[management] Record activity for a peer that was never seen

peer_status_last_seen is nullable — Status is an embedded pointer, so a peer
stored without one leaves the column NULL — and NULL loses the cutoff
comparison, so such a peer was silently skipped forever instead of recording
its first activity.

.goreleaser_ui.yaml

@@ -96,7 +96,6 @@ nfpms:
       - netbird (>= 0.75.0)
       - libgtk-4-1 (>= 4.14)
       - libwebkitgtk-6.0-4
-      - xdg-utils
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -120,7 +119,6 @@ nfpms:
       - netbird >= 0.75.0
       - (gtk4 >= 4.14 or libgtk-4-1 >= 4.14)
       - (webkitgtk6.0 or libwebkitgtk-6_0-4)
-      - xdg-utils
 
     rpm:
       signature:

.goreleaser_ui_gtk3.yaml

@@ -71,7 +71,6 @@ nfpms:
       - netbird (>= 0.75.0)
       - libgtk-3-0
       - libwebkit2gtk-4.1-0
-      - xdg-utils
 
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client UI.
@@ -96,7 +95,6 @@ nfpms:
       - netbird >= 0.75.0
       - (gtk3 or libgtk-3-0)
       - (webkit2gtk4.1 or libwebkit2gtk-4_1-0)
-      - xdg-utils
 
     rpm:
       signature:
@@ -114,13 +112,6 @@ uploads:
   # The gtk3 packages reuse the netbird-ui package name, so they live in
   # dedicated repo paths (deb distribution `gtk3`, yum path `yum-gtk3`) that
   # legacy distros point their repo config at.
-  #
-  # GoReleaser derives the credential env var from the upload name, so these
-  # would look for UPLOAD_DEBIAN-GTK3_SECRET / UPLOAD_YUM-GTK3_SECRET. The
-  # release workflow only exports UPLOAD_DEBIAN_SECRET / UPLOAD_YUM_SECRET, and
-  # a missing secret is a silent skip rather than a failure -- the packages
-  # reached the GitHub release but never the package repositories. Point
-  # `password` at the exported vars so both uploads authenticate.
   - name: debian-gtk3
     skip: "{{ .Env.SKIP_PUBLISH }}"
     ids:
@@ -128,7 +119,6 @@ uploads:
     mode: archive
     target: https://pkgs.wiretrustee.com/debian/pool/{{ .ArtifactName }};deb.distribution=gtk3;deb.component=main;deb.architecture={{ if .Arm }}armhf{{ else }}{{ .Arch }}{{ end }};deb.package=
     username: dev@wiretrustee.com
-    password: "{{ .Env.UPLOAD_DEBIAN_SECRET }}"
     method: PUT
 
   - name: yum-gtk3
@@ -138,5 +128,4 @@ uploads:
     mode: archive
     target: https://pkgs.wiretrustee.com/yum-gtk3/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
-    password: "{{ .Env.UPLOAD_YUM_SECRET }}"
     method: PUT

client/android/client.go

@@ -15,7 +15,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	nbAnonymize "github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -33,13 +32,6 @@ import (
 	types "github.com/netbirdio/netbird/upload-server/types"
 )
 
-// AnonymizeLevelDefault and AnonymizeLevelStrict are the accepted
-// anonymizeLevel values for DebugBundle.
-const (
-	AnonymizeLevelDefault = nbAnonymize.LevelDefaultString
-	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
-)
-
 // ConnectionListener export internal Listener for mobile
 type ConnectionListener interface {
 	peer.Listener
@@ -286,10 +278,8 @@ func (c *Client) GetTunSettings() (*TunSettings, error) {
 }
 
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
-// It works both with and without a running engine. anonymizeLevel is "default"
-// or "strict"; strict also anonymizes internal IP ranges, peer names, and
-// WireGuard public keys, and implies anonymize.
-func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonymizeLevel string) (string, error) {
+// It works both with and without a running engine.
+func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (string, error) {
 	cfg, cacheDir, cc := c.stateSnapshot()
 
 	// If the engine hasn't been started, load config from disk
@@ -308,7 +298,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonym
 		InternalConfig: cfg,
 		StatusRecorder: c.recorder,
 		TempDir:        cacheDir,
-		StatePath:      platformFiles.StateFilePath(),
 	}
 
 	if cc != nil {
@@ -332,7 +321,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool, anonym
 		deps,
 		debug.BundleConfig{
 			Anonymize:         anonymize,
-			AnonymizeLevel:    nbAnonymize.ParseLevel(anonymizeLevel),
 			IncludeSystemInfo: true,
 		},
 	)

client/anonymize/anonymize.go

@@ -2,7 +2,6 @@ package anonymize
 
 import (
 	"crypto/rand"
-	"encoding/base64"
 	"fmt"
 	"math/big"
 	"net"
@@ -16,88 +15,13 @@ import (
 
 const anonTLD = ".domain"
 
-// Level selects how much the anonymizer redacts. Levels are ordered: a higher
-// level redacts strictly more. On the wire (protos, flags) levels travel as
-// their string form.
-type Level int
-
-const (
-	// LevelDefault anonymizes public IP addresses, IPv6 ULA, domains, and MAC
-	// addresses. Internal IPv4 ranges (RFC 1918, CGNAT, link-local) are
-	// preserved so support can reason about the real topology.
-	LevelDefault Level = iota
-	// LevelStrict additionally anonymizes internal IP ranges, peer names, and
-	// WireGuard public keys.
-	LevelStrict
-)
-
-// LevelDefaultString and LevelStrictString are the wire forms of the levels,
-// for boundaries that pass levels as strings (flags, protos, mobile bindings).
-const (
-	LevelDefaultString = "default"
-	LevelStrictString  = "strict"
-)
-
-// ParseLevel maps s to a Level. Empty means LevelDefault; anything
-// unrecognized maps to LevelStrict so an unknown request never yields less
-// anonymization than intended.
-func ParseLevel(s string) Level {
-	switch strings.ToLower(s) {
-	case "", LevelDefaultString:
-		return LevelDefault
-	default:
-		return LevelStrict
-	}
-}
-
-// String returns the wire form of the level: "default" or "strict".
-func (l Level) String() string {
-	if l >= LevelStrict {
-		return LevelStrictString
-	}
-	return LevelDefaultString
-}
-
-// protectedDomains are NetBird-operated suffixes that stay recognizable in an
-// anonymized bundle. At LevelStrict the labels in front of them (the peer
-// name) are still replaced, except under netbird.io, which only hosts
-// NetBird infrastructure (api, signal, flow), never peer names.
-var protectedDomains = []string{"netbird.io", "netbird.selfhosted", "netbird.cloud", "netbird.stage"}
-
-const infraDomain = "netbird.io"
-
-var (
-	macColonRegex = regexp.MustCompile(`\b[0-9a-fA-F]{2}(?::[0-9a-fA-F]{2}){5}\b`)
-	macDashRegex  = regexp.MustCompile(`\b[0-9a-fA-F]{2}(?:-[0-9a-fA-F]{2}){5}\b`)
-	wgKeyRegex    = regexp.MustCompile(`\b[A-Za-z0-9+/]{43}=`)
-)
-
 type Anonymizer struct {
 	ipAnonymizer     map[netip.Addr]netip.Addr
 	domainAnonymizer map[string]string
-	// domainOrder caches the keys of domainAnonymizer sorted longest-first
-	// for AnonymizeString; it is rebuilt when the map gains entries.
-	domainOrder     []string
-	labelAnonymizer map[string]string
-	labelAnonymized map[string]struct{}
-	labelCounter    uint32
-	macAnonymizer   map[string]string
-	macCounter      uint32
-	wgKeyAnonymizer map[string]string
-	wgKeyAnonymized map[string]struct{}
-	currentAnonIPv4 netip.Addr
-	currentAnonIPv6 netip.Addr
-	startAnonIPv4   netip.Addr
-	startAnonIPv6   netip.Addr
-
-	// LevelStrict also anonymizes internal ranges (RFC 1918, CGNAT,
-	// link-local), replacing them from the dedicated internal pools below so
-	// a reader can still tell an internal address from a public one.
-	level                   Level
-	currentAnonInternalIPv4 netip.Addr
-	currentAnonInternalIPv6 netip.Addr
-	startAnonInternalIPv4   netip.Addr
-	startAnonInternalIPv6   netip.Addr
+	currentAnonIPv4  netip.Addr
+	currentAnonIPv6  netip.Addr
+	startAnonIPv4    netip.Addr
+	startAnonIPv6    netip.Addr
 
 	domainKeyRegex *regexp.Regexp
 }
@@ -108,50 +32,25 @@ func DefaultAddresses() (netip.Addr, netip.Addr) {
 	return netip.AddrFrom4([4]byte{198, 51, 100, 0}), netip.MustParseAddr("2001:db8:ffff::")
 }
 
-// InternalAddresses returns the pool starts used in strict mode for internal
-// ranges. Both are reserved ranges that cannot collide with real addressing:
-// 198.18.0.0 (RFC 2544 benchmarking), 2001:db8:1:: (RFC 3849 documentation).
-func InternalAddresses() (netip.Addr, netip.Addr) {
-	return netip.AddrFrom4([4]byte{198, 18, 0, 0}), netip.MustParseAddr("2001:db8:1::")
-}
-
 func NewAnonymizer(startIPv4, startIPv6 netip.Addr) *Anonymizer {
-	internalIPv4, internalIPv6 := InternalAddresses()
 	return &Anonymizer{
 		ipAnonymizer:     map[netip.Addr]netip.Addr{},
 		domainAnonymizer: map[string]string{},
-		labelAnonymizer:  map[string]string{},
-		labelAnonymized:  map[string]struct{}{},
-		macAnonymizer:    map[string]string{},
-		wgKeyAnonymizer:  map[string]string{},
-		wgKeyAnonymized:  map[string]struct{}{},
 		currentAnonIPv4:  startIPv4,
 		currentAnonIPv6:  startIPv6,
 		startAnonIPv4:    startIPv4,
 		startAnonIPv6:    startIPv6,
 
-		level:                   LevelDefault,
-		currentAnonInternalIPv4: internalIPv4,
-		currentAnonInternalIPv6: internalIPv6,
-		startAnonInternalIPv4:   internalIPv4,
-		startAnonInternalIPv6:   internalIPv6,
-
 		domainKeyRegex: regexp.MustCompile(`\bdomain=([^\s,:"]+)`),
 	}
 }
 
-// SetLevel selects the anonymization level. The zero value of a new
-// Anonymizer is LevelDefault.
-func (a *Anonymizer) SetLevel(level Level) {
-	a.level = level
-}
-
 func (a *Anonymizer) AnonymizeIP(ip netip.Addr) netip.Addr {
-	// Normalize 4-in-6 addresses so ::ffff:192.168.1.1 classifies and maps
-	// like 192.168.1.1.
-	ip = ip.Unmap()
-
 	if ip.IsLoopback() ||
+		ip.IsLinkLocalUnicast() ||
+		ip.IsLinkLocalMulticast() ||
+		ip.IsInterfaceLocalMulticast() ||
+		(ip.Is4() && ip.IsPrivate()) ||
 		ip.IsUnspecified() ||
 		ip.IsMulticast() ||
 		isWellKnown(ip) ||
@@ -160,100 +59,18 @@ func (a *Anonymizer) AnonymizeIP(ip netip.Addr) netip.Addr {
 		return ip
 	}
 
-	if isInternal(ip) && a.level < LevelStrict {
-		return ip
-	}
-
 	if _, ok := a.ipAnonymizer[ip]; !ok {
-		a.ipAnonymizer[ip] = a.nextAnonIP(ip)
+		if ip.Is4() {
+			a.ipAnonymizer[ip] = a.currentAnonIPv4
+			a.currentAnonIPv4 = a.currentAnonIPv4.Next()
+		} else {
+			a.ipAnonymizer[ip] = a.currentAnonIPv6
+			a.currentAnonIPv6 = a.currentAnonIPv6.Next()
+		}
 	}
 	return a.ipAnonymizer[ip]
 }
 
-func (a *Anonymizer) nextAnonIP(ip netip.Addr) netip.Addr {
-	// At the strict level, internal addresses (including IPv6 ULA, matched
-	// by IsPrivate) come from the internal pools so they remain recognizable
-	// as internal without disclosing the real values.
-	if a.level >= LevelStrict && (isInternal(ip) || ip.IsPrivate()) {
-		if ip.Is4() {
-			anon := a.currentAnonInternalIPv4
-			a.currentAnonInternalIPv4 = a.currentAnonInternalIPv4.Next()
-			return anon
-		}
-		anon := a.currentAnonInternalIPv6
-		a.currentAnonInternalIPv6 = a.currentAnonInternalIPv6.Next()
-		return anon
-	}
-
-	if ip.Is4() {
-		anon := a.currentAnonIPv4
-		a.currentAnonIPv4 = a.currentAnonIPv4.Next()
-		return anon
-	}
-	anon := a.currentAnonIPv6
-	a.currentAnonIPv6 = a.currentAnonIPv6.Next()
-	return anon
-}
-
-// AnonymizeMAC replaces a MAC address with a consistent placeholder from the
-// locally administered range starting at 02:00:00:00:00:01, at every
-// anonymization level. Broadcast, multicast, all-zero, and already assigned
-// placeholder addresses are preserved. The colon and dash spellings of the
-// same address share one placeholder; the output keeps the input's separator.
-func (a *Anonymizer) AnonymizeMAC(mac string) string {
-	hw, err := net.ParseMAC(mac)
-	if err != nil || len(hw) != 6 {
-		return mac
-	}
-
-	if isWellKnownMAC(hw) || a.isAnonymizedMAC(hw) {
-		return mac
-	}
-
-	key := hw.String()
-	anon, ok := a.macAnonymizer[key]
-	if !ok {
-		a.macCounter++
-		anon = fmt.Sprintf("02:00:00:%02x:%02x:%02x", byte(a.macCounter>>16), byte(a.macCounter>>8), byte(a.macCounter))
-		a.macAnonymizer[key] = anon
-	}
-
-	if strings.Contains(mac, "-") {
-		anon = strings.ReplaceAll(anon, ":", "-")
-	}
-	return anon
-}
-
-// isAnonymizedMAC reports whether hw is a placeholder this anonymizer already
-// handed out, so a second pass over anonymized output leaves it unchanged.
-func (a *Anonymizer) isAnonymizedMAC(hw net.HardwareAddr) bool {
-	if hw[0] != 0x02 || hw[1] != 0 || hw[2] != 0 {
-		return false
-	}
-	value := uint32(hw[3])<<16 | uint32(hw[4])<<8 | uint32(hw[5])
-	return value <= a.macCounter
-}
-
-// AnonymizeWGKey replaces a WireGuard public key with a consistent random
-// placeholder of the same shape. Keys are only anonymized at LevelStrict;
-// placeholders already handed out pass through unchanged.
-func (a *Anonymizer) AnonymizeWGKey(key string) string {
-	if a.level < LevelStrict || !looksLikeWGKey(key) {
-		return key
-	}
-	if _, ok := a.wgKeyAnonymized[key]; ok {
-		return key
-	}
-
-	anon, ok := a.wgKeyAnonymizer[key]
-	if !ok {
-		anon = generateAnonymousKey()
-		a.wgKeyAnonymizer[key] = anon
-		a.wgKeyAnonymized[anon] = struct{}{}
-	}
-	return anon
-}
-
 func (a *Anonymizer) AnonymizeUDPAddr(addr net.UDPAddr) net.UDPAddr {
 	// Convert IP to netip.Addr
 	ip, ok := netip.AddrFromSlice(addr.IP)
@@ -272,12 +89,12 @@ func (a *Anonymizer) AnonymizeUDPAddr(addr net.UDPAddr) net.UDPAddr {
 
 // isInAnonymizedRange checks if an IP is within the range of already assigned anonymized IPs
 func (a *Anonymizer) isInAnonymizedRange(ip netip.Addr) bool {
-	if ip.Is4() {
-		return inPoolRange(ip, a.startAnonIPv4, a.currentAnonIPv4) ||
-			inPoolRange(ip, a.startAnonInternalIPv4, a.currentAnonInternalIPv4)
+	if ip.Is4() && ip.Compare(a.startAnonIPv4) >= 0 && ip.Compare(a.currentAnonIPv4) <= 0 {
+		return true
+	} else if !ip.Is4() && ip.Compare(a.startAnonIPv6) >= 0 && ip.Compare(a.currentAnonIPv6) <= 0 {
+		return true
 	}
-	return inPoolRange(ip, a.startAnonIPv6, a.currentAnonIPv6) ||
-		inPoolRange(ip, a.startAnonInternalIPv6, a.currentAnonInternalIPv6)
+	return false
 }
 
 func (a *Anonymizer) AnonymizeIPString(ip string) string {
@@ -301,17 +118,14 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 		baseDomain = domain[:len(domain)-1]
 	}
 
