Add VNC allow and approval settings to MDM policy

# Conflicts:
#	client/proto/daemon.pb.go
#	client/ssh/proxy/proxy_test.go
#	client/wasm/cmd/main.go
#	shared/management/http/api/types.gen.go

client/android/client.go

@@ -247,9 +247,6 @@ func (c *Client) DebugBundle(platformFiles PlatformFiles, anonymize bool) (strin
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
-			deps.RefreshStatus = func() {
-				e.RunHealthProbes(context.Background(), true)
-			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/cmd/login.go

@@ -17,9 +17,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
-	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/util"
 )
@@ -333,14 +331,6 @@ func doForegroundLogin(ctx context.Context, cmd *cobra.Command, setupKey string,
 		return fmt.Errorf("read config file %s: %v", configFilePath, err)
 	}
 
-	// Mirror runInForegroundMode: recover residual state (DNS, firewall,
-	// ssh config, legacy routing) from a previous unclean shutdown and
-	// enable advanced routing before dialing management.
-	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configFilePath).GetStatePath()); err != nil {
-		log.Warnf("failed to restore residual state: %v", err)
-	}
-	nbnet.Init()
-
 	err = foregroundLogin(ctx, cmd, config, setupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)

client/cmd/up.go

@@ -22,8 +22,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
-	nbnet "github.com/netbirdio/netbird/client/net"
-	"github.com/netbirdio/netbird/client/server"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/util"
@@ -231,24 +229,6 @@ func runInForegroundMode(ctx context.Context, cmd *cobra.Command, activeProf *pr
 
 	_, _ = profilemanager.UpdateOldManagementURL(ctx, config, configFilePath)
 
-	// Restore residual state left by a previous run that did not shut down
-	// cleanly, mirroring what the daemon does before connecting: it recovers
-	// DNS config (a stale resolv.conf takeover can make the management
-	// hostname unresolvable), firewall rules, ssh config and legacy routing.
-	// Route cleanup itself happens at engine start; nbnet.Init() below lets
-	// the management dial bypass a leftover fwmark rule until then.
-	// Foreground mode is particularly exposed in containers: a crashed
-	// container restarts inside the same (pod) network namespace, so stale
-	// state survives while the process does not.
-	if err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configPath).GetStatePath()); err != nil {
-		log.Warnf("failed to restore residual state: %v", err)
-	}
-
-	// Enable advanced routing (as the daemon does on startup) so the
-	// management dial bypasses a leftover fwmark rule instead of being
-	// shunted into a stale routing table.
-	nbnet.Init()
-
 	err = foregroundLogin(ctx, cmd, config, providedSetupKey, activeProf.ID)
 	if err != nil {
 		return fmt.Errorf("foreground login failed: %v", err)
@@ -421,6 +401,12 @@ func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, pro
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		req.ServerSSHAllowed = &serverSSHAllowed
 	}
+	if cmd.Flag(serverVNCAllowedFlag).Changed {
+		req.ServerVNCAllowed = &serverVNCAllowed
+	}
+	if cmd.Flag(disableVNCApprovalFlag).Changed {
+		req.DisableVNCApproval = &disableVNCApproval
+	}
 	if cmd.Flag(enableSSHRootFlag).Changed {
 		req.EnableSSHRoot = &enableSSHRoot
 	}
@@ -523,30 +509,14 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		ic.ServerSSHAllowed = &serverSSHAllowed
 	}
-
-	if cmd.Flag(enableSSHRootFlag).Changed {
-		ic.EnableSSHRoot = &enableSSHRoot
+	if cmd.Flag(serverVNCAllowedFlag).Changed {
+		ic.ServerVNCAllowed = &serverVNCAllowed
+	}
+	if cmd.Flag(disableVNCApprovalFlag).Changed {
+		ic.DisableVNCApproval = &disableVNCApproval
 	}
 
-	if cmd.Flag(enableSSHSFTPFlag).Changed {
-		ic.EnableSSHSFTP = &enableSSHSFTP
-	}
-
-	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
-		ic.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
-	}
-
-	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
-		ic.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
-	}
-
-	if cmd.Flag(disableSSHAuthFlag).Changed {
-		ic.DisableSSHAuth = &disableSSHAuth
-	}
-
-	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
-		ic.SSHJWTCacheTTL = &sshJWTCacheTTL
-	}
+	applySSHFlagsToConfig(cmd, &ic)
 
 	if cmd.Flag(interfaceNameFlag).Changed {
 		if err := parseInterfaceName(interfaceName); err != nil {
@@ -619,6 +589,49 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 	return &ic, nil
 }
 
+func applySSHFlagsToConfig(cmd *cobra.Command, ic *profilemanager.ConfigInput) {
+	if cmd.Flag(enableSSHRootFlag).Changed {
+		ic.EnableSSHRoot = &enableSSHRoot
+	}
+	if cmd.Flag(enableSSHSFTPFlag).Changed {
+		ic.EnableSSHSFTP = &enableSSHSFTP
+	}
+	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
+		ic.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
+	}
+	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
+		ic.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
+	}
+	if cmd.Flag(disableSSHAuthFlag).Changed {
+		ic.DisableSSHAuth = &disableSSHAuth
+	}
+	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
+		ic.SSHJWTCacheTTL = &sshJWTCacheTTL
+	}
+}
+
+func applySSHFlagsToLogin(cmd *cobra.Command, req *proto.LoginRequest) {
+	if cmd.Flag(enableSSHRootFlag).Changed {
+		req.EnableSSHRoot = &enableSSHRoot
+	}
+	if cmd.Flag(enableSSHSFTPFlag).Changed {
+		req.EnableSSHSFTP = &enableSSHSFTP
+	}
+	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
+		req.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
+	}
+	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
+		req.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
+	}
+	if cmd.Flag(disableSSHAuthFlag).Changed {
+		req.DisableSSHAuth = &disableSSHAuth
+	}
+	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
+		ttl := int32(sshJWTCacheTTL)
+		req.SshJWTCacheTTL = &ttl
+	}
+}
+
 func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte, cmd *cobra.Command) (*proto.LoginRequest, error) {
 	loginRequest := proto.LoginRequest{
 		SetupKey:            providedSetupKey,
@@ -648,31 +661,14 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 	if cmd.Flag(serverSSHAllowedFlag).Changed {
 		loginRequest.ServerSSHAllowed = &serverSSHAllowed
 	}
-
-	if cmd.Flag(enableSSHRootFlag).Changed {
-		loginRequest.EnableSSHRoot = &enableSSHRoot
+	if cmd.Flag(serverVNCAllowedFlag).Changed {
+		loginRequest.ServerVNCAllowed = &serverVNCAllowed
+	}
+	if cmd.Flag(disableVNCApprovalFlag).Changed {
+		loginRequest.DisableVNCApproval = &disableVNCApproval
 	}
 
-	if cmd.Flag(enableSSHSFTPFlag).Changed {
-		loginRequest.EnableSSHSFTP = &enableSSHSFTP
-	}
-
-	if cmd.Flag(enableSSHLocalPortForwardFlag).Changed {
-		loginRequest.EnableSSHLocalPortForwarding = &enableSSHLocalPortForward
-	}
-
-	if cmd.Flag(enableSSHRemotePortForwardFlag).Changed {
-		loginRequest.EnableSSHRemotePortForwarding = &enableSSHRemotePortForward
-	}
-
-	if cmd.Flag(disableSSHAuthFlag).Changed {
-		loginRequest.DisableSSHAuth = &disableSSHAuth
-	}
-
-	if cmd.Flag(sshJWTCacheTTLFlag).Changed {
-		sshJWTCacheTTL32 := int32(sshJWTCacheTTL)
-		loginRequest.SshJWTCacheTTL = &sshJWTCacheTTL32
-	}
+	applySSHFlagsToLogin(cmd, &loginRequest)
 
 	if cmd.Flag(disableAutoConnectFlag).Changed {
 		loginRequest.DisableAutoConnect = &autoConnectDisabled

client/cmd/vnc_agent.go

@@ -0,0 +1,100 @@
+//go:build windows || (darwin && !ios)
+
+package cmd
+
+import (
+	"fmt"
+	"net"
+	"net/netip"
+	"os"
+
+	log "github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+
+	vncserver "github.com/netbirdio/netbird/client/vnc/server"
+)
+
+var (
+	vncAgentSocket    string
+	vncAgentTargetUID uint32
+)
+
+func init() {
+	vncAgentCmd.Flags().StringVar(&vncAgentSocket, "socket", "", "Unix-domain socket path the agent listens on (required)")
+	vncAgentCmd.Flags().Uint32Var(&vncAgentTargetUID, "target-uid", 0, "uid the agent should drop privileges to before listening (darwin only; 0 = stay as current uid)")
+	rootCmd.AddCommand(vncAgentCmd)
+}
+
+// vncAgentCmd runs a VNC server inside the user's interactive session,
+// listening on a Unix-domain socket. The NetBird service spawns it: on
+// Windows via CreateProcessAsUser into the console session, on macOS via
+// launchctl asuser into the Aqua session.
+var vncAgentCmd = &cobra.Command{
+	Use:    "vnc-agent",
+	Short:  "Run VNC capture agent (internal, spawned by service)",
+	Hidden: true,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		log.SetReportCaller(true)
+		log.SetFormatter(&log.JSONFormatter{})
+		log.SetOutput(os.Stderr)
+
+		if vncAgentSocket == "" {
+			return fmt.Errorf("--socket is required")
+		}
+
+		token := os.Getenv("NB_VNC_AGENT_TOKEN")
+		if token == "" {
+			return fmt.Errorf("NB_VNC_AGENT_TOKEN not set; agent requires a token from the service")
+		}
+		// Purge the token from env so it doesn't leak via /proc/<pid>/environ.
+		if err := os.Unsetenv("NB_VNC_AGENT_TOKEN"); err != nil {
+			log.Debugf("unset NB_VNC_AGENT_TOKEN: %v", err)
+		}
+
+		// Drop root privileges to the target console user BEFORE creating
+		// the listening socket: keeps a post-auth bug in the encoder /
+		// input / capture paths confined to the user's own privileges
+		// rather than escalating to host root, and makes the daemon's
+		// LOCAL_PEERCRED check see the right uid. No-op on Windows
+		// (both processes run as SYSTEM) and when --target-uid is 0.
+		if vncAgentTargetUID != 0 {
+			if err := dropAgentPrivileges(vncAgentTargetUID); err != nil {
+				return fmt.Errorf("drop privileges to uid %d: %w", vncAgentTargetUID, err)
+			}
+		}
+
+		if err := os.Remove(vncAgentSocket); err != nil && !os.IsNotExist(err) {
+			log.Debugf("remove stale socket %s: %v", vncAgentSocket, err)
+		}
+		ln, err := net.Listen("unix", vncAgentSocket)
+		if err != nil {
+			return fmt.Errorf("listen on %s: %w", vncAgentSocket, err)
+		}
+		if err := os.Chmod(vncAgentSocket, 0o600); err != nil {
+			log.Debugf("chmod %s: %v", vncAgentSocket, err)
+		}
+
+		capturer, injector, err := newAgentResources()
+		if err != nil {
+			_ = ln.Close()
+			return err
+		}
+		srv := vncserver.New(vncserver.Config{
+			Capturer:      capturer,
+			Injector:      injector,
+			DisableAuth:   true,
+			AgentTokenHex: token,
+			Listener:      ln,
+		})
+
+		if err := srv.Start(cmd.Context(), netip.AddrPort{}, netip.Prefix{}); err != nil {
+			return fmt.Errorf("start vnc server: %w", err)
+		}
+		log.Infof("vnc-agent listening on %s, ready", vncAgentSocket)
+
+		<-cmd.Context().Done()
+		log.Info("vnc-agent context cancelled, shutting down")
+		return srv.Stop()
+	},
+	SilenceUsage: true,
+}

client/cmd/vnc_agent_darwin.go

@@ -0,0 +1,18 @@
+//go:build darwin && !ios
+
+package cmd
+
+import (
+	"fmt"
+
+	vncserver "github.com/netbirdio/netbird/client/vnc/server"
+)
+
+func newAgentResources() (vncserver.ScreenCapturer, vncserver.InputInjector, error) {
+	capturer := vncserver.NewMacPoller()
+	injector, err := vncserver.NewMacInputInjector()
+	if err != nil {
+		return nil, nil, fmt.Errorf("macOS input injector: %w", err)
+	}
+	return capturer, injector, nil
+}

client/cmd/vnc_agent_dropprivs_darwin.go

@@ -0,0 +1,77 @@
+//go:build darwin && !ios
+
+package cmd
+
+import (
+	"fmt"
+	"os"
+	"os/user"
+	"strconv"
+	"syscall"
+)
+
+// dropAgentPrivileges drops the vnc-agent process from root (its
+// launchctl-asuser-inherited starting uid) to the target console user
+// before any other initialisation runs. Without this the agent runs as
+// root for the lifetime of the session; any post-auth memory-safety
+// issue in the capture/input/encode paths would then be a root-level
+// RCE on the host instead of a user-level one. Also makes the daemon's
+// LOCAL_PEERCRED check correctly identify the agent as the console user,
+// not as root.
+//
+// Returns an error when the agent is running as a non-root uid that
+// differs from targetUID: non-root can only setuid to itself, so a
+// mismatch here means the spawn went to the wrong session.
+func dropAgentPrivileges(targetUID uint32) error {
+	if targetUID == 0 {
+		return fmt.Errorf("refusing to keep agent running as root (target uid 0)")
+	}
+	cur := uint32(os.Getuid())
+	if cur == targetUID {
+		return nil
+	}
+	if cur != 0 {
+		return fmt.Errorf("agent uid %d does not match expected %d and we lack root to fix it", cur, targetUID)
+	}
+	// Resolve the target user's real primary group rather than reusing
+	// targetUID as the gid: a user's primary group on macOS is typically
+	// staff(20), not gid==uid. Fail closed if the lookup fails.
+	targetGID, err := primaryGroupID(targetUID)
+	if err != nil {
+		return err
+	}
+	// Drop supplementary groups first: setgid alone doesn't touch the
+	// auxiliary group list, leaving root's groups attached would let the
+	// dropped process write to root-only group-writable files.
+	if err := syscall.Setgroups([]int{}); err != nil {
+		return fmt.Errorf("setgroups([]): %w", err)
+	}
+	if err := syscall.Setgid(targetGID); err != nil {
+		return fmt.Errorf("setgid(%d): %w", targetGID, err)
+	}
+	if os.Getgid() != targetGID || os.Getegid() != targetGID {
+		return fmt.Errorf("setgid verification: gid=%d egid=%d, expected %d", os.Getgid(), os.Getegid(), targetGID)
+	}
+	if err := syscall.Setuid(int(targetUID)); err != nil {
+		return fmt.Errorf("setuid(%d): %w", targetUID, err)
+	}
+	if uint32(os.Getuid()) != targetUID || uint32(os.Geteuid()) != targetUID {
+		return fmt.Errorf("setuid verification: uid=%d euid=%d, expected %d", os.Getuid(), os.Geteuid(), targetUID)
+	}
+	return nil
+}
+
+// primaryGroupID resolves the real primary group id of the user with the
+// given uid. Fails closed: a lookup or parse error returns an error so the
+// caller never falls back to using uid as the gid.
+func primaryGroupID(targetUID uint32) (int, error) {
+	u, err := user.LookupId(strconv.Itoa(int(targetUID)))
+	if err != nil {
+		return 0, fmt.Errorf("look up uid %d: %w", targetUID, err)
+	}
+	gid, err := strconv.Atoi(u.Gid)
+	if err != nil {
+		return 0, fmt.Errorf("parse gid %q for uid %d: %w", u.Gid, targetUID, err)
+	}
+	return gid, nil
+}

client/cmd/vnc_agent_dropprivs_darwin_test.go

@@ -0,0 +1,55 @@
+//go:build darwin && !ios
+
+package cmd
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestDropAgentPrivileges_RefusesRootTarget locks in the contract that
+// dropAgentPrivileges must never be a no-op when asked to keep the
+// agent as root (target uid 0). A future caller that passes 0 by
+// mistake would otherwise leave the post-auth attack surface running
+// with full root privileges.
+func TestDropAgentPrivileges_RefusesRootTarget(t *testing.T) {
+	err := dropAgentPrivileges(0)
+	if err == nil {
+		t.Fatal("expected refusal for target uid 0, got nil")
+	}
+	if !strings.Contains(err.Error(), "root") {
+		t.Fatalf("error should mention root, got: %v", err)
+	}
+}
+
+// TestDropAgentPrivileges_NoOpWhenAlreadyTarget covers the dev path
+// where the agent is launched by hand as the target user (no root
+// available, no setuid needed). The helper must succeed silently
+// instead of trying (and failing) a setuid to its current uid.
+func TestDropAgentPrivileges_NoOpWhenAlreadyTarget(t *testing.T) {
+	// Skip when running as root: the early-return path we want to
+	// cover only fires when current uid == target uid.
+	uid := currentUIDForTest()
+	if uid == 0 {
+		t.Skip("test must not run as root; cannot exercise the no-op early-return")
+	}
+	if err := dropAgentPrivileges(uid); err != nil {
+		t.Fatalf("expected no-op when current uid == target, got: %v", err)
+	}
+}
+
+// TestDropAgentPrivileges_RefusesMismatchedNonRoot guards the "non-root
+// caller tries to setuid to a different uid" path: setuid would fail
+// with EPERM anyway, but the helper should surface a clear error
+// before issuing the syscall so a misconfigured spawn (wrong --target-uid
+// flag) is debuggable.
+func TestDropAgentPrivileges_RefusesMismatchedNonRoot(t *testing.T) {
+	uid := currentUIDForTest()
+	if uid == 0 {
+		t.Skip("test must not run as root; covered case requires non-root caller")
+	}
+	err := dropAgentPrivileges(uid + 1)
+	if err == nil {
+		t.Fatal("expected refusal when non-root caller asks to setuid elsewhere")
+	}
+}

client/cmd/vnc_agent_dropprivs_testhelpers_darwin.go

@@ -0,0 +1,11 @@
+//go:build darwin && !ios
+
+package cmd
+
+import "os"
+
+// currentUIDForTest exposes os.Getuid for the darwin dropprivs tests
+// without leaking an os import into the test file itself.
+func currentUIDForTest() uint32 {
+	return uint32(os.Getuid())
+}

client/cmd/vnc_agent_dropprivs_windows.go

@@ -0,0 +1,14 @@
+//go:build windows
+
+package cmd
+
+// dropAgentPrivileges is a no-op on Windows: the agent and the daemon
+// both run as SYSTEM (the daemon spawns the agent into the interactive
+// session via CreateProcessAsUser with an impersonation token, but the
+// resulting process still runs under SYSTEM, not under the user's
+// account). The Windows path relies on the DACL-restricted socket
+// directory, the unpredictable per-spawn socket name, the listen-readiness
+// gate, and the per-spawn token for integrity instead.
+func dropAgentPrivileges(_ uint32) error {
+	return nil
+}

client/cmd/vnc_agent_windows.go

@@ -0,0 +1,15 @@
+//go:build windows
+
+package cmd
+
+import (
+	log "github.com/sirupsen/logrus"
+
+	vncserver "github.com/netbirdio/netbird/client/vnc/server"
+)
+
+func newAgentResources() (vncserver.ScreenCapturer, vncserver.InputInjector, error) {
+	sessionID := vncserver.GetCurrentSessionID()
+	log.Infof("VNC agent running in Windows session %d", sessionID)
+	return vncserver.NewDesktopCapturer(), vncserver.NewWindowsInputInjector(), nil
+}

client/cmd/vnc_flags.go

@@ -0,0 +1,16 @@
+package cmd
+
+const (
+	serverVNCAllowedFlag   = "allow-server-vnc"
+	disableVNCApprovalFlag = "disable-vnc-approval"
+)
+
+var (
+	serverVNCAllowed   bool
+	disableVNCApproval bool
+)
+
+func init() {
+	upCmd.PersistentFlags().BoolVar(&serverVNCAllowed, serverVNCAllowedFlag, false, "Allow embedded VNC server on peer")
+	upCmd.PersistentFlags().BoolVar(&disableVNCApproval, disableVNCApprovalFlag, false, "Disable per-connection user approval prompts for the embedded VNC server")
+}

client/configs/configs.go

@@ -6,19 +6,30 @@ import (
 	"runtime"
 )
 
