 1500)}
 			sizes := make([]int, 1)
-			eps := make([]wgConn.Endpoint, 1)
+			eps := make([]wgbackend.Endpoint, 1)
 			first := true
 			for {
 				if first {

client/iface/bind/ice_bind_test.go

@@ -16,10 +16,9 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/ipv4"
 	"golang.org/x/net/ipv6"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 func TestICEBind_CreatesReceiverForBothIPv4AndIPv6(t *testing.T) {
@@ -370,16 +369,16 @@ func TestICEBind_OpenDoesNotDiscoverInterfaces(t *testing.T) {
 }
 
 func TestICEBind_DeviceUpDoesNotWaitOnInterfaceDiscovery(t *testing.T) {
-	tunDev, _, err := netstack.CreateNetTUN([]netip.Addr{netip.MustParseAddr("100.64.0.1")}, nil, 1280)
+	tunDev, _, err := wgbackend.CreateNetTUN([]netip.Addr{netip.MustParseAddr("100.64.0.1")}, nil, 1280)
 	require.NoError(t, err)
 
-	var dev *device.Device
+	var dev *wgbackend.Device
 	n := newCountingNet()
 	n.before = func() {
 		_ = dev.IpcGetOperation(io.Discard)
 	}
 	iceBind := NewICEBind(n, testAddress(), 1280)
-	dev = device.NewDevice(tunDev, iceBind, device.NewLogger(device.LogLevelSilent, ""))
+	dev = wgbackend.NewDevice(tunDev, iceBind, wgbackend.NewLogger(wgbackend.LogLevelSilent, ""))
 
 	upDone := make(chan error, 1)
 	go func() {

client/iface/bind/relay_bind.go

@@ -7,15 +7,15 @@ import (
 	"sync"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/conn"
 
 	"github.com/netbirdio/netbird/client/iface/udpmux"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // RelayBindJS is a conn.Bind implementation for WebAssembly environments.
 // Do not limit to build only js, because we want to be able to run tests
 type RelayBindJS struct {
-	*conn.StdNetBind
+	*wgbackend.StdNetBind
 
 	recvChan         chan recvMessage
 	endpoints        map[netip.Addr]net.Conn
@@ -34,12 +34,12 @@ func NewRelayBindJS() *RelayBindJS {
 }
 
 // Open creates a receive function for handling relay packets in WASM.
-func (s *RelayBindJS) Open(uport uint16) ([]conn.ReceiveFunc, uint16, error) {
+func (s *RelayBindJS) Open(uport uint16) ([]wgbackend.ReceiveFunc, uint16, error) {
 	log.Debugf("Open: creating receive function for port %d", uport)
 
 	s.ctx, s.cancel = context.WithCancel(context.Background())
 
-	receiveFn := func(bufs [][]byte, sizes []int, eps []conn.Endpoint) (int, error) {
+	receiveFn := func(bufs [][]byte, sizes []int, eps []wgbackend.Endpoint) (int, error) {
 		select {
 		case <-s.ctx.Done():
 			return 0, net.ErrClosed
@@ -49,13 +49,13 @@ func (s *RelayBindJS) Open(uport uint16) ([]conn.ReceiveFunc, uint16, error) {
 			}
 			copy(bufs[0], msg.Buffer)
 			sizes[0] = len(msg.Buffer)
-			eps[0] = conn.Endpoint(msg.Endpoint)
+			eps[0] = wgbackend.Endpoint(msg.Endpoint)
 			return 1, nil
 		}
 	}
 
 	log.Debugf("Open: receive function created, returning port %d", uport)
-	return []conn.ReceiveFunc{receiveFn}, uport, nil
+	return []wgbackend.ReceiveFunc{receiveFn}, uport, nil
 }
 
 func (s *RelayBindJS) Close() error {
@@ -78,7 +78,7 @@ func (s *RelayBindJS) ReceiveFromEndpoint(ctx context.Context, ep *Endpoint, buf
 }
 
 // Send forwards packets through the relay connection for WASM.
-func (s *RelayBindJS) Send(bufs [][]byte, ep conn.Endpoint) error {
+func (s *RelayBindJS) Send(bufs [][]byte, ep wgbackend.Endpoint) error {
 	if ep == nil {
 		return nil
 	}

client/iface/bind/stun_filter_test.go

@@ -12,7 +12,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/net/ipv4"
-	wgConn "golang.zx2c4.com/wireguard/conn"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // magicCookieBytes is the STUN magic cookie as it appears on the wire. In a
@@ -165,7 +166,7 @@ func TestReceiveFn_ClearsSizeOfConsumedPacket(t *testing.T) {
 	// A leftover size from an earlier read, which is what makes the missing reset
 	// observable.
 	sizes := []int{148}
-	eps := make([]wgConn.Endpoint, 1)
+	eps := make([]wgbackend.Endpoint, 1)
 
 	n, err := recvFn(bufs, sizes, eps)
 	require.NoError(t, err)

client/iface/configurer/uapi.go

@@ -5,16 +5,16 @@ package configurer
 import (
 	"net"
 
-	"golang.zx2c4.com/wireguard/ipc"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 func openUAPI(deviceName string) (net.Listener, error) {
-	uapiSock, err := ipc.UAPIOpen(deviceName)
+	uapiSock, err := wgbackend.UAPIOpen(deviceName)
 	if err != nil {
 		return nil, err
 	}
 
-	listener, err := ipc.UAPIListen(deviceName, uapiSock)
+	listener, err := wgbackend.UAPIListen(deviceName, uapiSock)
 	if err != nil {
 		_ = uapiSock.Close()
 		return nil, err

client/iface/configurer/uapi_windows.go

@@ -3,9 +3,9 @@ package configurer
 import (
 	"net"
 
-	"golang.zx2c4.com/wireguard/ipc"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 func openUAPI(deviceName string) (net.Listener, error) {
-	return ipc.UAPIListen(deviceName)
+	return wgbackend.UAPIListen(deviceName)
 }

client/iface/configurer/usp.go

@@ -10,11 +10,10 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	wgconn "golang.zx2c4.com/wireguard/conn"
-	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/monotime"
 )
@@ -22,7 +21,7 @@ import (
 var ErrAllowedIPNotFound = fmt.Errorf("allowed IP not found")
 
 type WGUSPConfigurer struct {
-	device           *device.Device
+	device           *wgbackend.Device
 	deviceName       string
 	activityRecorder *bind.ActivityRecorder
 	statsCache       *statsCache
@@ -31,14 +30,14 @@ type WGUSPConfigurer struct {
 }
 
 // NewUSPConfigurer creates a userspace configurer and starts its UAPI listener.
-func NewUSPConfigurer(device *device.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
+func NewUSPConfigurer(device *wgbackend.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
 	wgCfg := NewUSPConfigurerNoUAPI(device, deviceName, activityRecorder)
 	wgCfg.startUAPI()
 	return wgCfg
 }
 
 // NewUSPConfigurerNoUAPI creates a userspace configurer without a UAPI listener.
-func NewUSPConfigurerNoUAPI(device *device.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
+func NewUSPConfigurerNoUAPI(device *wgbackend.Device, deviceName string, activityRecorder *bind.ActivityRecorder) *WGUSPConfigurer {
 	wgCfg := &WGUSPConfigurer{
 		device:           device,
 		deviceName:       deviceName,
@@ -59,7 +58,7 @@ func (c *WGUSPConfigurer) ConfigureInterface(privateKey string, port int) error
 		return fmt.Errorf("invalid listen port %d", port)
 	}
 
-	if err := c.device.SetPrivateKey(device.NoisePrivateKey(key)); err != nil {
+	if err := c.device.SetPrivateKey(wgbackend.NoisePrivateKey(key)); err != nil {
 		return fmt.Errorf("set private key: %w", err)
 	}
 	if err := c.device.SetListenPort(uint16(port)); err != nil {
@@ -80,8 +79,8 @@ func (c *WGUSPConfigurer) SetPresharedKey(peerKey string, psk wgtypes.Key, updat
 		return err
 	}
 
-	presharedKey := device.NoisePresharedKey(psk)
+	presharedKey := wgbackend.NoisePresharedKey(psk)
-	return c.device.ConfigurePeer(device.NoisePublicKey(parsedPeerKey), device.PeerConfig{
+	return c.device.ConfigurePeer(wgbackend.NoisePublicKey(parsedPeerKey), wgbackend.PeerConfig{
 		PresharedKey: &presharedKey,
 		UpdateOnly:   updateOnly,
 	})
@@ -99,7 +98,7 @@ func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix,
 		return err
 	}
 
-	cfg := device.PeerConfig{
+	cfg := wgbackend.PeerConfig{
 		PersistentKeepalive: &keepAlive,
 		AllowedIPs:          prefixes,
 	}
@@ -116,11 +115,11 @@ func (c *WGUSPConfigurer) UpdatePeer(peerKey string, allowedIps []netip.Prefix,
 	}
 
 	if preSharedKey != nil {
-		psk := device.NoisePresharedKey(*preSharedKey)
+		psk := wgbackend.NoisePresharedKey(*preSharedKey)
 		cfg.PresharedKey = &psk
 	}
 
-	if err := c.device.ConfigurePeer(device.NoisePublicKey(peerKeyParsed), cfg); err != nil {
+	if err := c.device.ConfigurePeer(wgbackend.NoisePublicKey(peerKeyParsed), cfg); err != nil {
 		return fmt.Errorf("configure peer: %w", err)
 	}
 
@@ -138,7 +137,7 @@ func (c *WGUSPConfigurer) RemoveEndpointAddress(peerKey string) error {
 		return fmt.Errorf("parse peer key: %w", err)
 	}
 
-	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	peer := c.device.LookupPeer(wgbackend.NoisePublicKey(peerKeyParsed))
 	if peer == nil {
 		return ErrPeerNotFound
 	}
@@ -147,7 +146,7 @@ func (c *WGUSPConfigurer) RemoveEndpointAddress(peerKey string) error {
 	peer.ZeroAndFlushAll()
 
 	var noKeepAlive time.Duration
-	if err := c.device.ConfigurePeer(device.NoisePublicKey(peerKeyParsed), device.PeerConfig{
+	if err := c.device.ConfigurePeer(wgbackend.NoisePublicKey(peerKeyParsed), wgbackend.PeerConfig{
 		PersistentKeepalive: &noKeepAlive,
 		UpdateOnly:          true,
 	}); err != nil {
@@ -163,7 +162,7 @@ func (c *WGUSPConfigurer) RemovePeer(peerKey string) error {
 		return err
 	}
 
-	c.device.RemovePeer(device.NoisePublicKey(peerKeyParsed))
+	c.device.RemovePeer(wgbackend.NoisePublicKey(peerKeyParsed))
 	c.activityRecorder.Remove(peerKey)
 	return nil
 }
@@ -178,7 +177,7 @@ func (c *WGUSPConfigurer) AddAllowedIP(peerKey string, allowedIP netip.Prefix) e
 		return fmt.Errorf("invalid allowed IP %v", allowedIP)
 	}
 
-	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	peer := c.device.LookupPeer(wgbackend.NoisePublicKey(peerKeyParsed))
 	if peer == nil {
 		return nil
 	}
@@ -198,7 +197,7 @@ func (c *WGUSPConfigurer) RemoveAllowedIP(peerKey string, allowedIP netip.Prefix
 		return ErrAllowedIPNotFound
 	}
 
-	peer := c.device.LookupPeer(device.NoisePublicKey(peerKeyParsed))
+	peer := c.device.LookupPeer(wgbackend.NoisePublicKey(peerKeyParsed))
 	if peer == nil {
 		return ErrPeerNotFound
 	}
@@ -284,7 +283,7 @@ func (c *WGUSPConfigurer) fetchStats() (map[string]WGStats, error) {
 	return stats, nil
 }
 
-func peerStats(peer *device.Peer) Peer {
+func peerStats(peer *wgbackend.Peer) Peer {
 	stats := Peer{
 		PublicKey:     wgtypes.Key(peer.PublicKey()).String(),
 		AllowedIPs:    prefixesToIPNets(peer.AllowedIPs()),
@@ -299,7 +298,7 @@ func peerStats(peer *device.Peer) Peer {
 	return stats
 }
 