-	if strings.HasSuffix(baseDomain, anonTLD) {
+	if strings.HasSuffix(baseDomain, "netbird.io") ||
+		strings.HasSuffix(baseDomain, "netbird.selfhosted") ||
+		strings.HasSuffix(baseDomain, "netbird.cloud") ||
+		strings.HasSuffix(baseDomain, "netbird.stage") ||
+		strings.HasSuffix(baseDomain, anonTLD) {
 		return domain
 	}
 
-	if suffix := protectedSuffix(baseDomain); suffix != "" {
-		if a.level < LevelStrict || baseDomain == suffix || suffix == infraDomain {
-			return domain
-		}
-		return withTrailingDot(a.anonymizePeerName(baseDomain, suffix), hasDot)
-	}
-
 	parts := strings.Split(baseDomain, ".")
 	if len(parts) < 2 {
 		return domain
@@ -327,53 +141,12 @@ func (a *Anonymizer) AnonymizeDomain(domain string) string {
 	}
 
 	result := strings.Replace(baseDomain, baseForLookup, anonymized, 1)
-	if a.level >= LevelStrict && len(parts) > 2 {
-		prefix := strings.TrimSuffix(baseDomain, "."+baseForLookup)
-		result = a.anonymizeLabels(prefix, "host") + "." + anonymized
-		// The full mapping feeds AnonymizeString so seeded FQDNs are caught
-		// in log lines as a whole, labels included.
-		a.domainAnonymizer[baseDomain] = result
-	}
-	return withTrailingDot(result, hasDot)
-}
-
-// anonymizePeerName replaces the labels in front of a protected suffix with
-// numbered peer placeholders, keeping the suffix, and records the full
-// mapping for string replacement in logs. The numbering keeps a peer
-// recognizable across the whole bundle without disclosing its name.
-func (a *Anonymizer) anonymizePeerName(baseDomain, suffix string) string {
-	prefix := strings.TrimSuffix(baseDomain, "."+suffix)
-	result := a.anonymizeLabels(prefix, "peer") + "." + suffix
-	if result != baseDomain {
-		a.domainAnonymizer[baseDomain] = result
+	if hasDot {
+		result += "."
 	}
 	return result
 }
 
-// anonymizeLabels replaces each dot-separated label with a consistent
-// numbered placeholder ("<placeholder>-<n>"). Wildcard labels and
-// placeholders already handed out pass through unchanged.
-func (a *Anonymizer) anonymizeLabels(prefix, placeholder string) string {
-	labels := strings.Split(prefix, ".")
-	for i, label := range labels {
-		if label == "*" {
-			continue
-		}
-		if _, ok := a.labelAnonymized[label]; ok {
-			continue
-		}
-		anon, ok := a.labelAnonymizer[label]
-		if !ok {
-			a.labelCounter++
-			anon = fmt.Sprintf("%s-%d", placeholder, a.labelCounter)
-			a.labelAnonymizer[label] = anon
-			a.labelAnonymized[anon] = struct{}{}
-		}
-		labels[i] = anon
-	}
-	return strings.Join(labels, ".")
-}
-
 func (a *Anonymizer) AnonymizeURI(uri string) string {
 	u, err := url.Parse(uri)
 	if err != nil {
@@ -408,70 +181,16 @@ func (a *Anonymizer) AnonymizeString(str string) string {
 	str = ipv4Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 	str = ipv6Regex.ReplaceAllStringFunc(str, a.AnonymizeIPString)
 
-	for _, domain := range a.sortedDomains() {
-		str = strings.ReplaceAll(str, domain, a.domainAnonymizer[domain])
+	for domain, anonDomain := range a.domainAnonymizer {
+		str = strings.ReplaceAll(str, domain, anonDomain)
 	}
 
 	str = a.AnonymizeSchemeURI(str)
 	str = a.AnonymizeDNSLogLine(str)
 
-	// MAC handling runs after the IP passes so preserved IPv6 addresses are
-	// already out of the way; the separator guard skips matches embedded in a
-	// longer colon- or dash-separated sequence (such as an IPv6 tail).
-	str = a.anonymizeMACsInString(str, macColonRegex, ':')
-	str = a.anonymizeMACsInString(str, macDashRegex, '-')
-
-	if a.level >= LevelStrict {
-		str = wgKeyRegex.ReplaceAllStringFunc(str, a.AnonymizeWGKey)
-	}
-
 	return str
 }
 
-// sortedDomains returns the domain mappings longest-first, so a full-FQDN
-// mapping (strict level) is applied before the base-domain mapping it
-// contains. The order is rebuilt only when domainAnonymizer has grown.
-func (a *Anonymizer) sortedDomains() []string {
-	if len(a.domainOrder) == len(a.domainAnonymizer) {
-		return a.domainOrder
-	}
-
-	a.domainOrder = a.domainOrder[:0]
-	for domain := range a.domainAnonymizer {
-		a.domainOrder = append(a.domainOrder, domain)
-	}
-	slices.SortFunc(a.domainOrder, func(x, y string) int {
-		if d := len(y) - len(x); d != 0 {
-			return d
-		}
-		return strings.Compare(x, y)
-	})
-	return a.domainOrder
-}
-
-// anonymizeMACsInString replaces MAC addresses matched by re, skipping
-// matches that directly adjoin another sep so a six-group run inside a longer
-// separated sequence is left alone.
-func (a *Anonymizer) anonymizeMACsInString(str string, re *regexp.Regexp, sep byte) string {
-	matches := re.FindAllStringIndex(str, -1)
-	if len(matches) == 0 {
-		return str
-	}
-
-	var b strings.Builder
-	last := 0
-	for _, m := range matches {
-		if (m[0] > 0 && str[m[0]-1] == sep) || (m[1] < len(str) && str[m[1]] == sep) {
-			continue
-		}
-		b.WriteString(str[last:m[0]])
-		b.WriteString(a.AnonymizeMAC(str[m[0]:m[1]]))
-		last = m[1]
-	}
-	b.WriteString(str[last:])
-	return b.String()
-}
-
 // AnonymizeSchemeURI finds and anonymizes URIs with ws, wss, rel, rels, stun, stuns, turn, and turns schemes.
 func (a *Anonymizer) AnonymizeSchemeURI(text string) string {
 	re := regexp.MustCompile(`(?i)\b(wss?://|rels?://|stuns?:|turns?:|https?://)\S+\b`)
@@ -520,79 +239,10 @@ func isWellKnown(addr netip.Addr) bool {
 		"128.0.0.0", "8000::", // 2nd split subnet for default routes
 	}
 
-	return slices.Contains(wellKnown, addr.String())
-}
-
-// isInternal reports whether ip identifies a host only within the local
-// network: IPv4 private (RFC 1918), CGNAT (RFC 6598), and link-local (v4 and
-// v6). These are preserved at the default level so support can reason about
-// the real topology, and replaced from the internal pools at the strict
-// level. IPv6 ULA is deliberately not internal: its random global ID uniquely
-// fingerprints the network, so it is anonymized at every level.
-func isInternal(ip netip.Addr) bool {
-	return (ip.Is4() && ip.IsPrivate()) ||
-		ip.IsLinkLocalUnicast() ||
-		isCGNAT(ip)
-}
-
-func inPoolRange(ip, start, current netip.Addr) bool {
-	return ip.Compare(start) >= 0 && ip.Compare(current) <= 0
-}
-
-// isWellKnownMAC reports whether hw carries no stable host identity: all-zero
-// or a group address (broadcast and multicast).
-func isWellKnownMAC(hw net.HardwareAddr) bool {
-	if hw[0]&1 == 1 {
+	if slices.Contains(wellKnown, addr.String()) {
 		return true
 	}
-	for _, b := range hw {
-		if b != 0 {
-			return false
-		}
-	}
-	return true
-}
 
-// looksLikeWGKey reports whether s has the shape of a WireGuard key:
-// 44 base64 characters decoding to 32 bytes.
-func looksLikeWGKey(s string) bool {
-	if len(s) != 44 || s[43] != '=' {
-		return false
-	}
-	decoded, err := base64.StdEncoding.DecodeString(s)
-	return err == nil && len(decoded) == 32
-}
-
-func generateAnonymousKey() string {
-	buf := make([]byte, 32)
-	if _, err := rand.Read(buf); err != nil {
-		return strings.Repeat("A", 43) + "="
-	}
-	return base64.StdEncoding.EncodeToString(buf)
-}
-
-// protectedSuffix returns the protected NetBird suffix baseDomain ends with,
-// or empty. The match is label-anchored so an unrelated domain that merely
-// ends in the same characters is not preserved.
-func protectedSuffix(baseDomain string) string {
-	for _, d := range protectedDomains {
-		if baseDomain == d || strings.HasSuffix(baseDomain, "."+d) {
-			return d
-		}
-	}
-	return ""
-}
-
-func withTrailingDot(domain string, hasDot bool) string {
-	if hasDot {
-		return domain + "."
-	}
-	return domain
-}
-
-// isCGNAT reports whether addr is in 100.64.0.0/10 (RFC 6598), the range
-// NetBird assigns overlay peer addresses from.
-func isCGNAT(addr netip.Addr) bool {
 	cgnatRangeStart := netip.AddrFrom4([4]byte{100, 64, 0, 0})
 	cgnatRange := netip.PrefixFrom(cgnatRangeStart, 10)
 

client/anonymize/anonymize_test.go

@@ -1,11 +1,8 @@
 package anonymize_test
 
 import (
-	"bytes"
-	"encoding/base64"
 	"net/netip"
 	"regexp"
-	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -47,301 +44,6 @@ func TestAnonymizeIP(t *testing.T) {
 	}
 }
 
-func TestParseLevel(t *testing.T) {
-	tests := []struct {
-		input  string
-		expect anonymize.Level
-	}{
-		{"", anonymize.LevelDefault},
-		{"default", anonymize.LevelDefault},
-		{"DEFAULT", anonymize.LevelDefault},
-		{"strict", anonymize.LevelStrict},
-		{"STRICT", anonymize.LevelStrict},
-		// Unknown values must never yield less anonymization than requested.
-		{"garbage", anonymize.LevelStrict},
-	}
-
-	for _, tc := range tests {
-		t.Run("input="+tc.input, func(t *testing.T) {
-			assert.Equal(t, tc.expect, anonymize.ParseLevel(tc.input), "parsed level should match")
-		})
-	}
-}
-
-func TestAnonymizeIP_DefaultLevelInternalRanges(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	tests := []struct {
-		name   string
-		ip     string
-		expect string
-	}{
-		{"RFC1918 10/8", "10.1.2.3", "10.1.2.3"},
-		{"RFC1918 172.16/12", "172.16.5.5", "172.16.5.5"},
-		{"RFC1918 192.168/16", "192.168.1.1", "192.168.1.1"},
-		{"CGNAT", "100.64.0.5", "100.64.0.5"},
-		{"IPv4 link-local", "169.254.1.1", "169.254.1.1"},
-		{"IPv6 link-local", "fe80::1", "fe80::1"},
-		// ULA is anonymized even at the default level: its random global ID
-		// uniquely fingerprints the network, unlike shared RFC 1918 space.
-		{"IPv6 ULA", "fd12:3456:789a::1", "2001:db8:ffff::"},
-		// 4-in-6 addresses classify like their unmapped IPv4 form.
-		{"4-in-6 RFC1918", "::ffff:192.168.1.1", "192.168.1.1"},
-		{"4-in-6 CGNAT", "::ffff:100.64.0.5", "100.64.0.5"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := anonymizer.AnonymizeIP(netip.MustParseAddr(tc.ip))
-			assert.Equal(t, tc.expect, result.String(), "default level should preserve internal ranges except ULA")
-		})
-	}
-}
-
-func TestAnonymizeIP_StrictLevel(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	// Order matters: internal pool addresses are assigned sequentially.
-	tests := []struct {
-		name   string
-		ip     string
-		expect string
-	}{
-		{"RFC1918 192.168/16", "192.168.1.1", "198.18.0.0"},
-		{"Second RFC1918", "192.168.1.2", "198.18.0.1"},
-		{"Repeated RFC1918", "192.168.1.1", "198.18.0.0"},
-		{"RFC1918 10/8", "10.1.2.3", "198.18.0.2"},
-		{"RFC1918 172.16/12", "172.16.5.5", "198.18.0.3"},
-		{"CGNAT", "100.64.0.5", "198.18.0.4"},
-		{"IPv4 link-local", "169.254.1.1", "198.18.0.5"},
-		{"Public IPv4 uses public pool", "1.2.3.4", "198.51.100.0"},
-		{"IPv6 link-local", "fe80::1", "2001:db8:1::"},
-		{"IPv6 ULA", "fd12:3456:789a::1", "2001:db8:1::1"},
-		{"Public IPv6 uses public pool", "2607:f8b0:4005:805::200e", "2001:db8:ffff::"},
-		{"Loopback IPv4", "127.0.0.1", "127.0.0.1"},
-		{"Loopback IPv6", "::1", "::1"},
-		{"Unspecified", "0.0.0.0", "0.0.0.0"},
-		{"Multicast", "224.0.0.251", "224.0.0.251"},
-		{"Well known resolver", "8.8.8.8", "8.8.8.8"},
-		{"Well known split marker", "128.0.0.0", "128.0.0.0"},
-		{"In internal pool range", "198.18.0.3", "198.18.0.3"},
-		{"In public pool range", "198.51.100.0", "198.51.100.0"},
-		{"4-in-6 repeated RFC1918", "::ffff:192.168.1.1", "198.18.0.0"},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := anonymizer.AnonymizeIP(netip.MustParseAddr(tc.ip))
-			assert.Equal(t, tc.expect, result.String(), "strict level should replace internal ranges from the internal pools")
-		})
-	}
-}
-
-func TestAnonymizeString_StrictInternalIPs(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	input := "route 10.20.30.0/24 via 192.168.1.1 dev eth0 src 100.64.0.7"
-	firstPass := anonymizer.AnonymizeString(input)
-	secondPass := anonymizer.AnonymizeString(firstPass)
-
-	assert.NotContains(t, firstPass, "10.20.30.0", "private network address should be anonymized")
-	assert.NotContains(t, firstPass, "192.168.1.1", "private gateway should be anonymized")
-	assert.NotContains(t, firstPass, "100.64.0.7", "CGNAT address should be anonymized")
-	assert.Contains(t, firstPass, "/24", "prefix length should be preserved")
-	assert.Equal(t, firstPass, secondPass, "second pass should not further anonymize the string")
-}
-
-func TestAnonymizeMAC(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	first := anonymizer.AnonymizeMAC("aa:bb:cc:dd:ee:0f")
-	assert.Equal(t, "02:00:00:00:00:01", first, "first MAC should get the first placeholder")
-	assert.Equal(t, first, anonymizer.AnonymizeMAC("aa:bb:cc:dd:ee:0f"), "repeated MAC should map to the same placeholder")
-	assert.Equal(t, first, anonymizer.AnonymizeMAC("AA:BB:CC:DD:EE:0F"), "case should not affect the mapping")
-	assert.Equal(t, "02-00-00-00-00-01", anonymizer.AnonymizeMAC("AA-BB-CC-DD-EE-0F"), "dash form should keep its separator but share the mapping")
-
-	second := anonymizer.AnonymizeMAC("10:22:33:44:55:66")
-	assert.Equal(t, "02:00:00:00:00:02", second, "second distinct MAC should get the next placeholder")
-
-	tests := []struct {
-		name string
-		mac  string
-	}{
-		{"Broadcast", "ff:ff:ff:ff:ff:ff"},
-		{"IPv4 multicast", "01:00:5e:00:00:fb"},
-		{"IPv6 multicast", "33:33:00:00:00:01"},
-		{"All zero", "00:00:00:00:00:00"},
-		{"Assigned placeholder", "02:00:00:00:00:01"},
-		{"Invalid", "not-a-mac"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.mac, anonymizer.AnonymizeMAC(tc.mac), "should be preserved")
-		})
-	}
-}
-
-func TestAnonymizeString_MACAddresses(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	tests := []struct {
-		name   string
-		input  string
-		expect string
-	}{
-		{
-			name:   "nftables ether rule",
-			input:  "ether saddr aa:bb:cc:dd:ee:ff drop",
-			expect: "ether saddr 02:00:00:00:00:01 drop",
-		},
-		{
-			name:   "Windows dash form",
-			input:  "Physical Address : AA-BB-CC-DD-EE-FF",
-			expect: "Physical Address : 02-00-00-00-00-01",
-		},
-		{
-			name:   "IPv6 address tail is not treated as MAC",
-			input:  "addr fe80:0:11:22:33:44:55:66 scope link",
-			expect: "addr fe80:0:11:22:33:44:55:66 scope link",
-		},
-		{
-			name:   "broadcast MAC preserved",
-			input:  "dst ff:ff:ff:ff:ff:ff type ARP",
-			expect: "dst ff:ff:ff:ff:ff:ff type ARP",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			result := anonymizer.AnonymizeString(tc.input)
-			assert.Equal(t, tc.expect, result, "MAC addresses should be anonymized at every level")
-			assert.Equal(t, result, anonymizer.AnonymizeString(result), "second pass should not change the result")
-		})
-	}
-}
-
-func TestAnonymizeWGKey(t *testing.T) {
-	key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x42}, 32))
-
-	t.Run("default level preserves keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		assert.Equal(t, key, anonymizer.AnonymizeWGKey(key), "default level should not touch WireGuard keys")
-	})
-
-	t.Run("strict level replaces keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		anonymizer.SetLevel(anonymize.LevelStrict)
-
-		anon := anonymizer.AnonymizeWGKey(key)
-		assert.NotEqual(t, key, anon, "strict level should replace the key")
-		assert.Regexp(t, `^[A-Za-z0-9+/]{43}=$`, anon, "placeholder should keep the WireGuard key shape")
-		assert.Equal(t, anon, anonymizer.AnonymizeWGKey(key), "repeated key should map to the same placeholder")
-		assert.Equal(t, anon, anonymizer.AnonymizeWGKey(anon), "an assigned placeholder should pass through unchanged")
-
-		assert.Equal(t, "not-a-key", anonymizer.AnonymizeWGKey("not-a-key"), "non-key values should be preserved")
-	})
-}
-
-func TestAnonymizeString_WGKeys(t *testing.T) {
-	key := base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{0x42}, 32))
-	input := "peer " + key + " handshake completed"
-
-	t.Run("default level preserves keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		assert.Equal(t, input, anonymizer.AnonymizeString(input), "default level should not touch WireGuard keys in strings")
-	})
-
-	t.Run("strict level replaces keys", func(t *testing.T) {
-		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		anonymizer.SetLevel(anonymize.LevelStrict)
-
-		firstPass := anonymizer.AnonymizeString(input)
-		assert.NotContains(t, firstPass, key, "the key should not survive strict anonymization")
-		assert.Equal(t, anonymizer.AnonymizeWGKey(key), extractKey(t, firstPass), "string replacement should be consistent with AnonymizeWGKey")
-		assert.Equal(t, firstPass, anonymizer.AnonymizeString(firstPass), "second pass should not change the result")
-	})
-}
-
-func extractKey(t *testing.T, logLine string) string {
-	t.Helper()
-	fields := strings.Fields(logLine)
-	require.Len(t, fields, 4, "log line should keep its structure")
-	return fields[1]
-}
-
-func TestAnonymizeDomain_StrictLevel(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	t.Run("netbird peer name", func(t *testing.T) {
-		result := anonymizer.AnonymizeDomain("my-laptop.netbird.cloud")
-		assert.Regexp(t, `^peer-\d+\.netbird\.cloud$`, result, "peer name should be anonymized, suffix kept")
-		assert.NotContains(t, result, "my-laptop", "the peer name should not survive")
-		assert.Equal(t, result, anonymizer.AnonymizeDomain("my-laptop.netbird.cloud"), "repeated domain should map consistently")
-		assert.Equal(t, result, anonymizer.AnonymizeDomain(result), "an anonymized domain should pass through unchanged")
-	})
-
-	t.Run("bare netbird domain", func(t *testing.T) {
-		assert.Equal(t, "netbird.cloud", anonymizer.AnonymizeDomain("netbird.cloud"), "the bare protected suffix should be preserved")
-	})
-
-	t.Run("netbird infrastructure preserved", func(t *testing.T) {
-		assert.Equal(t, "api.netbird.io", anonymizer.AnonymizeDomain("api.netbird.io"),
-			"netbird.io hosts infrastructure, not peer names, and should stay readable")
-	})
-
-	t.Run("leading labels of other domains", func(t *testing.T) {
-		result := anonymizer.AnonymizeDomain("host1.corp.example.com")
-		assert.Regexp(t, `^host-\d+\.host-\d+\.anon-[a-zA-Z0-9]+\.domain$`, result, "every label should be anonymized")
-		for _, label := range []string{"host1", "corp", "example"} {
-			assert.NotContains(t, result, label, "no original label should survive")
-		}
-		assert.Equal(t, result, anonymizer.AnonymizeDomain("host1.corp.example.com"), "repeated domain should map consistently")
-	})
-
-	t.Run("same label maps consistently across domains", func(t *testing.T) {
-		first := anonymizer.AnonymizeDomain("shared.one.com")
-		second := anonymizer.AnonymizeDomain("shared.two.com")
-		assert.Equal(t, strings.Split(first, ".")[0], strings.Split(second, ".")[0], "the shared host label should get one placeholder")
-	})
-
-	t.Run("wildcard label preserved", func(t *testing.T) {
-		result := anonymizer.AnonymizeDomain("*.example.com")
-		assert.Regexp(t, `^\*\.anon-[a-zA-Z0-9]+\.domain$`, result, "the wildcard label should stay a wildcard")
-	})
-}
-
-func TestAnonymizeDomain_DefaultLevelKeepsPeerNames(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	assert.Equal(t, "my-laptop.netbird.cloud", anonymizer.AnonymizeDomain("my-laptop.netbird.cloud"),
-		"default level should preserve netbird FQDNs including the peer name")
-	assert.Regexp(t, `^sub\.anon-[a-zA-Z0-9]+\.domain$`, anonymizer.AnonymizeDomain("sub.example.com"),
-		"default level should keep subdomain labels")
-}
-
-func TestAnonymizeString_StrictPeerNames(t *testing.T) {
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(anonymize.LevelStrict)
-
-	// Seed like the bundle generator does from the status: base first, then
-	// the full FQDN, so replacement must prefer the longer mapping.
-	anonBase := anonymizer.AnonymizeDomain("example.com")
-	anonPeer := anonymizer.AnonymizeDomain("peer1.netbird.cloud")
-	anonHost := anonymizer.AnonymizeDomain("host1.example.com")
-
-	logLine := "connected to peer1.netbird.cloud via host1.example.com endpoint"
-	firstPass := anonymizer.AnonymizeString(logLine)
-	assert.NotContains(t, firstPass, "peer1", "the peer name should not survive in logs")
-	assert.NotContains(t, firstPass, "host1", "the host label should not survive in logs")
-	assert.Contains(t, firstPass, anonPeer, "the seeded peer mapping should be applied")
-	assert.Contains(t, firstPass, anonHost, "the seeded host mapping should be applied, not just the base mapping")
-	assert.NotContains(t, firstPass, "host1."+anonBase, "the base mapping must not preempt the longer FQDN mapping")
-	assert.Equal(t, firstPass, anonymizer.AnonymizeString(firstPass), "second pass should not change the result")
-}
-
 func TestAnonymizeDNSLogLine(t *testing.T) {
 	anonymizer := anonymize.NewAnonymizer(netip.Addr{}, netip.Addr{})
 	tests := []struct {