-var StateDir string
+var (
+	// StateDir holds persistent state (config, profiles, install metadata).
+	StateDir string
+	// RuntimeDir holds ephemeral artifacts that should not survive reboot,
+	// such as Unix sockets for daemon and per-session IPC. Empty on
+	// platforms without a conventional /var/run-style location.
+	RuntimeDir string
+)
 
 func init() {
-	StateDir = os.Getenv("NB_STATE_DIR")
-	if StateDir != "" {
-		return
-	}
 	switch runtime.GOOS {
 	case "windows":
 		StateDir = filepath.Join(os.Getenv("PROGRAMDATA"), "Netbird")
 	case "darwin", "linux":
 		StateDir = "/var/lib/netbird"
+		RuntimeDir = "/var/run/netbird"
 	case "freebsd", "openbsd", "netbsd", "dragonfly":
 		StateDir = "/var/db/netbird"
+		RuntimeDir = "/var/run/netbird"
+	}
+	if v := os.Getenv("NB_STATE_DIR"); v != "" {
+		StateDir = v
+	}
+	if v := os.Getenv("NB_RUNTIME_DIR"); v != "" {
+		RuntimeDir = v
 	}
 }

client/firewall/uspfilter/filter.go

@@ -121,7 +121,6 @@ type Manager struct {
 	udpTracker     *conntrack.UDPTracker
 	icmpTracker    *conntrack.ICMPTracker
 	tcpTracker     *conntrack.TCPTracker
-	fragments      *fragmentTracker
 	forwarder      atomic.Pointer[forwarder.Forwarder]
 	pendingCapture atomic.Pointer[forwarder.PacketCapture]
 	logger         *nblog.Logger
@@ -184,41 +183,6 @@ func (d *decoder) decodePacket(data []byte) error {
 	}
 }
 
-// decodeTransport decodes the transport header of a first fragment (which
-// gopacket leaves undecoded) into the decoder and appends its layer type to
-// decoded, so the ACL pipeline can evaluate it like a normal packet. It returns
-// false if the protocol is unsupported or the header is truncated.
-func (d *decoder) decodeTransport(proto layers.IPProtocol, payload []byte) bool {
-	var l4 gopacket.DecodingLayer
-	var layerType gopacket.LayerType
-	var minLen int
-	switch proto {
-	case layers.IPProtocolTCP:
-		l4, layerType, minLen = &d.tcp, layers.LayerTypeTCP, 20
-	case layers.IPProtocolUDP:
-		l4, layerType, minLen = &d.udp, layers.LayerTypeUDP, 8
-	case layers.IPProtocolICMPv4:
-		l4, layerType, minLen = &d.icmp4, layers.LayerTypeICMPv4, 8
-	case layers.IPProtocolICMPv6:
-		l4, layerType, minLen = &d.icmp6, layers.LayerTypeICMPv6, 8
-	default:
-		return false
-	}
-
-	// Reject a fragment too small to hold the full transport header before
-	// decoding: it can't be ACL-evaluated (tiny-fragment attack), and skipping
-	// the decode avoids gopacket allocating an error on the drop path.
-	if len(payload) < minLen {
-		return false
-	}
-
-	if err := l4.DecodeFromBytes(payload, gopacket.NilDecodeFeedback); err != nil {
-		return false
-	}
-	d.decoded = append(d.decoded, layerType)
-	return true
-}
-
 // Create userspace firewall manager constructor
 func Create(iface common.IFaceMapper, disableServerRoutes bool, flowLogger nftypes.FlowLogger, mtu uint16) (*Manager, error) {
 	return create(iface, nil, disableServerRoutes, flowLogger, mtu)
@@ -322,8 +286,6 @@ func create(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableSe
 	if err := m.localipmanager.UpdateLocalIPs(iface); err != nil {
 		return nil, fmt.Errorf("update local IPs: %w", err)
 	}
-	m.fragments = newFragmentTracker(m.logger)
-
 	if disableConntrack {
 		log.Info("conntrack is disabled")
 	} else {
@@ -337,7 +299,6 @@ func create(iface common.IFaceMapper, nativeFirewall firewall.Manager, disableSe
 		}
 	}
 	if err := iface.SetFilter(m); err != nil {
-		m.fragments.Close()
 		return nil, fmt.Errorf("set filter: %w", err)
 	}
 	return m, nil
@@ -733,10 +694,6 @@ func (m *Manager) resetState() {
 		m.tcpTracker.Close()
 	}
 
-	if m.fragments != nil {
-		m.fragments.Close()
-	}
-
 	if fwder := m.forwarder.Load(); fwder != nil {
 		fwder.SetCapture(nil)
 		fwder.Stop()
@@ -1089,20 +1046,19 @@ func (m *Manager) filterInbound(packetData []byte, size int) bool {
 		return true
 	}
 
-	// gopacket does not decode the transport header of any IP fragment, so
-	// fragments take a dedicated path: the first fragment's header is decoded
-	// and ACL-evaluated here, and the remaining fragments inherit its verdict.
+	// TODO: pass fragments of routed packets to forwarder
 	if fragment {
-		return m.filterInboundFragment(d, srcIP, dstIP, size)
+		if m.logger.Enabled(nblog.LevelTrace) {
+			if d.decoded[0] == layers.LayerTypeIPv4 {
+				m.logger.Trace4("packet is a fragment: src=%v dst=%v id=%v flags=%v",
+					srcIP, dstIP, d.ip4.Id, d.ip4.Flags)
+			} else {
+				m.logger.Trace2("packet is an IPv6 fragment: src=%v dst=%v", srcIP, dstIP)
+			}
+		}
+		return false
 	}
 
-	return m.filterInboundDecoded(d, srcIP, dstIP, packetData, size)
-}
-
-// filterInboundDecoded runs the ACL, DNAT and conntrack pipeline on a fully
-// decoded (non-fragment) inbound packet. It returns true if the packet should
-// be dropped.
-func (m *Manager) filterInboundDecoded(d *decoder, srcIP, dstIP netip.Addr, packetData []byte, size int) bool {
 	// TODO: optimize port DNAT by caching matched rules in conntrack
 	if translated := m.translateInboundPortDNAT(packetData, d, srcIP, dstIP); translated {
 		// Re-decode after port DNAT translation to update port information
@@ -1133,226 +1089,33 @@ func (m *Manager) filterInboundDecoded(d *decoder, srcIP, dstIP netip.Addr, pack
 	return m.handleRoutedTraffic(d, srcIP, dstIP, packetData, size)
 }
 
-// fragmentMeta holds the reassembly identity and layout of an IP fragment,
-// extracted uniformly for IPv4 and IPv6.
-type fragmentMeta struct {
-	key fragmentKey
-	// offset is the fragment offset in 8-byte units (zero for the first
-	// fragment).
-	offset uint16
-	// moreFragments is the More Fragments bit. A first fragment with it unset is
-	// an IPv6 atomic fragment (a complete datagram, RFC 6946): it has no trailing
-	// fragments to inherit a verdict, so it must not be recorded.
-	moreFragments bool
-	proto         layers.IPProtocol
-	// l4payload is the fragmentable payload of this fragment. For the first
-	// fragment it starts with the transport header.
-	l4payload []byte
-	// headerEndOctets is the first fragment's payload length in 8-byte units:
-	// the smallest offset a trailing fragment may start at without overlapping
-	// the inspected transport header.
-	headerEndOctets uint16
-}
-
-// fragmentMetadata extracts the fragment identity and layout from a decoded IP
-// fragment. It returns false for fragments it can't interpret (e.g. an IPv6
-// fragment header shorter than 8 bytes), which are then dropped.
-func fragmentMetadata(d *decoder, srcIP, dstIP netip.Addr) (fragmentMeta, bool) {
-	switch d.decoded[0] {
-	case layers.LayerTypeIPv4:
-		payload := d.ip4.Payload
-		return fragmentMeta{
-			key:             fragmentKey{srcIP: srcIP, dstIP: dstIP, id: uint32(d.ip4.Id), proto: uint8(d.ip4.Protocol)},
-			offset:          d.ip4.FragOffset,
-			moreFragments:   d.ip4.Flags&layers.IPv4MoreFragments != 0,
-			proto:           d.ip4.Protocol,
-			l4payload:       payload,
-			headerEndOctets: octets(len(payload)),
-		}, true
-
-	case layers.LayerTypeIPv6:
-		// IPv6 fragment extension header: 8 bytes, followed by the fragmentable
-		// payload. Layout: next header (1), reserved (1), offset+flags (2), id (4).
-		payload := d.ip6.Payload
-		if len(payload) < 8 {
-			return fragmentMeta{}, false
-		}
-		nextHeader := layers.IPProtocol(payload[0])
-		offsetFlags := binary.BigEndian.Uint16(payload[2:4])
-		id := binary.BigEndian.Uint32(payload[4:8])
-		l4 := payload[8:]
-		return fragmentMeta{
-			key:             fragmentKey{srcIP: srcIP, dstIP: dstIP, id: id, proto: uint8(nextHeader)},
-			offset:          offsetFlags >> 3,
-			moreFragments:   offsetFlags&1 != 0,
-			proto:           nextHeader,
-			l4payload:       l4,
-			headerEndOctets: octets(len(l4)),
-		}, true
-
-	default:
-		return fragmentMeta{}, false
-	}
-}
-
-// octets rounds a byte length up to whole 8-byte units, the granularity of the
-// IP fragment offset field.
-func octets(nbytes int) uint16 {
-	return uint16((nbytes + 7) / 8)
-}
-
-// filterInboundFragment decides the fate of an IP fragment. gopacket stops
-// decoding at the network layer for every fragment, so the first fragment's
-// transport header is decoded and ACL-evaluated here and its verdict recorded;
-// the remaining (headerless) fragments inherit that verdict. Anything that
-// cannot be tied to an allowed, non-overlapping first fragment is dropped.
-func (m *Manager) filterInboundFragment(d *decoder, srcIP, dstIP netip.Addr, size int) bool {
-	meta, ok := fragmentMetadata(d, srcIP, dstIP)
-	if !ok {
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace2("dropping unsupported fragment: src=%v dst=%v", srcIP, dstIP)
-		}
-		return true
-	}
-
-	if meta.offset != 0 {
-		return m.filterTrailingFragment(meta, srcIP, dstIP)
-	}
-
-	// A new first fragment supersedes any recorded verdict for this datagram, so
-	// a re-sent or overlapping offset-zero fragment can't inherit the old one.
-	m.fragments.poison(meta.key)
-
-	// First fragment: decode its transport header so the ACL can evaluate it. A
-	// decode failure means the fragment is too small to hold the full transport
-	// header (RFC 1858 §3 tiny-fragment attack); it can't be evaluated, so drop it.
-	if !d.decodeTransport(meta.proto, meta.l4payload) {
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace3("dropping first fragment without full L4 header: src=%v dst=%v id=%v",
-				srcIP, dstIP, meta.key.id)
-		}
-		return true
-	}
-
-	return m.filterFirstFragment(d, meta, srcIP, dstIP, size)
-}
-
-// filterTrailingFragment applies a recorded first-fragment verdict to a
-// non-first fragment.
-func (m *Manager) filterTrailingFragment(meta fragmentMeta, srcIP, dstIP netip.Addr) bool {
-	switch m.fragments.verdict(meta.key, meta.offset) {
-	case fragmentAllow:
-		return false
-	case fragmentOverlap:
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace3("dropping overlapping fragment rewriting inspected header: src=%v dst=%v id=%v",
-				srcIP, dstIP, meta.key.id)
-		}
-		return true
-	default:
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace3("dropping fragment with no allowed first fragment: src=%v dst=%v id=%v",
-				srcIP, dstIP, meta.key.id)
-		}
-		return true
-	}
-}
-
-// filterFirstFragment runs the verdict part of the inbound pipeline on a first
-// fragment with its transport header decoded. It mirrors filterInboundDecoded
-// but skips DNAT (port rewriting on fragments is unsupported) and forwarder
-// injection (fragments are left to the stack to reassemble, not forwarded).
-// Allowed fragments have their verdict recorded so the datagram's trailing
-// fragments inherit it.
-func (m *Manager) filterFirstFragment(d *decoder, meta fragmentMeta, srcIP, dstIP netip.Addr, size int) bool {
-	if m.stateful && m.isValidTrackedConnection(d, srcIP, dstIP, size) {
-		m.recordFirstFragment(meta)
-		return false
-	}
-
-	if m.localipmanager.IsLocalIP(dstIP) {
-		ruleID, blocked := m.peerACLsBlock(srcIP, d, nil)
-		if blocked {
-			m.storeDropFlow("Dropping local first fragment (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-				d, srcIP, dstIP, ruleID, size)
-			return true
-		}
-		m.trackInbound(d, srcIP, dstIP, ruleID, size)
-		m.recordFirstFragment(meta)
-		return false
-	}
-
-	if !m.routingEnabled.Load() {
-		if m.logger.Enabled(nblog.LevelTrace) {
-			m.logger.Trace2("Dropping routed fragment (routing disabled): src=%s dst=%s", srcIP, dstIP)
-		}
-		return true
-	}
-	if m.nativeRouter.Load() {
-		m.trackInbound(d, srcIP, dstIP, nil, size)
-		m.recordFirstFragment(meta)
-		return false
-	}
-
-	// TODO: pass fragments of routed packets to the forwarder; until then
-	// allowed routed fragments go to the native stack.
-	srcPort, dstPort := getPortsFromPacket(d)
-	ruleID, pass := m.routeACLsPass(srcIP, dstIP, d.decoded[1], srcPort, dstPort)
-	if !pass {
-		m.storeDropFlow("Dropping routed first fragment (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-			d, srcIP, dstIP, ruleID, size)
-		return true
-	}
-
-	m.recordFirstFragment(meta)
-	return false
-}
-
-// recordFirstFragment caches an allowed first fragment's verdict for its
-// trailing fragments to inherit. Atomic fragments (no More Fragments bit) are
-// complete datagrams with no trailing fragments, so they are not cached and
-// cannot exhaust the verdict table.
-func (m *Manager) recordFirstFragment(meta fragmentMeta) {
-	if !meta.moreFragments {
-		return
-	}
-	m.fragments.recordAllowed(meta.key, meta.headerEndOctets)
-}
-
-// storeDropFlow logs and records a netflow drop event for an inbound packet
-// denied by the ACLs. msg is the trace format taking rule id, protocol, source
-// and destination.
-func (m *Manager) storeDropFlow(msg string, d *decoder, srcIP, dstIP netip.Addr, ruleID []byte, size int) {
-	pnum := getProtocolFromPacket(d)
-	srcPort, dstPort := getPortsFromPacket(d)
-
-	if m.logger.Enabled(nblog.LevelTrace) {
-		m.logger.Trace6(msg, ruleID, pnum, srcIP, srcPort, dstIP, dstPort)
-	}
-
-	m.flowLogger.StoreEvent(nftypes.EventFields{
-		FlowID:     uuid.New(),
-		Type:       nftypes.TypeDrop,
-		RuleID:     ruleID,
-		Direction:  nftypes.Ingress,
-		Protocol:   pnum,
-		SourceIP:   srcIP,
-		DestIP:     dstIP,
-		SourcePort: srcPort,
-		DestPort:   dstPort,
-		// TODO: icmp type/code
-		RxPackets: 1,
-		RxBytes:   uint64(size),
-	})
-}
-
 // handleLocalTraffic handles local traffic.
 // If it returns true, the packet should be dropped.
 func (m *Manager) handleLocalTraffic(d *decoder, srcIP, dstIP netip.Addr, packetData []byte, size int) bool {
 	ruleID, blocked := m.peerACLsBlock(srcIP, d, packetData)
 	if blocked {
-		m.storeDropFlow("Dropping local packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-			d, srcIP, dstIP, ruleID, size)
+		pnum := getProtocolFromPacket(d)
+		srcPort, dstPort := getPortsFromPacket(d)
+
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace6("Dropping local packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+				ruleID, pnum, srcIP, srcPort, dstIP, dstPort)
+		}
+
+		m.flowLogger.StoreEvent(nftypes.EventFields{
+			FlowID:     uuid.New(),
+			Type:       nftypes.TypeDrop,
+			RuleID:     ruleID,
+			Direction:  nftypes.Ingress,
+			Protocol:   pnum,
+			SourceIP:   srcIP,
+			DestIP:     dstIP,
+			SourcePort: srcPort,
+			DestPort:   dstPort,
+			// TODO: icmp type/code
+			RxPackets: 1,
+			RxBytes:   uint64(size),
+		})
 		return true
 	}
 
@@ -1405,8 +1168,27 @@ func (m *Manager) handleRoutedTraffic(d *decoder, srcIP, dstIP netip.Addr, packe
 
 	ruleID, pass := m.routeACLsPass(srcIP, dstIP, protoLayer, srcPort, dstPort)
 	if !pass {
-		m.storeDropFlow("Dropping routed packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
-			d, srcIP, dstIP, ruleID, size)
+		proto := getProtocolFromPacket(d)
+
+		if m.logger.Enabled(nblog.LevelTrace) {
+			m.logger.Trace6("Dropping routed packet (ACL denied): rule_id=%s proto=%v src=%s:%d dst=%s:%d",
+				ruleID, proto, srcIP, srcPort, dstIP, dstPort)
+		}
+
+		m.flowLogger.StoreEvent(nftypes.EventFields{
+			FlowID:     uuid.New(),
+			Type:       nftypes.TypeDrop,
+			RuleID:     ruleID,
+			Direction:  nftypes.Ingress,
+			Protocol:   proto,
+			SourceIP:   srcIP,
+			DestIP:     dstIP,
+			SourcePort: srcPort,
+			DestPort:   dstPort,
+			// TODO: icmp type/code
+			RxPackets: 1,
+			RxBytes:   uint64(size),
+		})
 		return true
 	}
 

client/firewall/uspfilter/forwarder/forwarder.go

@@ -5,9 +5,7 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"os"
 	"runtime"
-	"strconv"
 	"sync"
 	"time"
 
@@ -33,11 +31,6 @@ const (
 	defaultMaxInFlight   = 1024
 	iosReceiveWindow     = 16384
 	iosMaxInFlight       = 256
-
-	// envForceTCPRACK overrides the platform default for gVisor's RACK loss
-	// detection. Set to a truthy value to force RACK on, or a falsy value to
-	// force it off, on any platform.
-	envForceTCPRACK = "NB_FORCE_TCP_RACK"
 )
 
 type Forwarder struct {
@@ -159,8 +152,6 @@ func New(iface common.IFaceMapper, logger *nblog.Logger, flowLogger nftypes.Flow
 		maxInFlight = iosMaxInFlight
 	}
 
-	configureTCPRecovery(s)
-
 	tcpForwarder := tcp.NewForwarder(s, receiveWindow, maxInFlight, f.handleTCP)
 	s.SetTransportProtocolHandler(tcp.ProtocolNumber, tcpForwarder.HandlePacket)
 