-func endpointAddrPort(endpoint wgconn.Endpoint) (netip.AddrPort, bool) {
+func endpointAddrPort(endpoint wgbackend.Endpoint) (netip.AddrPort, bool) {
 	if endpoint == nil {
 		return netip.AddrPort{}, false
 	}

client/iface/configurer/usp_allowedips_test.go

@@ -8,11 +8,10 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgconn "golang.zx2c4.com/wireguard/conn"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // newTestUSPConfigurer builds a configurer over a real wireguard-go device backed by an
@@ -20,7 +19,7 @@ import (
 func newTestUSPConfigurer(t *testing.T) *WGUSPConfigurer {
 	t.Helper()
 
-	dev := wgdevice.NewDevice(newIdleTUN(), wgconn.NewDefaultBind(), wgdevice.NewLogger(wgdevice.LogLevelSilent, ""))
+	dev := wgbackend.NewDevice(newIdleTUN(), wgbackend.NewDefaultBind(), wgbackend.NewLogger(wgbackend.LogLevelSilent, ""))
 	t.Cleanup(dev.Close)
 
 	c := NewUSPConfigurerNoUAPI(dev, "wgtest0", bind.NewActivityRecorder())

client/iface/configurer/usp_test.go

@@ -11,20 +11,20 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // idleTUN never reports an up event, so the wireguard-go device stays down: no socket is
 // opened, no peer goroutine starts, and the configuration state is all the tests observe.
 type idleTUN struct {
-	events chan tun.Event
+	events chan wgbackend.TUNEvent
 	closed chan struct{}
 }
 
 func newIdleTUN() *idleTUN {
-	return &idleTUN{events: make(chan tun.Event), closed: make(chan struct{})}
+	return &idleTUN{events: make(chan wgbackend.TUNEvent), closed: make(chan struct{})}
 }
 
 func (t *idleTUN) File() *os.File { return nil }
@@ -40,7 +40,7 @@ func (t *idleTUN) MTU() (int, error) { return 1420, nil }
 
 func (t *idleTUN) Name() (string, error) { return "idle", nil }
 
-func (t *idleTUN) Events() <-chan tun.Event { return t.events }
+func (t *idleTUN) Events() <-chan wgbackend.TUNEvent { return t.events }
 
 func (t *idleTUN) Close() error {
 	close(t.closed)
@@ -142,12 +142,12 @@ func TestRemoveEndpointAddressKeepsThePeerAndStopsTheKeepalive(t *testing.T) {
 	endpoint := &net.UDPAddr{IP: net.IPv4(192, 0, 2, 10), Port: 51820}
 	prefixes := []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")}
 	require.NoError(t, c.UpdatePeer(peerKey, prefixes, 25*time.Second, endpoint, nil), "add peer")
-	before := c.device.LookupPeer(wgdevice.NoisePublicKey(priv.PublicKey()))
+	before := c.device.LookupPeer(wgbackend.NoisePublicKey(priv.PublicKey()))
 	require.NotNil(t, before, "the peer must be on the device")
 
 	require.NoError(t, c.RemoveEndpointAddress(peerKey), "remove endpoint address")
 
-	assert.Same(t, before, c.device.LookupPeer(wgdevice.NoisePublicKey(priv.PublicKey())),
+	assert.Same(t, before, c.device.LookupPeer(wgbackend.NoisePublicKey(priv.PublicKey())),
 		"the peer object must survive the endpoint removal")
 	stats, err := c.FullStats()
 	require.NoError(t, err, "read device stats")

client/iface/device.go

@@ -3,13 +3,10 @@
 package iface
 
 import (
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
-	wgdevice "golang.zx2c4.com/wireguard/device"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type WGTunDevice interface {
@@ -21,7 +18,7 @@ type WGTunDevice interface {
 	DeviceName() string
 	Close() error
 	FilteredDevice() *device.FilteredDevice
-	Device() *wgdevice.Device
+	Device() *wgbackend.Device
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	GetICEBind() device.EndpointManager
 }

client/iface/device/device_android.go

@@ -8,14 +8,12 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // WGTunDevice ignore the WGTunDevice interface on Android because the creation of the tun device is different on this platform
@@ -30,7 +28,7 @@ type WGTunDevice struct {
 	disableDNS bool
 
 	name           string
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
@@ -74,7 +72,7 @@ func (t *WGTunDevice) Create(routes []string, dns string, searchDomains []string
 		return nil, err
 	}
 
-	unmonitoredTUN, name, err := tun.CreateUnmonitoredTUNFromFD(fd)
+	unmonitoredTUN, name, err := wgbackend.CreateUnmonitoredTUNFromFD(fd)
 	if err != nil {
 		_ = unix.Close(fd)
 		log.Errorf("failed to create Android interface: %s", err)
@@ -87,7 +85,7 @@ func (t *WGTunDevice) Create(routes []string, dns string, searchDomains []string
 	t.filteredDevice = newDeviceFilter(t.renewableTun)
 
 	log.Debugf("attaching to interface %v", name)
-	t.device = device.NewDevice(t.filteredDevice, t.iceBind, device.NewLogger(wgLogLevel(), "[netbird] "))
+	t.device = wgbackend.NewDevice(t.filteredDevice, t.iceBind, wgbackend.NewLogger(wgLogLevel(), "[netbird] "))
 	// without this property mobile devices can discover remote endpoints if the configured one was wrong.
 	// this helps with support for the older NetBird clients that had a hardcoded direct mode
 	// t.device.DisableSomeRoamingForBrokenMobileSemantics()
@@ -121,7 +119,7 @@ func (t *WGTunDevice) RenewTun(fd int) error {
 		return fmt.Errorf("device not initialized")
 	}
 
-	unmonitoredTUN, _, err := tun.CreateUnmonitoredTUNFromFD(fd)
+	unmonitoredTUN, _, err := wgbackend.CreateUnmonitoredTUNFromFD(fd)
 	if err != nil {
 		_ = unix.Close(fd)
 		log.Errorf("failed to renew Android interface: %s", err)
@@ -155,7 +153,7 @@ func (t *WGTunDevice) Close() error {
 	return nil
 }
 
-func (t *WGTunDevice) Device() *device.Device {
+func (t *WGTunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -175,7 +173,7 @@ func (t *WGTunDevice) FilteredDevice() *FilteredDevice {
 	return t.filteredDevice
 }
 
-func (t *WGTunDevice) GetNet() *netstack.Net {
+func (t *WGTunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_darwin.go

@@ -7,14 +7,12 @@ import (
 	"os/exec"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type TunDevice struct {
@@ -25,7 +23,7 @@ type TunDevice struct {
 	mtu     uint16
 	iceBind *bind.ICEBind
 
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
@@ -43,17 +41,17 @@ func NewTunDevice(name string, address wgaddr.Address, port int, key string, mtu
 }
 
 func (t *TunDevice) Create() (WGConfigurer, error) {
-	tunDevice, err := tun.CreateTUN(t.name, int(t.mtu))
+	tunDevice, err := wgbackend.CreateTUN(t.name, int(t.mtu))
 	if err != nil {
 		return nil, fmt.Errorf("error creating tun device: %s", err)
 	}
 	t.filteredDevice = newDeviceFilter(tunDevice)
 
 	// We need to create a wireguard-go device and listen to configuration requests
-	t.device = device.NewDevice(
+	t.device = wgbackend.NewDevice(
 		t.filteredDevice,
 		t.iceBind,
-		device.NewLogger(wgLogLevel(), "[netbird] "),
+		wgbackend.NewLogger(wgLogLevel(), "[netbird] "),
 	)
 
 	err = t.assignAddr()
@@ -125,7 +123,7 @@ func (t *TunDevice) FilteredDevice() *FilteredDevice {
 }
 
 // Device returns the wireguard device
-func (t *TunDevice) Device() *device.Device {
+func (t *TunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -160,7 +158,7 @@ func (t *TunDevice) assignAddr() error {
 	return nil
 }
 
-func (t *TunDevice) GetNet() *netstack.Net {
+func (t *TunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_filter.go

@@ -8,7 +8,8 @@ import (
 	"sync/atomic"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // PacketFilter interface for firewall abilities
@@ -42,7 +43,7 @@ type PacketCapture interface {
 
 // FilteredDevice to override Read or Write of packets
 type FilteredDevice struct {
-	tun.Device
+	wgbackend.TUN
 
 	filter  PacketFilter
 	capture atomic.Pointer[PacketCapture]
@@ -54,9 +55,9 @@ type FilteredDevice struct {
 }
 
 // newDeviceFilter constructor function
-func newDeviceFilter(device tun.Device) *FilteredDevice {
+func newDeviceFilter(device wgbackend.TUN) *FilteredDevice {
 	return &FilteredDevice{
-		Device: device,
+		TUN: device,
 	}
 }
 
@@ -66,7 +67,7 @@ func newDeviceFilter(device tun.Device) *FilteredDevice {
 func (d *FilteredDevice) Close() error {
 	var err error
 	d.closeOnce.Do(func() {
-		err = d.Device.Close()
+		err = d.TUN.Close()
 	})
 	if err != nil {
 		return err
@@ -142,14 +143,14 @@ func (d *FilteredDevice) Write(bufs [][]byte, offset int) (int, error) {
 // wintun read path and converting them into errors.
 func (d *FilteredDevice) deviceRead(bufs [][]byte, sizes []int, offset int) (n int, err error) {
 	defer d.recoverFromPanic("read", &n, &err)
-	return d.Device.Read(bufs, sizes, offset)
+	return d.TUN.Read(bufs, sizes, offset)
 }
 
 // deviceWrite calls the underlying device Write, recovering from panics in the
 // wintun write path and converting them into errors.
 func (d *FilteredDevice) deviceWrite(bufs [][]byte, offset int) (n int, err error) {
 	defer d.recoverFromPanic("write", &n, &err)
-	return d.Device.Write(bufs, offset)
+	return d.TUN.Write(bufs, offset)
 }
 
 // recoverFromPanic converts a panic in the underlying device into a regular

client/iface/device/device_ios.go

@@ -6,14 +6,12 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type TunDevice struct {
@@ -25,7 +23,7 @@ type TunDevice struct {
 	iceBind *bind.ICEBind
 	tunFd   int
 
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
@@ -50,7 +48,7 @@ var ErrInvalidTunnelFD = fmt.Errorf("invalid tunnel file descriptor: fd is 0 (Sw
 func (t *TunDevice) Create() (WGConfigurer, error) {
 	log.Infof("create tun interface")
 
-	var tunDevice tun.Device
+	var tunDevice wgbackend.TUN
 	var err error
 
 	// Validate the tunnel file descriptor.
@@ -79,7 +77,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 		_ = unix.Close(dupTunFd)
 		return nil, err
 	}
-	tunDevice, err = tun.CreateTUNFromFile(os.NewFile(uintptr(dupTunFd), "/dev/tun"), 0)
+	tunDevice, err = wgbackend.CreateTUNFromFile(os.NewFile(uintptr(dupTunFd), "/dev/tun"), 0)
 	if err != nil {
 		log.Errorf("Unable to create new tun device from fd: %v", err)
 		_ = unix.Close(dupTunFd)
@@ -88,7 +86,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 
 	t.filteredDevice = newDeviceFilter(tunDevice)
 	log.Debug("Attaching to interface")
-	t.device = device.NewDevice(t.filteredDevice, t.iceBind, device.NewLogger(wgLogLevel(), "[netbird] "))
+	t.device = wgbackend.NewDevice(t.filteredDevice, t.iceBind, wgbackend.NewLogger(wgLogLevel(), "[netbird] "))
 	// without this property mobile devices can discover remote endpoints if the configured one was wrong.
 	// this helps with support for the older NetBird clients that had a hardcoded direct mode
 	// t.device.DisableSomeRoamingForBrokenMobileSemantics()
@@ -118,7 +116,7 @@ func (t *TunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
 	return udpMux, nil
 }
 
-func (t *TunDevice) Device() *device.Device {
+func (t *TunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -163,7 +161,7 @@ func (t *TunDevice) FilteredDevice() *FilteredDevice {
 	return t.filteredDevice
 }
 