client/cmd/debug.go

@@ -27,8 +27,8 @@ import (
 const errCloseConnection = "Failed to close connection: %v"
 
 var (
-	logFileCount             uint32
-	systemInfoFlag           bool
+	logFileCount        uint32
+	systemInfoFlag      bool
 	uploadBundleFlag         bool
 	uploadBundleURLFlag      string
 	uploadBundleInsecureFlag bool
@@ -156,11 +156,6 @@ func debugConfigDump(cmd *cobra.Command, _ []string) error {
 // request. Returns an error if the RPC fails or if the daemon reports
 // an upload failure reason.
 func debugBundle(cmd *cobra.Command, _ []string) error {
-	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
-	if err != nil {
-		return err
-	}
-
 	conn, err := getClient(cmd)
 	if err != nil {
 		return err
@@ -173,11 +168,10 @@ func debugBundle(cmd *cobra.Command, _ []string) error {
 
 	client := proto.NewDaemonServiceClient(conn)
 	request := &proto.DebugBundleRequest{
-		Anonymize:      anonymizeEnabled,
-		AnonymizeLevel: anonymizeLevel.String(),
-		SystemInfo:     systemInfoFlag,
-		LogFileCount:   logFileCount,
-		CliVersion:     version.NetbirdVersion(),
+		Anonymize:    anonymizeFlag,
+		SystemInfo:   systemInfoFlag,
+		LogFileCount: logFileCount,
+		CliVersion:   version.NetbirdVersion(),
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag
@@ -235,11 +229,6 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("invalid duration format: %v", err)
 	}
 
-	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
-	if err != nil {
-		return err
-	}
-
 	conn, err := getClient(cmd)
 	if err != nil {
 		return err
@@ -379,11 +368,10 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 	cmd.Println("Creating debug bundle...")
 
 	request := &proto.DebugBundleRequest{
-		Anonymize:      anonymizeEnabled,
-		AnonymizeLevel: anonymizeLevel.String(),
-		SystemInfo:     systemInfoFlag,
-		LogFileCount:   logFileCount,
-		CliVersion:     version.NetbirdVersion(),
+		Anonymize:    anonymizeFlag,
+		SystemInfo:   systemInfoFlag,
+		LogFileCount: logFileCount,
+		CliVersion:   version.NetbirdVersion(),
 	}
 	if uploadBundleFlag {
 		request.UploadURL = uploadBundleURLFlag

client/cmd/root.go

@@ -21,7 +21,6 @@ import (
 	"github.com/spf13/pflag"
 	"google.golang.org/grpc"
 
-	"github.com/netbirdio/netbird/client/anonymize"
 	daddr "github.com/netbirdio/netbird/client/internal/daemonaddr"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 )
@@ -70,7 +69,6 @@ var (
 	autoConnectDisabled     bool
 	extraIFaceBlackList     []string
 	anonymizeFlag           bool
-	anonymizeLevelFlag      string
 	dnsRouteInterval        time.Duration
 	// lazyConnEnabled is the parse target for the deprecated --enable-lazy-connection
 	// flag. The flag is inert; the value is no longer read (use NB_LAZY_CONN instead).
@@ -158,8 +156,7 @@ func init() {
 	rootCmd.MarkFlagsMutuallyExclusive("setup-key", "setup-key-file")
 	rootCmd.PersistentFlags().StringVar(&preSharedKey, preSharedKeyFlag, "", "Sets WireGuard PreSharedKey property. If set, then only peers that have the same key can communicate.")
 	rootCmd.PersistentFlags().StringVarP(&hostName, "hostname", "n", "", "Sets a custom hostname for the device")
-	rootCmd.PersistentFlags().BoolVarP(&anonymizeFlag, "anonymize", "A", false, "anonymize public IP addresses, MAC addresses, and non-netbird.io domains in logs and status output; private, CGNAT, and link-local IP ranges are kept (see --anonymize-level strict)")
-	rootCmd.PersistentFlags().StringVar(&anonymizeLevelFlag, "anonymize-level", "", "anonymization level: \"default\" or \"strict\"; strict also anonymizes private, CGNAT, and link-local IP ranges, peer names, and WireGuard public keys. Setting this flag implies --anonymize")
+	rootCmd.PersistentFlags().BoolVarP(&anonymizeFlag, "anonymize", "A", false, "anonymize IP addresses and non-netbird.io domains in logs and status output")
 	rootCmd.PersistentFlags().StringVarP(&configPath, "config", "c", profilemanager.DefaultConfigPath, "Overrides the default profile file location")
 
 	rootCmd.AddCommand(upCmd)
@@ -296,19 +293,6 @@ var CLIBackOffSettings = &backoff.ExponentialBackOff{
 	Clock:               backoff.SystemClock,
 }
 
-// effectiveAnonymize resolves the --anonymize and --anonymize-level flags:
-// setting a level implies anonymization, and an invalid level is rejected.
-func effectiveAnonymize() (bool, anonymize.Level, error) {
-	if anonymizeLevelFlag == "" {
-		return anonymizeFlag, anonymize.LevelDefault, nil
-	}
-	level := anonymize.ParseLevel(anonymizeLevelFlag)
-	if !strings.EqualFold(anonymizeLevelFlag, level.String()) {
-		return false, anonymize.LevelDefault, fmt.Errorf("invalid anonymize level %q: use %q or %q", anonymizeLevelFlag, anonymize.LevelDefault.String(), anonymize.LevelStrict.String())
-	}
-	return true, level, nil
-}
-
 func getSetupKey() (string, error) {
 	if setupKeyPath != "" && setupKey == "" {
 		return getSetupKeyFromFile(setupKeyPath)

client/cmd/status.go

@@ -121,14 +121,8 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		sessionExpiresAt = ts.AsTime().UTC()
 	}
 
-	anonymizeEnabled, anonymizeLevel, err := effectiveAnonymize()
-	if err != nil {
-		return err
-	}
-
 	var outputInformationHolder = nbstatus.ConvertToStatusOutputOverview(resp.GetFullStatus(), nbstatus.ConvertOptions{
-		Anonymize:            anonymizeEnabled,
-		AnonymizeLevel:       anonymizeLevel,
+		Anonymize:            anonymizeFlag,
 		DaemonVersion:        resp.GetDaemonVersion(),
 		DaemonStatus:         nbstatus.ParseDaemonStatus(status),
 		StatusFilter:         statusFilter,

client/iface/bind/ice_bind.go

@@ -22,16 +22,6 @@ import (
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
-const (
-	// wgMsgTypeHandshakeInitiation is the lowest WireGuard message type.
-	wgMsgTypeHandshakeInitiation uint32 = 1
-	// wgMsgTypeTransport is the highest WireGuard message type.
-	wgMsgTypeTransport uint32 = 4
-	// wgMinMsgSize is the smallest WireGuard message: transport data with an empty
-	// payload, which is what a keepalive is.
-	wgMinMsgSize = 32
-)
-
 type receiverCreator struct {
 	iceBind *ICEBind
 }
@@ -226,15 +216,8 @@ func (s *ICEBind) createReceiverFn(pc wgConn.BatchReader, conn *net.UDPConn, rxO
 		for i := 0; i < numMsgs; i++ {
 			msg := &(*msgs)[i]
 
-			if ok, err := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr); ok {
-				if err != nil {
-					log.Debugf("failed to handle STUN packet from %s: %v", msg.Addr, err)
-				}
-				// WireGuard reuses sizes and eps across reads and only skips a slot
-				// whose size is below the minimum message size. Leaving a consumed
-				// slot untouched makes it process this buffer again under the
-				// previous packet's length and endpoint.
-				sizes[i] = 0
+			// todo: handle err
+			if ok, _ := s.filterOutStunMessages(msg.Buffers, msg.N, msg.Addr); ok {
 				continue
 			}
 			sizes[i] = msg.N
@@ -288,16 +271,11 @@ func (s *ICEBind) createOrUpdateMux() {
 
 func (s *ICEBind) filterOutStunMessages(buffers [][]byte, n int, addr net.Addr) (bool, error) {
 	for i := range buffers {
-		if n > len(buffers[i]) {
-			continue
-		}
-		pkt := buffers[i][:n]
-
-		if isWireGuardMsg(pkt) || !stun.IsMessage(pkt) {
+		if !stun.IsMessage(buffers[i]) {
 			continue
 		}
 
-		msg, err := s.parseSTUNMessage(pkt)
+		msg, err := s.parseSTUNMessage(buffers[i][:n])
 		if err != nil {
 			buffers[i] = []byte{}
 			return true, err
@@ -369,34 +347,18 @@ func putMessages(msgs *[]ipv6.Message, msgsPool *sync.Pool) {
 	msgsPool.Put(msgs)
 }
 
-// isWireGuardMsg reports whether the packet carries a WireGuard message header: a
-// little-endian uint32 message type in the range 1..4, which leaves the three bytes
-// after the type byte zero, in a packet long enough to hold any WireGuard message.
-//
-// A well formed STUN message cannot take that shape. Its length field sits in the two
-// bytes the type must leave zero, and for a message of at least wgMinMsgSize bytes that
-// field holds at least 12, so the two framings do not overlap. The test has to be this
-// tight because stun.IsMessage only looks at the magic cookie, which in a WireGuard
-// message overlaps the receiver index: a session whose index happens to equal the cookie
-// would otherwise have all of its inbound data misrouted to the STUN handler until the
-// next rekey.
-func isWireGuardMsg(pkt []byte) bool {
-	if len(pkt) < wgMinMsgSize {
-		return false
-	}
-
-	msgType := binary.LittleEndian.Uint32(pkt[:4])
-	return msgType >= wgMsgTypeHandshakeInitiation && msgType <= wgMsgTypeTransport
-}
-
-// isTransportPkg reports whether the packet is WireGuard transport data carrying a
-// payload, which is what counts as peer activity. A keepalive holds no payload and is
-// exactly wgMinMsgSize bytes.
 func isTransportPkg(buffers [][]byte, n int) bool {
-	if n < 4 || n > len(buffers[0]) {
-		return false
+	// The first buffer should contain at least 4 bytes for type
+	if len(buffers[0]) < 4 {
+		return true
 	}
 