@@ -475,31 +466,3 @@ func probeRawICMP(network, addr string, logger *nblog.Logger) bool {
 	logger.Debug1("forwarder: raw %s socket access available", network)
 	return true
 }
-
-// configureTCPRecovery disables gVisor's RACK loss detection on Windows, where
-// it interacts poorly with the host and collapses throughput on routed TCP
-// connections (gVisor issue #9778). Other platforms keep the default. The
-// EnvForceTCPRACK environment variable overrides the platform default.
-func configureTCPRecovery(s *stack.Stack) {
-	disableRACK := runtime.GOOS == "windows"
-
-	if val := os.Getenv(envForceTCPRACK); val != "" {
-		force, err := strconv.ParseBool(val)
-		if err != nil {
-			log.Warnf("parse %s: %v", envForceTCPRACK, err)
-		} else {
-			disableRACK = !force
-		}
-	}
-
-	if !disableRACK {
-		return
-	}
-
-	opt := tcpip.TCPRecovery(0)
-	if err := s.SetTransportProtocolOption(tcp.ProtocolNumber, &opt); err != nil {
-		log.Warnf("disable TCP RACK loss detection: %v", err)
-		return
-	}
-	log.Info("forwarder: TCP RACK loss detection disabled")
-}

client/firewall/uspfilter/fragment.go

@@ -1,204 +0,0 @@
-package uspfilter
-
-import (
-	"context"
-	"net/netip"
-	"os"
-	"strconv"
-	"sync"
-	"time"
-
-	nblog "github.com/netbirdio/netbird/client/firewall/uspfilter/log"
-)
-
-const (
-	// defaultFragmentTimeout bounds how long a first-fragment verdict is kept
-	// while the remaining fragments arrive. It mirrors the Linux IP reassembly
-	// timeout (net.ipv4.ipfrag_time).
-	defaultFragmentTimeout = 30 * time.Second
-	// fragmentCleanupInterval is how often expired verdicts are purged.
-	fragmentCleanupInterval = 10 * time.Second
-	// defaultMaxFragmentEntries caps the number of concurrently tracked
-	// fragmented datagrams. The table stays bounded because each datagram is a
-	// single small entry regardless of how many fragments it is split into, and
-	// the 13-bit IPv4 fragment-offset field limits any datagram to 64 KiB.
-	defaultMaxFragmentEntries = 16384
-
-	// EnvFragmentMaxEntries overrides defaultMaxFragmentEntries.
-	EnvFragmentMaxEntries = "NB_FRAGMENT_MAX_ENTRIES"
-)
-
-// fragmentVerdict is the decision for a trailing (headerless) fragment.
-type fragmentVerdict int
-
-const (
-	// fragmentDeny drops the fragment: no allowed first fragment is on record.
-	fragmentDeny fragmentVerdict = iota
-	// fragmentAllow passes the fragment: it belongs to an allowed datagram and
-	// does not overlap the already-inspected transport header.
-	fragmentAllow
-	// fragmentOverlap drops the fragment and poisons its datagram: it overlaps
-	// the transport header the ACL inspected (RFC 1858 §4, RFC 3128; RFC 5722
-	// requires discarding the whole datagram on overlap for IPv6).
-	fragmentOverlap
-)
-
-// fragmentKey identifies a fragmented datagram. It matches the RFC 791 / RFC
-// 8200 reassembly key: source, destination, protocol and identification. The id
-// is 32-bit to hold both the IPv4 (16-bit) and IPv6 (32-bit) identification.
-type fragmentKey struct {
-	srcIP netip.Addr
-	dstIP netip.Addr
-	id    uint32
-	proto uint8
-}
-
-// fragmentEntry records the verdict of an allowed first fragment.
-type fragmentEntry struct {
-	// headerEndOctets is the offset, in 8-byte units, at which the first
-	// fragment's payload ended. A trailing fragment starting before this
-	// overlaps bytes the ACL already inspected and is rejected.
-	headerEndOctets uint16
-	// recordedAt is when the first fragment was accepted. The verdict expires a
-	// fixed timeout later and is not refreshed, mirroring the kernel reassembly
-	// timer so a trailing-fragment flood can't keep a datagram alive.
-	recordedAt time.Time
-}
-
-// fragmentTracker records the ACL verdict of a datagram's first fragment so the
-// remaining fragments, which carry no L4 header, can inherit the decision
-// without reassembling the datagram. Only allowed first fragments are stored;
-// anything that cannot be tied to an allowed, non-overlapping first fragment is
-// dropped (fail closed).
-type fragmentTracker struct {
-	logger  *nblog.Logger
-	mutex   sync.Mutex
-	entries map[fragmentKey]fragmentEntry
-	timeout time.Duration
-	// maxEntries caps the table; atCapacity dedups the capacity warning until
-	// the table drains below the cap again.
-	maxEntries    int
-	atCapacity    bool
-	cleanupTicker *time.Ticker
-	cancel        context.CancelFunc
-}
-
-func newFragmentTracker(logger *nblog.Logger) *fragmentTracker {
-	ctx, cancel := context.WithCancel(context.Background())
-	t := &fragmentTracker{
-		logger:        logger,
-		entries:       make(map[fragmentKey]fragmentEntry),
-		timeout:       defaultFragmentTimeout,
-		maxEntries:    fragmentMaxEntries(logger),
-		cleanupTicker: time.NewTicker(fragmentCleanupInterval),
-		cancel:        cancel,
-	}
-	go t.cleanupRoutine(ctx)
-	return t
-}
-
-func fragmentMaxEntries(logger *nblog.Logger) int {
-	v := os.Getenv(EnvFragmentMaxEntries)
-	if v == "" {
-		return defaultMaxFragmentEntries
-	}
-	n, err := strconv.Atoi(v)
-	if err != nil || n <= 0 {
-		logger.Warn2("invalid %s=%q, using default", EnvFragmentMaxEntries, v)
-		return defaultMaxFragmentEntries
-	}
-	return n
-}
-
-// recordAllowed stores the verdict of an allowed first fragment. headerEndOctets
-// is the first fragment's payload length in 8-byte units. When the table is full
-// the record is dropped, which fails closed: the datagram's trailing fragments
-// will be denied.
-func (t *fragmentTracker) recordAllowed(key fragmentKey, headerEndOctets uint16) {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-
-	if t.entries == nil {
-		return
-	}
-	if _, ok := t.entries[key]; !ok && len(t.entries) >= t.maxEntries {
-		if !t.atCapacity {
-			t.atCapacity = true
-			t.logger.Warn2("fragment verdict table at capacity (%d/%d): trailing fragments of new datagrams will be dropped",
-				len(t.entries), t.maxEntries)
-		}
-		return
-	}
-	t.entries[key] = fragmentEntry{
-		headerEndOctets: headerEndOctets,
-		recordedAt:      time.Now(),
-	}
-}
-
-// poison drops any recorded verdict for a datagram, so its later fragments are
-// denied until a new allowed first fragment is recorded. Called on every
-// offset-zero fragment to defeat offset-zero overlap rewrites (RFC 3128).
-func (t *fragmentTracker) poison(key fragmentKey) {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-	delete(t.entries, key)
-}
-
-// verdict decides the fate of a trailing fragment at fragOffsetOctets (the IPv4
-// fragment offset, in 8-byte units). A fragment overlapping the inspected
-// header poisons the datagram: the entry is removed so all further fragments of
-// that datagram are denied too.
-func (t *fragmentTracker) verdict(key fragmentKey, fragOffsetOctets uint16) fragmentVerdict {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-
-	entry, ok := t.entries[key]
-	if !ok {
-		return fragmentDeny
-	}
-	if time.Since(entry.recordedAt) > t.timeout {
-		delete(t.entries, key)
-		return fragmentDeny
-	}
-	if fragOffsetOctets < entry.headerEndOctets {
-		delete(t.entries, key)
-		return fragmentOverlap
-	}
-	return fragmentAllow
-}
-
-func (t *fragmentTracker) cleanupRoutine(ctx context.Context) {
-	defer t.cleanupTicker.Stop()
-	for {
-		select {
-		case <-t.cleanupTicker.C:
-			t.cleanup()
-		case <-ctx.Done():
-			return
-		}
-	}
-}
-
-func (t *fragmentTracker) cleanup() {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-
-	for key, entry := range t.entries {
-		if time.Since(entry.recordedAt) > t.timeout {
-			delete(t.entries, key)
-		}
-	}
-
-	if len(t.entries) < t.maxEntries {
-		t.atCapacity = false
-	}
-}
-
-// Close stops the cleanup routine and releases resources.
-func (t *fragmentTracker) Close() {
-	t.cancel()
-
-	t.mutex.Lock()
-	t.entries = nil
-	t.mutex.Unlock()
-}

client/firewall/uspfilter/fragment_bench_test.go

@@ -1,115 +0,0 @@
-package uspfilter
-
-import (
-	"encoding/binary"
-	"testing"
-)
-
-// benchFilterInbound drives filterInbound over a fixed packet in a tight loop.
-// Packets are built once, outside the timed region, so the benchmark measures
-// only pipeline cost, which is what an attacker can amplify.
-func benchFilterInbound(b *testing.B, pkt []byte) {
-	b.Helper()
-	b.ReportAllocs()
-	b.SetBytes(int64(len(pkt)))
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		m := benchManager
-		m.filterInbound(pkt, len(pkt))
-	}
-}
-
-// benchManager is a package-level manager reused across fragment benchmarks so
-// setup cost stays out of the timed region.
-var benchManager *Manager
-
-func setupBenchManager(b *testing.B) *Manager {
-	b.Helper()
-	m := newFragmentTestManager(b)
-	allowUDP(b, m, 8080)
-	// Disable conntrack so the allowed-first-fragment path measures transport
-	// decode + ACL every iteration instead of matching the connection tracked
-	// on the first iteration.
-	m.stateful = false
-	benchManager = m
-	return m
-}
-
-// BenchmarkInbound_NormalPacket is the baseline: a full, non-fragmented UDP
-// packet that passes the ACL. Fragment paths should stay comparable to this.
-func BenchmarkInbound_NormalPacket(b *testing.B) {
-	setupBenchManager(b)
-	pkt := normalUDPPacket(b, 8080, 32)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_FirstFragmentAllowed measures the first-fragment path:
-// transport decode + ACL evaluation + verdict record.
-func BenchmarkInbound_FirstFragmentAllowed(b *testing.B) {
-	setupBenchManager(b)
-	pkt := firstFragmentUDP(b, 0x2000, 8080, 32)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_TrailingFragmentAllowed measures the common trailing-fragment
-// path: a single map lookup after the first fragment is on record.
-func BenchmarkInbound_TrailingFragmentAllowed(b *testing.B) {
-	m := setupBenchManager(b)
-	first := firstFragmentUDP(b, 0x3000, 8080, 32)
-	m.filterInbound(first, len(first))
-	pkt := trailingFragment(b, 0x3000, 5, false, 24)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_TrailingFragmentNoFirst is the primary DoS vector: an
-// attacker floods trailing fragments with no first fragment on record. Each is
-// a map miss and must be cheap.
-func BenchmarkInbound_TrailingFragmentNoFirst(b *testing.B) {
-	setupBenchManager(b)
-	pkt := trailingFragment(b, 0x4000, 185, false, 40)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_TinyFirstFragment measures the tiny-fragment drop path: a
-// first fragment too small to decode a transport header.
-func BenchmarkInbound_TinyFirstFragment(b *testing.B) {
-	setupBenchManager(b)
-	pkt := trailingFragment(b, 0x5000, 0, true, 4)
-	benchFilterInbound(b, pkt)
-}
-
-// BenchmarkInbound_TrailingFragmentDistinctIDs is the worst case for the
-// verdict table: an attacker varies the datagram id on every packet so no first
-// fragment ever matches. Verdict lookups always miss and nothing is recorded,
-// so the table cannot grow. Each iteration rewrites the id field in place.
-func BenchmarkInbound_TrailingFragmentDistinctIDs(b *testing.B) {
-	setupBenchManager(b)
-	pkt := trailingFragment(b, 0x6000, 185, false, 40)
-	m := benchManager
-
-	b.ReportAllocs()
-	b.SetBytes(int64(len(pkt)))
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		// IPv4 identification field is at bytes 4:6.
-		binary.BigEndian.PutUint16(pkt[4:6], uint16(i))
-		m.filterInbound(pkt, len(pkt))
-	}
-}
-
-// BenchmarkInbound_FirstFragmentDistinctIDs measures sustained first-fragment
-// pressure with distinct ids: transport decode + ACL + verdict insert until the
-// table caps, exercising the map growth and capacity guard.
-func BenchmarkInbound_FirstFragmentDistinctIDs(b *testing.B) {
-	setupBenchManager(b)
-	pkt := firstFragmentUDP(b, 0x7000, 8080, 32)
-	m := benchManager
-
-	b.ReportAllocs()
-	b.SetBytes(int64(len(pkt)))
-	b.ResetTimer()
-	for i := 0; i < b.N; i++ {
-		binary.BigEndian.PutUint16(pkt[4:6], uint16(i))
-		m.filterInbound(pkt, len(pkt))
-	}
-}