-func (t *TunDevice) GetNet() *netstack.Net {
+func (t *TunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_kernel_unix.go

@@ -9,12 +9,11 @@ import (
 
 	"github.com/pion/transport/v3"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/sharedsock"
 )
@@ -170,7 +169,7 @@ func (t *TunKernelDevice) DeviceName() string {
 }
 
 // Device returns the wireguard device, not applicable for kernel devices
-func (t *TunKernelDevice) Device() *device.Device {
+func (t *TunKernelDevice) Device() *wgbackend.Device {
 	return nil
 }
 
@@ -183,7 +182,7 @@ func (t *TunKernelDevice) assignAddr() error {
 	return t.link.assignAddr(&t.address)
 }
 
-func (t *TunKernelDevice) GetNet() *netstack.Net {
+func (t *TunKernelDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_netstack.go

@@ -6,20 +6,18 @@ import (
 	"net/netip"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/conn"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
 type Bind interface {
-	conn.Bind
+	wgbackend.Bind
 	GetICEMux() (*udpmux.UniversalUDPMuxDefault, error)
 	ActivityRecorder() *bind.ActivityRecorder
 	EndpointManager
@@ -34,13 +32,13 @@ type TunNetstackDevice struct {
 	listenAddress string
 	bind          Bind
 
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	nsTun          *nbnetstack.NetStackTun
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
 
-	net *netstack.Net
+	net *wgbackend.NetstackNet
 }
 
 func NewNetstackDevice(name string, address wgaddr.Address, wgPort int, key string, mtu uint16, bind Bind, listenAddress string) *TunNetstackDevice {
@@ -78,10 +76,10 @@ func (t *TunNetstackDevice) create() (WGConfigurer, error) {
 	t.filteredDevice = newDeviceFilter(tunIface)
 	t.net = net
 
-	t.device = device.NewDevice(
+	t.device = wgbackend.NewDevice(
 		t.filteredDevice,
 		t.bind,
-		device.NewLogger(wgLogLevel(), "[netbird] "),
+		wgbackend.NewLogger(wgLogLevel(), "[netbird] "),
 	)
 
 	t.configurer = configurer.NewUSPConfigurerNoUAPI(t.device, t.name, t.bind.ActivityRecorder())
@@ -156,11 +154,11 @@ func (t *TunNetstackDevice) FilteredDevice() *FilteredDevice {
 }
 
 // Device returns the wireguard device
-func (t *TunNetstackDevice) Device() *device.Device {
+func (t *TunNetstackDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
-func (t *TunNetstackDevice) GetNet() *netstack.Net {
+func (t *TunNetstackDevice) GetNet() *wgbackend.NetstackNet {
 	return t.net
 }
 

client/iface/device/device_usp_unix.go

@@ -6,14 +6,12 @@ import (
 	"fmt"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type TunDevice struct {
@@ -24,7 +22,7 @@ type TunDevice struct {
 	mtu     uint16
 	iceBind *bind.ICEBind
 
-	device         *device.Device
+	device         *wgbackend.Device
 	filteredDevice *FilteredDevice
 	udpMux         *udpmux.UniversalUDPMuxDefault
 	configurer     WGConfigurer
@@ -45,7 +43,7 @@ func NewTunDevice(name string, address wgaddr.Address, port int, key string, mtu
 
 func (t *TunDevice) Create() (WGConfigurer, error) {
 	log.Info("create tun interface")
-	tunIface, err := tun.CreateTUN(t.name, int(t.mtu))
+	tunIface, err := wgbackend.CreateTUN(t.name, int(t.mtu))
 	if err != nil {
 		log.Debugf("failed to create tun interface (%s, %d): %s", t.name, int(t.mtu), err)
 		return nil, fmt.Errorf("error creating tun device: %s", err)
@@ -53,10 +51,10 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 	t.filteredDevice = newDeviceFilter(tunIface)
 
 	// We need to create a wireguard-go device and listen to configuration requests
-	t.device = device.NewDevice(
+	t.device = wgbackend.NewDevice(
 		t.filteredDevice,
 		t.iceBind,
-		device.NewLogger(wgLogLevel(), "[netbird] "),
+		wgbackend.NewLogger(wgLogLevel(), "[netbird] "),
 	)
 
 	err = t.assignAddr()
@@ -132,7 +130,7 @@ func (t *TunDevice) FilteredDevice() *FilteredDevice {
 }
 
 // Device returns the wireguard device
-func (t *TunDevice) Device() *device.Device {
+func (t *TunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -143,7 +141,7 @@ func (t *TunDevice) assignAddr() error {
 	return link.assignAddr(&t.address)
 }
 
-func (t *TunDevice) GetNet() *netstack.Net {
+func (t *TunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/device_windows.go

@@ -6,15 +6,13 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/sys/windows"
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/windows/tunnel/winipcfg"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 const defaultWindowsGUIDSTring = "{f2f29e61-d91f-4d76-8151-119b20c4bdeb}"
@@ -27,8 +25,8 @@ type TunDevice struct {
 	mtu     uint16
 	iceBind *bind.ICEBind
 
-	device          *device.Device
+	device          *wgbackend.Device
-	nativeTunDevice *tun.NativeTun
+	nativeTunDevice *wgbackend.NativeTUN
 	filteredDevice  *FilteredDevice
 	udpMux          *udpmux.UniversalUDPMuxDefault
 	configurer      WGConfigurer
@@ -60,18 +58,18 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 		return nil, err
 	}
 	log.Info("create tun interface")
-	tunDevice, err := tun.CreateTUNWithRequestedGUID(t.name, &guid, int(t.mtu))
+	tunDevice, err := wgbackend.CreateTUNWithRequestedGUID(t.name, &guid, int(t.mtu))
 	if err != nil {
 		return nil, fmt.Errorf("error creating tun device: %s", err)
 	}
-	t.nativeTunDevice = tunDevice.(*tun.NativeTun)
+	t.nativeTunDevice = tunDevice.(*wgbackend.NativeTUN)
 	t.filteredDevice = newDeviceFilter(tunDevice)
 
 	// We need to create a wireguard-go device and listen to configuration requests
-	t.device = device.NewDevice(
+	t.device = wgbackend.NewDevice(
 		t.filteredDevice,
 		t.iceBind,
-		device.NewLogger(wgLogLevel(), "[netbird] "),
+		wgbackend.NewLogger(wgLogLevel(), "[netbird] "),
 	)
 
 	luid := winipcfg.LUID(t.nativeTunDevice.LUID())
@@ -172,7 +170,7 @@ func (t *TunDevice) FilteredDevice() *FilteredDevice {
 }
 
 // Device returns the wireguard device
-func (t *TunDevice) Device() *device.Device {
+func (t *TunDevice) Device() *wgbackend.Device {
 	return t.device
 }
 
@@ -209,7 +207,7 @@ func (t *TunDevice) assignAddr() error {
 	return luid.SetIPAddresses([]netip.Prefix{v4Prefix})
 }
 
-func (t *TunDevice) GetNet() *netstack.Net {
+func (t *TunDevice) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/iface/device/renewable_tun.go

@@ -10,7 +10,8 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // closeAwareDevice wraps a tun.Device along with a flag
@@ -23,15 +24,15 @@ import (
 // goroutine is awaited and closed only once.
 type closeAwareDevice struct {
 	isClosed atomic.Bool
-	tun.Device
+	wgbackend.TUN
 	closeEventCh chan struct{}
 	wg           sync.WaitGroup
 	closeOnce    sync.Once
 }
 
-func newClosableDevice(tunDevice tun.Device) *closeAwareDevice {
+func newClosableDevice(tunDevice wgbackend.TUN) *closeAwareDevice {
 	return &closeAwareDevice{
-		Device:       tunDevice,
+		TUN:          tunDevice,
 		isClosed:     atomic.Bool{},
 		closeEventCh: make(chan struct{}),
 	}
@@ -39,18 +40,18 @@ func newClosableDevice(tunDevice tun.Device) *closeAwareDevice {
 
 // redirectEvents redirects the Events() method of the underlying tun.Device
 // to the given channel (RenewableTUN's events channel).
-func (c *closeAwareDevice) redirectEvents(out chan tun.Event) {
+func (c *closeAwareDevice) redirectEvents(out chan wgbackend.TUNEvent) {
 	c.wg.Add(1)
 	go func() {
 		defer c.wg.Done()
 		for {
 			select {
-			case ev, ok := <-c.Device.Events():
+			case ev, ok := <-c.TUN.Events():
 				if !ok {
 					return
 				}
 
-				if ev == tun.EventDown {
+				if ev == wgbackend.TUNEventDown {
 					continue
 				}
 
@@ -72,7 +73,7 @@ func (c *closeAwareDevice) Close() (err error) {
 	c.closeOnce.Do(func() {
 		c.isClosed.Store(true)
 		close(c.closeEventCh)
-		err = c.Device.Close()
+		err = c.TUN.Close()
 		c.wg.Wait()
 	})
 
@@ -87,7 +88,7 @@ type RenewableTUN struct {
 	devices []*closeAwareDevice
 	mu      sync.Mutex
 	cond    *sync.Cond
-	events  chan tun.Event
+	events  chan wgbackend.TUNEvent
 	closed  atomic.Bool
 }
 
@@ -95,7 +96,7 @@ func NewRenewableTUN() *RenewableTUN {
 	r := &RenewableTUN{
 		devices: make([]*closeAwareDevice, 0),
 		mu:      sync.Mutex{},
-		events:  make(chan tun.Event, 16),
+		events:  make(chan wgbackend.TUNEvent, 16),
 	}
 	r.cond = sync.NewCond(&r.mu)
 	return r
@@ -225,7 +226,7 @@ func (r *RenewableTUN) Name() (string, error) {
 
 // Events returns a channel that is fed events from the underlying tun.Device's events channel
 // once it is added.
-func (r *RenewableTUN) Events() <-chan tun.Event {
+func (r *RenewableTUN) Events() <-chan wgbackend.TUNEvent {
 	return r.events
 }
 
@@ -259,7 +260,7 @@ func (r *RenewableTUN) BatchSize() int {
 	return 1
 }
 
-func (r *RenewableTUN) AddDevice(device tun.Device) {
+func (r *RenewableTUN) AddDevice(device wgbackend.TUN) {
 	r.mu.Lock()
 	if r.closed.Load() {
 		r.mu.Unlock()

client/iface/device/wg_log.go

@@ -3,13 +3,13 @@ package device
 import (
 	"os"
 
-	"golang.zx2c4.com/wireguard/device"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 func wgLogLevel() int {
 	if os.Getenv("NB_WG_DEBUG") == "true" {
-		return device.LogLevelVerbose
+		return wgbackend.LogLevelVerbose
 	} else {
-		return device.LogLevelSilent
+		return wgbackend.LogLevelSilent
 	}
 }

client/iface/device_android.go

@@ -1,13 +1,10 @@
 package iface
 
 import (
-	wgdevice "golang.zx2c4.com/wireguard/device"
-
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type WGTunDevice interface {
@@ -19,8 +16,8 @@ type WGTunDevice interface {
 	DeviceName() string
 	Close() error
 	FilteredDevice() *device.FilteredDevice
-	Device() *wgdevice.Device
+	Device() *wgbackend.Device
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	RenewTun(fd int) error
 	GetICEBind() device.EndpointManager
 }

client/iface/iface.go

@@ -10,17 +10,15 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/pion/transport/v3"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
-	wgdevice "golang.zx2c4.com/wireguard/device"
-
 	"github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/device"
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 	"github.com/netbirdio/netbird/monotime"
 )
@@ -271,7 +269,7 @@ func (w *WGIface) GetDevice() *device.FilteredDevice {
 }
 
 // GetWGDevice returns the WireGuard device
-func (w *WGIface) GetWGDevice() *wgdevice.Device {
+func (w *WGIface) GetWGDevice() *wgbackend.Device {
 	return w.tun.Device()
 }
 