-	msgType := binary.LittleEndian.Uint32(buffers[0][:4])
-	return msgType == wgMsgTypeTransport && n > wgMinMsgSize
+	// WireGuard packet type is a little-endian uint32 at start
+	packetType := binary.LittleEndian.Uint32(buffers[0][:4])
+
+	// Check if packetType matches known WireGuard message types
+	if packetType == 4 && n > 32 {
+		return true
+	}
+	return false
 }

client/iface/bind/stun_filter_test.go

@@ -1,215 +0,0 @@
-//go:build !js
-
-package bind
-
-import (
-	"encoding/binary"
-	"net"
-	"testing"
-	"time"
-
-	"github.com/pion/stun/v3"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/net/ipv4"
-	wgConn "golang.zx2c4.com/wireguard/conn"
-)
-
-// magicCookieBytes is the STUN magic cookie as it appears on the wire. In a
-// WireGuard message the same offset holds the receiver (or sender) index, which is
-// a random uint32, so a session can draw exactly this value.
-var magicCookieBytes = []byte{0x21, 0x12, 0xA4, 0x42}
-
-const testBufSize = 1500
-
-// wgMsg builds a WireGuard message of the given type and size, with the index field
-// at bytes 4:8 set to index.
-func wgMsg(msgType uint32, size int, index []byte) []byte {
-	pkt := make([]byte, size)
-	binary.LittleEndian.PutUint32(pkt[:4], msgType)
-	copy(pkt[4:8], index)
-	return pkt
-}
-
-// intoBuffer copies pkt into a full-size receive buffer, the way the kernel read
-// does, so tests see the same buffer/length split as the hot path.
-func intoBuffer(pkt []byte) [][]byte {
-	buf := make([]byte, testBufSize)
-	copy(buf, pkt)
-	return [][]byte{buf}
-}
-
-func TestFilterOutStunMessages_PassesWireGuardWithCookieShapedIndex(t *testing.T) {
-	tests := []struct {
-		name    string
-		msgType uint32
-		size    int
-	}{
-		{"transport data", wgMsgTypeTransport, 128},
-		{"keepalive", wgMsgTypeTransport, wgMinMsgSize},
-		{"handshake initiation", wgMsgTypeHandshakeInitiation, 148},
-		{"handshake response", 2, 92},
-		{"cookie reply", 3, 64},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			pkt := wgMsg(tc.msgType, tc.size, magicCookieBytes)
-			require.True(t, stun.IsMessage(pkt), "precondition: pion sees this as STUN")
-
-			buffers := intoBuffer(pkt)
-			bind := &ICEBind{}
-
-			filtered, err := bind.filterOutStunMessages(buffers, tc.size, &net.UDPAddr{})
-			assert.NoError(t, err)
-			assert.False(t, filtered, "WireGuard message must be handed to WireGuard, not the STUN handler")
-			assert.Len(t, buffers[0], testBufSize, "buffer must be left intact for WireGuard")
-		})
-	}
-}
-
-func TestFilterOutStunMessages_FiltersRealSTUNMessage(t *testing.T) {
-	msg, err := stun.Build(stun.BindingRequest, stun.TransactionID, stun.Fingerprint)
-	require.NoError(t, err)
-
-	buffers := intoBuffer(msg.Raw)
-	bind := &ICEBind{}
-
-	filtered, err := bind.filterOutStunMessages(buffers, len(msg.Raw), &net.UDPAddr{})
-	assert.NoError(t, err)
-	assert.True(t, filtered, "STUN message must be consumed by the STUN handler")
-	assert.Empty(t, buffers[0], "consumed buffer must be emptied so WireGuard does not see it")
-}
-
-// TestIsWireGuardMsg_DisjointFromSTUN locks the invariant the filter relies on: a
-// well formed STUN message long enough to be a WireGuard message always has a
-// non-zero length field, so it cannot be mistaken for a WireGuard header.
-func TestIsWireGuardMsg_DisjointFromSTUN(t *testing.T) {
-	types := []stun.MessageType{
-		stun.BindingRequest,
-		stun.BindingSuccess,
-		stun.BindingError,
-		{Method: stun.MethodBinding, Class: stun.ClassIndication},
-	}
-
-	for _, msgType := range types {
-		// Long enough that the length guard is not what makes this pass.
-		msg, err := stun.Build(msgType, stun.TransactionID,
-			stun.NewUsername("remoteUfrag:localUfrag"), stun.Fingerprint)
-		require.NoError(t, err)
-		require.GreaterOrEqual(t, len(msg.Raw), wgMinMsgSize, "precondition: %s", msgType)
-		assert.False(t, isWireGuardMsg(msg.Raw),
-			"%s must not look like a WireGuard message", msgType)
-	}
-}
-
-func TestIsWireGuardMsg(t *testing.T) {
-	tests := []struct {
-		name string
-		pkt  []byte
-		want bool
-	}{
-		{"transport data", wgMsg(wgMsgTypeTransport, 128, nil), true},
-		{"handshake initiation", wgMsg(wgMsgTypeHandshakeInitiation, 148, nil), true},
-		{"unknown type 5", wgMsg(5, 128, nil), false},
-		{"type 0", wgMsg(0, 128, nil), false},
-		{"non-zero reserved byte", []byte{0x04, 0x00, 0x01, 0x00}, false},
-		{"too short", []byte{0x04, 0x00, 0x00}, false},
-		{"empty", nil, false},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, isWireGuardMsg(tc.pkt), "wrong classification for %s", tc.name)
-		})
-	}
-}
-
-// TestFilterOutStunMessages_IgnoresBytesBeyondPacket guards against classifying on
-// buffer contents left over from an earlier, longer packet.
-func TestFilterOutStunMessages_IgnoresBytesBeyondPacket(t *testing.T) {
-	buf := make([]byte, testBufSize)
-	copy(buf[4:8], magicCookieBytes)
-	buffers := [][]byte{buf}
-	bind := &ICEBind{}
-
-	filtered, err := bind.filterOutStunMessages(buffers, 2, &net.UDPAddr{})
-	assert.NoError(t, err)
-	assert.False(t, filtered, "a 2 byte packet must not be classified from stale buffer bytes")
-}
-
-// TestReceiveFn_ClearsSizeOfConsumedPacket covers the accounting WireGuard relies
-// on: sizes is reused across reads, so a slot whose packet was consumed as STUN must
-// be reported as empty. Otherwise WireGuard reprocesses the same buffer under the
-// previous packet's length, which for a WireGuard-shaped packet means it is handled
-// twice.
-func TestReceiveFn_ClearsSizeOfConsumedPacket(t *testing.T) {
-	conn := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer conn.Close()
-
-	recvFn := receiverCreator{setupICEBind(t)}.CreateReceiverFn(
-		ipv4.NewPacketConn(conn), conn, false, createMsgPool(),
-	)
-
-	msg, err := stun.Build(stun.BindingRequest, stun.TransactionID, stun.Fingerprint)
-	require.NoError(t, err)
-
-	sender := listenUDP(t, "udp4", "127.0.0.1:0")
-	defer sender.Close()
-	_, err = sender.WriteTo(msg.Raw, conn.LocalAddr())
-	require.NoError(t, err)
-
-	require.NoError(t, conn.SetReadDeadline(time.Now().Add(3*time.Second)))
-
-	bufs := [][]byte{make([]byte, 1500)}
-	// A leftover size from an earlier read, which is what makes the missing reset
-	// observable.
-	sizes := []int{148}
-	eps := make([]wgConn.Endpoint, 1)
-
-	n, err := recvFn(bufs, sizes, eps)
-	require.NoError(t, err)
-	require.Equal(t, 1, n)
-	assert.Zero(t, sizes[0], "consumed STUN packet must not leave a size behind for WireGuard")
-}
-
-func TestIsTransportPkg(t *testing.T) {
-	tests := []struct {
-		name string
-		pkt  []byte
-		n    int
-		want bool
-	}{
-		{"transport data with payload", wgMsg(wgMsgTypeTransport, 128, nil), 128, true},
-		{"keepalive", wgMsg(wgMsgTypeTransport, wgMinMsgSize, nil), wgMinMsgSize, false},
-		{"handshake initiation", wgMsg(wgMsgTypeHandshakeInitiation, 148, nil), 148, false},
-		{"stale type bytes beyond packet", wgMsg(wgMsgTypeTransport, 128, nil), 2, false},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Equal(t, tc.want, isTransportPkg(intoBuffer(tc.pkt), tc.n),
-				"wrong activity classification for %s", tc.name)
-		})
-	}
-}
-
-// TestFilterOutStunMessages_ConsumesSTUNWithWireGuardShapedType covers the one STUN
-// encoding whose leading bytes collide with a WireGuard message type: method 0x080 as a
-// request encodes to 0x0200, so the type byte reads as a handshake response and the byte
-// after it is zero. Only the length check keeps such a message out of WireGuard's hands.
-// pion implements no method in that range, so this is a synthetic worst case rather than
-// traffic ICE produces.
-func TestFilterOutStunMessages_ConsumesSTUNWithWireGuardShapedType(t *testing.T) {
-	msg, err := stun.Build(stun.NewType(stun.Method(0x080), stun.ClassRequest), stun.TransactionID)
-	require.NoError(t, err)
-	require.Equal(t, []byte{0x02, 0x00, 0x00, 0x00}, msg.Raw[:4],
-		"precondition: the leading bytes read as a WireGuard message type")
-
-	buffers := intoBuffer(msg.Raw)
-	bind := &ICEBind{}
-
-	filtered, err := bind.filterOutStunMessages(buffers, len(msg.Raw), &net.UDPAddr{})
-	assert.NoError(t, err)
-	assert.True(t, filtered, "STUN message must be consumed despite its WireGuard-shaped type")
-}

client/internal/debug/debug.go

@@ -34,8 +34,9 @@ import (
 	"github.com/netbirdio/netbird/shared/netiputil"
 )
 
-const readmeContent = `This debug bundle contains the following files.
-If anonymization is enabled (--anonymize / --anonymize-level), the files are anonymized to protect sensitive information.
+const readmeContent = `Netbird debug bundle
+This debug bundle contains the following files.
+If the --anonymize flag is set, the files are anonymized to protect sensitive information.
 
 status.txt: Anonymized status information of the NetBird client.
 client.log: Most recent, anonymized client log file of the NetBird client.
@@ -69,34 +70,21 @@ capture.pcap: Packet capture in pcap format. Only present when capture was runni
 
 
 Anonymization Process
-The files in this bundle have been anonymized to protect sensitive information. The level applied to this bundle is recorded at the top of this file. Here's how the anonymization was applied:
+The files in this bundle have been anonymized to protect sensitive information. Here's how the anonymization was applied:
 
 IP Addresses
 
-Default level:
-- Public IPv4 addresses are replaced with addresses starting from 198.51.100.0
-- Public IPv6 addresses are replaced with addresses starting from 2001:db8:ffff::
-- IPv6 unique local addresses (fc00::/7) are anonymized as well: their random global ID uniquely identifies the network.
-- IP addresses from internal IPv4 ranges and well-known addresses are not anonymized (e.g. 8.8.8.8, 100.64.0.0/10, addresses starting with 192.168., 172.16., 10., 169.254., fe80::).
-
-Strict level (--anonymize-level strict), in addition to the default level:
-- Private (RFC 1918), CGNAT (100.64.0.0/10), and link-local (169.254.0.0/16, fe80::/10) addresses are anonymized too.
-- Internal IPv4 addresses are replaced with addresses starting from 198.18.0.0 and internal IPv6 addresses with addresses starting from 2001:db8:1::, so internal addresses remain distinguishable from public ones.
-- Addresses are mapped in order of first appearance: subnet structure, allocation scheme, and gateway conventions are not preserved. Prefix lengths of networks are preserved.
-- Peer names in front of NetBird domains are replaced with numbered placeholders (e.g. peer-1.netbird.cloud), and subdomain labels of other domains with host-N placeholders.
-- WireGuard public keys are replaced with consistent placeholder keys.
+IPv4 addresses are replaced with addresses starting from 198.51.100.0
+IPv6 addresses are replaced with addresses starting from 100::
 
+IP addresses from non public ranges and well known addresses are not anonymized (e.g. 8.8.8.8, 100.64.0.0/10, addresses starting with 192.168., 172.16., 10., etc.).
 Reoccuring IP addresses are replaced with the same anonymized address.
 
 Note: The anonymized IP addresses in the status file do not match those in the log and routes files. However, the anonymized IP addresses are consistent within the status file and across the routes and log files.
 
-MAC Addresses
-MAC addresses are replaced at every anonymization level with consistent placeholders counting up from 02:00:00:00:00:01. Broadcast, multicast, and all-zero addresses are kept. At the default level a preserved IPv6 link-local address may still embed a MAC address (EUI-64); the strict level anonymizes those addresses.
-
 Domains
 All domain names (except for the netbird domains) are replaced with randomly generated strings ending in ".domain". Anonymized domains are consistent across all files in the bundle.
 Reoccuring domain names are replaced with the same anonymized domain.
-At the strict level, the peer name labels in front of netbird domains are anonymized as well.
 
 Sync Response
 The network_map.json file contains the following anonymized information:
@@ -293,7 +281,6 @@ type BundleGenerator struct {
 	cliVersion     string
 
 	anonymize         bool
-	anonymizeLevel    anonymize.Level
 	includeSystemInfo bool
 	logFileCount      uint32
 
@@ -301,10 +288,7 @@ type BundleGenerator struct {
 }
 
 type BundleConfig struct {
-	Anonymize bool
-	// AnonymizeLevel selects how much the anonymizer redacts.
-	// anonymize.LevelStrict implies Anonymize.
-	AnonymizeLevel    anonymize.Level
+	Anonymize         bool
 	IncludeSystemInfo bool
 	LogFileCount      uint32
 }
@@ -343,11 +327,8 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		uiLogOpener = openLogFile
 	}
 
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-	anonymizer.SetLevel(cfg.AnonymizeLevel)
-
 	return &BundleGenerator{
-		anonymizer: anonymizer,
+		anonymizer: anonymize.NewAnonymizer(anonymize.DefaultAddresses()),
 
 		internalConfig: deps.InternalConfig,
 		statusRecorder: deps.StatusRecorder,
@@ -364,8 +345,7 @@ func NewBundleGenerator(deps GeneratorDependencies, cfg BundleConfig) *BundleGen
 		daemonVersion:  deps.DaemonVersion,
 		cliVersion:     deps.CliVersion,
 
-		anonymize:         cfg.Anonymize || cfg.AnonymizeLevel >= anonymize.LevelStrict,
-		anonymizeLevel:    cfg.AnonymizeLevel,
+		anonymize:         cfg.Anonymize,
 		includeSystemInfo: cfg.IncludeSystemInfo,
 		logFileCount:      logFileCount,
 	}
@@ -505,13 +485,7 @@ func (g *BundleGenerator) addSystemInfo() {
 }
 
 func (g *BundleGenerator) addReadme() error {
-	level := "none (anonymization disabled)"
-	if g.anonymize {
-		level = g.anonymizeLevel.String()
-	}
-	header := fmt.Sprintf("Netbird debug bundle\nAnonymization level applied to this bundle: %s\n", level)
-
-	readmeReader := strings.NewReader(header + readmeContent)
+	readmeReader := strings.NewReader(readmeContent)
 	if err := g.addFileToZip(readmeReader, "README.txt"); err != nil {
 		return fmt.Errorf("add README file to zip: %w", err)
 	}
@@ -533,10 +507,9 @@ func (g *BundleGenerator) addStatus() error {
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
-			Anonymize:      g.anonymize,
-			AnonymizeLevel: g.anonymizeLevel,
-			ProfileName:    profName,
-			DaemonVersion:  g.daemonVersion,
+			Anonymize:     g.anonymize,
+			ProfileName:   profName,
+			DaemonVersion: g.daemonVersion,
 		})
 		overview.CliVersion = g.cliVersion
 		statusOutput := overview.FullDetailSummary()
@@ -689,7 +662,7 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	configContent.WriteString("NetBird Client Configuration:\n\n")
 
 	if key, err := wgtypes.ParseKey(g.internalConfig.PrivateKey); err == nil {
-		configContent.WriteString(fmt.Sprintf("PublicKey: %s\n", g.anonymizer.AnonymizeWGKey(key.PublicKey().String())))
+		configContent.WriteString(fmt.Sprintf("PublicKey: %s\n", key.PublicKey().String()))
 	}
 	configContent.WriteString(fmt.Sprintf("WgIface: %s\n", g.internalConfig.WgIface))
 	configContent.WriteString(fmt.Sprintf("WgPort: %d\n", g.internalConfig.WgPort))
@@ -979,11 +952,6 @@ func (g *BundleGenerator) addUpdateLogs() error {
 		}
 
 		baseName := filepath.Base(logFile)
-		data, err = g.anonymizeBytes(data)
-		if err != nil {
-			log.Warnf("skipping update log file %s: %v", baseName, err)
-			continue
-		}
 		if err := g.addFileToZip(bytes.NewReader(data), filepath.Join("update-logs", baseName)); err != nil {
 			return fmt.Errorf("add update log file %s to zip: %w", baseName, err)
 		}
@@ -1011,13 +979,6 @@ func (g *BundleGenerator) addCorruptedStateFiles() error {
 		}
 
 		fileName := filepath.Base(match)
-		// Corrupted state files usually fail structured JSON anonymization,
-		// so run them through the string anonymizer instead.
-		data, err = g.anonymizeBytes(data)
-		if err != nil {
-			log.Warnf("skipping corrupted state file %s: %v", fileName, err)
-			continue
-		}
 		if err := g.addFileToZip(bytes.NewReader(data), "corrupted_states/"+fileName); err != nil {
 			log.Warnf("Failed to add corrupted state file %s to zip: %v", fileName, err)
 			continue
@@ -1029,27 +990,6 @@ func (g *BundleGenerator) addCorruptedStateFiles() error {
 	return nil
 }
 