client/firewall/uspfilter/fragment_test.go

@@ -1,554 +0,0 @@
-package uspfilter
-
-import (
-	"encoding/binary"
-	"net"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/google/gopacket"
-	"github.com/google/gopacket/layers"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	nbiface "github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-const (
-	fragTestSrc   = "100.10.0.1"
-	fragTestDst   = "100.10.0.100"
-	fragTestSrcV6 = "fd00::1"
-	fragTestDstV6 = "fd00::100"
-)
-
-func newFragmentTestManager(tb testing.TB) *Manager {
-	tb.Helper()
-
-	ifaceMock := &IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr(fragTestDst),
-				Network: netip.MustParsePrefix("100.10.0.0/16"),
-				IPv6:    netip.MustParseAddr(fragTestDstV6),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-
-	m, err := Create(ifaceMock, false, flowLogger, nbiface.DefaultMTU)
-	require.NoError(tb, err)
-	require.NoError(tb, m.UpdateLocalIPs())
-	tb.Cleanup(func() { require.NoError(tb, m.Close(nil)) })
-	return m
-}
-
-// firstFragmentUDPTo builds the first fragment of a fragmented UDP datagram to
-// the given destination: it carries the full UDP header plus payloadLen bytes
-// of data, with the More Fragments flag set and offset zero.
-func firstFragmentUDPTo(tb testing.TB, dst string, id uint16, dstPort uint16, payloadLen int) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:  4,
-		TTL:      64,
-		Id:       id,
-		Protocol: layers.IPProtocolUDP,
-		SrcIP:    net.ParseIP(fragTestSrc),
-		DstIP:    net.ParseIP(dst),
-		Flags:    layers.IPv4MoreFragments,
-	}
-	udp := &layers.UDP{SrcPort: 40000, DstPort: layers.UDPPort(dstPort)}
-	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, payloadLen))))
-	return buf.Bytes()
-}
-
-func firstFragmentUDP(tb testing.TB, id uint16, dstPort uint16, payloadLen int) []byte {
-	tb.Helper()
-	return firstFragmentUDPTo(tb, fragTestDst, id, dstPort, payloadLen)
-}
-
-// firstFragmentTCP builds the first fragment of a fragmented TCP datagram: the
-// full 20-byte TCP header plus 12 bytes of data, with the More Fragments flag
-// set and offset zero.
-func firstFragmentTCP(tb testing.TB, id uint16, dstPort uint16) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:  4,
-		TTL:      64,
-		Id:       id,
-		Protocol: layers.IPProtocolTCP,
-		SrcIP:    net.ParseIP(fragTestSrc),
-		DstIP:    net.ParseIP(fragTestDst),
-		Flags:    layers.IPv4MoreFragments,
-	}
-	tcp := &layers.TCP{SrcPort: 40000, DstPort: layers.TCPPort(dstPort), SYN: true, Window: 64240}
-	require.NoError(tb, tcp.SetNetworkLayerForChecksum(ip))
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, tcp, gopacket.Payload(make([]byte, 12))))
-	return buf.Bytes()
-}
-
-// trailingFragmentTo builds a non-first fragment to the given destination: an
-// IPv4 header at the given fragment offset (in 8-byte units) carrying raw
-// payload and no L4 header.
-func trailingFragmentTo(tb testing.TB, dst string, proto layers.IPProtocol, id uint16, fragOffsetOctets uint16, moreFragments bool, payloadLen int) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:    4,
-		TTL:        64,
-		Id:         id,
-		Protocol:   proto,
-		SrcIP:      net.ParseIP(fragTestSrc),
-		DstIP:      net.ParseIP(dst),
-		FragOffset: fragOffsetOctets,
-	}
-	if moreFragments {
-		ip.Flags = layers.IPv4MoreFragments
-	}
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, gopacket.Payload(make([]byte, payloadLen))))
-	return buf.Bytes()
-}
-
-func trailingFragment(tb testing.TB, id uint16, fragOffsetOctets uint16, moreFragments bool, payloadLen int) []byte {
-	tb.Helper()
-	return trailingFragmentTo(tb, fragTestDst, layers.IPProtocolUDP, id, fragOffsetOctets, moreFragments, payloadLen)
-}
-
-// outboundUDPPacket builds a complete outbound UDP packet from the local
-// address, used to establish conntrack state for reply-direction tests.
-func outboundUDPPacket(tb testing.TB, srcPort, dstPort uint16) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:  4,
-		TTL:      64,
-		Id:       1,
-		Protocol: layers.IPProtocolUDP,
-		SrcIP:    net.ParseIP(fragTestDst),
-		DstIP:    net.ParseIP(fragTestSrc),
-	}
-	udp := &layers.UDP{SrcPort: layers.UDPPort(srcPort), DstPort: layers.UDPPort(dstPort)}
-	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, 16))))
-	return buf.Bytes()
-}
-
-// normalUDPPacket builds a complete, non-fragmented UDP packet for baseline
-// comparisons against the fragment paths.
-func normalUDPPacket(tb testing.TB, dstPort uint16, payloadLen int) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv4{
-		Version:  4,
-		TTL:      64,
-		Id:       1,
-		Protocol: layers.IPProtocolUDP,
-		SrcIP:    net.ParseIP(fragTestSrc),
-		DstIP:    net.ParseIP(fragTestDst),
-	}
-	udp := &layers.UDP{SrcPort: 40000, DstPort: layers.UDPPort(dstPort)}
-	require.NoError(tb, udp.SetNetworkLayerForChecksum(ip))
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	require.NoError(tb, gopacket.SerializeLayers(buf, opts, ip, udp, gopacket.Payload(make([]byte, payloadLen))))
-	return buf.Bytes()
-}
-
-func allowUDP(tb testing.TB, m *Manager, dstPort uint16) {
-	tb.Helper()
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolUDP, nil,
-		&fw.Port{Values: []uint16{dstPort}}, fw.ActionAccept, "")
-	require.NoError(tb, err)
-}
-
-// TestFragment_TrailingWithoutFirstDropped is the core bypass repro: a trailing
-// fragment with no allowed first fragment on record must be dropped. Before the
-// fix, filterInbound returned false (allow) for any fragment.
-func TestFragment_TrailingWithoutFirstDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-
-	frag := trailingFragment(t, 0x1234, 185, false, 40)
-	require.True(t, m.filterInbound(frag, len(frag)),
-		"trailing fragment without an allowed first fragment must be dropped")
-}
-
-// TestFragment_AllowedFirstPassesTrailing verifies that once a first fragment
-// passes the ACL, its trailing fragments inherit the allow verdict.
-func TestFragment_AllowedFirstPassesTrailing(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	// First fragment: UDP header (8) + 32 payload = 40 octets -> headerEnd = 5.
-	first := firstFragmentUDP(t, 0x2222, 8080, 32)
-	require.False(t, m.filterInbound(first, len(first)),
-		"allowed first fragment should pass and be recorded")
-
-	trailing := trailingFragment(t, 0x2222, 5, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of an allowed datagram should pass")
-}
-
-// TestFragment_DeniedFirstDropsTrailing verifies that a first fragment blocked
-// by the ACL leaves no verdict, so its trailing fragments are dropped.
-func TestFragment_DeniedFirstDropsTrailing(t *testing.T) {
-	m := newFragmentTestManager(t)
-	// No accept rule: local traffic defaults to deny.
-
-	first := firstFragmentUDP(t, 0x3333, 9999, 32)
-	require.True(t, m.filterInbound(first, len(first)),
-		"first fragment to a blocked port should be dropped by the ACL")
-
-	trailing := trailingFragment(t, 0x3333, 5, false, 24)
-	require.True(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of a denied datagram must be dropped")
-}
-
-// TestFragment_OverlappingHeaderDropped covers the RFC 1858 §4 / RFC 3128
-// overlapping-fragment rewrite: a trailing fragment starting inside the range
-// the ACL already inspected is dropped and poisons the datagram. TCP is used so
-// the overlap lands on real header bytes (the flags at byte 13).
-func TestFragment_OverlappingHeaderDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	// First fragment: TCP header (20) + 12 data = 32 bytes -> headerEnd = 4 octets.
-	first := firstFragmentTCP(t, 0x4444, 8080)
-	require.False(t, m.filterInbound(first, len(first)))
-
-	// Overlapping fragment at offset 1 (byte 8) falls inside the inspected TCP
-	// header, so it could rewrite the flags or port on reassembly.
-	overlap := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x4444, 1, true, 32)
-	require.True(t, m.filterInbound(overlap, len(overlap)),
-		"fragment overlapping the inspected header must be dropped")
-
-	// The datagram is now poisoned: a later, non-overlapping fragment is also
-	// dropped because the verdict was removed.
-	later := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x4444, 4, false, 24)
-	require.True(t, m.filterInbound(later, len(later)),
-		"fragments after an overlap must be dropped (datagram poisoned)")
-}
-
-// TestFragment_OffsetZeroOverlapPoisons covers the RFC 3128 offset-zero rewrite:
-// an allowed first fragment followed by a denied offset-zero fragment for the
-// same datagram must not leave the earlier allow verdict in place.
-func TestFragment_OffsetZeroOverlapPoisons(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	allowed := firstFragmentUDP(t, 0x5A5A, 8080, 32)
-	require.False(t, m.filterInbound(allowed, len(allowed)),
-		"allowed first fragment should pass and be recorded")
-
-	// A second offset-zero fragment to a denied port supersedes the datagram's
-	// verdict; it is dropped and must not leave the allow in place.
-	denied := firstFragmentUDP(t, 0x5A5A, 9999, 32)
-	require.True(t, m.filterInbound(denied, len(denied)),
-		"denied offset-zero fragment must be dropped")
-
-	trailing := trailingFragment(t, 0x5A5A, 5, false, 24)
-	require.True(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment must be denied after the datagram was poisoned")
-}
-
-// TestFragment_TinyFirstDropped covers the tiny-fragment attack: a first
-// fragment too small to contain the full transport header can't be
-// ACL-evaluated and must be dropped.
-func TestFragment_TinyFirstDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	// IPv4 header + 4 raw bytes, MF set, offset 0: too small for the 8-byte UDP
-	// header, so it decodes to L3 only.
-	tiny := trailingFragment(t, 0x5555, 0, true, 4)
-	require.True(t, m.filterInbound(tiny, len(tiny)),
-		"tiny first fragment without a full L4 header must be dropped")
-}
-
-// TestFragment_TCPFirstFragment verifies the TCP arm of the transport decode: a
-// first fragment carrying the full 20-byte TCP header is ACL-evaluated and its
-// trailing fragments inherit the verdict.
-func TestFragment_TCPFirstFragment(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	// TCP header (20) + 12 data = 32 bytes -> headerEnd = 4 octets.
-	first := firstFragmentTCP(t, 0x6666, 8080)
-	require.False(t, m.filterInbound(first, len(first)),
-		"allowed TCP first fragment should pass and be recorded")
-
-	trailing := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x6666, 4, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of an allowed TCP datagram should pass")
-}
-
-// TestFragment_TCPTinyFirstDropped verifies the TCP minimum header length: 12
-// bytes would satisfy a UDP header but falls short of the 20-byte TCP header.
-func TestFragment_TCPTinyFirstDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrc), fw.ProtocolTCP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	tiny := trailingFragmentTo(t, fragTestDst, layers.IPProtocolTCP, 0x7777, 0, true, 12)
-	require.True(t, m.filterInbound(tiny, len(tiny)),
-		"first fragment shorter than the TCP header must be dropped")
-}
-
-// TestFragment_ConntrackAllowsFirstFragment verifies the conntrack branch: reply
-// fragments of an outbound-established UDP flow pass without any inbound rule.
-func TestFragment_ConntrackAllowsFirstFragment(t *testing.T) {
-	m := newFragmentTestManager(t)
-
-	out := outboundUDPPacket(t, 12345, 40000)
-	require.False(t, m.filterOutbound(out, len(out)))
-
-	first := firstFragmentUDP(t, 0x8888, 12345, 32)
-	require.False(t, m.filterInbound(first, len(first)),
-		"reply first fragment should pass via conntrack")
-
-	trailing := trailingFragment(t, 0x8888, 5, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of a tracked flow should pass")
-}
-
-// TestFragment_RoutingDisabledDropsFragment verifies routed first fragments are
-// dropped when routing is disabled.
-func TestFragment_RoutingDisabledDropsFragment(t *testing.T) {
-	m := newFragmentTestManager(t)
-	m.routingEnabled.Store(false)
-
-	first := firstFragmentUDPTo(t, "198.51.100.10", 0x9999, 8080, 32)
-	require.True(t, m.filterInbound(first, len(first)),
-		"routed first fragment must be dropped when routing is disabled")
-}
-
-// TestFragment_RouteACL verifies the route-ACL branch: fragments to a non-local
-// destination follow the route rules, allowed datagrams pass their trailing
-// fragments and denied ones don't.
-func TestFragment_RouteACL(t *testing.T) {
-	m := newFragmentTestManager(t)
-	m.routingEnabled.Store(true)
-	m.nativeRouter.Store(false)
-
-	_, err := m.AddRouteFiltering(
-		[]byte("rt-1"),
-		[]netip.Prefix{netip.MustParsePrefix("100.10.0.0/16")},
-		fw.Network{Prefix: netip.MustParsePrefix("198.51.100.0/24")},
-		fw.ProtocolUDP,
-		nil,
-		&fw.Port{Values: []uint16{8080}},
-		fw.ActionAccept,
-	)
-	require.NoError(t, err)
-
-	first := firstFragmentUDPTo(t, "198.51.100.10", 0xAAAA, 8080, 32)
-	require.False(t, m.filterInbound(first, len(first)),
-		"route-ACL-allowed first fragment should pass")
-	trailing := trailingFragmentTo(t, "198.51.100.10", layers.IPProtocolUDP, 0xAAAA, 5, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of an allowed routed datagram should pass")
-
-	denied := firstFragmentUDPTo(t, "198.51.100.10", 0xBBBB, 9999, 32)
-	require.True(t, m.filterInbound(denied, len(denied)),
-		"route-ACL-denied first fragment must be dropped")
-	deniedTrailing := trailingFragmentTo(t, "198.51.100.10", layers.IPProtocolUDP, 0xBBBB, 5, false, 24)
-	require.True(t, m.filterInbound(deniedTrailing, len(deniedTrailing)),
-		"trailing fragment of a denied routed datagram must be dropped")
-}
-
-// TestFragment_ExpiredVerdictDropsTrailing verifies a verdict older than the
-// tracker timeout no longer admits trailing fragments.
-func TestFragment_ExpiredVerdictDropsTrailing(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	first := firstFragmentUDP(t, 0xCCCC, 8080, 32)
-	require.False(t, m.filterInbound(first, len(first)))
-
-	m.fragments.mutex.Lock()
-	for key, entry := range m.fragments.entries {
-		entry.recordedAt = time.Now().Add(-defaultFragmentTimeout - time.Second)
-		m.fragments.entries[key] = entry
-	}
-	m.fragments.mutex.Unlock()
-
-	trailing := trailingFragment(t, 0xCCCC, 5, false, 24)
-	require.True(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment after verdict expiry must be dropped")
-}
-
-// TestFragment_CapacityFailsClosed verifies the table cap: at capacity, new
-// datagram verdicts are not recorded (their trailing fragments are dropped)
-// while already-recorded datagrams keep working.
-func TestFragment_CapacityFailsClosed(t *testing.T) {
-	m := newFragmentTestManager(t)
-	allowUDP(t, m, 8080)
-
-	m.fragments.mutex.Lock()
-	m.fragments.maxEntries = 1
-	m.fragments.mutex.Unlock()
-
-	first1 := firstFragmentUDP(t, 0x0101, 8080, 32)
-	require.False(t, m.filterInbound(first1, len(first1)))
-
-	first2 := firstFragmentUDP(t, 0x0202, 8080, 32)
-	require.False(t, m.filterInbound(first2, len(first2)),
-		"first fragment itself still passes at capacity")
-
-	trailing2 := trailingFragment(t, 0x0202, 5, false, 24)
-	require.True(t, m.filterInbound(trailing2, len(trailing2)),
-		"trailing fragment of an unrecorded datagram must be dropped at capacity")
-
-	trailing1 := trailingFragment(t, 0x0101, 5, false, 24)
-	require.False(t, m.filterInbound(trailing1, len(trailing1)),
-		"already-recorded datagram should keep passing at capacity")
-}
-
-// v6FragmentHeader builds the 8-byte IPv6 fragment extension header for the
-// given inner protocol, offset (8-byte units), More Fragments bit and id.
-func v6FragmentHeader(proto layers.IPProtocol, offsetOctets uint16, moreFragments bool, id uint32) []byte {
-	offsetFlags := offsetOctets << 3
-	if moreFragments {
-		offsetFlags |= 1
-	}
-	hdr := make([]byte, 8)
-	hdr[0] = uint8(proto)
-	binary.BigEndian.PutUint16(hdr[2:4], offsetFlags)
-	binary.BigEndian.PutUint32(hdr[4:8], id)
-	return hdr
-}
-
-func v6UDPHeader(dstPort uint16, dataLen int) []byte {
-	hdr := make([]byte, 8)
-	binary.BigEndian.PutUint16(hdr[0:2], 40000)
-	binary.BigEndian.PutUint16(hdr[2:4], dstPort)
-	binary.BigEndian.PutUint16(hdr[4:6], uint16(8+dataLen))
-	return hdr
-}
-
-// firstFragmentUDPv6 builds the first fragment of a fragmented IPv6 UDP
-// datagram: fragment header (offset 0, More Fragments set) + full UDP header +
-// data.
-func firstFragmentUDPv6(tb testing.TB, id uint32, dstPort uint16, dataLen int) []byte {
-	tb.Helper()
-	return fragmentUDPv6(tb, id, dstPort, dataLen, true)
-}
-
-// fragmentUDPv6 builds an offset-zero IPv6 UDP fragment. With moreFragments
-// false it is an atomic fragment (a complete datagram, RFC 6946).
-func fragmentUDPv6(tb testing.TB, id uint32, dstPort uint16, dataLen int, moreFragments bool) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv6{
-		Version:    6,
-		NextHeader: layers.IPProtocolIPv6Fragment,
-		HopLimit:   64,
-		SrcIP:      net.ParseIP(fragTestSrcV6),
-		DstIP:      net.ParseIP(fragTestDstV6),
-	}
-	payload := append(v6FragmentHeader(layers.IPProtocolUDP, 0, moreFragments, id), v6UDPHeader(dstPort, dataLen)...)
-	payload = append(payload, make([]byte, dataLen)...)
-
-	buf := gopacket.NewSerializeBuffer()
-	require.NoError(tb, gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true}, ip, gopacket.Payload(payload)))
-	return buf.Bytes()
-}
-
-// trailingFragmentV6 builds a non-first IPv6 fragment: fragment header at the
-// given offset carrying raw data and no transport header.
-func trailingFragmentV6(tb testing.TB, id uint32, offsetOctets uint16, moreFragments bool, dataLen int) []byte {
-	tb.Helper()
-
-	ip := &layers.IPv6{
-		Version:    6,
-		NextHeader: layers.IPProtocolIPv6Fragment,
-		HopLimit:   64,
-		SrcIP:      net.ParseIP(fragTestSrcV6),
-		DstIP:      net.ParseIP(fragTestDstV6),
-	}
-	payload := append(v6FragmentHeader(layers.IPProtocolUDP, offsetOctets, moreFragments, id), make([]byte, dataLen)...)
-
-	buf := gopacket.NewSerializeBuffer()
-	require.NoError(tb, gopacket.SerializeLayers(buf, gopacket.SerializeOptions{FixLengths: true}, ip, gopacket.Payload(payload)))
-	return buf.Bytes()
-}
-
-// TestFragmentV6_TrailingWithoutFirstDropped verifies the IPv6 bypass is closed:
-// a trailing fragment with no allowed first fragment is dropped.
-func TestFragmentV6_TrailingWithoutFirstDropped(t *testing.T) {
-	m := newFragmentTestManager(t)
-
-	frag := trailingFragmentV6(t, 0xAABBCCDD, 100, false, 40)
-	require.True(t, m.filterInbound(frag, len(frag)),
-		"IPv6 trailing fragment without an allowed first fragment must be dropped")
-}
-
-// TestFragmentV6_AllowedFirstPassesTrailing verifies IPv6 fragments are
-// evaluated like IPv4: an allowed first fragment lets its trailing fragments
-// through.
-func TestFragmentV6_AllowedFirstPassesTrailing(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrcV6), fw.ProtocolUDP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	// First fragment: UDP header (8) + 32 data = 40 octets -> headerEnd = 5.
-	first := firstFragmentUDPv6(t, 0xAABBCCDD, 8080, 32)
-	require.False(t, m.filterInbound(first, len(first)),
-		"allowed IPv6 first fragment should pass and be recorded")
-
-	trailing := trailingFragmentV6(t, 0xAABBCCDD, 5, false, 24)
-	require.False(t, m.filterInbound(trailing, len(trailing)),
-		"trailing fragment of an allowed IPv6 datagram should pass")
-}
-
-// TestFragmentV6_AtomicNotCached verifies an IPv6 atomic fragment (fragment
-// header with offset 0 and no More Fragments, a complete datagram per RFC 6946)
-// is evaluated but not recorded, so a flood of allowed atomic fragments can't
-// exhaust the verdict table.
-func TestFragmentV6_AtomicNotCached(t *testing.T) {
-	m := newFragmentTestManager(t)
-	_, err := m.AddPeerFiltering(nil, net.ParseIP(fragTestSrcV6), fw.ProtocolUDP, nil,
-		&fw.Port{Values: []uint16{8080}}, fw.ActionAccept, "")
-	require.NoError(t, err)
-
-	atomic := fragmentUDPv6(t, 0xA70301C, 8080, 16, false)
-	require.False(t, m.filterInbound(atomic, len(atomic)),
-		"allowed IPv6 atomic fragment should pass")
-
-	m.fragments.mutex.Lock()
-	n := len(m.fragments.entries)
-	m.fragments.mutex.Unlock()
-	require.Zero(t, n, "atomic fragment must not create a verdict entry")
-
-	// A genuine fragmented datagram (More Fragments set) is still recorded.
-	first := fragmentUDPv6(t, 0xBEEF, 8080, 32, true)
-	require.False(t, m.filterInbound(first, len(first)))
-	m.fragments.mutex.Lock()
-	n = len(m.fragments.entries)
-	m.fragments.mutex.Unlock()
-	require.Equal(t, 1, n, "genuine first fragment must record a verdict")
-}

client/iface/netstack/env.go

@@ -3,31 +3,14 @@
 package netstack
 
 import (
-	"net"
+	"fmt"
 	"os"
 	"strconv"
 
 	log "github.com/sirupsen/logrus"
 )
 
-const (
-	EnvUseNetstackMode = "NB_USE_NETSTACK_MODE"
-
-	// EnvSocks5ListenerPort overrides the port the SOCKS5 proxy listens on.
-	EnvSocks5ListenerPort = "NB_SOCKS5_LISTENER_PORT"
-
-	// EnvSocks5ListenerAddress overrides the host/IP the SOCKS5 proxy binds to.
-	// The proxy is a bridge for local host applications into the userspace
-	// WireGuard netstack, so it binds to loopback by default. Override this only
-	// when the proxy must be reachable from other hosts (e.g. a container
-	// gateway); doing so exposes an unauthenticated SOCKS5 proxy on that
-	// address.
-	EnvSocks5ListenerAddress = "NB_SOCKS5_LISTENER_ADDRESS"
-
-	// defaultSocks5Host is the loopback address the SOCKS5 proxy binds to unless
-	// overridden via EnvSocks5ListenerAddress.
-	defaultSocks5Host = "127.0.0.1"
-)
+const EnvUseNetstackMode = "NB_USE_NETSTACK_MODE"
 
 // IsEnabled todo: move these function to cmd layer
 func IsEnabled() bool {
@@ -35,40 +18,24 @@ func IsEnabled() bool {
 }
 
 func ListenAddr() string {
-	return net.JoinHostPort(listenHost(), strconv.Itoa(listenPort()))
-}
-
-// listenHost returns the host/IP the SOCKS5 proxy binds to. It defaults to
-// loopback and only honors EnvSocks5ListenerAddress when it holds a valid IP.
-func listenHost() string {
-	addr := os.Getenv(EnvSocks5ListenerAddress)
-	if addr == "" {
-		return defaultSocks5Host
-	}
-	if net.ParseIP(addr) == nil {
-		log.Warnf("invalid socks5 listener address %q, falling back to default: %s", addr, defaultSocks5Host)
-		return defaultSocks5Host
-	}
-	return addr
-}
-
-// listenPort returns the port the SOCKS5 proxy binds to, defaulting to
-// DefaultSocks5Port when EnvSocks5ListenerPort is unset or invalid.
-func listenPort() int {
-	sPort := os.Getenv(EnvSocks5ListenerPort)
+	sPort := os.Getenv("NB_SOCKS5_LISTENER_PORT")
 	if sPort == "" {
-		return DefaultSocks5Port
+		return listenAddr(DefaultSocks5Port)
 	}
 
 	port, err := strconv.Atoi(sPort)
 	if err != nil {
 		log.Warnf("invalid socks5 listener port, unable to convert it to int, falling back to default: %d", DefaultSocks5Port)
-		return DefaultSocks5Port
+		return listenAddr(DefaultSocks5Port)
 	}
 	if port < 1 || port > 65535 {
 		log.Warnf("invalid socks5 listener port, it should be in the range 1-65535, falling back to default: %d", DefaultSocks5Port)
-		return DefaultSocks5Port
+		return listenAddr(DefaultSocks5Port)
 	}
 
-	return port
+	return listenAddr(port)
+}
+
+func listenAddr(port int) string {
+	return fmt.Sprintf("0.0.0.0:%d", port)
 }

client/iface/netstack/env_test.go

@@ -1,63 +0,0 @@
-//go:build !js
-
-package netstack
-
-import (
-	"net"
-	"strconv"
-	"testing"
-)
-
-func TestListenAddr_DefaultsToLoopback(t *testing.T) {
-	// No env overrides: must bind loopback, never all interfaces.
-	got := ListenAddr()
-	want := net.JoinHostPort("127.0.0.1", strconv.Itoa(DefaultSocks5Port))
-	if got != want {
-		t.Fatalf("ListenAddr() = %q, want %q", got, want)
-	}
-}
-
-func TestListenAddr_AddressOverride(t *testing.T) {
-	tests := []struct {
-		name string
-		env  string
-		want string
-	}{
-		{name: "valid override honored", env: "0.0.0.0", want: "0.0.0.0"},
-		{name: "valid specific ip honored", env: "10.0.0.5", want: "10.0.0.5"},
-		{name: "ipv6 loopback bracketed", env: "::1", want: "::1"},
-		{name: "invalid falls back to loopback", env: "not-an-ip", want: "127.0.0.1"},
-		{name: "empty falls back to loopback", env: "", want: "127.0.0.1"},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv(EnvSocks5ListenerAddress, tc.env)
-			want := net.JoinHostPort(tc.want, strconv.Itoa(DefaultSocks5Port))
-			if got := ListenAddr(); got != want {
-				t.Fatalf("ListenAddr() = %q, want %q", got, want)
-			}
-		})
-	}
-}
-
-func TestListenAddr_PortOverride(t *testing.T) {
-	tests := []struct {
-		name string
-		env  string
-		want int
-	}{
-		{name: "valid port honored", env: "1081", want: 1081},
-		{name: "non-numeric falls back", env: "abc", want: DefaultSocks5Port},
-		{name: "out of range falls back", env: "70000", want: DefaultSocks5Port},
-		{name: "zero falls back", env: "0", want: DefaultSocks5Port},
-	}
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Setenv(EnvSocks5ListenerPort, tc.env)
-			want := net.JoinHostPort("127.0.0.1", strconv.Itoa(tc.want))
-			if got := ListenAddr(); got != want {
-				t.Fatalf("ListenAddr() = %q, want %q", got, want)
-			}
-		})
-	}
-}