@@ -344,7 +342,7 @@ func (w *WGIface) waitUntilRemoved() error {
 }
 
 // GetNet returns the netstack.Net for the netstack device
-func (w *WGIface) GetNet() *netstack.Net {
+func (w *WGIface) GetNet() *wgbackend.NetstackNet {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 

client/iface/iface_close_test.go

@@ -8,13 +8,11 @@ import (
 	"testing"
 	"time"
 
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 )
 
@@ -40,8 +38,8 @@ func (f *fakeTunDevice) WgAddress() wgaddr.Address              { return wgaddr.
 func (f *fakeTunDevice) MTU() uint16                            { return DefaultMTU }
 func (f *fakeTunDevice) DeviceName() string                     { return "nb-close-test" }
 func (f *fakeTunDevice) FilteredDevice() *device.FilteredDevice { return nil }
-func (f *fakeTunDevice) Device() *wgdevice.Device               { return nil }
+func (f *fakeTunDevice) Device() *wgbackend.Device              { return nil }
-func (f *fakeTunDevice) GetNet() *netstack.Net                  { return nil }
+func (f *fakeTunDevice) GetNet() *wgbackend.NetstackNet         { return nil }
 func (f *fakeTunDevice) GetICEBind() device.EndpointManager     { return nil }
 
 func (f *fakeTunDevice) Close() error {

client/iface/mocks/tun.go

@@ -1,5 +1,5 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: golang.zx2c4.com/wireguard/tun (interfaces: Device)
+// Source: github.com/netbirdio/wireguard-go/tun (interfaces: Device)
 
 // Package mocks is a generated GoMock package.
 package mocks
@@ -8,8 +8,8 @@ import (
 	os "os"
 	reflect "reflect"
 
+	tun "github.com/netbirdio/wireguard-go/tun"
 	gomock "go.uber.org/mock/gomock"
-	tun "golang.zx2c4.com/wireguard/tun"
 )
 
 // MockDevice is a mock of Device interface.

client/iface/netstack/dialer.go

@@ -5,7 +5,8 @@ import (
 	"net"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type Dialer interface {
@@ -13,10 +14,10 @@ type Dialer interface {
 }
 
 type NSDialer struct {
-	net *netstack.Net
+	net *wgbackend.NetstackNet
 }
 
-func NewNSDialer(net *netstack.Net) *NSDialer {
+func NewNSDialer(net *wgbackend.NetstackNet) *NSDialer {
 	return &NSDialer{
 		net: net,
 	}

client/iface/netstack/tun.go

@@ -6,8 +6,8 @@ import (
 	"strconv"
 
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun"
+
-	"golang.zx2c4.com/wireguard/tun/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 const EnvSkipProxy = "NB_NETSTACK_SKIP_PROXY"
@@ -19,7 +19,7 @@ type NetStackTun struct { //nolint:revive
 	listenAddress string
 
 	proxy  *Proxy
-	tundev tun.Device
+	tundev wgbackend.TUN
 }
 
 func NewNetStackTun(listenAddress string, addresses []netip.Addr, dnsAddress netip.Addr, mtu int) *NetStackTun {
@@ -31,8 +31,8 @@ func NewNetStackTun(listenAddress string, addresses []netip.Addr, dnsAddress net
 	}
 }
 
-func (t *NetStackTun) Create() (tun.Device, *netstack.Net, error) {
+func (t *NetStackTun) Create() (wgbackend.TUN, *wgbackend.NetstackNet, error) {
-	nsTunDev, tunNet, err := netstack.CreateNetTUN(
+	nsTunDev, tunNet, err := wgbackend.CreateNetTUN(
 		t.addresses,
 		[]netip.Addr{t.dnsAddress},
 		t.mtu)

client/iface/udpmux/mux.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	"github.com/pion/logging"
 	"github.com/pion/stun/v3"
 	"github.com/pion/transport/v3"

client/iface/wgbackend/conn.go

@@ -0,0 +1,27 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/conn"
+
+type (
+	BatchReader    = conn.BatchReader
+	Bind           = conn.Bind
+	Endpoint       = conn.Endpoint
+	ReceiveFunc    = conn.ReceiveFunc
+	StdNetBind     = conn.StdNetBind
+	StdNetEndpoint = conn.StdNetEndpoint
+)
+
+const (
+	IdealBatchSize         = conn.IdealBatchSize
+	UdpSegmentMaxDatagrams = conn.UdpSegmentMaxDatagrams
+)
+
+var (
+	ControlFns                       = conn.ControlFns
+	GetGSOSize                       = conn.GetGSOSize
+	GetSrcFromControl                = conn.GetSrcFromControl
+	NewDefaultBind                   = conn.NewDefaultBind
+	NewStdNetBind                    = conn.NewStdNetBind
+	NewStdNetBindWithReceiverCreator = conn.NewStdNetBindWithReceiverCreator
+	SplitCoalescedMessages           = conn.SplitCoalescedMessages
+)

client/iface/wgbackend/device.go

@@ -0,0 +1,24 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/device"
+
+type (
+	Device            = device.Device
+	NoisePresharedKey = device.NoisePresharedKey
+	NoisePrivateKey   = device.NoisePrivateKey
+	NoisePublicKey    = device.NoisePublicKey
+	Peer              = device.Peer
+	PeerConfig        = device.PeerConfig
+)
+
+const (
+	LogLevelSilent  = device.LogLevelSilent
+	LogLevelVerbose = device.LogLevelVerbose
+)
+
+var (
+	NewDevice                     = device.NewDevice
+	NewLogger                     = device.NewLogger
+	SetMaxBatchSizeOverride       = device.SetMaxBatchSizeOverride
+	SetPreallocatedBuffersPerPool = device.SetPreallocatedBuffersPerPool
+)

client/iface/wgbackend/doc.go

@@ -0,0 +1,5 @@
+// Package wgbackend is the single place in the client's hand-written code that names
+// the WireGuard implementation. Other packages import it instead of the wireguard-go
+// packages, so swapping the implementation only touches the aliases here and the
+// generated mocks.
+package wgbackend

client/iface/wgbackend/ipc_unix.go

@@ -0,0 +1,10 @@
+//go:build linux || darwin || freebsd || openbsd
+
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/ipc"
+
+var (
+	UAPIListen = ipc.UAPIListen
+	UAPIOpen   = ipc.UAPIOpen
+)

client/iface/wgbackend/ipc_windows.go

@@ -0,0 +1,5 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/ipc"
+
+var UAPIListen = ipc.UAPIListen

client/iface/wgbackend/tun.go

@@ -0,0 +1,19 @@
+package wgbackend
+
+import (
+	"github.com/netbirdio/wireguard-go/tun"
+	"github.com/netbirdio/wireguard-go/tun/netstack"
+)
+
+type (
+	// TUN is the packet device the WireGuard device reads from and writes to.
+	TUN = tun.Device
+	// TUNEvent is a status change reported by a TUN.
+	TUNEvent = tun.Event
+	// NetstackNet is the userspace network stack a netstack TUN is attached to.
+	NetstackNet = netstack.Net
+)
+
+const TUNEventDown = tun.EventDown
+
+var CreateNetTUN = netstack.CreateNetTUN

client/iface/wgbackend/tun_linux.go

@@ -0,0 +1,5 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/tun"
+
+var CreateUnmonitoredTUNFromFD = tun.CreateUnmonitoredTUNFromFD

client/iface/wgbackend/tun_unix.go

@@ -0,0 +1,10 @@
+//go:build linux || darwin || freebsd || openbsd
+
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/tun"
+
+var (
+	CreateTUN         = tun.CreateTUN
+	CreateTUNFromFile = tun.CreateTUNFromFile
+)

client/iface/wgbackend/tun_windows.go

@@ -0,0 +1,7 @@
+package wgbackend
+
+import "github.com/netbirdio/wireguard-go/tun"
+
+type NativeTUN = tun.NativeTun
+
+var CreateTUNWithRequestedGUID = tun.CreateTUNWithRequestedGUID

client/installer.nsis

@@ -198,6 +198,15 @@ FunctionEnd
 ######################################################################
 Section -MainProgram
     ${INSTALL_TYPE}
+    ; The previous uninstaller stops the service and the UI only when its uninstall key
+    ; is found and endpoint protection lets the unsigned uninstaller run. Extraction
+    ; fails on any exe that is still running.
+    DetailPrint "Stopping Netbird service..."
+    ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service stop'
+    DetailPrint "Terminating ${UI_APP_NAME} process..."
+    ExecWait '"$SYSDIR\taskkill.exe" /im ${UI_APP_EXE}.exe /f'
+    ; Both return before the processes release their image files.
+    Sleep 3000
     # SetOverwrite ifnewer
     SetOutPath "$INSTDIR"
     !ifndef ARCH

client/internal/acl/mocks/iface_mapper.go

@@ -8,10 +8,10 @@ import (
 	reflect "reflect"
 
 	gomock "go.uber.org/mock/gomock"
-	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // MockIFaceMapper is a mock of IFaceMapper interface.
@@ -108,10 +108,10 @@ func (mr *MockIFaceMapperMockRecorder) GetDevice() *gomock.Call {
 }
 
 // GetWGDevice mocks base method.
-func (m *MockIFaceMapper) GetWGDevice() *wgdevice.Device {
+func (m *MockIFaceMapper) GetWGDevice() *wgbackend.Device {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetWGDevice")
-	ret0, _ := ret[0].(*wgdevice.Device)
+	ret0, _ := ret[0].(*wgbackend.Device)
 	return ret0
 }
 

client/internal/dns/response_writer.go

@@ -7,14 +7,15 @@ import (
 	"github.com/google/gopacket"
 	"github.com/google/gopacket/layers"
 	"github.com/miekg/dns"
-	"golang.zx2c4.com/wireguard/tun"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type responseWriter struct {
 	local  net.Addr
 	remote net.Addr
 	packet gopacket.Packet
-	device tun.Device
+	device wgbackend.TUN
 }
 
 // LocalAddr returns the net.Addr of the server

client/internal/dns/server_test.go

@@ -15,7 +15,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/firewall/uspfilter"
@@ -23,6 +22,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/dns/local"
 	"github.com/netbirdio/netbird/client/internal/dns/test"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
@@ -83,7 +83,7 @@ func (w *mocWGIface) GetStats(_ string) (configurer.WGStats, error) {
 	return configurer.WGStats{}, nil
 }
 
-func (w *mocWGIface) GetNet() *netstack.Net {
+func (w *mocWGIface) GetNet() *wgbackend.NetstackNet {
 	return nil
 }
 

client/internal/dns/service_memory.go

@@ -108,7 +108,7 @@ func (s *ServiceViaMemory) filterDNSTraffic() error {
 	if s.tcpDNS == nil {
 		if dev := s.wgInterface.GetDevice(); dev != nil {
 			// MTU only affects TCP segment sizing; DNS messages are small so this has no practical impact.
-			s.tcpDNS = newTCPDNSServer(s.dnsMux, dev.Device, s.runtimeIP, uint16(s.runtimePort), iface.DefaultMTU)
+			s.tcpDNS = newTCPDNSServer(s.dnsMux, dev.TUN, s.runtimeIP, uint16(s.runtimePort), iface.DefaultMTU)
 		}
 	}
 
@@ -143,7 +143,7 @@ func (s *ServiceViaMemory) filterDNSTraffic() error {
 		writer := &responseWriter{
 			remote: remoteAddrFromPacket(packet),
 			packet: packet,
-			device: dev.Device,
+			device: dev.TUN,
 		}
 		go s.dnsMux.ServeDNS(writer, msg)
 		return true

client/internal/dns/tcpstack.go

@@ -12,7 +12,6 @@ import (
 
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun"
 	"gvisor.dev/gvisor/pkg/buffer"
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/adapters/gonet"
@@ -21,6 +20,8 @@ import (
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
 	"gvisor.dev/gvisor/pkg/tcpip/transport/tcp"
 	"gvisor.dev/gvisor/pkg/waiter"
+
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 const (
@@ -38,7 +39,7 @@ type tcpDNSServer struct {
 	s      *stack.Stack
 	ep     *dnsEndpoint
 	mux    *dns.ServeMux
-	tunDev tun.Device
+	tunDev wgbackend.TUN
 	ip     netip.Addr
 	port   uint16
 	mtu    uint16
@@ -49,7 +50,7 @@ type tcpDNSServer struct {
 	timer   *time.Timer
 }
 