-// anonymizeBytes runs raw file content through the string anonymizer line by
-// line when anonymization is enabled. It errors instead of returning partial
-// content, so a caller never adds an unanonymized fallback to the bundle.
-func (g *BundleGenerator) anonymizeBytes(data []byte) ([]byte, error) {
-	if !g.anonymize {
-		return data, nil
-	}
-
-	var buf bytes.Buffer
-	scanner := bufio.NewScanner(bytes.NewReader(data))
-	scanner.Buffer(make([]byte, 1024*1024), 1024*1024)
-	for scanner.Scan() {
-		buf.WriteString(g.anonymizer.AnonymizeString(scanner.Text()))
-		buf.WriteByte('\n')
-	}
-	if err := scanner.Err(); err != nil {
-		return nil, fmt.Errorf("anonymize content: %w", err)
-	}
-	return buf.Bytes(), nil
-}
-
 func (g *BundleGenerator) addMetrics() error {
 	if g.clientMetrics == nil {
 		log.Debugf("skipping metrics in debug bundle: no metrics collector")
@@ -1522,7 +1462,6 @@ func anonymizeRemotePeer(peer *mgmProto.RemotePeerConfig, anonymizer *anonymize.
 	}
 
 	peer.Fqdn = anonymizer.AnonymizeDomain(peer.Fqdn)
-	peer.WgPubKey = anonymizer.AnonymizeWGKey(peer.WgPubKey)
 
 	anonymizeSSHConfig(peer.SshConfig)
 }

client/internal/debug/wgshow.go

@@ -35,14 +35,14 @@ func (g *BundleGenerator) toWGShowFormat(s *configurer.Stats) string {
 	var sb strings.Builder
 
 	sb.WriteString(fmt.Sprintf("interface: %s\n", s.DeviceName))
-	sb.WriteString(fmt.Sprintf("  public key: %s\n", g.anonymizer.AnonymizeWGKey(s.PublicKey)))
+	sb.WriteString(fmt.Sprintf("  public key: %s\n", s.PublicKey))
 	sb.WriteString(fmt.Sprintf("  listen port: %d\n", s.ListenPort))
 	if s.FWMark != 0 {
 		sb.WriteString(fmt.Sprintf("  fwmark: %#x\n", s.FWMark))
 	}
 
 	for _, peer := range s.Peers {
-		sb.WriteString(fmt.Sprintf("\npeer: %s\n", g.anonymizer.AnonymizeWGKey(peer.PublicKey)))
+		sb.WriteString(fmt.Sprintf("\npeer: %s\n", peer.PublicKey))
 		if peer.Endpoint.IP != nil {
 			if g.anonymize {
 				anonEndpoint := g.anonymizer.AnonymizeUDPAddr(peer.Endpoint)
@@ -54,11 +54,7 @@ func (g *BundleGenerator) toWGShowFormat(s *configurer.Stats) string {
 		if len(peer.AllowedIPs) > 0 {
 			var ipStrings []string
 			for _, ipnet := range peer.AllowedIPs {
-				ipStr := ipnet.String()
-				if g.anonymize {
-					ipStr = g.anonymizer.AnonymizeIPString(ipStr)
-				}
-				ipStrings = append(ipStrings, ipStr)
+				ipStrings = append(ipStrings, ipnet.String())
 			}
 			sb.WriteString(fmt.Sprintf("  allowed ips: %s\n", strings.Join(ipStrings, ", ")))
 		}

client/internal/engine.go

@@ -23,7 +23,6 @@ import (
 	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
-	"github.com/netbirdio/netbird/client/anonymize"
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/firewall"
 	"github.com/netbirdio/netbird/client/firewall/firewalld"
@@ -1386,7 +1385,6 @@ func (e *Engine) handleBundle(params *mgmProto.BundleParameters) (*mgmProto.JobR
 
 	bundleJobParams := debug.BundleConfig{
 		Anonymize:         params.Anonymize,
-		AnonymizeLevel:    anonymize.ParseLevel(params.AnonymizeLevel),
 		IncludeSystemInfo: true,
 		LogFileCount:      uint32(params.LogFileCount),
 	}

client/ios/NetBirdSDK/client.go

@@ -14,7 +14,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	nbAnonymize "github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/debug"
@@ -29,13 +28,6 @@ import (
 	types "github.com/netbirdio/netbird/upload-server/types"
 )
 
-// AnonymizeLevelDefault and AnonymizeLevelStrict are the accepted
-// anonymizeLevel values for DebugBundle.
-const (
-	AnonymizeLevelDefault = nbAnonymize.LevelDefaultString
-	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
-)
-
 // ConnectionListener export internal Listener for mobile
 type ConnectionListener interface {
 	peer.Listener
@@ -208,10 +200,8 @@ func (c *Client) Stop() {
 // DebugBundle generates a debug bundle, uploads it and returns the upload key.
 // It works with or without a running engine: when the engine is up it reuses
 // the live config, sync response and client metrics; otherwise it loads the
-// config from disk (or the preloaded tvOS config). anonymizeLevel is "default"
-// or "strict"; strict also anonymizes internal IP ranges, peer names, and
-// WireGuard public keys, and implies anonymize.
-func (c *Client) DebugBundle(anonymize bool, anonymizeLevel string) (string, error) {
+// config from disk (or the preloaded tvOS config).
+func (c *Client) DebugBundle(anonymize bool) (string, error) {
 	cfg, cc := c.stateSnapshot()
 
 	// If the engine hasn't been started, load config so we can reach management.
@@ -261,7 +251,6 @@ func (c *Client) DebugBundle(anonymize bool, anonymizeLevel string) (string, err
 		deps,
 		debug.BundleConfig{
 			Anonymize:         anonymize,
-			AnonymizeLevel:    nbAnonymize.ParseLevel(anonymizeLevel),
 			IncludeSystemInfo: true,
 		},
 	)

client/proto/daemon.pb.go

@@ -2781,11 +2781,6 @@ type DebugBundleRequest struct {
 	// untrusted TLS certificate. Restricted to privileged callers; for
 	// self-hosted upload servers.
 	UploadInsecure bool `protobuf:"varint,7,opt,name=uploadInsecure,proto3" json:"uploadInsecure,omitempty"`
-	// anonymizeLevel selects how much the anonymizer redacts: "default"
-	// (or empty) keeps internal IP ranges, "strict" also anonymizes them.
-	// Unknown values are treated as "strict". Only meaningful with anonymize;
-	// "strict" implies it.
-	AnonymizeLevel string `protobuf:"bytes,8,opt,name=anonymizeLevel,proto3" json:"anonymizeLevel,omitempty"`
 	unknownFields  protoimpl.UnknownFields
 	sizeCache      protoimpl.SizeCache
 }
@@ -2862,13 +2857,6 @@ func (x *DebugBundleRequest) GetUploadInsecure() bool {
 	return false
 }
 
-func (x *DebugBundleRequest) GetAnonymizeLevel() string {
-	if x != nil {
-		return x.AnonymizeLevel
-	}
-	return ""
-}
-
 type DebugBundleResponse struct {
 	state               protoimpl.MessageState `protogen:"open.v1"`
 	Path                string                 `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
@@ -7265,7 +7253,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\x12translatedHostname\x18\x04 \x01(\tR\x12translatedHostname\x128\n" +
 	"\x0etranslatedPort\x18\x05 \x01(\v2\x10.daemon.PortInfoR\x0etranslatedPort\"G\n" +
 	"\x17ForwardingRulesResponse\x12,\n" +
-	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\x84\x02\n" +
+	"\x05rules\x18\x01 \x03(\v2\x16.daemon.ForwardingRuleR\x05rules\"\xdc\x01\n" +
 	"\x12DebugBundleRequest\x12\x1c\n" +
 	"\tanonymize\x18\x01 \x01(\bR\tanonymize\x12\x1e\n" +
 	"\n" +
@@ -7276,8 +7264,7 @@ const file_daemon_proto_rawDesc = "" +
 	"\n" +
 	"cliVersion\x18\x06 \x01(\tR\n" +
 	"cliVersion\x12&\n" +
-	"\x0euploadInsecure\x18\a \x01(\bR\x0euploadInsecure\x12&\n" +
-	"\x0eanonymizeLevel\x18\b \x01(\tR\x0eanonymizeLevel\"}\n" +
+	"\x0euploadInsecure\x18\a \x01(\bR\x0euploadInsecure\"}\n" +
 	"\x13DebugBundleResponse\x12\x12\n" +
 	"\x04path\x18\x01 \x01(\tR\x04path\x12 \n" +
 	"\vuploadedKey\x18\x02 \x01(\tR\vuploadedKey\x120\n" +

client/proto/daemon.proto

@@ -540,11 +540,6 @@ message DebugBundleRequest {
   // untrusted TLS certificate. Restricted to privileged callers; for
   // self-hosted upload servers.
   bool uploadInsecure = 7;
-  // anonymizeLevel selects how much the anonymizer redacts: "default"
-  // (or empty) keeps internal IP ranges, "strict" also anonymizes them.
-  // Unknown values are treated as "strict". Only meaningful with anonymize;
-  // "strict" implies it.
-  string anonymizeLevel = 8;
 }
 
 message DebugBundleResponse {

client/server/debug.go

@@ -16,7 +16,6 @@ import (
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
-	"github.com/netbirdio/netbird/client/anonymize"
 	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/ipcauth"
 	"github.com/netbirdio/netbird/client/proto"
@@ -123,7 +122,6 @@ func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener deb
 		},
 		debug.BundleConfig{
 			Anonymize:         req.GetAnonymize(),
-			AnonymizeLevel:    anonymize.ParseLevel(req.GetAnonymizeLevel()),
 			IncludeSystemInfo: req.GetSystemInfo(),
 			LogFileCount:      req.GetLogFileCount(),
 		},

client/status/status.go

@@ -46,10 +46,7 @@ func ParseDaemonStatus(s string) DaemonStatus {
 
 // ConvertOptions holds parameters for ConvertToStatusOutputOverview.
 type ConvertOptions struct {
-	Anonymize bool
-	// AnonymizeLevel selects how much the anonymizer redacts. Only
-	// meaningful when Anonymize is set.
-	AnonymizeLevel       anonymize.Level
+	Anonymize            bool
 	DaemonVersion        string
 	DaemonStatus         DaemonStatus
 	StatusFilter         string
@@ -220,7 +217,6 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 
 	if opts.Anonymize {
 		anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-		anonymizer.SetLevel(opts.AnonymizeLevel)
 		anonymizeOverview(anonymizer, &overview)
 	}
 
@@ -980,7 +976,6 @@ func timeAgo(t time.Time) string {
 
 func anonymizePeerDetail(a *anonymize.Anonymizer, peer *PeerStateDetailOutput) {
 	peer.FQDN = a.AnonymizeDomain(peer.FQDN)
-	peer.PubKey = a.AnonymizeWGKey(peer.PubKey)
 	if localIP, port, err := net.SplitHostPort(peer.IceCandidateEndpoint.Local); err == nil {
 		peer.IceCandidateEndpoint.Local = fmt.Sprintf("%s:%s", a.AnonymizeIPString(localIP), port)
 	}
@@ -1012,7 +1007,6 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 	overview.SignalState.URL = a.AnonymizeURI(overview.SignalState.URL)
 	overview.SignalState.Error = a.AnonymizeString(overview.SignalState.Error)
 
-	overview.PubKey = a.AnonymizeWGKey(overview.PubKey)
 	overview.IP = a.AnonymizeIPString(overview.IP)
 	overview.IPv6 = a.AnonymizeIPString(overview.IPv6)
 	for i, detail := range overview.Relays.Details {

client/ui/frontend/src/contexts/DebugBundleContext.tsx

@@ -71,12 +71,10 @@ type BundleOptions = {
     hasWindow: boolean;
     totalSec: number;
     uploadUrl: string;
-    anonymizeLevel: AnonymizeLevel;
+    anonymize: boolean;
     systemInfo: boolean;
 };
 
-export type AnonymizeLevel = "none" | "default" | "strict";
-
 const startCaptureBestEffort = async (totalSec: number, pcap: CaptureState) => {
     try {
         // Mirror the CLI's safety margin: window + 30s, server caps at 10m.
@@ -189,10 +187,7 @@ const runBundleFlow = async (
 
     if (opts.uploadUrl) setStage({ kind: "uploading" });
     const result = await DebugSvc.Bundle({
-        anonymize: opts.anonymizeLevel !== "none",
-        // The daemon only knows "default" and "strict"; "none" is expressed
-        // through the anonymize flag being off.
-        anonymizeLevel: opts.anonymizeLevel === "strict" ? "strict" : "default",
+        anonymize: opts.anonymize,
         systemInfo: opts.systemInfo,
         uploadUrl: opts.uploadUrl,
         logFileCount,
@@ -203,7 +198,7 @@ const runBundleFlow = async (
 };
 
 const useDebugBundle = () => {
-    const [anonymizeLevel, setAnonymizeLevel] = useState<AnonymizeLevel>("none");
+    const [anonymize, setAnonymize] = useState(false);
     const [systemInfo, setSystemInfo] = useState(true);
     const [upload, setUpload] = useState(true);
     const [trace, setTrace] = useState(true);
@@ -245,7 +240,7 @@ const useDebugBundle = () => {
             hasWindow: capture && totalSec > 0,
             totalSec,
             uploadUrl: upload ? NETBIRD_UPLOAD_URL : "",
-            anonymizeLevel,
+            anonymize,
             systemInfo,
         };
 
@@ -277,8 +272,8 @@ const useDebugBundle = () => {
     };
 
     return {
-        anonymizeLevel,
-        setAnonymizeLevel,
+        anonymize,
+        setAnonymize,
         systemInfo,
         setSystemInfo,
         upload,

client/ui/frontend/src/modules/settings/SettingsTroubleshooting.tsx

@@ -1,6 +1,6 @@
 import { useId, type ReactNode } from "react";
 import { Trans, useTranslation } from "react-i18next";
-import { ChevronDown, CircleCheckBig, FolderOpen, Info, Loader2 } from "lucide-react";
+import { CircleCheckBig, FolderOpen, Loader2 } from "lucide-react";
 import { Browser } from "@wailsio/runtime";
 import { Debug as DebugSvc } from "@bindings/services";
 import type { DebugBundleResult } from "@bindings/services/models.js";
@@ -8,22 +8,13 @@ import { Button } from "@/components/buttons/Button";
 import { DialogActions } from "@/components/dialog/DialogActions";
 import { DialogDescription } from "@/components/dialog/DialogDescription";
 import { DialogHeading } from "@/components/dialog/DialogHeading";
-import {
-    DropdownMenu,
-    DropdownMenuContent,
-    DropdownMenuRadioGroup,
-    DropdownMenuRadioItem,
-    DropdownMenuTrigger,
-} from "@/components/DropdownMenu";
 import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
 import HelpText from "@/components/typography/HelpText.tsx";
 import { Input } from "@/components/inputs/Input";
 import { Label } from "@/components/typography/Label";
 import { SquareIcon } from "@/components/SquareIcon";
-import { Tooltip } from "@/components/Tooltip";
-import { cn } from "@/lib/cn";
 import { formatRemaining } from "@/lib/formatters";
-import type { AnonymizeLevel, DebugStage } from "@/contexts/DebugBundleContext";
+import type { DebugStage } from "@/contexts/DebugBundleContext";
 import { useDebugBundleContext } from "@/contexts/DebugBundleContext";
 import { SectionGroup, SettingsBottomBar } from "@/modules/settings/SettingsSection.tsx";
 