client/internal/approval/broker.go

@@ -0,0 +1,219 @@
+// Package approval brokers per-attempt user-accept prompts for inbound
+// remote access (VNC today, SSH and others in the future). A caller pushes
+// a Prompt; the broker emits a SystemEvent on the daemon→UI stream and
+// blocks until the UI calls the daemon's RespondApproval RPC, the per-
+// request timeout fires, or no subscriber is connected. The latter case
+// fails closed so a backgrounded UI cannot silently bypass the gate.
+package approval
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/google/uuid"
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// Metadata keys the broker reserves on the emitted SystemEvent. Callers
+// should not set these themselves; values in Prompt.Metadata that collide
+// are overwritten by the broker.
+const (
+	MetaRequestID = "request_id"
+	MetaKind      = "kind"
+	MetaExpiresAt = "expires_at"
+)
+
+// ShortKeyFingerprint formats a hex-encoded Noise_IK static pubkey as a
+// short, eyeball-able fingerprint to display in the approval dialog.
+// The dashboard-supplied display name attached to a SessionPubKey isn't
+// cryptographically asserted by the connecting client, so the prompt
+// must also show something that IS: the key fingerprint, a hash of
+// the static public key the client just proved possession of during the
+// Noise handshake. Returns the empty string when the input is too short
+// to plausibly be a hex pubkey, so the row is omitted rather than
+// rendered as a misleading partial.
+//
+// Output format: 16 hex chars grouped as XXXX-XXXX-XXXX-XXXX (64 bits of
+// fingerprint, resistant to random-prefix collisions and easy for a human
+// to compare with an out-of-band reference).
+func ShortKeyFingerprint(hexKey string) string {
+	if len(hexKey) < 8 {
+		return ""
+	}
+	src := hexKey
+	if len(src) > 16 {
+		src = src[:16]
+	}
+	var out []byte
+	for i, c := range src {
+		if i > 0 && i%4 == 0 {
+			out = append(out, '-')
+		}
+		out = append(out, byte(c))
+	}
+	return string(out)
+}
+
+// Kind values for the well-known prompt subjects. New subsystems should
+// add a constant here so the UI can dispatch on a known string.
+const (
+	KindVNC = "vnc"
+	KindSSH = "ssh"
+)
+
+// DefaultTimeout is the wall-clock window the user has to accept or deny a
+// pending approval before the broker fails closed and returns ErrTimeout.
+// Kept well under typical VNC client and dashboard connection timeouts so
+// the RFB rejection actually reaches the browser instead of racing the
+// browser's own "connection timed out" message.
+const DefaultTimeout = 15 * time.Second
+
+// timeoutValue returns the active timeout. It's a var so tests in this
+// package can shorten the wait without exposing a setter on the public
+// API. Production code always sees DefaultTimeout.
+var timeoutValue = func() time.Duration { return DefaultTimeout }
+
+// ErrNoSubscriber indicates no UI is connected to consume the prompt.
+// The caller must reject the underlying connection (fail-closed).
+var ErrNoSubscriber = errors.New("no UI subscriber connected for approval")
+
+// ErrTimeout indicates the user did not respond within DefaultTimeout.
+var ErrTimeout = errors.New("approval timed out")
+
+// ErrDenied indicates the user explicitly denied the connection.
+var ErrDenied = errors.New("approval denied")
+
+// EventPublisher is the subset of peer.Status used to emit prompts.
+type EventPublisher interface {
+	PublishEvent(
+		severity proto.SystemEvent_Severity,
+		category proto.SystemEvent_Category,
+		msg string,
+		userMsg string,
+		metadata map[string]string,
+	)
+	HasEventSubscribers() bool
+}
+
+// Prompt describes the pending request shown to the user. Kind selects
+// the UI dispatch path (e.g. "vnc", "ssh"). Subject is the human-readable
+// one-liner the UI may show as a title or notification body. Metadata is
+// passed through verbatim and is the subsystem-specific payload (peer
+// name, source IP, mode, etc.).
+type Prompt struct {
+	Kind     string
+	Subject  string
+	Metadata map[string]string
+}
+
+// Decision carries the user's response to an approval prompt. ViewOnly is
+// only meaningful when Accept is true; it lets the host grant the
+// connection but signal the requester that input control is withheld.
+type Decision struct {
+	Accept   bool
+	ViewOnly bool
+}
+
+// Broker holds in-flight approval requests keyed by request ID.
+type Broker struct {
+	pub EventPublisher
+
+	mu      sync.Mutex
+	pending map[string]chan Decision
+}
+
+// New returns a broker that publishes prompts via pub.
+func New(pub EventPublisher) *Broker {
+	return &Broker{
+		pub:     pub,
+		pending: make(map[string]chan Decision),
+	}
+}
+
+// Request emits a SystemEvent for p and blocks until the UI calls Respond,
+// ctx is cancelled, or DefaultTimeout elapses. Returns a Decision when
+// the user replied; ErrDenied / ErrTimeout / ErrNoSubscriber / ctx.Err
+// otherwise. Callers must treat any non-nil error as a deny.
+func (b *Broker) Request(ctx context.Context, p Prompt) (Decision, error) {
+	var zero Decision
+	if b == nil || b.pub == nil {
+		return zero, fmt.Errorf("approval broker not configured")
+	}
+	if !b.pub.HasEventSubscribers() {
+		return zero, ErrNoSubscriber
+	}
+
+	id := uuid.NewString()
+	resp := make(chan Decision, 1)
+
+	b.mu.Lock()
+	b.pending[id] = resp
+	b.mu.Unlock()
+
+	defer b.dropPending(id)
+
+	timeout := timeoutValue()
+	expiresAt := time.Now().Add(timeout)
+	meta := make(map[string]string, len(p.Metadata)+3)
+	for k, v := range p.Metadata {
+		meta[k] = v
+	}
+	meta[MetaRequestID] = id
+	meta[MetaKind] = p.Kind
+	meta[MetaExpiresAt] = expiresAt.UTC().Format(time.RFC3339)
+
+	subject := p.Subject
+	if subject == "" {
+		subject = fmt.Sprintf("%s connection requires approval", p.Kind)
+	}
+	b.pub.PublishEvent(proto.SystemEvent_INFO, proto.SystemEvent_APPROVAL, subject, subject, meta)
+	log.Debugf("approval request %s (%s) emitted: %s", id, p.Kind, subject)
+
+	timer := time.NewTimer(timeout)
+	defer timer.Stop()
+
+	select {
+	case d := <-resp:
+		if !d.Accept {
+			return zero, ErrDenied
+		}
+		return d, nil
+	case <-timer.C:
+		return zero, ErrTimeout
+	case <-ctx.Done():
+		return zero, ctx.Err()
+	}
+}
+
+// Respond delivers the user's decision for id. Returns true when a pending
+// request matched and was woken, false when id was unknown or already done.
+func (b *Broker) Respond(id string, d Decision) bool {
+	if b == nil {
+		return false
+	}
+	b.mu.Lock()
+	ch, ok := b.pending[id]
+	if ok {
+		delete(b.pending, id)
+	}
+	b.mu.Unlock()
+	if !ok {
+		return false
+	}
+	select {
+	case ch <- d:
+	default:
+	}
+	return true
+}
+
+func (b *Broker) dropPending(id string) {
+	b.mu.Lock()
+	delete(b.pending, id)
+	b.mu.Unlock()
+}

client/internal/approval/broker_test.go

@@ -0,0 +1,434 @@
+package approval
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/client/proto"
+)
+
+// fakePublisher records published events and reports whether subscribers
+// are connected. The subscribers flag is the security-critical signal:
+// when false the broker must refuse to emit and the gate must fail closed.
+type fakePublisher struct {
+	mu          sync.Mutex
+	subscribers bool
+	events      []*proto.SystemEvent
+}
+
+func (p *fakePublisher) PublishEvent(
+	severity proto.SystemEvent_Severity,
+	category proto.SystemEvent_Category,
+	msg string,
+	userMsg string,
+	metadata map[string]string,
+) {
+	p.mu.Lock()
+	p.events = append(p.events, &proto.SystemEvent{
+		Severity:    severity,
+		Category:    category,
+		Message:     msg,
+		UserMessage: userMsg,
+		Metadata:    metadata,
+	})
+	p.mu.Unlock()
+}
+
+func (p *fakePublisher) HasEventSubscribers() bool {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return p.subscribers
+}
+
+func (p *fakePublisher) lastEvent(t *testing.T) *proto.SystemEvent {
+	t.Helper()
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	require.NotEmpty(t, p.events, "publisher saw no events")
+	return p.events[len(p.events)-1]
+}
+
+func (p *fakePublisher) eventCount() int {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	return len(p.events)
+}
+
+// TestRequestNoSubscriberFailsClosed is the core fail-closed invariant:
+// when the UI is not subscribed, the broker must refuse without emitting
+// an event or arming a waiter. A regression here is a silent bypass.
+func TestRequestNoSubscriberFailsClosed(t *testing.T) {
+	pub := &fakePublisher{subscribers: false}
+	b := New(pub)
+
+	_, err := b.Request(context.Background(), Prompt{Kind: KindVNC, Subject: "test"})
+	assert.ErrorIs(t, err, ErrNoSubscriber)
+	assert.Equal(t, 0, pub.eventCount(), "no event must be emitted when fail-closed")
+
+	b.mu.Lock()
+	pending := len(b.pending)
+	b.mu.Unlock()
+	assert.Equal(t, 0, pending, "no waiter must be registered on fail-closed")
+}
+
+// TestRequestTimeoutDenies verifies that a request without a UI response
+// returns ErrTimeout (deny) rather than nil (silent accept). Uses a short
+// per-test broker timeout via Respond after the fact to keep the test fast.
+func TestRequestTimeoutDenies(t *testing.T) {
+	// Replace DefaultTimeout for the lifetime of this test.
+	orig := DefaultTimeout
+	defaultTimeout(t, 60*time.Millisecond)
+	defer defaultTimeout(t, orig)
+
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	start := time.Now()
+	_, err := b.Request(context.Background(), Prompt{Kind: KindVNC, Subject: "test"})
+	assert.ErrorIs(t, err, ErrTimeout, "missing user response must yield ErrTimeout, not nil")
+	assert.GreaterOrEqual(t, time.Since(start), 50*time.Millisecond, "timeout fired prematurely")
+}
+
+// TestRequestDenied returns ErrDenied when the UI responds with false.
+func TestRequestDenied(t *testing.T) {
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	var requestID string
+	done := make(chan error, 1)
+	go func() {
+		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC, Subject: "test"})
+	}()
+
+	requestID = waitForRequestID(t, pub)
+	require.True(t, b.Respond(requestID, Decision{Accept: false}))
+
+	select {
+	case err := <-done:
+		assert.ErrorIs(t, err, ErrDenied)
+	case <-time.After(time.Second):
+		t.Fatal("Request did not return after Respond(false)")
+	}
+}
+
+// TestRequestAccepted is the happy path. Failure here doesn't bypass the
+// gate but breaks the feature.
+func TestRequestAccepted(t *testing.T) {
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	done := make(chan error, 1)
+	go func() {
+		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC, Subject: "test"})
+	}()
+
+	id := waitForRequestID(t, pub)
+	require.True(t, b.Respond(id, Decision{Accept: true}))
+
+	select {
+	case err := <-done:
+		assert.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("Request did not return after Respond(true)")
+	}
+}
+
+// TestRequestCtxCancelDenies verifies that an upstream cancel (e.g. the
+// engine shutting down mid-prompt) returns the cancel error rather than
+// nil. A nil here would be a silent bypass on shutdown races.
+func TestRequestCtxCancelDenies(t *testing.T) {
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan error, 1)
+	go func() {
+		done <- requestErr(b, ctx, Prompt{Kind: KindVNC, Subject: "test"})
+	}()
+
+	// Wait until the prompt is in flight so cancel races a live waiter.
+	_ = waitForRequestID(t, pub)
+	cancel()
+
+	select {
+	case err := <-done:
+		assert.ErrorIs(t, err, context.Canceled)
+	case <-time.After(time.Second):
+		t.Fatal("Request did not return after ctx cancel")
+	}
+}
+
+// TestRespondUnknownIsNoop ensures a stray RespondApproval RPC cannot
+// affect or accidentally accept any in-flight request whose id it doesn't
+// match. Also confirms it doesn't panic.
+func TestRespondUnknownIsNoop(t *testing.T) {
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	// No in-flight prompts: Respond returns false.
+	assert.False(t, b.Respond("does-not-exist", Decision{Accept: true}))
+
+	// With an in-flight prompt, a wrong id still returns false and the
+	// prompt remains armed (eventually timing out as a deny).
+	defaultTimeout(t, 60*time.Millisecond)
+	defer defaultTimeout(t, DefaultTimeout)
+
+	done := make(chan error, 1)
+	go func() {
+		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC})
+	}()
+	realID := waitForRequestID(t, pub)
+	assert.False(t, b.Respond("totally-bogus", Decision{Accept: true}), "unknown id must not match")
+	assert.NotEqual(t, "totally-bogus", realID)
+
+	select {
+	case err := <-done:
+		assert.ErrorIs(t, err, ErrTimeout, "armed prompt must still time out, not accept")
+	case <-time.After(time.Second):
+		t.Fatal("prompt did not resolve")
+	}
+}
+
+// TestRespondAfterTimeoutNoop confirms a late accept response can't
+// retroactively flip a denied (timed-out) request. The dropPending defer
+// in Request must have removed the entry by the time Respond races in.
+func TestRespondAfterTimeoutNoop(t *testing.T) {
+	defaultTimeout(t, 30*time.Millisecond)
+	defer defaultTimeout(t, DefaultTimeout)
+
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	done := make(chan error, 1)
+	go func() {
+		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC})
+	}()
+	id := waitForRequestID(t, pub)
+
+	select {
+	case err := <-done:
+		require.ErrorIs(t, err, ErrTimeout)
+	case <-time.After(time.Second):
+		t.Fatal("prompt did not time out")
+	}
+
+	assert.False(t, b.Respond(id, Decision{Accept: true}), "late respond must be no-op")
+}
+
+// TestRespondDoubleNoop ensures a duplicate ack from the UI doesn't leak
+// past the matched waiter or panic on a closed/full channel.
+func TestRespondDoubleNoop(t *testing.T) {
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	done := make(chan error, 1)
+	go func() {
+		done <- requestErr(b, context.Background(), Prompt{Kind: KindVNC})
+	}()
+	id := waitForRequestID(t, pub)
+	require.True(t, b.Respond(id, Decision{Accept: true}))
+	assert.False(t, b.Respond(id, Decision{Accept: false}), "second response must be no-op")
+
+	select {
+	case err := <-done:
+		assert.NoError(t, err)
+	case <-time.After(time.Second):
+		t.Fatal("prompt did not resolve")
+	}
+}
+
+// TestNilBrokerRequestErrors guards the engine pre-init path where the
+// broker may not yet exist (or its publisher is nil): Request must
+// error, never silently accept.
+func TestNilBrokerRequestErrors(t *testing.T) {
+	var b *Broker
+	_, err := b.Request(context.Background(), Prompt{Kind: KindVNC})
+	assert.Error(t, err, "nil broker must error, never silently accept")
+
+	b2 := New(nil)
+	_, err = b2.Request(context.Background(), Prompt{Kind: KindVNC})
+	assert.Error(t, err, "broker with nil publisher must error, never silently accept")
+}
+
+// TestPromptMetadataInjected confirms the broker stamps request_id, kind,
+// and expires_at on the emitted event. The UI relies on these keys; if
+// they are dropped, the user cannot route the prompt and the response
+// path breaks (which fails closed via timeout).
+func TestPromptMetadataInjected(t *testing.T) {
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	done := make(chan error, 1)
+	go func() {
+		done <- requestErr(b, context.Background(), Prompt{
+			Kind:     KindVNC,
+			Subject:  "VNC connection from peerA",
+			Metadata: map[string]string{"peer_name": "peerA"},
+		})
+	}()
+
+	id := waitForRequestID(t, pub)
+	ev := pub.lastEvent(t)
+
+	assert.Equal(t, proto.SystemEvent_APPROVAL, ev.Category)
+	assert.Equal(t, KindVNC, ev.Metadata[MetaKind])
+	assert.Equal(t, id, ev.Metadata[MetaRequestID])
+	assert.NotEmpty(t, ev.Metadata[MetaExpiresAt])
+	assert.Equal(t, "peerA", ev.Metadata["peer_name"], "caller metadata must pass through")
+
+	require.True(t, b.Respond(id, Decision{Accept: true}))
+	<-done
+}
+
+// TestConcurrentRequests verifies that two concurrent prompts are tracked
+// independently. A bug that aliases ids would let one Respond unblock
+// the wrong waiter (a silent accept across prompts).
+func TestConcurrentRequests(t *testing.T) {
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	const n = 20
+	results := make(chan error, n)
+	for i := 0; i < n; i++ {
+		go func() {
+			results <- requestErr(b, context.Background(), Prompt{Kind: KindVNC})
+		}()
+	}
+
+	ids := waitForNRequestIDs(t, pub, n)
+	require.Len(t, ids, n)
+
+	// Deny exactly half, accept the rest. Track outcome per id so we can
+	// match each Request's return value against the response we sent.
+	denySet := make(map[string]bool, n)
+	for i, id := range ids {
+		deny := i%2 == 0
+		denySet[id] = deny
+		require.True(t, b.Respond(id, Decision{Accept: !deny}))
+	}
+
+	// Collect all returns and check no nil errors slipped past a deny.
+	var accepted, denied atomic.Int32
+	for i := 0; i < n; i++ {
+		select {
+		case err := <-results:
+			if err == nil {
+				accepted.Add(1)
+			} else {
+				assert.ErrorIs(t, err, ErrDenied)
+				denied.Add(1)
+			}
+		case <-time.After(2 * time.Second):
+			t.Fatalf("only got %d/%d responses", i, n)
+		}
+	}
+	assert.Equal(t, int32(n/2), denied.Load())
+	assert.Equal(t, int32(n/2), accepted.Load())
+}
+
+// waitForRequestID blocks until the publisher sees its next event and
+// returns the request_id stamped on it.
+func waitForRequestID(t *testing.T, pub *fakePublisher) string {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		pub.mu.Lock()
+		count := len(pub.events)
+		var id string
+		if count > 0 {
+			id = pub.events[count-1].Metadata[MetaRequestID]
+		}
+		pub.mu.Unlock()
+		if id != "" {
+			return id
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+	t.Fatal("timeout waiting for emitted event")
+	return ""
+}
+
+func waitForNRequestIDs(t *testing.T, pub *fakePublisher, n int) []string {
+	t.Helper()
+	deadline := time.Now().Add(2 * time.Second)
+	for time.Now().Before(deadline) {
+		pub.mu.Lock()
+		count := len(pub.events)
+		pub.mu.Unlock()
+		if count >= n {
+			break
+		}
+		time.Sleep(2 * time.Millisecond)
+	}
+	pub.mu.Lock()
+	defer pub.mu.Unlock()
+	out := make([]string, 0, len(pub.events))
+	seen := make(map[string]struct{}, len(pub.events))
+	for _, ev := range pub.events {
+		id := ev.Metadata[MetaRequestID]
+		if id == "" {
+			continue
+		}
+		if _, dup := seen[id]; dup {
+			continue
+		}
+		seen[id] = struct{}{}
+		out = append(out, id)
+	}
+	if len(out) < n {
+		t.Fatalf("only got %d/%d request ids", len(out), n)
+	}
+	return out
+}
+
+// defaultTimeout swaps the broker's per-request wall-clock window so the
+// timeout tests run quickly. Restores the prior value on the next call.
+func defaultTimeout(t *testing.T, d time.Duration) {
+	t.Helper()
+	if d <= 0 {
+		t.Fatal("defaultTimeout must be > 0")
+	}
+	timeoutValue = func() time.Duration { return d }
+}
+
+// requestErr wraps Broker.Request to drop the Decision when tests only
+// care about the error path. Keeps the goroutine bodies tight.
+func requestErr(b *Broker, ctx context.Context, p Prompt) error {
+	_, err := b.Request(ctx, p)
+	return err
+}
+
+// TestRequestViewOnly checks the view-only outcome flows through Request's
+// Decision return without being silently swallowed.
+func TestRequestViewOnly(t *testing.T) {
+	pub := &fakePublisher{subscribers: true}
+	b := New(pub)
+
+	type result struct {
+		d   Decision
+		err error
+	}
+	done := make(chan result, 1)
+	go func() {
+		d, err := b.Request(context.Background(), Prompt{Kind: KindVNC})
+		done <- result{d, err}
+	}()
+
+	id := waitForRequestID(t, pub)
+	require.True(t, b.Respond(id, Decision{Accept: true, ViewOnly: true}))
+
+	select {
+	case r := <-done:
+		assert.NoError(t, r.err)
+		assert.True(t, r.d.Accept)
+		assert.True(t, r.d.ViewOnly, "ViewOnly must survive the round-trip")
+	case <-time.After(time.Second):
+		t.Fatal("view-only request did not resolve")
+	}
+}

client/internal/approval/fingerprint_test.go

@@ -0,0 +1,62 @@
+package approval
+
+import "testing"
+
+// TestShortKeyFingerprint locks in the format the VNC approval prompt
+// shows to the user. The fingerprint is the user's only cryptographic
+// anchor against a malicious management server that pushes a spoofed
+// display name, so accidental changes to its format would silently
+// undermine that defence.
+func TestShortKeyFingerprint(t *testing.T) {
+	cases := []struct {
+		name string
+		in   string
+		want string
+	}{
+		{
+			name: "full_32_byte_pubkey",
+			in:   "0123456789abcdeffedcba9876543210ffeeddccbbaa99887766554433221100",
+			want: "0123-4567-89ab-cdef",
+		},
+		{
+			name: "exactly_16_chars",
+			in:   "0123456789abcdef",
+			want: "0123-4567-89ab-cdef",
+		},
+		{
+			name: "borderline_8_chars",
+			in:   "01234567",
+			want: "0123-4567",
+		},
+		{
+			name: "too_short_returns_empty",
+			in:   "0123",
+			want: "",
+		},
+		{
+			name: "empty_returns_empty",
+			in:   "",
+			want: "",
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := ShortKeyFingerprint(tc.in)
+			if got != tc.want {
+				t.Fatalf("ShortKeyFingerprint(%q) = %q, want %q", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+
+// TestShortKeyFingerprint_DistinctKeysDistinctOutputs guards against a
+// formatting bug that would collapse different prefixes onto the same
+// displayed fingerprint and let an attacker substitute their pubkey for
+// a victim's while keeping the prompt visually identical.
+func TestShortKeyFingerprint_DistinctKeysDistinctOutputs(t *testing.T) {
+	a := ShortKeyFingerprint("0123456789abcdef" + "rest_of_pubkey_ignored")
+	b := ShortKeyFingerprint("0123456789abcde0" + "rest_of_pubkey_ignored")
+	if a == b {
+		t.Fatalf("expected distinct outputs for distinct prefixes, both = %q", a)
+	}
+}

client/internal/auth/auth.go

@@ -344,6 +344,7 @@ func (a *Auth) setSystemInfoFlags(info *system.Info) {
 		a.config.RosenpassEnabled,
 		a.config.RosenpassPermissive,
 		a.config.ServerSSHAllowed,
+		a.config.ServerVNCAllowed,
 		a.config.DisableClientRoutes,
 		a.config.DisableServerRoutes,
 		a.config.DisableDNS,

client/internal/auth/device_flow.go

@@ -299,7 +299,7 @@ func (d *DeviceAuthorizationFlow) WaitToken(ctx context.Context, info AuthFlowIn
 				UseIDToken:   d.providerConfig.UseIDToken,
 			}
 