-func newTCPDNSServer(mux *dns.ServeMux, tunDev tun.Device, ip netip.Addr, port uint16, mtu uint16) *tcpDNSServer {
+func newTCPDNSServer(mux *dns.ServeMux, tunDev wgbackend.TUN, ip netip.Addr, port uint16, mtu uint16) *tcpDNSServer {
 	return &tcpDNSServer{
 		mux:    mux,
 		tunDev: tunDev,
@@ -270,7 +271,7 @@ func (t *tcpDNSServer) handleTCPDNS(r *tcp.ForwarderRequest) {
 // dnsEndpoint implements stack.LinkEndpoint for writing packets back via the tun device.
 type dnsEndpoint struct {
 	dispatcher stack.NetworkDispatcher
-	tunDev     tun.Device
+	tunDev     wgbackend.TUN
 	mtu        atomic.Uint32
 }
 

client/internal/dns/upstream.go

@@ -44,10 +44,10 @@ import (
 
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/dns/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
@@ -714,7 +714,7 @@ func toTCPClient(c *dns.Client) *dns.Client {
 
 // ExchangeWithNetstack performs a DNS exchange using netstack for dialing.
 // This is needed when netstack is enabled to reach peer IPs through the tunnel.
-func ExchangeWithNetstack(ctx context.Context, nsNet *netstack.Net, r *dns.Msg, upstream string) (*dns.Msg, error) {
+func ExchangeWithNetstack(ctx context.Context, nsNet *wgbackend.NetstackNet, r *dns.Msg, upstream string) (*dns.Msg, error) {
 	// If request came in over TCP, go straight to TCP upstream
 	if dnsProtocolFromContext(ctx) == protoTCP {
 		rm, err := netstackExchange(ctx, nsNet, r, upstream, protoTCP)
@@ -758,7 +758,7 @@ func ExchangeWithNetstack(ctx context.Context, nsNet *netstack.Net, r *dns.Msg,
 	return reply, nil
 }
 
-func netstackExchange(ctx context.Context, nsNet *netstack.Net, r *dns.Msg, upstream, network string) (*dns.Msg, error) {
+func netstackExchange(ctx context.Context, nsNet *wgbackend.NetstackNet, r *dns.Msg, upstream, network string) (*dns.Msg, error) {
 	conn, err := nsNet.DialContext(ctx, network, upstream)
 	if err != nil {
 		return nil, fmt.Errorf("with %s: %w", network, err)

client/internal/dns/upstream_general.go

@@ -9,15 +9,15 @@ import (
 	"time"
 
 	"github.com/miekg/dns"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 type upstreamResolver struct {
 	*upstreamResolverBase
-	nsNet *netstack.Net
+	nsNet *wgbackend.NetstackNet
 }
 
 func newUpstreamResolver(

client/internal/dns/upstream_test.go

@@ -13,10 +13,10 @@ import (
 	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/dns/test"
 )
 
@@ -128,7 +128,7 @@ func (m *mockNetstackProvider) ToInterface() *net.Interface       { return nil }
 func (m *mockNetstackProvider) IsUserspaceBind() bool             { return false }
 func (m *mockNetstackProvider) GetFilter() device.PacketFilter    { return nil }
 func (m *mockNetstackProvider) GetDevice() *device.FilteredDevice { return nil }
-func (m *mockNetstackProvider) GetNet() *netstack.Net             { return nil }
+func (m *mockNetstackProvider) GetNet() *wgbackend.NetstackNet    { return nil }
 func (m *mockNetstackProvider) GetInterfaceGUIDString() (string, error) {
 	return "", nil
 }

client/internal/dns/wgiface.go

@@ -5,10 +5,9 @@ package dns
 import (
 	"net"
 
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // WGIface defines subset methods of interface required for manager
@@ -19,5 +18,5 @@ type WGIface interface {
 	IsUserspaceBind() bool
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 }

client/internal/dns/wgiface_windows.go

@@ -1,10 +1,9 @@
 package dns
 
 import (
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 // WGIface defines subset methods of interface required for manager
@@ -14,6 +13,6 @@ type WGIface interface {
 	IsUserspaceBind() bool
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	GetInterfaceGUIDString() (string, error)
 }

client/internal/dnsfwd/forwarder.go

@@ -14,10 +14,10 @@ import (
 	"github.com/hashicorp/go-multierror"
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/dns/resutil"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/route"
@@ -90,7 +90,7 @@ func NewDNSForwarder(listenAddress netip.AddrPort, ttl uint32, firewall firewall
 }
 
 func (f *DNSForwarder) Listen(entries []*ForwarderEntry) error {
-	var netstackNet *netstack.Net
+	var netstackNet *wgbackend.NetstackNet
 	if f.wgIface != nil {
 		netstackNet = f.wgIface.GetNet()
 	}
@@ -153,7 +153,7 @@ func (f *DNSForwarder) Listen(entries []*ForwarderEntry) error {
 	return <-errCh
 }
 
-func (f *DNSForwarder) createUDPListener(netstackNet *netstack.Net) (net.PacketConn, error) {
+func (f *DNSForwarder) createUDPListener(netstackNet *wgbackend.NetstackNet) (net.PacketConn, error) {
 	if netstackNet != nil {
 		return netstackNet.ListenUDPAddrPort(f.listenAddress)
 	}
@@ -161,7 +161,7 @@ func (f *DNSForwarder) createUDPListener(netstackNet *netstack.Net) (net.PacketC
 	return net.ListenUDP("udp", net.UDPAddrFromAddrPort(f.listenAddress))
 }
 
-func (f *DNSForwarder) createTCPListener(netstackNet *netstack.Net) (net.Listener, error) {
+func (f *DNSForwarder) createTCPListener(netstackNet *wgbackend.NetstackNet) (net.Listener, error) {
 	if netstackNet != nil {
 		return netstackNet.ListenTCPAddrPort(f.listenAddress)
 	}

client/internal/dnsfwd/manager.go

@@ -9,11 +9,11 @@ import (
 
 	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -28,7 +28,7 @@ const (
 
 // wgIface defines the interface for WireGuard interface operations needed by the DNS forwarder.
 type wgIface interface {
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	Address() wgaddr.Address
 }
 

client/internal/engine.go

@@ -18,11 +18,9 @@ import (
 	"time"
 
 	"github.com/hashicorp/go-multierror"
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	"github.com/pion/stun/v3"
 	log "github.com/sirupsen/logrus"
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/anonymize"
@@ -36,6 +34,7 @@ import (
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/acl"
 	"github.com/netbirdio/netbird/client/internal/certproof"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -245,7 +244,7 @@ type Engine struct {
 	// wgInterface. Reaching the device through wgInterface requires
 	// syncMsgMux, which handleSync holds while it adds and removes peers;
 	// SetPerformance must stay reachable exactly when that work is stuck.
-	wgDevice atomic.Pointer[wgdevice.Device]
+	wgDevice atomic.Pointer[wgbackend.Device]
 
 	udpMux *udpmux.UniversalUDPMuxDefault
 
@@ -2703,7 +2702,7 @@ func (e *Engine) stopDNSForwarder() {
 	e.dnsForwardMgr = nil
 }
 
-func (e *Engine) GetNet() (*netstack.Net, error) {
+func (e *Engine) GetNet() (*wgbackend.NetstackNet, error) {
 	e.syncMsgMux.Lock()
 	intf := e.wgInterface
 	e.syncMsgMux.Unlock()

client/internal/engine_test.go

@@ -14,10 +14,9 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 
 	"github.com/netbirdio/netbird/client/iface"
@@ -61,11 +60,11 @@ type MockWGIface struct {
 	SetFilterFunc              func(filter device.PacketFilter) error
 	GetFilterFunc              func() device.PacketFilter
 	GetDeviceFunc              func() *device.FilteredDevice
-	GetWGDeviceFunc            func() *wgdevice.Device
+	GetWGDeviceFunc            func() *wgbackend.Device
 	GetStatsFunc               func() (map[string]configurer.WGStats, error)
 	GetInterfaceGUIDStringFunc func() (string, error)
 	GetProxyFunc               func() wgproxy.Proxy
-	GetNetFunc                 func() *netstack.Net
+	GetNetFunc                 func() *wgbackend.NetstackNet
 	LastActivitiesFunc         func() map[string]monotime.Time
 }
 
@@ -149,7 +148,7 @@ func (m *MockWGIface) GetDevice() *device.FilteredDevice {
 	return m.GetDeviceFunc()
 }
 
-func (m *MockWGIface) GetWGDevice() *wgdevice.Device {
+func (m *MockWGIface) GetWGDevice() *wgbackend.Device {
 	return m.GetWGDeviceFunc()
 }
 
@@ -161,7 +160,7 @@ func (m *MockWGIface) GetProxy() wgproxy.Proxy {
 	return m.GetProxyFunc()
 }
 
-func (m *MockWGIface) GetNet() *netstack.Net {
+func (m *MockWGIface) GetNet() *wgbackend.NetstackNet {
 	return m.GetNetFunc()
 }
 

client/internal/iface_common.go

@@ -5,14 +5,13 @@ import (
 	"net/netip"
 	"time"
 
-	wgdevice "golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 	"github.com/netbirdio/netbird/monotime"
 )
@@ -37,9 +36,9 @@ type wgIfaceBase interface {
 	SetFilter(filter device.PacketFilter) error
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetWGDevice() *wgdevice.Device
+	GetWGDevice() *wgbackend.Device
 	GetStats() (map[string]configurer.WGStats, error)
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 	FullStats() (*configurer.Stats, error)
 	LastActivities() map[string]monotime.Time
 	SetPresharedKey(peerKey string, psk wgtypes.Key, updateOnly bool) error

client/internal/peer/conn.go

@@ -10,7 +10,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 

client/internal/peer/guard/ice_monitor.go

@@ -8,7 +8,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	log "github.com/sirupsen/logrus"
 
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"

client/internal/peer/ice/agent.go

@@ -6,7 +6,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	"github.com/pion/logging"
 	"github.com/pion/randutil"
 	log "github.com/sirupsen/logrus"

client/internal/peer/ice/config.go

@@ -1,7 +1,7 @@
 package ice
 
 import (
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )

client/internal/peer/signaler.go

@@ -1,7 +1,7 @@
 package peer
 
 import (
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 

client/internal/peer/worker_ice.go

@@ -9,7 +9,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface"

client/internal/peer/worker_ice_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/pion/ice/v4"
+	"github.com/netbirdio/ice/v4"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )

client/internal/routemanager/iface/iface_common.go

@@ -4,10 +4,9 @@ import (
 	"net"
 	"net/netip"
 
-	"golang.zx2c4.com/wireguard/tun/netstack"
-
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 )
 
 type wgIfaceBase interface {
@@ -20,5 +19,5 @@ type wgIfaceBase interface {
 	IsUserspaceBind() bool
 	GetFilter() device.PacketFilter
 	GetDevice() *device.FilteredDevice
-	GetNet() *netstack.Net
+	GetNet() *wgbackend.NetstackNet
 }

client/internal/routemanager/reconcile_test.go

@@ -10,10 +10,10 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
 )
 
@@ -48,7 +48,7 @@ func (m *reconcileWGMock) ToInterface() *net.Interface                { return n
 func (m *reconcileWGMock) IsUserspaceBind() bool                      { return false }
 func (m *reconcileWGMock) GetFilter() device.PacketFilter             { return nil }
 func (m *reconcileWGMock) GetDevice() *device.FilteredDevice          { return nil }
-func (m *reconcileWGMock) GetNet() *netstack.Net                      { return nil }
+func (m *reconcileWGMock) GetNet() *wgbackend.NetstackNet             { return nil }
 
 // TestReconcilePeerAllowedIPs verifies the declarative reconcile re-applies every routed prefix
 // tracked for the peer (self-heal, independent of refcount level) and stays scoped to that peer.