@@ -33,8 +24,8 @@ export function SettingsTroubleshooting() {
     const { t } = useTranslation();
     const durationId = useId();
     const {
-        anonymizeLevel,
-        setAnonymizeLevel,
+        anonymize,
+        setAnonymize,
         systemInfo,
         setSystemInfo,
         upload,
@@ -64,71 +55,12 @@ export function SettingsTroubleshooting() {
 
     return (
         <SectionGroup title={t("settings.troubleshooting.section.title")}>
-            <div className={"flex items-center justify-between gap-6"}>
-                <div className={"max-w-md flex-1"}>
-                    <Label as={"div"}>
-                        <span className={"inline-flex items-center gap-1.5"}>
-                            {t("settings.troubleshooting.anonymize.label")}
-                            <Tooltip
-                                content={
-                                    <div className={"max-w-xs whitespace-normal leading-relaxed"}>
-                                        {t("settings.troubleshooting.anonymize.info")}
-                                    </div>
-                                }
-                            >
-                                <Info
-                                    size={14}
-                                    aria-label={t("settings.troubleshooting.anonymize.label")}
-                                    className={"shrink-0 cursor-default text-nb-gray-400"}
-                                />
-                            </Tooltip>
-                        </span>
-                    </Label>
-                    <HelpText margin={false}>
-                        {t("settings.troubleshooting.anonymize.help")}
-                    </HelpText>
-                </div>
-                <div className={"shrink-0"}>
-                    <DropdownMenu>
-                        <DropdownMenuTrigger asChild>
-                            <button
-                                type={"button"}
-                                aria-label={t("settings.troubleshooting.anonymize.label")}
-                                className={cn(
-                                    "inline-flex h-[40px] min-w-[160px] items-center justify-between gap-2 px-3",
-                                    "rounded-md border bg-white dark:bg-nb-gray-900",
-                                    "border-neutral-200 dark:border-nb-gray-700",
-                                    "cursor-default text-xs font-semibold text-nb-gray-100 outline-none",
-                                    "hover:border-nb-gray-600 data-[state=open]:border-nb-gray-600",
-                                )}
-                            >
-                                {t(`settings.troubleshooting.anonymize.${anonymizeLevel}`)}
-                                <ChevronDown
-                                    size={16}
-                                    aria-hidden={"true"}
-                                    className={"shrink-0 text-nb-gray-200"}
-                                />
-                            </button>
-                        </DropdownMenuTrigger>
-                        <DropdownMenuContent align={"end"} className={"min-w-[160px]"}>
-                            <DropdownMenuRadioGroup
-                                value={anonymizeLevel}
-                                onValueChange={(v) => setAnonymizeLevel(v as AnonymizeLevel)}
-                            >
-                                <DropdownMenuRadioItem value={"none"}>
-                                    {t("settings.troubleshooting.anonymize.none")}
-                                </DropdownMenuRadioItem>
-                                <DropdownMenuRadioItem value={"default"}>
-                                    {t("settings.troubleshooting.anonymize.default")}
-                                </DropdownMenuRadioItem>
-                                <DropdownMenuRadioItem value={"strict"}>
-                                    {t("settings.troubleshooting.anonymize.strict")}
-                                </DropdownMenuRadioItem>
-                            </DropdownMenuRadioGroup>
-                        </DropdownMenuContent>
-                    </DropdownMenu>
-                </div>
-            </div>
+            <FancyToggleSwitch
+                value={anonymize}
+                onChange={setAnonymize}
+                label={t("settings.troubleshooting.anonymize.label")}
+                helpText={t("settings.troubleshooting.anonymize.help")}
+            />
             <FancyToggleSwitch
                 value={systemInfo}
                 onChange={setSystemInfo}

client/ui/i18n/locales/en/common.json

@@ -1013,27 +1013,11 @@
     },
     "settings.troubleshooting.anonymize.label": {
         "message": "Anonymize Sensitive Information",
-        "description": "Label for the anonymization level dropdown (None, Default, Strict)."
+        "description": "Toggle label: anonymize sensitive information in the bundle."
     },
     "settings.troubleshooting.anonymize.help": {
-        "message": "Hides IP addresses, domains, and other sensitive values.",
-        "description": "Helper text under the anonymization dropdown. The level details live in the info tooltip."
-    },
-    "settings.troubleshooting.anonymize.info": {
-        "message": "Default keeps internal IPv4 addresses and peer names readable for support. Strict additionally anonymizes private (RFC 1918), CGNAT, and link-local IP addresses, peer names, and WireGuard public keys. Recurring values map to the same placeholder, so peers stay distinguishable. Use Strict when sharing the bundle outside your organization.",
-        "description": "Info tooltip explaining the anonymization levels. 'RFC 1918', 'CGNAT', 'link-local', and 'WireGuard' are technical terms — keep them."
-    },
-    "settings.troubleshooting.anonymize.none": {
-        "message": "None",
-        "description": "Dropdown option: no anonymization."
-    },
-    "settings.troubleshooting.anonymize.default": {
-        "message": "Default",
-        "description": "Dropdown option: default anonymization level."
-    },
-    "settings.troubleshooting.anonymize.strict": {
-        "message": "Strict",
-        "description": "Dropdown option: strict anonymization level."
+        "message": "Hides public IP addresses and non-NetBird domains from logs.",
+        "description": "Helper text for anonymizing logs (hides public IPs and non-NetBird domains)."
     },
     "settings.troubleshooting.systemInfo.label": {
         "message": "Include System Information",

client/ui/services/debug.go

@@ -15,13 +15,10 @@ import (
 )
 
 type DebugBundleParams struct {
-	Anonymize bool `json:"anonymize"`
-	// AnonymizeLevel is "default" or "strict"; strict also anonymizes
-	// private IP ranges, peer names, and WireGuard public keys.
-	AnonymizeLevel string `json:"anonymizeLevel"`
-	SystemInfo     bool   `json:"systemInfo"`
-	UploadURL      string `json:"uploadUrl"`
-	LogFileCount   uint32 `json:"logFileCount"`
+	Anonymize    bool   `json:"anonymize"`
+	SystemInfo   bool   `json:"systemInfo"`
+	UploadURL    string `json:"uploadUrl"`
+	LogFileCount uint32 `json:"logFileCount"`
 }
 
 // DebugBundleResult: Path is set for local-only bundles, UploadedKey on upload
@@ -51,12 +48,11 @@ func (s *Debug) Bundle(ctx context.Context, p DebugBundleParams) (DebugBundleRes
 		return DebugBundleResult{}, err
 	}
 	resp, err := cli.DebugBundle(ctx, &proto.DebugBundleRequest{
-		Anonymize:      p.Anonymize,
-		AnonymizeLevel: p.AnonymizeLevel,
-		SystemInfo:     p.SystemInfo,
-		UploadURL:      p.UploadURL,
-		LogFileCount:   p.LogFileCount,
-		CliVersion:     version.NetbirdVersion(),
+		Anonymize:    p.Anonymize,
+		SystemInfo:   p.SystemInfo,
+		UploadURL:    p.UploadURL,
+		LogFileCount: p.LogFileCount,
+		CliVersion:   version.NetbirdVersion(),
 	})
 	if err != nil {
 		return DebugBundleResult{}, err

go.mod

@@ -97,9 +97,9 @@ require (
 	github.com/pion/transport/v3 v3.1.1
 	github.com/pion/turn/v3 v3.0.1
 	github.com/pires/go-proxyproto v0.11.0
-	github.com/pkg/sftp v1.13.11
+	github.com/pkg/sftp v1.13.9
 	github.com/prometheus/client_golang v1.23.2
-	github.com/quic-go/quic-go v0.59.1
+	github.com/quic-go/quic-go v0.55.0
 	github.com/redis/go-redis/v9 v9.7.3
 	github.com/rs/xid v1.3.0
 	github.com/shirou/gopsutil/v4 v4.25.8
@@ -239,6 +239,7 @@ require (
 	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
 	github.com/jackc/puddle/v2 v2.2.1 // indirect
 	github.com/jackpal/go-nat-pmp v1.0.2 // indirect
+	github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
@@ -339,4 +340,4 @@ replace github.com/dexidp/dex/api/v2 => github.com/netbirdio/dex/api/v2 v2.0.0-2
 
 replace github.com/mailru/easyjson => github.com/netbirdio/easyjson v0.9.0
 
-replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260810103952-24e716aea4db
+replace github.com/wailsapp/wails/v3 => github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701

go.sum

@@ -349,6 +349,8 @@ github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk
 github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jackpal/go-nat-pmp v1.0.2 h1:KzKSgb7qkJvOUTqYl9/Hg/me3pWgBmERKrTGD7BdWus=
 github.com/jackpal/go-nat-pmp v1.0.2/go.mod h1:QPH045xvCAeXUZOxsnwmrtiCoxIr9eob+4orBN1SBKc=
+github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1 h1:njuLRcjAuMKr7kI3D85AXWkw6/+v9PwtV6M6o11sWHQ=
+github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1/go.mod h1:alcuEEnZsY1WQsagKhZDsoPCRoOijYqhZvPwLG0kzVs=
 github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
 github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
 github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
@@ -488,8 +490,8 @@ github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9ax
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45/go.mod h1:5/sjFmLb8O96B5737VCqhHyGRzNFIaN/Bu7ZodXc3qQ=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260810103952-24e716aea4db h1:gBOE2r4AW1soSmpYJC5/n9/1L8UQ8+HLjed8CY/TzZY=
-github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260810103952-24e716aea4db/go.mod h1:bsdahLwBQxXjlmdPPeQyrTcDJfcqAr/ymFj0RXhwtWI=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701 h1:QL9nupfRom0L9jcY7N9l/Bc6QK2PtC6pHzC+ftpTqpw=
+github.com/netbirdio/wails/v3 v3.0.0-beta.3.0.20260807055527-fc03f984d701/go.mod h1:BzATbK71VFikMMMCo434wAi0QcaI03P+xeaWgDvQvjw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a h1:3CWK+yTvRKOcC0Q8VCTGy4l60TEb27CQVS7LkMxwjmw=
 github.com/netbirdio/wireguard-go v0.0.0-20260628102922-2834bebf6c1a/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@@ -561,8 +563,8 @@ github.com/pires/go-proxyproto v0.11.0/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.11 h1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=
-github.com/pkg/sftp v1.13.11/go.mod h1:uNkH9roSXglNJqM+glJJi+TQXQUm0fXFWqCFmT8hsN0=
+github.com/pkg/sftp v1.13.9 h1:4NGkvGudBL7GteO3m6qnaQ4pC0Kvf0onSVc9gR3EWBw=
+github.com/pkg/sftp v1.13.9/go.mod h1:OBN7bVXdstkFFN/gdnHPUb5TE8eb8G1Rp9wCItqjkkA=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -580,8 +582,8 @@ github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEo
 github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM=
 github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws=
 github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw=
-github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic=
-github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/quic-go/quic-go v0.55.0 h1:zccPQIqYCXDt5NmcEabyYvOnomjs8Tlwl7tISjJh9Mk=
+github.com/quic-go/quic-go v0.55.0/go.mod h1:DR51ilwU1uE164KuWXhinFcKWGlEjzys2l8zUl5Ss1U=
 github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM=
 github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
@@ -723,7 +725,11 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.8.0/go.mod h1:mRqEX+O9/h5TFCrQhkgjo2yKi0yYA+9ecGkdQoHrywE=
 golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98yw=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
+golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
@@ -737,6 +743,9 @@ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
 golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -753,7 +762,10 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
+golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
 golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.8.0/go.mod h1:yr7u4HXZRm1R1kBWqr/xKNqewf0plRYoB7sla+BCIXE=
@@ -766,6 +778,10 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -777,6 +793,7 @@ golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200810151505-1b9f1253b3ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201015000850-e3ed0017c211/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -797,16 +814,25 @@ golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.11.0/go.mod h1:zC9APTIj3jG3FdV/Ons+XE1riIZXG4aZ4GTHiPZJPIU=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
+golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
+golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
 golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -816,7 +842,10 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
@@ -830,6 +859,8 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
+golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
 golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

management/internals/modules/reverseproxy/activity/interface.go

@@ -0,0 +1,25 @@
+// Package activity records that a principal used a reverse proxy service, so
+// that activity accounting counts people and devices which reach services
+// through the proxy but never touch the dashboard or the management API.
+package activity
+
+import (
+	"context"
+
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// Manager records reverse proxy usage against the timestamps activity
+// accounting reads. Both methods are best effort from the caller's point of
+// view: a lost record is corrected by the next request, and no authorization
+// decision reads them back.
+type Manager interface {
+	// RecordUserLogin records a completed SSO sign-in to a proxied service.
+	// Service users have no interactive login and are ignored.
+	RecordUserLogin(ctx context.Context, accountID string, user *types.User) error
+	// RecordPeerSeen records that a peer reached a private service over the
+	// mesh, which is what lets its owner count as active. Peers activity
+	// accounting excludes, and peers already seen recently, are ignored.
+	RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error
+}

management/internals/modules/reverseproxy/activity/manager/manager.go

@@ -0,0 +1,66 @@
+package manager
+
+import (
+	"context"
+	"time"
+
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// peerSeenInterval is how stale a peer's LastSeen must be before reaching a
+// private service refreshes it. Positive tunnel validations are cached on the
+// proxy for five minutes, so without a floor a busy peer would rewrite its row
+// behind every request; an hour still sits well inside the window activity
+// accounting asks about.
+const peerSeenInterval = time.Hour
+
+type managerImpl struct {
+	store store.Store
+}
+
+// NewManager returns the activity manager backed by the management store.
+func NewManager(store store.Store) activity.Manager {
+	return &managerImpl{store: store}
+}
+
+// RecordUserLogin stamps the login the same way the dashboard and device login
+// paths do, so a person who only ever reaches proxied services still has a
+// login on record.
+func (m *managerImpl) RecordUserLogin(ctx context.Context, accountID string, user *types.User) error {
+	if user == nil || user.IsServiceUser {
+		return nil
+	}
+
+	return m.store.SaveUserLastLogin(ctx, accountID, user.Id, time.Now().UTC())
+}
+
+// RecordPeerSeen stamps LastSeen, the column a peer activates its owner
+// through. The peer the caller already holds answers the throttle without a
+// query, so a peer seen inside the interval costs nothing to skip; the same
+// cutoff goes to the store, which enforces it inside the UPDATE so concurrent
+// requests for one peer cannot each write off their own stale read.
+func (m *managerImpl) RecordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) error {
+	if peer == nil || !countsTowardActivity(peer) {
+		return nil
+	}
+
+	staleBefore := time.Now().UTC().Add(-peerSeenInterval)
+	if peer.Status != nil && peer.Status.LastSeen.After(staleBefore) {
+		return nil
+	}
+
+	_, err := m.store.RefreshPeerLastSeen(ctx, accountID, peer.ID, staleBefore)
+
+	return err
+}
+
+// countsTowardActivity reports whether the peer represents a device a person
+// actually runs. Embedded proxy peers are infrastructure and browser (WASM)
+// clients are ephemeral sessions, so activity accounting ignores both and a
+// write for them could never count.
+func countsTowardActivity(peer *peer.Peer) bool {
+	return !peer.ProxyMeta.Embedded && peer.Meta.KernelVersion != "wasm"
+}