-			err = validateTokenAudience(tokenInfo.GetTokenToUse(), d.providerConfig.Audience)
+			err = isValidAccessToken(tokenInfo.GetTokenToUse(), d.providerConfig.Audience)
 			if err != nil {
 				return TokenInfo{}, fmt.Errorf("validate access token failed with error: %v", err)
 			}

client/internal/auth/pkce_flow.go

@@ -306,7 +306,7 @@ func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo,
 		audience = p.providerConfig.ClientID
 	}
 
-	if err := validateTokenAudience(tokenInfo.GetTokenToUse(), audience); err != nil {
+	if err := isValidAccessToken(tokenInfo.GetTokenToUse(), audience); err != nil {
 		return TokenInfo{}, fmt.Errorf("authentication failed: invalid access token - %w", err)
 	}
 
@@ -320,11 +320,6 @@ func (p *PKCEAuthorizationFlow) parseOAuthToken(token *oauth2.Token) (TokenInfo,
 	return tokenInfo, nil
 }
 
-// parseEmailFromIDToken extracts the email (or name) claim from an ID token
-// without verifying its signature. The value is best-effort and used only as a
-// UX convenience (login hint prefill and display); it never drives an
-// authorization decision. The authoritative identity is established server-side
-// from the signature-verified token.
 func parseEmailFromIDToken(token string) (string, error) {
 	parts := strings.Split(token, ".")
 	if len(parts) < 2 {

client/internal/auth/util.go

@@ -20,26 +20,14 @@ func randomBytesInHex(count int) (string, error) {
 	return hex.EncodeToString(buf), nil
 }
 
-// validateTokenAudience checks that the token is a well-formed JWT whose
-// audience claim matches the expected audience.
-//
-// It does NOT verify the token's cryptographic signature and therefore must not
-// be treated as an authenticity check. The token is obtained by the client
-// directly from the IdP token endpoint over TLS, and its signature is verified
-// server-side by the management server against the IdP's JWKS
-// (see shared/auth/jwt/validator.go). This function is only a client-side
-// sanity check that the returned token targets the expected audience.
-func validateTokenAudience(token string, audience string) error {
+// isValidAccessToken is a simple validation of the access token
+func isValidAccessToken(token string, audience string) error {
 	if token == "" {
 		return fmt.Errorf("token received is empty")
 	}
 
-	parts := strings.Split(token, ".")
-	if len(parts) != 3 {
-		return fmt.Errorf("token is not a well-formed JWT")
-	}
-
-	claimsString, err := base64.RawURLEncoding.DecodeString(parts[1])
+	encodedClaims := strings.Split(token, ".")[1]
+	claimsString, err := base64.RawURLEncoding.DecodeString(encodedClaims)
 	if err != nil {
 		return err
 	}

client/internal/auth/util_test.go

@@ -1,108 +0,0 @@
-package auth
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"testing"
-)
-
-// makeJWT builds an unsigned JWT-shaped string (header.payload.signature) with
-// the given claims payload. The signature part is arbitrary because
-// validateTokenAudience intentionally does not verify it.
-func makeJWT(t *testing.T, claims map[string]interface{}) string {
-	t.Helper()
-	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"RS256","typ":"JWT"}`))
-	payloadBytes, err := json.Marshal(claims)
-	if err != nil {
-		t.Fatalf("marshal claims: %v", err)
-	}
-	payload := base64.RawURLEncoding.EncodeToString(payloadBytes)
-	return header + "." + payload + ".unverified-signature"
-}
-
-func TestValidateTokenAudience(t *testing.T) {
-	tests := []struct {
-		name     string
-		token    string
-		audience string
-		wantErr  bool
-	}{
-		{
-			name:     "empty token",
-			token:    "",
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "not a JWT - no dots",
-			token:    "notajwt",
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "not a JWT - two parts only",
-			token:    "header.payload",
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "matching string audience",
-			token:    makeJWT(t, map[string]interface{}{"aud": "netbird"}),
-			audience: "netbird",
-			wantErr:  false,
-		},
-		{
-			name:     "mismatching string audience",
-			token:    makeJWT(t, map[string]interface{}{"aud": "other"}),
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "matching audience in array",
-			token:    makeJWT(t, map[string]interface{}{"aud": []interface{}{"other", "netbird"}}),
-			audience: "netbird",
-			wantErr:  false,
-		},
-		{
-			name:     "mismatching audience array",
-			token:    makeJWT(t, map[string]interface{}{"aud": []interface{}{"a", "b"}}),
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "missing audience claim",
-			token:    makeJWT(t, map[string]interface{}{"sub": "user"}),
-			audience: "netbird",
-			wantErr:  true,
-		},
-		{
-			name:     "invalid base64 payload",
-			token:    "header.!!!not-base64!!!.sig",
-			audience: "netbird",
-			wantErr:  true,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			err := validateTokenAudience(tc.token, tc.audience)
-			if tc.wantErr && err == nil {
-				t.Fatalf("expected error, got nil")
-			}
-			if !tc.wantErr && err != nil {
-				t.Fatalf("expected no error, got %v", err)
-			}
-		})
-	}
-}
-
-// TestValidateTokenAudienceNoPanic guards the regression where a non-empty
-// token without the JWT dot structure caused an index-out-of-range panic.
-func TestValidateTokenAudienceNoPanic(t *testing.T) {
-	inputs := []string{"a", ".", "a.", "aaaa", "no-dots-here"}
-	for _, in := range inputs {
-		if err := validateTokenAudience(in, "netbird"); err == nil {
-			t.Fatalf("expected error for malformed token %q, got nil", in)
-		}
-	}
-}

client/internal/conn_mgr.go

@@ -34,8 +34,6 @@ const (
 // - Handling connection establishment based on peer signaling
 //
 // The implementation is not thread-safe; it is protected by engine.syncMsgMux.
-// The only exception is ActivatePeer, which is safe for concurrent use so the
-// DNS warm-up path can call it without contending on the engine mutex.
 type ConnMgr struct {
 	peerStore        *peerstore.Store
 	statusRecorder   *peer.Status
@@ -44,10 +42,6 @@ type ConnMgr struct {
 	rosenpassEnabled bool
 
 	lazyConnMgr *manager.Manager
-	// lazyConnMgrMu guards the lazyConnMgr pointer for readers outside the
-	// engine loop (ActivatePeer). Writers hold it in addition to
-	// engine.syncMsgMux; all other reads stay under engine.syncMsgMux only.
-	lazyConnMgrMu sync.RWMutex
 
 	wg            sync.WaitGroup
 	lazyCtx       context.Context
@@ -244,20 +238,12 @@ func (e *ConnMgr) RemovePeerConn(peerKey string) {
 	conn.Log.Infof("removed peer from lazy conn manager")
 }
 
-// ActivatePeer wakes an idle lazy connection. Unlike the rest of ConnMgr it is
-// safe for concurrent use: the lazy manager pointer is read under lazyConnMgrMu
-// and the manager itself is internally synchronized, so callers outside the
-// engine loop (DNS warm-up) do not need engine.syncMsgMux.
 func (e *ConnMgr) ActivatePeer(ctx context.Context, conn *peer.Conn) {
-	e.lazyConnMgrMu.RLock()
-	lazyConnMgr := e.lazyConnMgr
-	started := lazyConnMgr != nil && e.lazyCtxCancel != nil
-	e.lazyConnMgrMu.RUnlock()
-	if !started {
+	if !e.isStartedWithLazyMgr() {
 		return
 	}
 
-	if found := lazyConnMgr.ActivatePeer(conn.GetKey()); found {
+	if found := e.lazyConnMgr.ActivatePeer(conn.GetKey()); found {
 		if err := conn.Open(ctx); err != nil {
 			conn.Log.Errorf("failed to open connection: %v", err)
 		}
@@ -282,21 +268,16 @@ func (e *ConnMgr) Close() {
 
 	e.lazyCtxCancel()
 	e.wg.Wait()
-
-	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = nil
-	e.lazyConnMgrMu.Unlock()
 }
 
 func (e *ConnMgr) initLazyManager(engineCtx context.Context) {
 	cfg := manager.Config{
 		InactivityThreshold: inactivityThresholdEnv(),
 	}
-
-	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = manager.NewManager(cfg, engineCtx, e.peerStore, e.iface)
+
 	e.lazyCtx, e.lazyCtxCancel = context.WithCancel(engineCtx)
-	e.lazyConnMgrMu.Unlock()
 
 	e.wg.Add(1)
 	go func() {
@@ -335,10 +316,7 @@ func (e *ConnMgr) closeManager(ctx context.Context) {
 
 	e.lazyCtxCancel()
 	e.wg.Wait()
-
-	e.lazyConnMgrMu.Lock()
 	e.lazyConnMgr = nil
-	e.lazyConnMgrMu.Unlock()
 
 	for _, peerID := range e.peerStore.PeersPubKey() {
 		e.peerStore.PeerConnOpen(ctx, peerID)

client/internal/conn_mgr_test.go

@@ -1,21 +1,10 @@
 package internal
 
 import (
-	"context"
-	"net"
-	"net/netip"
 	"os"
-	"sync"
 	"testing"
-	"time"
 
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
-	"github.com/netbirdio/netbird/monotime"
 )
 
 func TestResolveLazyForce(t *testing.T) {
@@ -49,58 +38,3 @@ func TestResolveLazyForce(t *testing.T) {
 		})
 	}
 }
-
-type mockLazyWGIface struct{}
-
-func (mockLazyWGIface) RemovePeer(string) error { return nil }
-func (mockLazyWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
-	return nil
-}
-func (mockLazyWGIface) IsUserspaceBind() bool                    { return false }
-func (mockLazyWGIface) Address() wgaddr.Address                  { return wgaddr.Address{} }
-func (mockLazyWGIface) LastActivities() map[string]monotime.Time { return nil }
-func (mockLazyWGIface) MTU() uint16                              { return 1280 }
-
-// TestConnMgr_ActivatePeerConcurrentWithLifecycle exercises ActivatePeer from
-// non-engine goroutines (the DNS warm-up path) racing the manager lifecycle,
-// which stays on the engine loop. Run with -race: it fails if ActivatePeer
-// still requires engine.syncMsgMux for safety.
-func TestConnMgr_ActivatePeerConcurrentWithLifecycle(t *testing.T) {
-	t.Setenv(lazyconn.EnvLazyConn, "on")
-
-	status := peer.NewRecorder("https://mgm")
-	store := peerstore.NewConnStore()
-	connMgr := NewConnMgr(&EngineConfig{}, status, store, mockLazyWGIface{})
-
-	conn := newTestPeerConn(t, "peerA")
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	connMgr.Start(ctx)
-
-	done := make(chan struct{})
-	var wg sync.WaitGroup
-	for range 4 {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for {
-				select {
-				case <-done:
-					return
-				default:
-					connMgr.ActivatePeer(ctx, conn)
-				}
-			}
-		}()
-	}
-
-	// Let the activators spin against the started manager, then tear it down
-	// underneath them and let them spin against the stopped manager.
-	time.Sleep(100 * time.Millisecond)
-	connMgr.Close()
-	time.Sleep(50 * time.Millisecond)
-
-	close(done)
-	wg.Wait()
-}

client/internal/connect.go

@@ -604,6 +604,8 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 		RosenpassEnabled:              config.RosenpassEnabled,
 		RosenpassPermissive:           config.RosenpassPermissive,
 		ServerSSHAllowed:              util.ReturnBoolWithDefaultTrue(config.ServerSSHAllowed),
+		ServerVNCAllowed:              config.ServerVNCAllowed != nil && *config.ServerVNCAllowed,
+		DisableVNCApproval:            config.DisableVNCApproval,
 		EnableSSHRoot:                 config.EnableSSHRoot,
 		EnableSSHSFTP:                 config.EnableSSHSFTP,
 		EnableSSHLocalPortForwarding:  config.EnableSSHLocalPortForwarding,
@@ -686,6 +688,7 @@ func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte,
 		config.RosenpassEnabled,
 		config.RosenpassPermissive,
 		config.ServerSSHAllowed,
+		config.ServerVNCAllowed,
 		config.DisableClientRoutes,
 		config.DisableServerRoutes,
 		config.DisableDNS,

client/internal/debug/debug.go

@@ -480,6 +480,7 @@ func (g *BundleGenerator) addStatus() error {
 
 		fullStatus := g.statusRecorder.GetFullStatus()
 		protoFullStatus := nbstatus.ToProtoFullStatus(fullStatus)
+		protoFullStatus.Events = g.statusRecorder.GetEventHistory()
 		overview := nbstatus.ConvertToStatusOutputOverview(protoFullStatus, nbstatus.ConvertOptions{
 			Anonymize:     g.anonymize,
 			ProfileName:   profName,
@@ -668,6 +669,12 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	if g.internalConfig.SSHJWTCacheTTL != nil {
 		configContent.WriteString(fmt.Sprintf("SSHJWTCacheTTL: %d\n", *g.internalConfig.SSHJWTCacheTTL))
 	}
+	if g.internalConfig.ServerVNCAllowed != nil {
+		configContent.WriteString(fmt.Sprintf("ServerVNCAllowed: %v\n", *g.internalConfig.ServerVNCAllowed))
+	}
+	if g.internalConfig.DisableVNCApproval != nil {
+		configContent.WriteString(fmt.Sprintf("DisableVNCApproval: %v\n", *g.internalConfig.DisableVNCApproval))
+	}
 
 	configContent.WriteString(fmt.Sprintf("DisableClientRoutes: %v\n", g.internalConfig.DisableClientRoutes))
 	configContent.WriteString(fmt.Sprintf("DisableServerRoutes: %v\n", g.internalConfig.DisableServerRoutes))

client/internal/debug/debug_test.go

@@ -864,6 +864,8 @@ func TestAddConfig_AllFieldsCovered(t *testing.T) {
 		RosenpassEnabled:              true,
 		RosenpassPermissive:           true,
 		ServerSSHAllowed:              &bTrue,
+		ServerVNCAllowed:              &bTrue,
+		DisableVNCApproval:            &bTrue,
 		EnableSSHRoot:                 &bTrue,
 		EnableSSHSFTP:                 &bTrue,
 		EnableSSHLocalPortForwarding:  &bTrue,

client/internal/dns/local/local.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"os"
 	"slices"
 	"strings"
 	"sync"
@@ -37,43 +36,7 @@ type resolver interface {
 // record is left alone (it points at something outside our mesh, e.g.
 // a non-peer upstream).
 type PeerConnectivity interface {
-	IsConnectedByIP(ip netip.Addr) (known, connected bool)
-}
-
-// PeerActivator wakes lazy-connection peers on demand. The local resolver calls
-// it with the tunnel IPs an answer points at, so a peer that is idle (lazily
-// disconnected) starts connecting at DNS-resolution time rather than racing the
-// client's first request packet. nil disables warm-up.
-type PeerActivator interface {
-	// ActivatePeersByIP triggers wake-up for the peer(s) owning addrs and blocks
-	// until one is connected or ctx (a short per-query budget) expires. It is a
-	// fast no-op for unknown or already-connected addresses.
-	ActivatePeersByIP(ctx context.Context, addrs []netip.Addr)
-}
-
-const (
-	defaultLazyWarmupTimeout = 2 * time.Second
-	envLazyWarmupTimeout     = "NB_DNS_LAZY_WARMUP_TIMEOUT"
-)
-
-// lazyWarmupTimeoutFromEnv returns the per-query budget for waking a
-// lazy-connection peer a DNS answer points at. Tunable via
-// NB_DNS_LAZY_WARMUP_TIMEOUT (a Go duration). Parsed once at construction time.
-func lazyWarmupTimeoutFromEnv() time.Duration {
-	v := os.Getenv(envLazyWarmupTimeout)
-	if v == "" {
-		return defaultLazyWarmupTimeout
-	}
-	d, err := time.ParseDuration(v)
-	if err != nil {
-		log.Warnf("invalid %s value %q, using default %s: %v", envLazyWarmupTimeout, v, defaultLazyWarmupTimeout, err)
-		return defaultLazyWarmupTimeout
-	}
-	if d <= 0 {
-		log.Warnf("non-positive %s value %q, using default %s", envLazyWarmupTimeout, v, defaultLazyWarmupTimeout)
-		return defaultLazyWarmupTimeout
-	}
-	return d
+	IsConnectedByIP(ip string) (known, connected bool)
 }
 
 type Resolver struct {
@@ -88,12 +51,6 @@ type Resolver struct {
 	// filter and preserves the legacy "return whatever is registered"
 	// behaviour for callers that never wire a status source.
 	peerConn PeerConnectivity
-	// peerActivator, when non-nil, is called at resolution time to warm the
-	// lazy connection to the peer(s) an answer points at. nil disables warm-up.
-	peerActivator PeerActivator
-	// warmupTimeout is the per-query budget for the lazy-connection warm-up
-	// wait, resolved from the environment once at construction time.
-	warmupTimeout time.Duration
 
 	ctx    context.Context
 	cancel context.CancelFunc
@@ -102,12 +59,11 @@ type Resolver struct {
 func NewResolver() *Resolver {
 	ctx, cancel := context.WithCancel(context.Background())
 	return &Resolver{
-		records:       make(map[dns.Question][]dns.RR),
-		domains:       make(map[domain.Domain]struct{}),
-		zones:         make(map[domain.Domain]bool),
-		warmupTimeout: lazyWarmupTimeoutFromEnv(),
-		ctx:           ctx,
-		cancel:        cancel,
+		records: make(map[dns.Question][]dns.RR),
+		domains: make(map[domain.Domain]struct{}),
+		zones:   make(map[domain.Domain]bool),
+		ctx:     ctx,
+		cancel:  cancel,
 	}
 }
 
@@ -120,14 +76,6 @@ func (d *Resolver) SetPeerConnectivity(p PeerConnectivity) {
 	d.peerConn = p
 }
 
-// SetPeerActivator wires the DNS-time lazy-connection warm-up. Pass nil to
-// disable. Safe to call multiple times; the latest value wins.
-func (d *Resolver) SetPeerActivator(a PeerActivator) {
-	d.mu.Lock()
-	defer d.mu.Unlock()
-	d.peerActivator = a
-}
-
 func (d *Resolver) MatchSubdomains() bool {
 	return true
 }
@@ -174,9 +122,6 @@ func (d *Resolver) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 	replyMessage.RecursionAvailable = true
 
 	result := d.lookupRecords(logger, question)
-	// Warm before filtering: activation flips a lazily-idle target to connected,
-	// which then lets it survive the disconnected-peer filter below.
-	d.warmLazyPeers(question, result.records)
 	result.records = d.filterDisconnectedPeerAnswers(logger, question, result.records)
 	replyMessage.Authoritative = !result.hasExternalData
 	replyMessage.Answer = result.records
@@ -550,8 +495,8 @@ func (d *Resolver) filterDisconnectedPeerAnswers(logger *log.Entry, question dns
 	kept := make([]dns.RR, 0, len(records))
 	var dropped int
 	for _, rr := range records {
-		ip, ok := extractRecordAddr(rr)
-		if !ok {
+		ip := extractRecordIP(rr)
+		if ip == "" {
 			kept = append(kept, rr)
 			continue
 		}
@@ -573,54 +518,22 @@ func (d *Resolver) filterDisconnectedPeerAnswers(logger *log.Entry, question dns
 	return kept
 }
 