client/ssh/server/server.go

@@ -20,9 +20,9 @@ import (
 	log "github.com/sirupsen/logrus"
 	cryptossh "golang.org/x/crypto/ssh"
 	"golang.org/x/exp/maps"
-	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgbackend"
 	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	"github.com/netbirdio/netbird/client/ssh/detection"
 	"github.com/netbirdio/netbird/shared/auth"
@@ -167,7 +167,7 @@ type Server struct {
 	allowSFTP                 bool
 	jwtEnabled                bool
 
-	netstackNet *netstack.Net
+	netstackNet *wgbackend.NetstackNet
 
 	wgAddress wgaddr.Address
 
@@ -445,7 +445,7 @@ func (s *Server) buildSessionInfo(state *sessionState) SessionInfo {
 }
 
 // SetNetstackNet sets the netstack network for userspace networking
-func (s *Server) SetNetstackNet(net *netstack.Net) {
+func (s *Server) SetNetstackNet(net *wgbackend.NetstackNet) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.netstackNet = net

client/ui/frontend/.prettierrc

@@ -8,5 +8,6 @@
     "arrowParens": "always",
     "endOfLine": "lf",
     "plugins": ["prettier-plugin-tailwindcss"],
+    "tailwindStylesheet": "./src/globals.css",
     "tailwindFunctions": ["cn", "clsx", "cva", "tw"]
 }

client/ui/frontend/package.json

@@ -46,11 +46,11 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
+    "@tailwindcss/vite": "^4.3.3",
     "@types/node": "^25.6.0",
     "@types/react": "^18.3.18",
     "@types/react-dom": "^18.3.5",
     "@vitejs/plugin-react": "^4.3.4",
-    "autoprefixer": "^10.4.20",
     "eslint": "^9.39.4",
     "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-react": "^7.37.5",
@@ -59,9 +59,9 @@
     "globals": "^17.6.0",
     "postcss": "^8.5.1",
     "prettier": "^3.8.3",
-    "prettier-plugin-tailwindcss": "^0.8.0",
+    "prettier-plugin-tailwindcss": "^0.8.1",
-    "tailwindcss": "^3.4.17",
+    "tailwindcss": "^4.3.3",
-    "tailwindcss-animate": "^1.0.7",
+    "tw-animate-css": "^1.4.0",
     "typescript": "^5.7.3",
     "typescript-eslint": "^8.61.1",
     "vite": "^6.0.7"

client/ui/frontend/postcss.config.js

@@ -1,6 +0,0 @@
-export default {
-  plugins: {
-    tailwindcss: {},
-    autoprefixer: {},
-  },
-};

client/ui/frontend/src/components/Badge.tsx

@@ -30,7 +30,7 @@ export const Badge = forwardRef<HTMLSpanElement, Props>(function Badge(
             ref={ref}
             className={cn(
                 "relative top-px inline-flex items-center gap-1 rounded-full px-1.5 py-[0.15rem]",
-                "shrink-0 text-[0.64rem] font-semibold leading-none",
+                "shrink-0 text-[0.64rem] leading-none font-semibold",
                 VARIANT_CLASSES[variant],
                 className,
             )}

client/ui/frontend/src/components/CopyToClipboard.tsx

@@ -4,8 +4,8 @@ import { Check, Copy } from "lucide-react";
 import { cn } from "@/lib/cn";
 
 const VARIANT_HOVER = {
-    default: "group-hover/copy:[&_*]:text-nb-gray-300",
+    default: "**:group-hover/copy:text-nb-gray-300",
-    bright: "group-hover/copy:[&_*]:text-nb-gray-200",
+    bright: "**:group-hover/copy:text-nb-gray-200",
 } as const;
 
 type CopyToClipboardVariant = keyof typeof VARIANT_HOVER;
@@ -80,7 +80,7 @@ export const CopyToClipboard = ({
             aria-label={resolvedLabel}
             aria-live={"polite"}
             className={cn(
-                "group/copy wails-no-draggable pointer-events-auto inline-flex cursor-default items-center gap-2 rounded-sm text-start outline-none",
+                "group/copy wails-no-draggable pointer-events-auto inline-flex cursor-default items-center gap-2 rounded-xs text-start outline-hidden",
                 "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                 className,
             )}
@@ -88,8 +88,8 @@ export const CopyToClipboard = ({
             <span
                 className={cn(
                     "relative min-w-0",
-                    wrap ? "whitespace-pre-wrap break-all" : "truncate",
+                    wrap ? "break-all whitespace-pre-wrap" : "truncate",
-                    "[&_*]:transition-colors",
+                    "**:transition-colors",
                     VARIANT_HOVER[variant],
                 )}
             >
@@ -104,7 +104,7 @@ export const CopyToClipboard = ({
             <span
                 aria-hidden={"true"}
                 className={cn(
-                    "relative end-[1px] top-[2px] inline-flex shrink-0",
+                    "relative inset-e-[1px] top-[2px] inline-flex shrink-0",
                     iconAlignment === "left" ? "order-first" : "order-last",
                     iconClassName,
                 )}

client/ui/frontend/src/components/DropdownMenu.tsx

@@ -36,8 +36,8 @@ const DropdownMenuSubTrigger = React.forwardRef<
     <DropdownMenuPrimitive.SubTrigger
         ref={ref}
         className={cn(
-            "relative flex cursor-default select-none items-center rounded-md py-1.5 pe-2 ps-3 text-sm outline-none",
+            "relative flex cursor-default items-center rounded-md py-1.5 ps-3 pe-2 text-sm outline-hidden select-none",
-            "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            "transition-colors data-disabled:pointer-events-none data-disabled:opacity-50",
             inset && "ps-8",
             menuItemVariants({ variant }),
             className,
@@ -57,8 +57,8 @@ const DropdownMenuSubContent = React.forwardRef<
     <DropdownMenuPrimitive.SubContent
         ref={ref}
         className={cn(
-            "z-50 min-w-[8rem] overflow-hidden rounded-md border border-nb-gray-900 bg-nb-gray-930 p-1 text-nb-gray-200 shadow-lg",
+            "z-50 min-w-32 overflow-hidden rounded-md border border-nb-gray-900 bg-nb-gray-930 p-1 text-nb-gray-200 shadow-lg",
-            "data-[state=open]:animate-in data-[state=closed]:animate-out",
+            "data-[state=closed]:animate-out data-[state=open]:animate-in",
             "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
             "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
             "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
@@ -79,8 +79,8 @@ const DropdownMenuContent = React.forwardRef<
             ref={ref}
             sideOffset={sideOffset}
             className={cn(
-                "z-50 min-w-[8rem] overflow-hidden rounded-lg border border-nb-gray-900 bg-nb-gray-935 p-1 text-nb-gray-200 shadow-lg",
+                "z-50 min-w-32 overflow-hidden rounded-lg border border-nb-gray-900 bg-nb-gray-935 p-1 text-nb-gray-200 shadow-lg",
-                "data-[state=open]:animate-in data-[state=closed]:animate-out",
+                "data-[state=closed]:animate-out data-[state=open]:animate-in",
                 "data-[state=closed]:fade-out-0 data-[state=open]:fade-in-0",
                 "data-[state=closed]:zoom-out-95 data-[state=open]:zoom-in-95",
                 "data-[side=bottom]:slide-in-from-top-2 data-[side=left]:slide-in-from-right-2",
@@ -106,8 +106,8 @@ const DropdownMenuItem = React.forwardRef<
     <DropdownMenuPrimitive.Item
         ref={ref}
         className={cn(
-            "relative flex cursor-default select-none items-center rounded-md px-2 py-1.5 text-sm outline-none",
+            "relative flex cursor-default items-center rounded-md px-2 py-1.5 text-sm outline-hidden select-none",
-            "transition-colors data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            "transition-colors data-disabled:pointer-events-none data-disabled:opacity-50",
             inset && "ps-8",
             menuItemVariants({ variant }),
             className,
@@ -138,15 +138,15 @@ const DropdownMenuCheckboxItem = React.forwardRef<
     <DropdownMenuPrimitive.CheckboxItem
         ref={ref}
         className={cn(
-            "relative flex cursor-default select-none items-center rounded-sm py-1.5 pe-2 ps-8 text-sm outline-none",
+            "relative flex cursor-default items-center rounded-xs py-1.5 ps-8 pe-2 text-sm outline-hidden select-none",
             "text-nb-gray-200 transition-colors hover:bg-nb-gray-900 hover:text-nb-gray-50 focus-visible:bg-nb-gray-900 focus-visible:text-nb-gray-50",
-            "data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            "data-disabled:pointer-events-none data-disabled:opacity-50",
             className,
         )}
         checked={checked}
         {...props}
     >
-        <span className={"absolute start-2 flex h-3.5 w-3.5 items-center justify-center"}>
+        <span className={"absolute inset-s-2 flex h-3.5 w-3.5 items-center justify-center"}>
             <DropdownMenuPrimitive.ItemIndicator>
                 <Check className={"h-4 w-4"} />
             </DropdownMenuPrimitive.ItemIndicator>
@@ -163,10 +163,10 @@ const DropdownMenuRadioItem = React.forwardRef<
     <DropdownMenuPrimitive.RadioItem
         ref={ref}
         className={cn(
-            "my-0.5 flex cursor-default select-none items-center gap-2 rounded-md px-2 py-2 outline-none",
+            "my-0.5 flex cursor-default items-center gap-2 rounded-md px-2 py-2 outline-hidden select-none",
             "text-xs font-semibold text-nb-gray-200 transition-colors",
-            "data-[highlighted]:bg-nb-gray-850 data-[highlighted]:text-nb-gray-50",
+            "data-highlighted:bg-nb-gray-850 data-highlighted:text-nb-gray-50",
-            "data-[disabled]:pointer-events-none data-[disabled]:opacity-50",
+            "data-disabled:pointer-events-none data-disabled:opacity-50",
             className,
         )}
         {...props}

client/ui/frontend/src/components/LanguagePicker.tsx

@@ -99,7 +99,7 @@ export function LanguagePicker() {
                                 "inline-flex h-[40px] min-w-[240px] items-center gap-2 px-3",
                                 "rounded-md border bg-white dark:bg-nb-gray-900",
                                 "border-neutral-200 dark:border-nb-gray-700",
-                                "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
+                                "cursor-default text-xs font-semibold text-nb-gray-100 outline-hidden",
                                 "hover:border-nb-gray-700 data-[state=open]:border-nb-gray-700 dark:hover:border-nb-gray-600 dark:data-[state=open]:border-nb-gray-600",
                                 isFocusVisible &&
                                     "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
@@ -127,7 +127,7 @@ export function LanguagePicker() {
                             align={"start"}
                             sideOffset={6}
                             className={cn(
-                                "w-[var(--radix-popover-trigger-width)]",
+                                "w-(--radix-popover-trigger-width)",
                                 "z-50 rounded-lg border border-nb-gray-850 bg-nb-gray-920 p-1 shadow-lg",
                                 "data-[side=bottom]:origin-top data-[side=top]:origin-bottom",
                                 "data-[state=open]:animate-in",
@@ -142,7 +142,7 @@ export function LanguagePicker() {
                                 loop
                                 className={cn(
                                     "flex flex-col",
-                                    "[&_[cmdk-input-wrapper]]:flex [&_[cmdk-input-wrapper]]:items-center",
+                                    "**:[[cmdk-input-wrapper]]:flex **:[[cmdk-input-wrapper]]:items-center",
                                 )}
                             >
                                 <div className={"px-1 pb-1"}>
@@ -161,7 +161,7 @@ export function LanguagePicker() {
                                             aria-label={t("settings.general.language.search")}
                                             className={cn(
                                                 "w-full bg-transparent text-xs text-nb-gray-100 placeholder:text-nb-gray-600 dark:placeholder:text-nb-gray-300",
-                                                "border-none outline-none",
+                                                "border-none outline-hidden",
                                             )}
                                         />
                                     </div>
@@ -192,7 +192,7 @@ export function LanguagePicker() {
                                                         value={`${lang.displayName} ${lang.englishName} ${lang.code}`}
                                                         onSelect={() => void select(lang.code)}
                                                         className={cn(
-                                                            "my-0.5 flex cursor-default items-center gap-2 rounded-md px-2 py-2 outline-none",
+                                                            "my-0.5 flex cursor-default items-center gap-2 rounded-md px-2 py-2 outline-hidden",
                                                             "text-xs font-semibold text-nb-gray-200",
                                                             "data-[selected=true]:bg-nb-gray-850 data-[selected=true]:text-nb-gray-50",
                                                         )}
@@ -221,7 +221,7 @@ export function LanguagePicker() {
                                     <ScrollArea.Scrollbar
                                         orientation={"vertical"}
                                         className={cn(
-                                            "flex touch-none select-none transition-colors",
+                                            "flex touch-none transition-colors select-none",
                                             "w-1.5 bg-transparent py-1",
                                         )}
                                     >