management/internals/modules/reverseproxy/activity/manager/manager_test.go

@@ -0,0 +1,149 @@
+package manager
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/store"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+// recordingStore captures the two writes the activity manager makes. The
+// embedded interface satisfies the rest and panics if anything else is called,
+// which keeps the manager honest about its surface.
+type recordingStore struct {
+	store.Store
+	logins []loginWrite
+	seen   []seenWrite
+}
+
+type loginWrite struct {
+	accountID string
+	userID    string
+	at        time.Time
+}
+
+type seenWrite struct {
+	accountID   string
+	peerID      string
+	staleBefore time.Time
+}
+
+func (s *recordingStore) SaveUserLastLogin(_ context.Context, accountID, userID string, lastLogin time.Time) error {
+	s.logins = append(s.logins, loginWrite{accountID: accountID, userID: userID, at: lastLogin})
+	return nil
+}
+
+func (s *recordingStore) RefreshPeerLastSeen(_ context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
+	s.seen = append(s.seen, seenWrite{accountID: accountID, peerID: peerID, staleBefore: staleBefore})
+	return true, nil
+}
+
+func TestRecordUserLogin(t *testing.T) {
+	tests := []struct {
+		name        string
+		user        *types.User
+		expectWrite bool
+	}{
+		{
+			name:        "regular user is recorded",
+			user:        &types.User{Id: "user1", AccountID: "account1"},
+			expectWrite: true,
+		},
+		{
+			// Activity accounting never counts service users, so a row for one
+			// would be noise.
+			name:        "service user is ignored",
+			user:        &types.User{Id: "svc1", AccountID: "account1", IsServiceUser: true},
+			expectWrite: false,
+		},
+		{
+			name:        "missing user is ignored",
+			user:        nil,
+			expectWrite: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := &recordingStore{}
+			require.NoError(t, NewManager(st).RecordUserLogin(context.Background(), "account1", tt.user))
+
+			if !tt.expectWrite {
+				assert.Empty(t, st.logins, "no login should have been recorded")
+				return
+			}
+
+			require.Len(t, st.logins, 1, "exactly one login should have been recorded")
+			assert.Equal(t, "account1", st.logins[0].accountID, "login must be recorded against the service account")
+			assert.Equal(t, tt.user.Id, st.logins[0].userID, "login must be recorded against the signing-in user")
+			assert.Equal(t, time.UTC, st.logins[0].at.Location(), "timestamps are written in UTC")
+			assert.WithinDuration(t, time.Now().UTC(), st.logins[0].at, time.Minute, "login should be stamped now")
+		})
+	}
+}
+
+func TestRecordPeerSeen(t *testing.T) {
+	tests := []struct {
+		name        string
+		peer        *peer.Peer
+		expectWrite bool
+	}{
+		{
+			name:        "peer seen long ago is recorded",
+			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+			expectWrite: true,
+		},
+		{
+			name:        "peer never seen is recorded",
+			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{}},
+			expectWrite: true,
+		},
+		{
+			// The throttle. The caller already holds the peer, so skipping a
+			// recently seen one costs nothing.
+			name:        "peer seen inside the interval is skipped",
+			peer:        &peer.Peer{ID: "peer1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-10 * time.Minute)}},
+			expectWrite: false,
+		},
+		{
+			name:        "embedded proxy peer is skipped",
+			peer:        &peer.Peer{ID: "peer1", ProxyMeta: peer.ProxyMeta{Embedded: true}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+			expectWrite: false,
+		},
+		{
+			name:        "browser client is skipped",
+			peer:        &peer.Peer{ID: "peer1", Meta: peer.PeerSystemMeta{KernelVersion: "wasm"}, Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+			expectWrite: false,
+		},
+		{
+			name:        "missing peer is ignored",
+			peer:        nil,
+			expectWrite: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := &recordingStore{}
+			require.NoError(t, NewManager(st).RecordPeerSeen(context.Background(), "account1", tt.peer))
+
+			if !tt.expectWrite {
+				assert.Empty(t, st.seen, "no activity should have been recorded")
+				return
+			}
+
+			require.Len(t, st.seen, 1, "exactly one activity write should have been recorded")
+			assert.Equal(t, "account1", st.seen[0].accountID, "activity must be recorded against the service account")
+			assert.Equal(t, tt.peer.ID, st.seen[0].peerID, "activity must be recorded against the calling peer")
+			assert.Equal(t, time.UTC, st.seen[0].staleBefore.Location(), "cutoffs are passed in UTC")
+			assert.WithinDuration(t, time.Now().UTC().Add(-peerSeenInterval), st.seen[0].staleBefore, time.Minute,
+				"the store must enforce the same interval the local check applies")
+		})
+	}
+}

management/internals/server/boot.go

@@ -27,6 +27,8 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
 	accesslogsmanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs/manager"
+	proxyactivity "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
+	proxyactivitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
 	"github.com/netbirdio/netbird/management/server/activity"
@@ -231,6 +233,7 @@ func (s *BaseServer) ReverseProxyGRPCServer() *nbgrpc.ProxyServiceServer {
 		proxyService := nbgrpc.NewProxyServiceServer(s.AccessLogsManager(), s.ProxyTokenStore(), s.PKCEVerifierStore(), s.proxyOIDCConfig(), s.PeersManager(), s.UsersManager(), s.IdpManager(), s.ProxyManager(), s.Store())
 		s.AfterInit(func(s *BaseServer) {
 			proxyService.SetServiceManager(s.ServiceManager())
+			proxyService.SetActivityManager(s.ProxyActivityManager())
 			proxyService.SetProxyController(s.ServiceProxyController())
 			proxyService.SetAgentNetworkSynthesizer(newAgentNetworkSynthesizer(s.Store()))
 			proxyService.SetAgentNetworkLimitsService(s.AgentNetworkManager())
@@ -290,6 +293,13 @@ func (s *BaseServer) PKCEVerifierStore() *nbgrpc.PKCEVerifierStore {
 	})
 }
 
+// ProxyActivityManager records reverse proxy usage for activity accounting.
+func (s *BaseServer) ProxyActivityManager() proxyactivity.Manager {
+	return Create(s, func() proxyactivity.Manager {
+		return proxyactivitymanager.NewManager(s.Store())
+	})
+}
+
 func (s *BaseServer) AccessLogsManager() accesslogs.Manager {
 	return Create(s, func() accesslogs.Manager {
 		accessLogManager := accesslogsmanager.NewManager(s.Store(), s.PermissionsManager(), s.GeoLocationManager())

management/internals/shared/grpc/proxy.go

@@ -32,6 +32,7 @@ import (
 	"github.com/netbirdio/netbird/management/internals/modules/agentnetwork"
 	"github.com/netbirdio/netbird/management/internals/modules/peers"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/sessionkey"
@@ -114,6 +115,9 @@ type ProxyServiceServer struct {
 	// Manager for IdP-enriched user data (may be nil when no IdP is configured)
 	idpManager idp.Manager
 
+	// Manager that records reverse proxy usage for activity accounting
+	activityManager activity.Manager
+
 	// Store for one-time authentication tokens
 	tokenStore *OneTimeTokenStore
 
@@ -236,6 +240,13 @@ func (s *ProxyServiceServer) SetServiceManager(manager rpservice.Manager) {
 	s.serviceManager = manager
 }
 
+// SetActivityManager wires the manager that records reverse proxy usage.
+func (s *ProxyServiceServer) SetActivityManager(manager activity.Manager) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.activityManager = manager
+}
+
 // SetAgentNetworkSynthesizer wires the agent-network service synthesiser.
 // Optional — when nil the snapshot path skips agent-network synthesis. The
 // modules layer injects this after both the proxy server and the agent-network
@@ -1672,7 +1683,7 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 
 	groupIDs, groupNames := pairGroupIDsAndNames(userGroups)
 
-	return sessionkey.SignToken(
+	token, err := sessionkey.SignToken(
 		service.SessionPrivateKey,
 		userID,
 		user.Email,
@@ -1682,6 +1693,25 @@ func (s *ProxyServiceServer) GenerateSessionToken(ctx context.Context, domain, u
 		groupNames,
 		proxyauth.DefaultSessionExpiry,
 	)
+	if err != nil {
+		return "", err
+	}
+
+	s.recordUserLogin(ctx, service.AccountID, user)
+
+	return token, nil
+}
+
+// recordUserLogin hands the sign-in to the activity manager. The RPC must not
+// fail on it, so the error is logged and dropped here rather than returned.
+func (s *ProxyServiceServer) recordUserLogin(ctx context.Context, accountID string, user *types.User) {
+	if s.activityManager == nil {
+		return
+	}
+
+	if err := s.activityManager.RecordUserLogin(ctx, accountID, user); err != nil {
+		log.WithContext(ctx).Debugf("record proxy login for user %s: %v", user.Id, err)
+	}
 }
 
 // ValidateUserGroupAccess checks if a user has access to a service.
@@ -2031,6 +2061,8 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 		return nil, err
 	}
 
+	s.recordPeerSeen(ctx, service.AccountID, peer)
+
 	log.WithFields(log.Fields{
 		"domain":       domain,
 		"tunnel_ip":    tunnelIPStr,
@@ -2048,6 +2080,18 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 	}, nil
 }
 
+// recordPeerSeen hands the mesh request to the activity manager. The RPC must
+// not fail on it, so the error is logged and dropped here rather than returned.
+func (s *ProxyServiceServer) recordPeerSeen(ctx context.Context, accountID string, peer *peer.Peer) {
+	if s.activityManager == nil {
+		return
+	}
+
+	if err := s.activityManager.RecordPeerSeen(ctx, accountID, peer); err != nil {
+		log.WithContext(ctx).Debugf("record proxy activity for peer %s: %v", peer.ID, err)
+	}
+}
+
 // resolvePeerOwner returns the user a peer is linked to, once per request so
 // the status gate and the identity resolution below share a single lookup.
 // Unlinked peers (machine agents) have no owner. A lookup that fails returns

management/internals/shared/grpc/proxy_group_access_test.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -155,6 +156,27 @@ type mockTunnelPeersManager struct {
 	groupsErr error
 }
 
+// mockActivityManager records what the RPC handed to the activity manager. The
+// policy (throttling, exclusions) is the manager's and is tested there; these
+// tests only pin which requests reach it.
+type mockActivityManager struct {
+	seenMarks []seenMark
+}
+
+type seenMark struct {
+	accountID string
+	peerID    string
+}
+
+func (m *mockActivityManager) RecordUserLogin(_ context.Context, _ string, _ *types.User) error {
+	return nil
+}
+
+func (m *mockActivityManager) RecordPeerSeen(_ context.Context, accountID string, peer *peer.Peer) error {
+	m.seenMarks = append(m.seenMarks, seenMark{accountID: accountID, peerID: peer.ID})
+	return nil
+}
+
 func (m *mockTunnelPeersManager) GetPeerByTunnelIP(_ context.Context, _ string, _ net.IP) (*peer.Peer, error) {
 	return m.peer, m.peerErr
 }
@@ -745,6 +767,78 @@ func TestValidateTunnelPeerOwnerStatus(t *testing.T) {
 	}
 }
 
+// TestValidateTunnelPeerRecordsActivity pins that a granted mesh request is
+// handed to the activity manager. Which of those the manager then writes is its
+// own decision, covered by its tests.
+func TestValidateTunnelPeerRecordsActivity(t *testing.T) {
+	const (
+		domain    = "app.example.com"
+		accountID = "account1"
+		peerID    = "peer1"
+	)
+
+	activityManager := &mockActivityManager{}
+	server := &ProxyServiceServer{
+		activityManager: activityManager,
+		serviceManager: &mockReverseProxyManager{
+			proxiesByAccount: map[string][]*service.Service{
+				accountID: {{Domain: domain, AccountID: accountID}},
+			},
+		},
+		peersManager: &mockTunnelPeersManager{
+			peer: &peer.Peer{ID: peerID, Name: "agent", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+		},
+		usersManager: &mockUsersManager{users: map[string]*types.User{}},
+	}
+
+	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
+		Domain:   domain,
+		TunnelIp: "100.64.0.1",
+	})
+
+	require.NoError(t, err)
+	require.True(t, resp.GetValid(), "peer should be granted access")
+
+	require.Len(t, activityManager.seenMarks, 1, "a granted peer should reach the activity manager once")
+	assert.Equal(t, accountID, activityManager.seenMarks[0].accountID, "activity must be attributed to the service account")
+	assert.Equal(t, peerID, activityManager.seenMarks[0].peerID, "activity must be attributed to the calling peer")
+}
+
+// TestValidateTunnelPeerDeniedRecordsNoActivity keeps the write on the granted
+// path only: a refused peer is not evidence its owner was active.
+func TestValidateTunnelPeerDeniedRecordsNoActivity(t *testing.T) {
+	const (
+		domain    = "app.example.com"
+		accountID = "account1"
+	)
+
+	activityManager := &mockActivityManager{}
+	server := &ProxyServiceServer{
+		activityManager: activityManager,
+		serviceManager: &mockReverseProxyManager{
+			proxiesByAccount: map[string][]*service.Service{
+				accountID: {{Domain: domain, AccountID: accountID}},
+			},
+		},
+		peersManager: &mockTunnelPeersManager{
+			peer: &peer.Peer{ID: "peer1", Name: "agent", UserID: "user1", Status: &peer.PeerStatus{LastSeen: time.Now().Add(-3 * time.Hour)}},
+		},
+		// The owner is blocked, so the tunnel gate denies before the mint.
+		usersManager: &mockUsersManager{users: map[string]*types.User{
+			"user1": {Id: "user1", AccountID: accountID, Blocked: true},
+		}},
+	}
+
+	resp, err := server.ValidateTunnelPeer(context.Background(), &proto.ValidateTunnelPeerRequest{
+		Domain:   domain,
+		TunnelIp: "100.64.0.1",
+	})
+
+	require.NoError(t, err)
+	require.False(t, resp.GetValid(), "blocked owner should be denied")
+	assert.Empty(t, activityManager.seenMarks, "a denied peer must not be marked seen")
+}
+
 func TestGetAccountProxyByDomain(t *testing.T) {
 	tests := []struct {
 		name             string

management/server/http/handlers/proxy/auth_callback_integration_test.go

@@ -19,6 +19,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/accesslogs"
+	activitymanager "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/activity/manager"
 	nbproxy "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
 	"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
 	nbgrpc "github.com/netbirdio/netbird/management/internals/shared/grpc"
@@ -221,6 +222,7 @@ func setupAuthCallbackTest(t *testing.T) *testSetup {
 	)
 
 	proxyService.SetServiceManager(&testServiceManager{store: testStore})
+	proxyService.SetActivityManager(activitymanager.NewManager(testStore))
 
 	handler := NewAuthCallbackHandler(proxyService, nil)
 
@@ -538,6 +540,55 @@ func TestAuthCallback_UserAllowedToLogin(t *testing.T) {
 // TestAuthCallback_UserDeniedByAccountStatus asserts that a user whose account
 // is pending approval or blocked never receives a session token from the OIDC
 // callback, and that the redirect carries a description the proxy can render.
+// TestAuthCallback_RecordsUserLogin drives the real OIDC callback and asserts
+// the login lands on the user row. That timestamp is what activity accounting
+// reads, and it is the only signal that can ever count someone who reaches
+// proxy-protected services from a browser and never opens the dashboard.
+func TestAuthCallback_RecordsUserLogin(t *testing.T) {
+	setup := setupAuthCallbackTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+
+	before, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
+	require.NoError(t, err)
+	require.Nil(t, before.LastLogin, "fixture user starts with no login on record")
+
+	setup.oidcServer.tokenSubject = "allowedUserId"
+	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+
+	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
+	rec := httptest.NewRecorder()
+	setup.router.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusFound, rec.Code)
+
+	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "allowedUserId")
+	require.NoError(t, err)
+	require.NotNil(t, after.LastLogin, "a completed proxy SSO login must be recorded on the user")
+	require.WithinDuration(t, time.Now().UTC(), after.LastLogin.UTC(), time.Minute, "login should be stamped at sign-in time")
+}
+
+// TestAuthCallback_DeniedUserLoginNotRecorded keeps the write on the granted
+// path: a refused sign-in is not a login.
+func TestAuthCallback_DeniedUserLoginNotRecorded(t *testing.T) {
+	setup := setupAuthCallbackTest(t)
+	defer setup.cleanup()
+
+	ctx := context.Background()
+
+	setup.oidcServer.tokenSubject = "blockedUserId"
+	state := createTestState(t, setup.proxyService, "https://test-proxy.example.com/dashboard")
+
+	req := httptest.NewRequest(http.MethodGet, "/reverse-proxy/callback?code=test-auth-code&state="+url.QueryEscape(state), nil)
+	rec := httptest.NewRecorder()
+	setup.router.ServeHTTP(rec, req)
+	require.Equal(t, http.StatusFound, rec.Code)
+
+	after, err := setup.store.GetUserByUserID(ctx, store.LockingStrengthNone, "blockedUserId")
+	require.NoError(t, err)
+	require.Nil(t, after.LastLogin, "a denied user must not be recorded as having logged in")
+}
+
 func TestAuthCallback_UserDeniedByAccountStatus(t *testing.T) {
 	tests := []struct {
 		name            string

management/server/store/sql_store.go

@@ -599,6 +599,34 @@ func (s *SqlStore) ApproveAccountPeers(ctx context.Context, accountID string) (i
 	return int(result.RowsAffected), nil
 }
 