-// warmLazyPeers triggers lazy-connection wake-up for the peers a resolved
-// answer points at and waits briefly for one to connect, so the caller's first
-// request doesn't race the connection establishment. Warm-up is scoped to
-// match-only (non-authoritative) zones — the synthesized private-service zones
-// and user-created zones whose records point at specific peers. The account's
-// peer zone is authoritative, so plain peer-name lookups never trigger warm-up;
-// otherwise resolving any peer's name would wake its idle connection, defeating
-// laziness mesh-wide. No-op when no activator is wired (lazy connections
-// disabled) or the answer carries no peer IPs.
-func (d *Resolver) warmLazyPeers(question dns.Question, records []dns.RR) {
-	d.mu.RLock()
-	activator := d.peerActivator
-	var nonAuth, found bool
-	if activator != nil {
-		nonAuth, found = d.findZone(question.Name)
-	}
-	d.mu.RUnlock()
-	if activator == nil || !found || !nonAuth {
-		return
-	}
-
-	var addrs []netip.Addr
-	for _, rr := range records {
-		if addr, ok := extractRecordAddr(rr); ok {
-			addrs = append(addrs, addr)
-		}
-	}
-	if len(addrs) == 0 {
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(d.ctx, d.warmupTimeout)
-	defer cancel()
-	activator.ActivatePeersByIP(ctx, addrs)
-}
-
-// extractRecordAddr returns the IP address carried by an A or AAAA record.
-// ok is false for any other record type or a record with no address.
-func extractRecordAddr(rr dns.RR) (netip.Addr, bool) {
+// extractRecordIP returns the dotted-decimal / colon-hex IP carried by
+// an A or AAAA record, or "" for any other record type.
+func extractRecordIP(rr dns.RR) string {
 	switch r := rr.(type) {
 	case *dns.A:
-		addr, ok := netip.AddrFromSlice(r.A)
-		return addr.Unmap(), ok
+		if r.A == nil {
+			return ""
+		}
+		return r.A.String()
 	case *dns.AAAA:
-		addr, ok := netip.AddrFromSlice(r.AAAA)
-		return addr.Unmap(), ok
+		if r.AAAA == nil {
+			return ""
+		}
+		return r.AAAA.String()
 	}
-	return netip.Addr{}, false
+	return ""
 }
 
 // Update replaces all zones and their records

client/internal/dns/local/local_test.go

@@ -37,8 +37,8 @@ type mockPeerConnectivity struct {
 	byIP map[string]struct{ known, connected bool }
 }
 
-func (m mockPeerConnectivity) IsConnectedByIP(ip netip.Addr) (known, connected bool) {
-	v, ok := m.byIP[ip.String()]
+func (m mockPeerConnectivity) IsConnectedByIP(ip string) (known, connected bool) {
+	v, ok := m.byIP[ip]
 	if !ok {
 		return false, false
 	}

client/internal/dns/local/warmup_test.go

@@ -1,172 +0,0 @@
-package local
-
-import (
-	"context"
-	"net"
-	"net/netip"
-	"sync"
-	"testing"
-	"time"
-
-	"github.com/miekg/dns"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/dns/test"
-	nbdns "github.com/netbirdio/netbird/dns"
-)
-
-// recordingActivator records the addresses it was asked to warm and returns
-// immediately, so ServeDNS is not blocked by the test.
-type recordingActivator struct {
-	mu     sync.Mutex
-	called bool
-	addrs  []netip.Addr
-}
-
-func (r *recordingActivator) ActivatePeersByIP(_ context.Context, addrs []netip.Addr) {
-	r.mu.Lock()
-	defer r.mu.Unlock()
-	r.called = true
-	r.addrs = append(r.addrs, addrs...)
-}
-
-func serveA(t *testing.T, resolver *Resolver, name string) *dns.Msg {
-	t.Helper()
-	var resp *dns.Msg
-	w := &test.MockResponseWriter{WriteMsgFunc: func(m *dns.Msg) error { resp = m; return nil }}
-	resolver.ServeDNS(w, new(dns.Msg).SetQuestion(name, dns.TypeA))
-	return resp
-}
-
-// serviceZone registers rec in a match-only (non-authoritative) zone, the shape
-// the synthesized private-service zones arrive in.
-func serviceZone(t *testing.T, resolver *Resolver, zone string, records ...nbdns.SimpleRecord) {
-	t.Helper()
-	resolver.Update([]nbdns.CustomZone{{
-		Domain:           zone,
-		Records:          records,
-		NonAuthoritative: true,
-	}})
-}
-
-func TestLocalResolver_WarmsLazyPeerOnResolve(t *testing.T) {
-	rec := nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"}
-	resolver := NewResolver()
-	serviceZone(t, resolver, "proxy.netbird.cloud", rec)
-
-	act := &recordingActivator{}
-	resolver.SetPeerActivator(act)
-
-	resp := serveA(t, resolver, rec.Name)
-	require.NotNil(t, resp, "resolver must answer")
-	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
-
-	act.mu.Lock()
-	defer act.mu.Unlock()
-	assert.True(t, act.called, "activator must be invoked for a service-zone A answer")
-	assert.Contains(t, act.addrs, netip.MustParseAddr("100.64.0.7"), "activator must receive the answer's peer IP")
-}
-
-func TestLocalResolver_NoActivatorNoWarmup(t *testing.T) {
-	// With no activator wired the resolver behaves exactly as before.
-	rec := nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"}
-	resolver := NewResolver()
-	serviceZone(t, resolver, "proxy.netbird.cloud", rec)
-
-	resp := serveA(t, resolver, rec.Name)
-	require.NotNil(t, resp, "resolver must still answer without an activator")
-	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
-}
-
-func TestLocalResolver_NoWarmupForMissingRecord(t *testing.T) {
-	// A query that resolves to nothing must not invoke the activator (no IPs).
-	resolver := NewResolver()
-	serviceZone(t, resolver, "proxy.netbird.cloud",
-		nbdns.SimpleRecord{Name: "svc.proxy.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.7"})
-
-	act := &recordingActivator{}
-	resolver.SetPeerActivator(act)
-
-	serveA(t, resolver, "absent.proxy.netbird.cloud.")
-
-	act.mu.Lock()
-	defer act.mu.Unlock()
-	assert.False(t, act.called, "activator must not be invoked when there is no answer")
-}
-
-func TestLocalResolver_NoWarmupInAuthoritativeZone(t *testing.T) {
-	// The account's peer zone is authoritative; resolving a peer's name there
-	// must not wake its lazy connection — warm-up is scoped to match-only
-	// (non-authoritative) zones such as the synthesized private-service zones.
-	rec := nbdns.SimpleRecord{Name: "peer.netbird.cloud.", Type: 1, Class: nbdns.DefaultClass, TTL: 300, RData: "100.64.0.9"}
-	resolver := NewResolver()
-	resolver.Update([]nbdns.CustomZone{{
-		Domain:  "netbird.cloud",
-		Records: []nbdns.SimpleRecord{rec},
-	}})
-
-	act := &recordingActivator{}
-	resolver.SetPeerActivator(act)
-
-	resp := serveA(t, resolver, rec.Name)
-	require.NotNil(t, resp, "resolver must answer")
-	require.NotEmpty(t, resp.Answer, "answer must carry the A record")
-
-	act.mu.Lock()
-	defer act.mu.Unlock()
-	assert.False(t, act.called, "activator must not be invoked for authoritative-zone answers")
-}
-
-func TestLazyWarmupTimeoutFromEnv(t *testing.T) {
-	tests := []struct {
-		name   string
-		value  string
-		envSet bool
-		want   time.Duration
-	}{
-		{name: "unset uses default", want: defaultLazyWarmupTimeout},
-		{name: "valid overrides", value: "5s", envSet: true, want: 5 * time.Second},
-		{name: "invalid falls back", value: "not-a-duration", envSet: true, want: defaultLazyWarmupTimeout},
-		{name: "negative falls back", value: "-1s", envSet: true, want: defaultLazyWarmupTimeout},
-		{name: "zero falls back", value: "0s", envSet: true, want: defaultLazyWarmupTimeout},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.envSet {
-				t.Setenv(envLazyWarmupTimeout, tt.value)
-			}
-			assert.Equal(t, tt.want, lazyWarmupTimeoutFromEnv())
-			assert.Equal(t, tt.want, NewResolver().warmupTimeout, "constructor must resolve the timeout once")
-		})
-	}
-}
-
-func TestExtractRecordAddr(t *testing.T) {
-	t.Run("A record yields unmapped v4", func(t *testing.T) {
-		// net.ParseIP returns the 16-byte v4-in-v6 form, the same shape
-		// miekg/dns stores after parsing an A record; the extracted address
-		// must compare equal to a plain v4 netip.Addr.
-		addr, ok := extractRecordAddr(&dns.A{A: net.ParseIP("100.64.0.7")})
-		require.True(t, ok)
-		assert.True(t, addr.Is4())
-		assert.Equal(t, netip.MustParseAddr("100.64.0.7"), addr)
-	})
-
-	t.Run("AAAA record yields v6", func(t *testing.T) {
-		addr, ok := extractRecordAddr(&dns.AAAA{AAAA: net.ParseIP("fd00::1")})
-		require.True(t, ok)
-		assert.Equal(t, netip.MustParseAddr("fd00::1"), addr)
-	})
-
-	t.Run("A record without address", func(t *testing.T) {
-		_, ok := extractRecordAddr(&dns.A{})
-		assert.False(t, ok)
-	})
-
-	t.Run("non-address record", func(t *testing.T) {
-		_, ok := extractRecordAddr(&dns.CNAME{Target: "target.netbird.cloud."})
-		assert.False(t, ok)
-	})
-}

client/internal/dns/mock_server.go

@@ -8,7 +8,6 @@ import (
 	"github.com/miekg/dns"
 
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
-	"github.com/netbirdio/netbird/client/internal/dns/local"
 	nbdns "github.com/netbirdio/netbird/dns"
 	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -93,11 +92,6 @@ func (m *MockServer) SetFirewall(Firewall) {
 	// Mock implementation - no-op
 }
 
-// SetPeerActivator mock implementation of SetPeerActivator from Server interface
-func (m *MockServer) SetPeerActivator(local.PeerActivator) {
-	// Mock implementation - no-op
-}
-
 // BeginBatch mock implementation of BeginBatch from Server interface
 func (m *MockServer) BeginBatch() {
 	// Mock implementation - no-op

client/internal/dns/server.go

@@ -82,7 +82,6 @@ type Server interface {
 	PopulateManagementDomain(mgmtURL *url.URL) error
 	SetRouteSources(selected, active func() route.HAMap)
 	SetFirewall(Firewall)
-	SetPeerActivator(local.PeerActivator)
 }
 
 type nsGroupsByDomain struct {
@@ -492,13 +491,6 @@ func (s *DefaultServer) SetFirewall(fw Firewall) {
 	}
 }
 
-// SetPeerActivator wires the DNS-time lazy-connection warm-up on the local
-// resolver. Injected after the connection manager exists (it does not at
-// DNS-server construction time). Pass nil to disable.
-func (s *DefaultServer) SetPeerActivator(a local.PeerActivator) {
-	s.localResolver.SetPeerActivator(a)
-}
-
 // Stop stops the server
 func (s *DefaultServer) Stop() {
 	s.ctxCancel()
@@ -1443,11 +1435,11 @@ type localPeerConnectivity struct {
 
 // IsConnectedByIP looks the IP up in the peerstore and surfaces both
 // the known and connected bits. Used by Resolver.filterDisconnectedPeerAnswers.
-func (l localPeerConnectivity) IsConnectedByIP(ip netip.Addr) (known, connected bool) {
+func (l localPeerConnectivity) IsConnectedByIP(ip string) (known, connected bool) {
 	if l.status == nil {
 		return false, false
 	}
-	state, ok := l.status.PeerStateByIP(ip.String())
+	state, ok := l.status.PeerStateByIP(ip)
 	if !ok {
 		return false, false
 	}

client/internal/dns/service_listener.go

@@ -292,16 +292,18 @@ func (s *serviceViaListener) generateFreePort() (uint16, error) {
 		return customPort, nil
 	}
 
-	probeListener, err := net.ListenUDP("udp4", &net.UDPAddr{})
+	udpAddr := net.UDPAddrFromAddrPort(netip.MustParseAddrPort("0.0.0.0:0"))
+	probeListener, err := net.ListenUDP("udp", udpAddr)
 	if err != nil {
 		log.Debugf("failed to bind random port for DNS: %s", err)
 		return 0, err
 	}
 
-	port := uint16(probeListener.LocalAddr().(*net.UDPAddr).Port)
-	if err = probeListener.Close(); err != nil {
+	addrPort := netip.MustParseAddrPort(probeListener.LocalAddr().String()) // might panic if address is incorrect
+	err = probeListener.Close()
+	if err != nil {
 		log.Debugf("failed to free up DNS port: %s", err)
 		return 0, err
 	}
-	return port, nil
+	return addrPort.Port(), nil
 }

client/internal/dns_peer_activator.go

@@ -1,76 +0,0 @@
-package internal
-
-import (
-	"context"
-	"net/netip"
-	"time"
-
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
-)
-
-const dnsActivationPollInterval = 50 * time.Millisecond
-
-// dnsPeerActivator wakes lazy-connection peers from the DNS resolution path. It
-// implements dns/local.PeerActivator. DNS queries run on their own goroutines,
-// so it only touches state that is safe for concurrent use — ConnMgr.ActivatePeer,
-// peerstore.Store and peer.Status — and never takes the engine's syncMsgMux,
-// keeping DNS resolution from contending with network-map processing.
-type dnsPeerActivator struct {
-	connMgr   *ConnMgr
-	peerStore *peerstore.Store
-	status    *peer.Status
-	// ctx is the engine's long-lived context. The connection dial is tied to it
-	// (not the per-query DNS wait budget) so a handshake that outlasts the wait
-	// still completes in the background rather than being cancelled at the deadline.
-	ctx context.Context
-}
-
-// ActivatePeersByIP triggers wake-up for the peer(s) owning addrs and waits
-// until one is connected or ctx (the per-query DNS wait budget) expires.
-// Activation itself is tied to the engine's long-lived context so the dial
-// survives a wait that times out. Unknown or already-connected addresses are
-// skipped, so the steady-state (warm) path adds no latency.
-func (a *dnsPeerActivator) ActivatePeersByIP(ctx context.Context, addrs []netip.Addr) {
-	if a == nil || a.connMgr == nil {
-		return
-	}
-
-	var pending []string
-	for _, addr := range addrs {
-		ip := addr.String()
-		st, ok := a.status.PeerStateByIP(ip)
-		if !ok || st.ConnStatus == peer.StatusConnected {
-			continue
-		}
-		conn, ok := a.peerStore.PeerConn(st.PubKey)
-		if !ok {
-			continue
-		}
-		a.connMgr.ActivatePeer(a.ctx, conn)
-		pending = append(pending, ip)
-	}
-
-	if len(pending) == 0 {
-		return
-	}
-	a.waitConnected(ctx, pending)
-}
-
-// waitConnected blocks until any of ips reports a connected peer or ctx expires.
-func (a *dnsPeerActivator) waitConnected(ctx context.Context, ips []string) {
-	ticker := time.NewTicker(dnsActivationPollInterval)
-	defer ticker.Stop()
-	for {
-		for _, ip := range ips {
-			if st, ok := a.status.PeerStateByIP(ip); ok && st.ConnStatus == peer.StatusConnected {
-				return
-			}
-		}
-		select {
-		case <-ctx.Done():
-			return
-		case <-ticker.C:
-		}
-	}
-}

client/internal/dns_peer_activator_test.go

@@ -1,129 +0,0 @@
-package internal
-
-import (
-	"context"
-	"net/netip"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
-)
-
-func newTestPeerConn(t *testing.T, key string) *peer.Conn {
-	t.Helper()
-	conn, err := peer.NewConn(peer.ConnConfig{
-		Key:      key,
-		LocalKey: "local",
-		WgConfig: peer.WgConfig{
-			AllowedIps: []netip.Prefix{netip.MustParsePrefix("100.64.0.1/32")},
-		},
-	}, peer.ServiceDependencies{})
-	require.NoError(t, err)
-	return conn
-}
-
-func newTestDNSPeerActivator(t *testing.T) (*dnsPeerActivator, *peer.Status, *peerstore.Store) {
-	t.Helper()
-	status := peer.NewRecorder("https://mgm")
-	store := peerstore.NewConnStore()
-	// ConnMgr without Start: the lazy manager is nil, so ActivatePeer is a
-	// no-op — these tests exercise the activator's skip/wait logic.
-	connMgr := NewConnMgr(&EngineConfig{}, status, store, nil)
-	return &dnsPeerActivator{
-		connMgr:   connMgr,
-		peerStore: store,
-		status:    status,
-		ctx:       context.Background(),
-	}, status, store
-}
-
-func TestDNSPeerActivator_NilSafe(t *testing.T) {
-	var a *dnsPeerActivator
-	a.ActivatePeersByIP(context.Background(), []netip.Addr{netip.MustParseAddr("100.64.0.1")})
-}
-
-// TestDNSPeerActivator_SkipsUnknownAndConnectedPeers verifies the steady-state
-// (warm) path adds no latency: already-connected and unknown addresses never
-// enter the wait loop.
-func TestDNSPeerActivator_SkipsUnknownAndConnectedPeers(t *testing.T) {
-	a, status, store := newTestDNSPeerActivator(t)
-
-	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", "fd00::1"))
-	require.NoError(t, status.UpdatePeerState(peer.State{PubKey: "peerA", ConnStatus: peer.StatusConnected}))
-	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	start := time.Now()
-	a.ActivatePeersByIP(ctx, []netip.Addr{
-		netip.MustParseAddr("100.64.0.1"),  // known, connected -> skipped
-		netip.MustParseAddr("fd00::1"),     // known via IPv6, connected -> skipped
-		netip.MustParseAddr("100.64.0.99"), // unknown -> skipped
-	})
-	require.Less(t, time.Since(start), time.Second, "no pending peer must mean no wait")
-}
-
-// TestDNSPeerActivator_WaitsForPendingPeerToConnect verifies the wait loop
-// returns as soon as a pending peer reports connected, well before the
-// per-query budget expires.
-func TestDNSPeerActivator_WaitsForPendingPeerToConnect(t *testing.T) {
-	a, status, store := newTestDNSPeerActivator(t)
-
-	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
-	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
-
-	go func() {
-		time.Sleep(150 * time.Millisecond)
-		_ = status.UpdatePeerState(peer.State{PubKey: "peerA", ConnStatus: peer.StatusConnected})
-	}()
-
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-
-	start := time.Now()
-	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
-	elapsed := time.Since(start)
-
-	require.GreaterOrEqual(t, elapsed, 100*time.Millisecond, "must wait for the pending peer")
-	require.Less(t, elapsed, 5*time.Second, "must return on connect, not at the deadline")
-}
-
-// TestDNSPeerActivator_ReturnsAtBudgetWhenPeerStaysIdle verifies a peer that
-// never connects releases the DNS response at the per-query budget instead of
-// blocking it indefinitely.
-func TestDNSPeerActivator_ReturnsAtBudgetWhenPeerStaysIdle(t *testing.T) {
-	a, status, store := newTestDNSPeerActivator(t)
-
-	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
-	store.AddPeerConn("peerA", newTestPeerConn(t, "peerA"))
-
-	ctx, cancel := context.WithTimeout(context.Background(), 300*time.Millisecond)
-	defer cancel()
-
-	start := time.Now()
-	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
-	elapsed := time.Since(start)
-
-	require.GreaterOrEqual(t, elapsed, 250*time.Millisecond, "must wait out the budget for a pending peer")
-	require.Less(t, elapsed, 5*time.Second, "must not block past the budget")
-}
-
-// TestDNSPeerActivator_NoWaitWithoutPeerConn verifies a known-but-idle peer
-// with no connection object in the store is not waited on: there is nothing to
-// activate, so waiting could only ever time out.
-func TestDNSPeerActivator_NoWaitWithoutPeerConn(t *testing.T) {
-	a, status, _ := newTestDNSPeerActivator(t)
-
-	require.NoError(t, status.AddPeer("peerA", "a.netbird.cloud", "100.64.0.1", ""))
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	start := time.Now()
-	a.ActivatePeersByIP(ctx, []netip.Addr{netip.MustParseAddr("100.64.0.1")})
-	require.Less(t, time.Since(start), time.Second, "peer without a conn must not be waited on")
-}

client/internal/engine.go

@@ -34,6 +34,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/acl"
+	"github.com/netbirdio/netbird/client/internal/approval"
 	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
@@ -132,6 +133,8 @@ type EngineConfig struct {
 	RosenpassPermissive bool
 