client/ui/frontend/src/components/ManagementServerSwitch.tsx

@@ -26,7 +26,7 @@ export const ManagementServerSwitch = ({ value, onChange, fullWidth = false }: P
                     src={netbirdLogo}
                     alt={""}
                     aria-hidden={"true"}
-                    className={"aspect-[31/23] h-[0.8rem] shrink-0"}
+                    className={"aspect-31/23 h-[0.8rem] shrink-0"}
                 />
                 {t("settings.general.management.cloud")}
             </SwitchItem>

client/ui/frontend/src/components/Tooltip.tsx

@@ -95,8 +95,8 @@ export const Tooltip = ({
                         onPointerLeave={interactive ? scheduleClose : undefined}
                         onPointerDownOutside={interactive ? undefined : (e) => e.preventDefault()}
                         className={cn(
-                            "z-50 select-none text-xs text-nb-gray-100 shadow-sm dark:shadow-lg",
+                            "z-50 text-xs text-nb-gray-100 shadow-xs select-none dark:shadow-lg",
-                            "data-[state=delayed-open]:animate-in data-[state=closed]:animate-out",
+                            "data-[state=closed]:animate-out data-[state=delayed-open]:animate-in",
                             "data-[state=closed]:fade-out-0 data-[state=delayed-open]:fade-in-0",
                             !interactive && "pointer-events-none",
                             contentClassName ??

client/ui/frontend/src/components/VerticalTabs.tsx

@@ -49,7 +49,7 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
         <Tabs.Trigger
             ref={ref}
             className={cn(
-                "group flex w-full cursor-default items-center gap-3 rounded-md border border-transparent px-2 py-2.5 text-start outline-none dark:border-0",
+                "group flex w-full cursor-default items-center gap-3 rounded-md border border-transparent px-2 py-2.5 text-start outline-hidden dark:border-0",
                 "transition-colors duration-150",
                 "data-[state=active]:border-nb-gray-800 data-[state=active]:bg-white dark:data-[state=active]:bg-nb-gray-930",
                 "data-[state=inactive]:hover:bg-nb-gray-850 dark:data-[state=inactive]:hover:bg-nb-gray-935",
@@ -65,20 +65,20 @@ const Trigger = forwardRef<HTMLButtonElement, TriggerProps>(function VerticalTab
                 className={cn(
                     "ms-2 shrink-0 transition-colors duration-150",
                     "text-nb-gray-350 dark:text-nb-gray-400",
-                    "group-data-[state=active]:text-nb-gray-100",
+                    "group-data-[state=active]:text-nb-gray-100 dark:group-data-[state=active]:text-nb-gray-100",
                 )}
             />
             <span
                 className={cn(
                     "min-w-0 truncate text-sm font-medium transition-colors duration-150",
                     "text-nb-gray-350 dark:text-nb-gray-400",
-                    "group-data-[state=active]:font-semibold group-data-[state=active]:text-nb-gray-100 dark:group-data-[state=active]:font-medium",
+                    "group-data-[state=active]:font-semibold group-data-[state=active]:text-nb-gray-100 dark:group-data-[state=active]:font-medium dark:group-data-[state=active]:text-nb-gray-100",
                 )}
             >
                 {title}
             </span>
             {adornment && (
-                <div aria-hidden={"true"} className={"me-2 ms-auto shrink-0"}>
+                <div aria-hidden={"true"} className={"ms-auto me-2 shrink-0"}>
                     {adornment}
                 </div>
             )}
@@ -94,7 +94,7 @@ const Content = forwardRef<HTMLDivElement, Tabs.TabsContentProps>(function Verti
         <Tabs.Content
             ref={ref}
             tabIndex={-1}
-            className={cn("outline-none", className)}
+            className={cn("outline-hidden", className)}
             {...props}
         />
     );

client/ui/frontend/src/components/buttons/Button.tsx

@@ -16,9 +16,9 @@ interface ButtonProps extends ButtonHTMLAttributes<HTMLButtonElement>, ButtonVar
 const buttonVariants = cva(
     [
         "relative",
-        "cursor-default select-none whitespace-nowrap text-sm font-medium shadow-sm focus:z-10 focus:outline-none focus:ring-2",
+        "cursor-default text-sm font-medium whitespace-nowrap shadow-xs select-none focus:z-10 focus:ring-2 focus:outline-hidden",
         "inline-flex items-center justify-center gap-2 transition-colors focus:ring-offset-1",
-        "disabled:cursor-not-allowed disabled:opacity-40 dark:ring-offset-neutral-950/50 disabled:dark:text-nb-gray-300",
+        "disabled:cursor-not-allowed disabled:opacity-40 dark:ring-offset-neutral-950/50 dark:disabled:text-nb-gray-300",
     ],
     {
         variants: {
@@ -28,7 +28,7 @@ const buttonVariants = cva(
                     "dark:border-gray-700/30 dark:bg-nb-gray dark:text-gray-400 dark:hover:bg-zinc-800/50 dark:hover:text-nb-gray-50 dark:focus:ring-zinc-800/50",
                 ],
                 primary: [
-                    "dark:text-gray-100 dark:ring-offset-neutral-950/50 dark:focus:ring-netbird-600/50 enabled:dark:bg-netbird enabled:dark:hover:bg-netbird-500/80 enabled:dark:hover:text-nb-gray-50 disabled:dark:bg-nb-gray-900",
+                    "dark:text-gray-100 dark:ring-offset-neutral-950/50 dark:focus:ring-netbird-600/50 dark:enabled:bg-netbird dark:enabled:hover:bg-netbird-500/80 dark:enabled:hover:text-nb-gray-50 dark:disabled:bg-nb-gray-900",
                     "enabled:bg-netbird enabled:text-white enabled:hover:bg-netbird-500 enabled:focus:ring-netbird-400/50 disabled:bg-nb-gray-700",
                 ],
                 secondary: [
@@ -63,11 +63,11 @@ const buttonVariants = cva(
                 ],
                 tertiary: [
                     "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
-                    "dark:border-gray-700/40 dark:bg-white dark:text-gray-800 dark:hover:bg-neutral-200 dark:focus:ring-zinc-800/50 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300",
+                    "dark:border-gray-700/40 dark:bg-white dark:text-gray-800 dark:hover:bg-neutral-200 dark:focus:ring-zinc-800/50 dark:disabled:bg-nb-gray-920 dark:disabled:text-nb-gray-300",
                 ],
                 white: [
-                    "border-white bg-white text-neutral-800 outline-none hover:bg-neutral-200 focus:ring-white/50 dark:text-gray-800 disabled:dark:bg-nb-gray-920 disabled:dark:text-nb-gray-300",
+                    "border-white bg-white text-neutral-800 outline-hidden hover:bg-neutral-200 focus:ring-white/50 dark:text-gray-800 dark:disabled:bg-nb-gray-920 dark:disabled:text-nb-gray-300",
-                    "disabled:dark:border-nb-gray-900 disabled:dark:bg-nb-gray-900 disabled:dark:text-nb-gray-300",
+                    "dark:disabled:border-nb-gray-900 dark:disabled:bg-nb-gray-900 dark:disabled:text-nb-gray-300",
                 ],
                 outline: [
                     "border-neutral-200 bg-white text-neutral-900 hover:bg-neutral-100 hover:text-black focus:ring-neutral-200/50",
@@ -75,10 +75,10 @@ const buttonVariants = cva(
                 ],
                 "danger-outline": [
                     "bg-transparent text-red-600 enabled:hover:bg-red-50 enabled:focus:ring-red-200/50",
-                    "dark:bg-transparent dark:text-red-500 enabled:dark:hover:border-red-800/50 enabled:hover:dark:bg-red-950/50 enabled:dark:focus:bg-red-950/40 enabled:dark:focus:ring-red-800/20",
+                    "dark:bg-transparent dark:text-red-500 dark:enabled:hover:border-red-800/50 dark:enabled:hover:bg-red-950/50 dark:enabled:focus:bg-red-950/40 dark:enabled:focus:ring-red-800/20",
                 ],
                 "danger-text": [
-                    "rounded-sm border-transparent bg-transparent !px-0 !py-0 text-red-600 !shadow-none hover:text-red-700 focus:ring-red-500/30",
+                    "rounded-xs border-transparent bg-transparent px-0! py-0! text-red-600 shadow-none! hover:text-red-700 focus:ring-red-500/30",
                     "dark:border-transparent dark:bg-transparent dark:text-red-500 dark:ring-offset-neutral-950/50 dark:hover:text-red-600",
                 ],
                 "default-outline": [
@@ -92,12 +92,12 @@ const buttonVariants = cva(
                 ],
                 danger: [
                     "bg-red-600 text-red-50 hover:bg-red-700 focus:bg-red-700 focus:ring-red-700/20",
-                    "dark:bg-red-600 dark:text-red-100 dark:hover:border-red-800/50 hover:dark:bg-red-700 dark:focus:bg-red-700 dark:focus:ring-red-700/20",
+                    "dark:bg-red-600 dark:text-red-100 dark:hover:border-red-800/50 dark:hover:bg-red-700 dark:focus:bg-red-700 dark:focus:ring-red-700/20",
                 ],
             },
             size: {
                 xs: "px-3.5 py-2.5 text-xs",
-                xs2: "px-4 py-[1.1rem] text-[0.78rem] leading-[0]",
+                xs2: "px-4 py-[1.1rem] text-[0.78rem] leading-0",
                 sm: "px-4 py-[9px] text-sm",
                 md: "px-4 py-[9px]",
                 lg: "px-4 py-[9px] text-lg",
@@ -109,7 +109,7 @@ const buttonVariants = cva(
             border: {
                 0: "border",
                 1: "border border-transparent",
-                2: "border border-b-0 border-t-0",
+                2: "border border-t-0 border-b-0",
             },
         },
     },

client/ui/frontend/src/components/buttons/IconButton.tsx

@@ -21,7 +21,7 @@ export const IconButton = forwardRef<HTMLButtonElement, Props>(function IconButt
             disabled={disabled}
             tabIndex={disabled ? -1 : 0}
             className={cn(
-                "flex h-10 w-10 cursor-default items-center justify-center rounded-lg outline-none",
+                "flex h-10 w-10 cursor-default items-center justify-center rounded-lg outline-hidden",
                 "text-nb-gray-400 hover:bg-nb-gray-900 hover:text-nb-gray-300",
                 isFocusVisible &&
                     "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",

client/ui/frontend/src/components/dialog/ConfirmDialog.tsx

@@ -18,13 +18,13 @@ export const ConfirmDialog = forwardRef<HTMLDivElement, ConfirmDialogProps>(func
             aria-label={ariaLabel}
             aria-labelledby={ariaLabelledBy}
             className={
-                "wails-draggable static m-0 flex max-h-none w-full max-w-none select-none flex-col items-center border-0 bg-transparent p-0 text-inherit"
+                "wails-draggable static m-0 flex max-h-none w-full max-w-none flex-col items-center border-0 bg-transparent p-0 text-inherit select-none"
             }
         >
             <div
                 ref={ref}
                 className={cn(
-                    "flex flex-col items-center gap-5 px-8 pb-7 pt-6 text-center",
+                    "flex flex-col items-center gap-5 px-8 pt-6 pb-7 text-center",
                     isMacOS() && "pt-10",
                 )}
             >