+// RefreshPeerLastSeen updates only peer_status_last_seen. Every other status
+// column is left untouched: peer_status_connected and
+// peer_status_session_started_at belong to the sync stream that owns the
+// session, and a blind write here would corrupt the fencing
+// MarkPeerConnectedIfNewerSession relies on.
+//
+// LastSeen comes from the database clock for the same reason it does there: a
+// Go-side timestamp is taken before the write and can land after a connect that
+// used CURRENT_TIMESTAMP, dragging the column backwards.
+//
+// staleBefore carries the caller's throttle into the same statement, so
+// concurrent requests for one peer collapse into a single write instead of
+// each racing on its own stale read. The column is nullable — Status is an
+// embedded pointer, so a peer stored without one leaves it NULL — and NULL
+// loses every comparison, hence the explicit branch for a peer never seen.
+func (s *SqlStore) RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
+	result := s.db.WithContext(ctx).
+		Model(&nbpeer.Peer{}).
+		Where(accountAndIDQueryCondition, accountID, peerID).
+		Where("(peer_status_last_seen IS NULL OR peer_status_last_seen < ?)", staleBefore).
+		Update("peer_status_last_seen", gorm.Expr("CURRENT_TIMESTAMP"))
+	if result.Error != nil {
+		return false, status.Errorf(status.Internal, "refresh peer last seen: %v", result.Error)
+	}
+
+	return result.RowsAffected > 0, nil
+}
+
 // SaveUsers saves the given list of users to the database.
 func (s *SqlStore) SaveUsers(ctx context.Context, users []*types.User) error {
 	if len(users) == 0 {

management/server/store/sql_store_activity_test.go

@@ -0,0 +1,122 @@
+package store
+
+import (
+	"context"
+	"net/netip"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	nbpeer "github.com/netbirdio/netbird/management/server/peer"
+	"github.com/netbirdio/netbird/management/server/types"
+)
+
+const activityAccountID = "activityAccountId"
+
+func newActivityTestStore(t *testing.T) Store {
+	t.Helper()
+
+	store, cleanUp, err := NewTestStoreFromSQL(context.Background(), "", t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(cleanUp)
+
+	require.NoError(t, store.SaveAccount(context.Background(), &types.Account{
+		Id:        activityAccountID,
+		Domain:    "activity.example.com",
+		CreatedAt: time.Now().UTC(),
+	}))
+
+	return store
+}
+
+func TestRefreshPeerLastSeen(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+	stored := time.Now().UTC().Add(-3 * time.Hour)
+	require.NoError(t, store.AddPeerToAccount(ctx, activityPeer(stored)))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	assert.True(t, refreshed, "a peer seen three hours ago is stale enough to refresh")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should be stamped at write time")
+	assert.True(t, peer.Status.LastSeen.After(stored), "last seen must move forward")
+}
+
+// TestRefreshPeerLastSeenHonoursCutoff covers the throttle the caller relies on:
+// two concurrent requests both read the same stale peer, but only the statement
+// that still finds LastSeen behind the cutoff writes.
+func TestRefreshPeerLastSeenHonoursCutoff(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+	stored := time.Now().UTC().Add(-10 * time.Minute)
+	require.NoError(t, store.AddPeerToAccount(ctx, activityPeer(stored)))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	assert.False(t, refreshed, "a peer seen inside the interval must not be written")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, stored, peer.Status.LastSeen.UTC(), time.Second, "last seen must be left where it was")
+}
+
+// TestRefreshPeerLastSeenRecordsNeverSeenPeer covers the nullable column. Status
+// is an embedded pointer, so a peer stored without one leaves last seen NULL,
+// and NULL loses the cutoff comparison — such a peer would never record its
+// first activity.
+func TestRefreshPeerLastSeenRecordsNeverSeenPeer(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+	stored := activityPeer(time.Time{})
+	stored.Status = nil
+	require.NoError(t, store.AddPeerToAccount(ctx, stored))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	assert.True(t, refreshed, "a peer that was never seen must record its first activity")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should be stamped at write time")
+}
+
+// TestRefreshPeerLastSeenLeavesSessionStateAlone pins the column boundary: the
+// connected flag and the session token belong to the sync stream that owns the
+// peer's session, and a blind write here would corrupt its fencing. This is why
+// SavePeerStatus is not reused for an activity bump.
+func TestRefreshPeerLastSeenLeavesSessionStateAlone(t *testing.T) {
+	ctx := context.Background()
+	store := newActivityTestStore(t)
+
+	stored := activityPeer(time.Date(2026, 3, 1, 9, 0, 0, 0, time.UTC))
+	stored.Status.Connected = true
+	stored.Status.SessionStartedAt = 1234567890
+	require.NoError(t, store.AddPeerToAccount(ctx, stored))
+
+	refreshed, err := store.RefreshPeerLastSeen(ctx, activityAccountID, "activityPeer", time.Now().UTC().Add(-time.Hour))
+	require.NoError(t, err)
+	require.True(t, refreshed, "the peer is stale enough to refresh")
+
+	peer, err := store.GetPeerByID(ctx, LockingStrengthNone, activityAccountID, "activityPeer")
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), peer.Status.LastSeen.UTC(), time.Minute, "last seen should move forward")
+	assert.True(t, peer.Status.Connected, "connected flag must survive an activity write")
+	assert.Equal(t, int64(1234567890), peer.Status.SessionStartedAt, "session token must survive an activity write")
+}
+
+func activityPeer(lastSeen time.Time) *nbpeer.Peer {
+	return &nbpeer.Peer{
+		ID:        "activityPeer",
+		AccountID: activityAccountID,
+		Key:       "activityPeerKey",
+		IP:        netip.MustParseAddr("100.64.0.9"),
+		Name:      "activity-peer",
+		DNSLabel:  "activity-peer",
+		Status:    &nbpeer.PeerStatus{LastSeen: lastSeen},
+	}
+}

management/server/store/store.go

@@ -180,6 +180,14 @@ type Store interface {
 	// Returns true when the update happened, false when this stream lost
 	// the race against a newer session.
 	MarkPeerConnectedIfNewerSession(ctx context.Context, accountID, peerID string, newSessionStartedAt int64) (bool, error)
+	// RefreshPeerLastSeen records that a peer was just seen, stamping the
+	// database clock like the other status writers. Connected and
+	// SessionStartedAt are left alone, so this never interferes with the
+	// session-ownership protocol MarkPeerConnectedIfNewerSession implements.
+	// The write only lands when the stored LastSeen is older than
+	// staleBefore, which keeps a caller's throttle atomic under concurrent
+	// requests for the same peer. Returns true when the update happened.
+	RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error)
 	// MarkPeerDisconnectedIfSameSession sets the peer to disconnected and
 	// resets SessionStartedAt to zero, but only when the stored
 	// SessionStartedAt equals the given sessionStartedAt. LastSeen is

management/server/store/store_mock.go

@@ -3203,6 +3203,21 @@ func (mr *MockStoreMockRecorder) MarkProxyAccessTokenUsed(ctx, tokenID interface
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkProxyAccessTokenUsed", reflect.TypeOf((*MockStore)(nil).MarkProxyAccessTokenUsed), ctx, tokenID)
 }
 
+// RefreshPeerLastSeen mocks base method.
+func (m *MockStore) RefreshPeerLastSeen(ctx context.Context, accountID, peerID string, staleBefore time.Time) (bool, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RefreshPeerLastSeen", ctx, accountID, peerID, staleBefore)
+	ret0, _ := ret[0].(bool)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RefreshPeerLastSeen indicates an expected call of RefreshPeerLastSeen.
+func (mr *MockStoreMockRecorder) RefreshPeerLastSeen(ctx, accountID, peerID, staleBefore interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RefreshPeerLastSeen", reflect.TypeOf((*MockStore)(nil).RefreshPeerLastSeen), ctx, accountID, peerID, staleBefore)
+}
+
 // RemovePeerFromAllGroups mocks base method.
 func (m *MockStore) RemovePeerFromAllGroups(ctx context.Context, peerID string) error {
 	m.ctrl.T.Helper()

shared/management/proto/management.proto

@@ -110,10 +110,6 @@ message BundleParameters {
   int64  bundle_for_time  = 2;
   int32  log_file_count   = 3;
   bool   anonymize        = 4;
-  // anonymize_level selects how much the anonymizer redacts: "default"
-  // (or empty) keeps internal IP ranges, "strict" also anonymizes them.
-  // Unknown values are treated as "strict".
-  string anonymize_level  = 5;
 }
 
 message BundleResult {

shared/relay/client/dialer/quic/quic.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/quic-go/quic-go"
+	"github.com/quic-go/quic-go/logging"
 	log "github.com/sirupsen/logrus"
 
 	nbnet "github.com/netbirdio/netbird/client/net"
@@ -79,6 +80,28 @@ func (d Dialer) Dial(ctx context.Context, address, serverName string) (net.Conn,
 	return conn, nil
 }
 
+// connectionTracer returns a QUIC tracer that logs the DPLPMTUD result and the
+// reason a relay connection closed, so the path MTU settled on and teardown
+// cause are visible in logs. Lines carry the relay address as a structured
+// field, matching the rest of the relay client logging.
+func connectionTracer(addr string) func(context.Context, logging.Perspective, quic.ConnectionID) *logging.ConnectionTracer {
+	relayLog := log.WithField("relay", addr)
+	return func(context.Context, logging.Perspective, quic.ConnectionID) *logging.ConnectionTracer {
+		return &logging.ConnectionTracer{
+			UpdatedMTU: func(mtu logging.ByteCount, done bool) {
+				if done {
+					relayLog.Infof("QUIC path MTU settled at %d", mtu)
+					return
+				}
+				relayLog.Debugf("QUIC path MTU probing at %d", mtu)
+			},
+			ClosedConnection: func(err error) {
+				relayLog.Debugf("QUIC connection closed: %v", err)
+			},
+		}
+	}
+}
+
 func prepareURL(address string) (string, error) {
 	var host string
 	var defaultPort string

shared/relay/client/dialer/quic/quic_test.go

@@ -1,145 +0,0 @@
-package quic
-
-import (
-	"testing"
-
-	"github.com/quic-go/quic-go/qlog"
-	"github.com/quic-go/quic-go/qlogwriter"
-	log "github.com/sirupsen/logrus"
-	"github.com/sirupsen/logrus/hooks/test"
-)
-
-func TestCloseReason(t *testing.T) {
-	transportErr := qlog.TransportErrorCode(0x2) // CONNECTION_REFUSED
-	appErr := qlog.ApplicationErrorCode(42)
-
-	tests := []struct {
-		name  string
-		event qlog.ConnectionClosed
-		want  string
-	}{
-		{
-			// A close carrying nothing but an initiator still reads sensibly.
-			name:  "initiator only",
-			event: qlog.ConnectionClosed{Initiator: qlog.InitiatorLocal},
-			want:  "closed by local",
-		},
-		{
-			name: "transport error with trigger",
-			event: qlog.ConnectionClosed{
-				Initiator:       qlog.InitiatorRemote,
-				ConnectionError: &transportErr,
-				Trigger:         qlog.ConnectionCloseTriggerIdleTimeout,
-			},
-			want: "closed by remote, transport error: CONNECTION_REFUSED, trigger: idle_timeout",
-		},
-		{
-			name: "application error with reason",
-			event: qlog.ConnectionClosed{
-				Initiator:        qlog.InitiatorLocal,
-				ApplicationError: &appErr,
-				Reason:           "bye",
-			},
-			want: "closed by local, application error: 42, reason: bye",
-		},
-		{
-			// Transport and application errors are mutually exclusive in
-			// practice; if both are set the transport code wins.
-			name: "transport error takes precedence over application error",
-			event: qlog.ConnectionClosed{
-				Initiator:        qlog.InitiatorLocal,
-				ConnectionError:  &transportErr,
-				ApplicationError: &appErr,
-			},
-			want: "closed by local, transport error: CONNECTION_REFUSED",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := closeReason(tt.event); got != tt.want {
-				t.Errorf("closeReason() = %q, want %q", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestLogSinkRecordEvent(t *testing.T) {
-	tests := []struct {
-		name      string
-		event     qlogwriter.Event
-		wantLevel log.Level
-		wantMsg   string
-	}{
-		{
-			name:      "settled MTU is logged at info",
-			event:     qlog.MTUUpdated{Value: 1400, Done: true},
-			wantLevel: log.InfoLevel,
-			wantMsg:   "QUIC path MTU settled at 1400",
-		},
-		{
-			// Probing fires repeatedly during discovery, so it stays at debug.
-			name:      "MTU probe is logged at debug",
-			event:     qlog.MTUUpdated{Value: 1300, Done: false},
-			wantLevel: log.DebugLevel,
-			wantMsg:   "QUIC path MTU probing at 1300",
-		},
-		{
-			name:      "connection closed is logged at debug",
-			event:     qlog.ConnectionClosed{Initiator: qlog.InitiatorRemote},
-			wantLevel: log.DebugLevel,
-			wantMsg:   "QUIC connection closed: closed by remote",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			logger, hook := test.NewNullLogger()
-			logger.SetLevel(log.DebugLevel)
-			recorder := logSink{log: logger.WithField("relay", "relay.example.com:443")}
-
-			recorder.RecordEvent(tt.event)
-
-			entries := hook.AllEntries()
-			if len(entries) != 1 {
-				t.Fatalf("got %d log entries, want 1", len(entries))
-			}
-			if entries[0].Level != tt.wantLevel {
-				t.Errorf("level = %v, want %v", entries[0].Level, tt.wantLevel)
-			}
-			if entries[0].Message != tt.wantMsg {
-				t.Errorf("message = %q, want %q", entries[0].Message, tt.wantMsg)
-			}
-			if relay := entries[0].Data["relay"]; relay != "relay.example.com:443" {
-				t.Errorf("relay field = %v, want relay.example.com:443", relay)
-			}
-		})
-	}
-}
-
-// Events the relay client does not care about must not produce log lines.
-func TestLogSinkIgnoresUnhandledEvents(t *testing.T) {
-	logger, hook := test.NewNullLogger()
-	logger.SetLevel(log.DebugLevel)
-	recorder := logSink{log: logger.WithField("relay", "relay.example.com:443")}
-
-	recorder.RecordEvent(qlog.PacketLost{})
-
-	if entries := hook.AllEntries(); len(entries) != 0 {
-		t.Errorf("got %d log entries, want 0", len(entries))
-	}
-}
-
-func TestLogSinkSupportsSchemas(t *testing.T) {
-	trace := logSink{log: log.WithField("relay", "relay.example.com:443")}
-
-	if !trace.SupportsSchemas(qlog.EventSchema) {
-		t.Errorf("SupportsSchemas(%q) = false, want true", qlog.EventSchema)
-	}
-	if trace.SupportsSchemas("urn:ietf:params:qlog:events:http3-12") {
-		t.Error("SupportsSchemas() = true for an unrelated schema, want false")
-	}
-	if trace.AddProducer() == nil {
-		t.Error("AddProducer() = nil, want a recorder")
-	}
-}

shared/relay/client/dialer/quic/tracer.go

@@ -1,70 +0,0 @@
-package quic
-
-import (
-	"context"
-	"fmt"
-	"strings"
-
-	"github.com/quic-go/quic-go"
-	"github.com/quic-go/quic-go/qlog"
-	"github.com/quic-go/quic-go/qlogwriter"
-	log "github.com/sirupsen/logrus"
-)
-
-// logSink implements both qlogwriter.Trace and qlogwriter.Recorder, forwarding
-// the few qlog events the relay client cares about to logrus instead of
-// writing a qlog file. It holds no mutable state and logrus entries are safe
-// to share, so one value can serve every producer on the connection.
-type logSink struct {
-	log *log.Entry
-}
-
-func (s logSink) AddProducer() qlogwriter.Recorder { return s }
-
-func (s logSink) SupportsSchemas(schema string) bool { return schema == qlog.EventSchema }
-
-func (s logSink) RecordEvent(event qlogwriter.Event) {
-	switch e := event.(type) {
-	case qlog.MTUUpdated:
-		if e.Done {
-			s.log.Infof("QUIC path MTU settled at %d", e.Value)
-			return
-		}
-		s.log.Debugf("QUIC path MTU probing at %d", e.Value)
-	case qlog.ConnectionClosed:
-		s.log.Debugf("QUIC connection closed: %s", closeReason(e))
-	}
-}
-
-func (s logSink) Close() error { return nil }
-
-// connectionTracer returns a QUIC tracer that logs the DPLPMTUD result and the
-// reason a relay connection closed, so the path MTU settled on and teardown
-// cause are visible in logs. Lines carry the relay address as a structured
-// field, matching the rest of the relay client logging.
-func connectionTracer(addr string) func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
-	relayLog := log.WithField("relay", addr)
-	return func(context.Context, bool, quic.ConnectionID) qlogwriter.Trace {
-		return logSink{log: relayLog}
-	}
-}
-
-// closeReason renders a ConnectionClosed event as a single line. The event
-// carries the error as separate initiator, code, trigger and reason fields,
-// any of which may be unset.
-func closeReason(e qlog.ConnectionClosed) string {
-	parts := []string{fmt.Sprintf("closed by %s", e.Initiator)}
-	switch {
-	case e.ConnectionError != nil:
-		parts = append(parts, fmt.Sprintf("transport error: %s", *e.ConnectionError))
-	case e.ApplicationError != nil:
-		parts = append(parts, fmt.Sprintf("application error: %d", *e.ApplicationError))
-	}
-	if e.Trigger != "" {
-		parts = append(parts, fmt.Sprintf("trigger: %s", e.Trigger))
-	}
-	if e.Reason != "" {
-		parts = append(parts, fmt.Sprintf("reason: %s", e.Reason))
-	}
-	return strings.Join(parts, ", ")
-}