client/ui/frontend/src/components/dialog/Dialog.tsx

@@ -65,8 +65,8 @@ export const Content = forwardRef<ElementRef<typeof DialogPrimitive.Content>, Co
                     <DialogPrimitive.Content
                         ref={ref}
                         className={cn(
-                            "relative z-[52] mx-auto w-full outline-none ring-0",
+                            "relative z-52 mx-auto w-full ring-0 outline-hidden",
-                            "focus:outline-none focus:ring-0 focus-visible:outline-none focus-visible:ring-0",
+                            "focus:ring-0 focus:outline-hidden focus-visible:ring-0 focus-visible:outline-hidden",
                             "rounded-lg border border-nb-gray-800 bg-nb-gray-940 py-7 shadow-2xl dark:border-nb-gray-900 dark:bg-nb-gray",
                             "data-[state=open]:animate-in data-[state=open]:fade-in-0",
                             "data-[state=open]:zoom-in-95 data-[state=open]:slide-in-from-left-1",
@@ -95,9 +95,9 @@ export const Content = forwardRef<ElementRef<typeof DialogPrimitive.Content>, Co
                         {showClose && (
                             <DialogPrimitive.Close
                                 className={cn(
-                                    "absolute end-3 top-3 z-10 rounded-md p-3 transition-colors",
+                                    "absolute inset-e-3 top-3 z-10 rounded-md p-3 transition-colors",
                                     "text-nb-gray-300 hover:text-nb-gray-100",
-                                    "focus:outline-none disabled:pointer-events-none",
+                                    "focus:outline-hidden disabled:pointer-events-none",
                                 )}
                                 aria-label={t("common.close")}
                             >
@@ -119,7 +119,7 @@ export const Title = forwardRef<
         <DialogPrimitive.Title
             ref={ref}
             className={cn(
-                "text-md font-semibold leading-none tracking-tight text-nb-gray-50",
+                "text-md leading-none font-semibold tracking-tight text-nb-gray-50",
                 className,
             )}
             {...props}
@@ -149,7 +149,7 @@ export const Footer = ({ className, separator = true, ...props }: FooterProps) =
         <div
             className={cn(
                 "flex flex-col-reverse gap-3 sm:flex-row sm:justify-end",
-                "[&>*]:w-full sm:[&>*]:w-auto",
+                "*:w-full sm:*:w-auto",
                 "px-8 pt-6",
                 className,
             )}

client/ui/frontend/src/components/dialog/DialogDescription.tsx

@@ -20,7 +20,7 @@ export const DialogDescription = ({
     className,
     align = "center",
 }: DialogDescriptionProps) => (
-    <p className={cn("w-full select-none text-sm text-nb-gray-300", alignClass[align], className)}>
+    <p className={cn("w-full text-sm text-nb-gray-300 select-none", alignClass[align], className)}>
         {children}
     </p>
 );

client/ui/frontend/src/components/dialog/DialogHeading.tsx

@@ -25,7 +25,7 @@ export const DialogHeading = ({
     <h2
         id={id}
         className={cn(
-            "w-full select-none text-base font-semibold text-nb-gray-50",
+            "w-full text-base font-semibold text-nb-gray-50 select-none",
             alignClass[align],
             className,
         )}

client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx

@@ -41,7 +41,7 @@ export const DaemonOutdatedOverlay = () => {
     return (
         <div
             className={
-                "wails-draggable fixed inset-0 z-[100] flex cursor-default select-none items-center justify-center bg-nb-gray-950 backdrop-blur-sm"
+                "wails-draggable fixed inset-0 z-100 flex cursor-default items-center justify-center bg-nb-gray-950 backdrop-blur-xs select-none"
             }
         >
             <div className={"flex max-w-lg flex-col items-center gap-5 px-8 text-center"}>

client/ui/frontend/src/components/empty-state/DaemonUnavailableOverlay.tsx

@@ -26,7 +26,7 @@ export const DaemonUnavailableOverlay = () => {
     return (
         <div
             className={
-                "wails-draggable fixed inset-0 z-[100] flex cursor-default select-none items-center justify-center bg-nb-gray-950 backdrop-blur-sm"
+                "wails-draggable fixed inset-0 z-100 flex cursor-default items-center justify-center bg-nb-gray-950 backdrop-blur-xs select-none"
             }
         >
             <div className={"flex max-w-lg flex-col items-center gap-5 px-8 text-center"}>

client/ui/frontend/src/components/empty-state/NoResults.tsx

@@ -16,7 +16,7 @@ export const NoResults = ({ icon = FunnelXIcon, title, description }: Props) =>
             icon={icon}
             title={title ?? t("common.noResults.title")}
             description={description ?? t("common.noResults.description")}
-            className={"pointer-events-none relative -top-[3.8rem]"}
+            className={"pointer-events-none relative top-[-3.8rem]"}
         />
     );
 };

client/ui/frontend/src/components/empty-state/NotConnectedState.tsx

@@ -5,7 +5,7 @@ import { EmptyState } from "./EmptyState";
 export const NotConnectedState = () => {
     const { t } = useTranslation();
     return (
-        <div className={"relative top-[3rem] w-full"}>
+        <div className={"relative top-12 w-full"}>
             <EmptyState
                 icon={GlobeOffIcon}
                 title={t("notConnected.title")}

client/ui/frontend/src/components/inputs/Input.tsx

@@ -82,17 +82,17 @@ function buildInputClassName(
 ): string {
     return cn(
         inputVariants({ variant: opts.variant }),
-        "flex h-[40px] w-full select-text rounded-md bg-white px-3 py-2 text-sm",
+        "flex h-[40px] w-full rounded-md bg-white px-3 py-2 text-sm select-text",
         "file:border-0 file:bg-transparent file:text-sm file:font-medium",
-        "focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-offset-2",
+        "focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:outline-hidden",
         "disabled:cursor-not-allowed disabled:opacity-40",
-        opts.hasCustomPrefix && "!rounded-s-none !border-s-0",
+        opts.hasCustomPrefix && "rounded-s-none! border-s-0!",
-        opts.hasSuffix && "!pe-9",
+        opts.hasSuffix && "pe-9!",
-        opts.hasIcon && "!ps-10",
+        opts.hasIcon && "ps-10!",
         "border",
-        opts.readOnly && "!border-nb-gray-800 !bg-nb-gray-910 text-nb-gray-350",
+        opts.readOnly && "border-nb-gray-800! bg-nb-gray-910! text-nb-gray-350",
         opts.showStepper &&
-            "!rounded-e-none [-moz-appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none",
+            "rounded-e-none! [-moz-appearance:textfield] [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none",
         opts.className,
     );
 }
@@ -108,7 +108,7 @@ function InputAffix({
             className={cn(
                 inputVariants({ prefixSuffixVariant: error ? "error" : "default" }),
                 "flex h-[40px] w-auto rounded-s-md bg-white px-3 py-2 text-sm",
-                "items-center whitespace-nowrap border",
+                "items-center border whitespace-nowrap",
                 disabled && "opacity-40",
                 className,
             )}
@@ -122,7 +122,7 @@ function InputIconSlot({ icon, disabled }: Readonly<{ icon: ReactNode; disabled?
     return (
         <div
             className={cn(
-                "absolute start-0 top-0 flex h-full items-center ps-3 text-xs leading-[0] dark:text-nb-gray-300",
+                "absolute inset-s-0 top-0 flex h-full items-center ps-3 text-xs leading-0 dark:text-nb-gray-300",
                 disabled && "opacity-40",
             )}
         >
@@ -138,7 +138,7 @@ function InputSuffixSlot({
     return (
         <div
             className={cn(
-                "pointer-events-none absolute end-0 top-0 flex h-full select-none items-center pe-3 text-xs leading-[0] dark:text-nb-gray-300",
+                "pointer-events-none absolute inset-e-0 top-0 flex h-full items-center pe-3 text-xs leading-0 select-none dark:text-nb-gray-300",
                 disabled && "opacity-30",
             )}
         >
@@ -349,7 +349,7 @@ export const Input = forwardRef<HTMLInputElement, InputProps>(function Input(
 
                 {icon && <InputIconSlot icon={icon} disabled={props.disabled} />}
 
-                <div className={"relative flex min-w-0 flex-grow"}>
+                <div className={"relative flex min-w-0 grow"}>
                     <input
                         id={inputId}
                         type={inputType}

client/ui/frontend/src/components/inputs/SearchInput.tsx

@@ -34,7 +34,7 @@ export const SearchInput = forwardRef<HTMLInputElement, Props>(function SearchIn
                 {...props}
                 className={cn(
                     "w-full bg-transparent text-sm text-nb-gray-200 placeholder:text-nb-gray-600 dark:placeholder:text-nb-gray-400",
-                    "border-none outline-none",
+                    "border-none outline-hidden",
                     disabled && "cursor-not-allowed",
                     className,
                 )}
@@ -45,7 +45,7 @@ export const SearchInput = forwardRef<HTMLInputElement, Props>(function SearchIn
                     className={cn(
                         "shrink-0 select-none",
                         "inline-flex items-center justify-center",
-                        "h-5 min-w-[20px] rounded px-1.5",
+                        "h-5 min-w-[20px] rounded-sm px-1.5",
                         "border border-nb-gray-850 bg-nb-gray-920",
                         "text-[10px] font-medium text-nb-gray-400",
                         "wails-no-draggable",

client/ui/frontend/src/components/inputs/Select.tsx

@@ -49,7 +49,7 @@ export function Select<T extends string>({
                         "inline-flex h-[40px] min-w-[160px] items-center gap-2 px-3",
                         "rounded-md border bg-white dark:bg-nb-gray-900",
                         "border-neutral-200 dark:border-nb-gray-700",
-                        "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
+                        "cursor-default text-xs font-semibold text-nb-gray-100 outline-hidden",
                         "hover:border-nb-gray-700 data-[state=open]:border-nb-gray-700 dark:hover:border-nb-gray-600 dark:data-[state=open]:border-nb-gray-600",
                         isFocusVisible &&
                             "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
@@ -76,7 +76,7 @@ export function Select<T extends string>({
                 align={"start"}
                 sideOffset={6}
                 className={
-                    "w-[var(--radix-dropdown-menu-trigger-width)] border-nb-gray-850 bg-nb-gray-920"
+                    "w-(--radix-dropdown-menu-trigger-width) border-nb-gray-850 bg-nb-gray-920"
                 }
             >
                 <DropdownMenuRadioGroup value={value} onValueChange={(v) => onChange(v as T)}>

client/ui/frontend/src/components/switches/FancyToggleSwitch.tsx

@@ -36,7 +36,7 @@ export default function FancyToggleSwitch({
 
     if (loading) {
         const shimmer =
-            "text-transparent select-none rounded bg-nb-gray-920 box-decoration-clone animate-pulse";
+            "text-transparent select-none rounded-sm bg-nb-gray-920 box-decoration-clone animate-pulse";
         return (
             <div
                 role={"status"}
@@ -72,7 +72,7 @@ export default function FancyToggleSwitch({
         <div
             {...(disabled ? { inert: "" } : {})}
             className={cn(
-                "relative z-[1] cursor-default transition-all duration-300",
+                "relative z-1 cursor-default transition-all duration-300",
                 "inline-block w-full text-start",
                 disabled && "pointer-events-none opacity-30",
                 className,

client/ui/frontend/src/components/switches/SwitchItem.tsx

@@ -19,7 +19,7 @@ export const SwitchItem = ({ value, children, className }: Props) => {
             value={value}
             className={cn(
                 "relative inline-flex items-center justify-center gap-1 rounded-md px-3.5 py-2 text-xs font-semibold",
-                "cursor-default outline-none",
+                "cursor-default outline-hidden",
                 "focus-visible:ring-2 focus-visible:ring-nb-gray-50/60 focus-visible:ring-offset-2 focus-visible:ring-offset-nb-gray-940",
                 active
                     ? "text-nb-gray-100"
@@ -31,7 +31,7 @@ export const SwitchItem = ({ value, children, className }: Props) => {
                 <motion.span
                     layoutId={layoutId}
                     className={
-                        "absolute inset-0 rounded-md bg-white shadow-sm dark:bg-nb-gray-700 dark:shadow-none"
+                        "absolute inset-0 rounded-md bg-white shadow-xs dark:bg-nb-gray-700 dark:shadow-none"
                     }
                     transition={{ type: "spring", stiffness: 500, damping: 35 }}
                 />