 	ServerSSHAllowed              bool
+	ServerVNCAllowed              bool
+	DisableVNCApproval            *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -222,7 +225,9 @@ type Engine struct {
 
 	networkMonitor *networkmonitor.NetworkMonitor
 
-	sshServer sshServer
+	sshServer      sshServer
+	vncSrv         vncServer
+	approvalBroker *approval.Broker
 
 	statusRecorder *peer.Status
 
@@ -329,6 +334,7 @@ func NewEngine(
 		TURNs:              []*stun.URI{},
 		networkSerial:      0,
 		statusRecorder:     services.StatusRecorder,
+		approvalBroker:     approval.New(services.StatusRecorder),
 		stateManager:       services.StateManager,
 		portForwardManager: portforward.NewManager(),
 		checks:             services.Checks,
@@ -403,6 +409,10 @@ func (e *Engine) stopLocked() {
 		log.Warnf("failed to stop SSH server: %v", err)
 	}
 
+	if err := e.stopVNCServer(); err != nil {
+		log.Warnf("failed to stop VNC server: %v", err)
+	}
+
 	e.cleanupSSHConfig()
 
 	if e.ingressGatewayMgr != nil {
@@ -654,16 +664,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 	e.connMgr = NewConnMgr(e.config, e.statusRecorder, e.peerStore, wgIface)
 	e.connMgr.Start(e.ctx)
 
-	// Wire DNS-time lazy-connection warm-up now that the connection manager
-	// exists (it does not at DNS-server construction time). A DNS answer that
-	// points at an idle peer then wakes it before the client's first request.
-	e.dnsServer.SetPeerActivator(&dnsPeerActivator{
-		connMgr:   e.connMgr,
-		peerStore: e.peerStore,
-		status:    e.statusRecorder,
-		ctx:       e.ctx,
-	})
-
 	e.srWatcher = guard.NewSRWatcher(e.signal, e.relayManager, e.mobileDep.IFaceDiscover, iceCfg)
 	e.srWatcher.Start(peer.IsForceRelayed())
 
@@ -1167,6 +1167,7 @@ func (e *Engine) applyInfoFlags(info *system.Info) {
 		e.config.RosenpassEnabled,
 		e.config.RosenpassPermissive,
 		&e.config.ServerSSHAllowed,
+		&e.config.ServerVNCAllowed,
 		e.config.DisableClientRoutes,
 		e.config.DisableServerRoutes,
 		e.config.DisableDNS,
@@ -1221,6 +1222,10 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 		}
 	}
 
+	if err := e.updateVNC(); err != nil {
+		log.Warnf("failed handling VNC server setup: %v", err)
+	}
+
 	state := e.statusRecorder.GetLocalPeerState()
 	state.IP = e.wgInterface.Address().String()
 	state.IPv6 = e.wgInterface.Address().IPv6String()
@@ -1521,6 +1526,11 @@ func (e *Engine) reconcilePeers(networkMap *mgmProto.NetworkMap) ([]*mgmProto.Re
 		}
 	}
 
+	// VNC auth: always sync, including nil so cleared auth on the management
+	// side is applied locally, and so it isn't skipped on the RemotePeersIsEmpty
+	// cleanup path.
+	e.updateVNCServerAuth(networkMap.GetVncAuth())
+
 	// cleanup request, most likely our peer has been deleted
 	if networkMap.GetRemotePeersIsEmpty() {
 		err := e.removeAllPeers()
@@ -2035,6 +2045,7 @@ func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, err
 		e.config.RosenpassEnabled,
 		e.config.RosenpassPermissive,
 		&e.config.ServerSSHAllowed,
+		&e.config.ServerVNCAllowed,
 		e.config.DisableClientRoutes,
 		e.config.DisableServerRoutes,
 		e.config.DisableDNS,
@@ -2615,14 +2626,13 @@ func (e *Engine) updateForwardRules(rules []*mgmProto.ForwardingRule) ([]firewal
 
 func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers []*mgmProto.RemotePeerConfig) map[string]bool {
 	excludedPeers := make(map[string]bool)
-
-	// Ingress forward targets: inbound forwarded traffic is initiated remotely and
-	// cannot wake a lazy connection, so the peer routing the target must stay
-	// permanently connected. AllowedIPs are already parsed on the peer conn, so
-	// reuse those typed prefixes instead of re-parsing the network map strings.
 	for _, r := range rules {
+		ip := r.TranslatedAddress
 		for _, p := range peers {
-			if e.peerRoutesAddr(p, r.TranslatedAddress) {
+			for _, allowedIP := range p.GetAllowedIps() {
+				if allowedIP != ip.String() {
+					continue
+				}
 				log.Infof("exclude forwarder peer from lazy connection: %s", p.GetWgPubKey())
 				excludedPeers[p.GetWgPubKey()] = true
 			}
@@ -2632,27 +2642,6 @@ func (e *Engine) toExcludedLazyPeers(rules []firewallManager.ForwardRule, peers
 	return excludedPeers
 }
 
-// peerRoutesAddr reports whether the peer is a router for addr, matched against
-// the peer's already-parsed AllowedIPs from the store (the same typed value the
-// lazy manager consumes) rather than re-parsing the network map strings.
-func (e *Engine) peerRoutesAddr(p *mgmProto.RemotePeerConfig, addr netip.Addr) bool {
-	prefixes, ok := e.peerStore.AllowedIPs(p.GetWgPubKey())
-	if !ok {
-		return false
-	}
-	return prefixesContain(prefixes, addr)
-}
-
-// prefixesContain reports whether addr falls within any of the prefixes.
-func prefixesContain(prefixes []netip.Prefix, addr netip.Addr) bool {
-	for _, prefix := range prefixes {
-		if prefix.Contains(addr) {
-			return true
-		}
-	}
-	return false
-}
-
 // isChecksEqual checks if two slices of checks are equal.
 func isChecksEqual(checks1, checks2 []*mgmProto.Checks) bool {
 	normalize := func(checks []*mgmProto.Checks) []string {
@@ -2837,3 +2826,16 @@ func decodeRelayIP(b []byte) netip.Addr {
 	}
 	return ip.Unmap()
 }
+
+// RespondApproval relays the user's decision for a pending approval to
+// the broker. viewOnly is honoured only when accept is true. Returns
+// true when the request_id matched a live prompt.
+func (e *Engine) RespondApproval(requestID string, accept, viewOnly bool) bool {
+	if e == nil || e.approvalBroker == nil {
+		return false
+	}
+	return e.approvalBroker.Respond(requestID, approval.Decision{
+		Accept:   accept,
+		ViewOnly: accept && viewOnly,
+	})
+}

client/internal/engine_lazy_exclude_test.go

@@ -1,87 +0,0 @@
-package internal
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-
-	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/client/internal/peerstore"
-	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-)
-
-func TestPrefixesContain(t *testing.T) {
-	tests := []struct {
-		name     string
-		prefixes []string
-		addr     string
-		want     bool
-	}{
-		{name: "own overlay /32 matches", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.145", want: true},
-		{name: "addr inside routed subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.121.208.4", want: true},
-		{name: "addr outside subnet", prefixes: []string{"10.121.0.0/16"}, addr: "10.122.0.1", want: false},
-		{name: "different /32", prefixes: []string{"100.110.8.145/32"}, addr: "100.110.8.146", want: false},
-		{name: "ipv6 /128 matches", prefixes: []string{"fd00::1/128"}, addr: "fd00::1", want: true},
-		{name: "no prefixes", prefixes: nil, addr: "10.121.208.4", want: false},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			prefixes := make([]netip.Prefix, 0, len(tt.prefixes))
-			for _, p := range tt.prefixes {
-				prefixes = append(prefixes, netip.MustParsePrefix(p))
-			}
-			require.Equal(t, tt.want, prefixesContain(prefixes, netip.MustParseAddr(tt.addr)))
-		})
-	}
-}
-
-// TestToExcludedLazyPeers_ForwardTarget guards a regression: the forward-target
-// peer (the peer routing a ForwardRule.TranslatedAddress) must be excluded from
-// lazy connections, matched via the peer's already-parsed AllowedIPs.
-func TestToExcludedLazyPeers_ForwardTarget(t *testing.T) {
-	const targetPeerKey = "cccccccccccccccccccccccccccccccccccccccccc0="
-	const otherPeerKey = "dddddddddddddddddddddddddddddddddddddddddd0="
-
-	store := peerstore.NewConnStore()
-	store.AddPeerConn(targetPeerKey, newTestConn(t, targetPeerKey, "100.110.8.145/32"))
-	store.AddPeerConn(otherPeerKey, newTestConn(t, otherPeerKey, "100.110.9.10/32"))
-
-	e := &Engine{peerStore: store}
-
-	peers := []*mgmProto.RemotePeerConfig{
-		{WgPubKey: targetPeerKey, AllowedIps: []string{"100.110.8.145/32"}},
-		{WgPubKey: otherPeerKey, AllowedIps: []string{"100.110.9.10/32"}},
-	}
-	rules := []firewallManager.ForwardRule{
-		{TranslatedAddress: netip.MustParseAddr("100.110.8.145")},
-	}
-
-	excluded := e.toExcludedLazyPeers(rules, peers)
-
-	require.True(t, excluded[targetPeerKey], "forward-target peer must be excluded from lazy connections")
-	require.False(t, excluded[otherPeerKey], "non-target peer must not be excluded")
-	require.Len(t, excluded, 1)
-}
-
-func TestToExcludedLazyPeers_NoRules(t *testing.T) {
-	e := &Engine{peerStore: peerstore.NewConnStore()}
-
-	peers := []*mgmProto.RemotePeerConfig{
-		{WgPubKey: "peer-a", AllowedIps: []string{"100.110.8.145/32"}},
-	}
-
-	require.Empty(t, e.toExcludedLazyPeers(nil, peers))
-}
-
-func newTestConn(t *testing.T, key, allowedIP string) *peer.Conn {
-	t.Helper()
-	conn, err := peer.NewConn(peer.ConnConfig{
-		Key:      key,
-		WgConfig: peer.WgConfig{AllowedIps: []netip.Prefix{netip.MustParsePrefix(allowedIP)}},
-	}, peer.ServiceDependencies{})
-	require.NoError(t, err)
-	return conn
-}

client/internal/engine_ssh.go

@@ -12,10 +12,10 @@ import (
 	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface/netstack"
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
-	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
 	sshserver "github.com/netbirdio/netbird/client/ssh/server"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
 	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
 )
 
@@ -237,22 +237,18 @@ func (e *Engine) startSSHServer(jwtConfig *sshserver.JWTConfig) error {
 		return errors.New("wg interface not initialized")
 	}
 
+	wgAddr := e.wgInterface.Address()
 	serverConfig := &sshserver.Config{
-		HostKeyPEM: e.config.SSHKey,
-		JWT:        jwtConfig,
+		HostKeyPEM:        e.config.SSHKey,
+		JWT:               jwtConfig,
+		NetstackNet:       e.wgInterface.GetNet(),
+		NetworkValidation: wgAddr,
 	}
 	server := sshserver.New(serverConfig)
 
-	wgAddr := e.wgInterface.Address()
-	server.SetNetworkValidation(wgAddr)
-
 	netbirdIP := wgAddr.IP
 	listenAddr := netip.AddrPortFrom(netbirdIP, sshserver.InternalSSHPort)
 
-	if netstackNet := e.wgInterface.GetNet(); netstackNet != nil {
-		server.SetNetstackNet(netstackNet)
-	}
-
 	e.configureSSHServer(server)
 
 	if err := server.Start(e.ctx, listenAddr); err != nil {

client/internal/engine_vnc.go

@@ -0,0 +1,325 @@
+//go:build !js && !ios && !android
+
+package internal
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/netip"
+
+	log "github.com/sirupsen/logrus"
+
+	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
+	"github.com/netbirdio/netbird/client/internal/approval"
+	"github.com/netbirdio/netbird/client/internal/metrics"
+	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
+	"github.com/netbirdio/netbird/client/internal/peer"
+	"github.com/netbirdio/netbird/client/vnc"
+	vncserver "github.com/netbirdio/netbird/client/vnc/server"
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
+	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
+)
+
+type vncServer interface {
+	Start(ctx context.Context, addr netip.AddrPort, network netip.Prefix) error
+	AddListener(ctx context.Context, addr netip.AddrPort, network netip.Prefix) error
+	Stop() error
+	ActiveSessions() []vncserver.ActiveSessionInfo
+}
+
+func (e *Engine) setupVNCPortRedirection() error {
+	if e.firewall == nil || e.wgInterface == nil {
+		return nil
+	}
+
+	localAddr := e.wgInterface.Address().IP
+	if !localAddr.IsValid() {
+		return errors.New("invalid local NetBird address")
+	}
+
+	if err := e.firewall.AddInboundDNAT(localAddr, firewallManager.ProtocolTCP, vnc.ExternalPort, vnc.InternalPort); err != nil {
+		return fmt.Errorf("add VNC port redirection: %w", err)
+	}
+	log.Infof("VNC port redirection: %s:%d -> %s:%d", localAddr, vnc.ExternalPort, localAddr, vnc.InternalPort)
+
+	if wgAddr := e.wgInterface.Address(); wgAddr.HasIPv6() {
+		v6 := wgAddr.IPv6
+		if err := e.firewall.AddInboundDNAT(v6, firewallManager.ProtocolTCP, vnc.ExternalPort, vnc.InternalPort); err != nil {
+			log.Warnf("failed to add IPv6 VNC port redirection: %v", err)
+		} else {
+			log.Infof("VNC port redirection: [%s]:%d -> [%s]:%d", v6, vnc.ExternalPort, v6, vnc.InternalPort)
+		}
+	}
+
+	return nil
+}
+
+func (e *Engine) cleanupVNCPortRedirection() error {
+	if e.firewall == nil || e.wgInterface == nil {
+		return nil
+	}
+
+	localAddr := e.wgInterface.Address().IP
+	if !localAddr.IsValid() {
+		return errors.New("invalid local NetBird address")
+	}
+
+	if err := e.firewall.RemoveInboundDNAT(localAddr, firewallManager.ProtocolTCP, vnc.ExternalPort, vnc.InternalPort); err != nil {
+		return fmt.Errorf("remove VNC port redirection: %w", err)
+	}
+
+	if wgAddr := e.wgInterface.Address(); wgAddr.HasIPv6() {
+		if err := e.firewall.RemoveInboundDNAT(wgAddr.IPv6, firewallManager.ProtocolTCP, vnc.ExternalPort, vnc.InternalPort); err != nil {
+			log.Debugf("failed to remove IPv6 VNC port redirection: %v", err)
+		}
+	}
+
+	return nil
+}
+
+// updateVNC handles starting/stopping the VNC server based on the config flag.
+func (e *Engine) updateVNC() error {
+	if !e.config.ServerVNCAllowed {
+		if e.vncSrv != nil {
+			log.Info("VNC server disabled, stopping")
+		}
+		return e.stopVNCServer()
+	}
+
+	if e.config.BlockInbound {
+		log.Info("VNC server disabled because inbound connections are blocked")
+		return e.stopVNCServer()
+	}
+
+	if e.vncSrv != nil {
+		return nil
+	}
+
+	return e.startVNCServer()
+}
+
+func (e *Engine) startVNCServer() error {
+	if e.wgInterface == nil {
+		return errors.New("wg interface not initialized")
+	}
+
+	capturer, injector, ok := newPlatformVNC()
+	if !ok {
+		log.Debug("VNC server not supported on this platform")
+		return nil
+	}
+
+	netbirdIP := e.wgInterface.Address().IP
+
+	var sessionRecorder func(vncserver.SessionTick)
+	if e.clientMetrics != nil {
+		sessionRecorder = func(t vncserver.SessionTick) {
+			e.clientMetrics.RecordVNCSessionTick(e.ctx, metrics.VNCSessionTick{
+				Period:        t.Period,
+				BytesOut:      t.BytesOut,
+				Writes:        t.Writes,
+				FBUs:          t.FBUs,
+				MaxFBUBytes:   t.MaxFBUBytes,
+				MaxFBURects:   t.MaxFBURects,
+				MaxWriteBytes: t.MaxWriteBytes,
+				WriteNanos:    t.WriteNanos,
+			})
+		}
+	}
+	serviceMode := vncNeedsServiceMode()
+	if serviceMode {
+		log.Info("VNC: running as system service, enabling service mode (per-session agent proxy)")
+	}
+	requireApproval := e.config.DisableVNCApproval == nil || !*e.config.DisableVNCApproval
+	srv := vncserver.New(vncserver.Config{
+		Capturer:        capturer,
+		Injector:        injector,
+		IdentityKey:     e.config.WgPrivateKey[:],
+		ServiceMode:     serviceMode,
+		SessionRecorder: sessionRecorder,
+		NetstackNet:     e.wgInterface.GetNet(),
+		RequireApproval: requireApproval,
+		Approver:        &vncApprover{broker: e.approvalBroker, statusRecorder: e.statusRecorder},
+	})
+
+	listenAddr := netip.AddrPortFrom(netbirdIP, vnc.InternalPort)
+	network := e.wgInterface.Address().Network
+	if err := srv.Start(e.ctx, listenAddr, network); err != nil {
+		return fmt.Errorf("start VNC server: %w", err)
+	}
+
+	if wgAddr := e.wgInterface.Address(); wgAddr.HasIPv6() {
+		v6Addr := netip.AddrPortFrom(wgAddr.IPv6, vnc.InternalPort)
+		if err := srv.AddListener(e.ctx, v6Addr, wgAddr.IPv6Net); err != nil {
+			log.Warnf("failed to add IPv6 VNC listener: %v", err)
+		}
+	}
+
+	e.vncSrv = srv
+
+	if netstackNet := e.wgInterface.GetNet(); netstackNet != nil {
+		if registrar, ok := e.firewall.(interface {
+			RegisterNetstackService(protocol nftypes.Protocol, port uint16)
+		}); ok {
+			registrar.RegisterNetstackService(nftypes.TCP, vnc.InternalPort)
+			log.Debugf("registered VNC service with netstack for TCP:%d", vnc.InternalPort)
+		}
+	}
+
+	if err := e.setupVNCPortRedirection(); err != nil {
+		log.Warnf("setup VNC port redirection: %v", err)
+	}
+
+	log.Info("VNC server enabled")
+	return nil
+}
+
+// updateVNCServerAuth updates VNC fine-grained access control from management.
+// A nil vncAuth clears all authorized users and session pubkeys so management
+// can revoke access by omitting the field on the next sync.
+func (e *Engine) updateVNCServerAuth(vncAuth *mgmProto.VNCAuth) {
+	if e.vncSrv == nil {
+		return
+	}
+
+	vncSrv, ok := e.vncSrv.(*vncserver.Server)
+	if !ok {
+		return
+	}
+
+	if vncAuth == nil {
+		vncSrv.UpdateVNCAuth(&sshauth.Config{})
+		return
+	}
+
+	protoUsers := vncAuth.GetAuthorizedUsers()
+	authorizedUsers := make([]sshuserhash.UserIDHash, len(protoUsers))
+	for i, hash := range protoUsers {
+		if len(hash) != 16 {
+			log.Warnf("invalid VNC auth hash length %d, expected 16", len(hash))
+			return
+		}
+		authorizedUsers[i] = sshuserhash.UserIDHash(hash)
+	}
+
+	machineUsers := make(map[string][]uint32)
+	for osUser, indexes := range vncAuth.GetMachineUsers() {
+		machineUsers[osUser] = indexes.GetIndexes()
+	}
+
+	sessionPubKeys := make([]sshauth.SessionPubKey, 0, len(vncAuth.GetSessionPubKeys()))
+	for _, pk := range vncAuth.GetSessionPubKeys() {
+		pub := pk.GetPubKey()
+		if len(pub) != 32 {
+			log.Warnf("VNC session pubkey wrong length %d", len(pub))
+			continue
+		}
+		hash := pk.GetUserIdHash()
+		if len(hash) != 16 {
+			log.Warnf("VNC session user id hash wrong length %d", len(hash))
+			continue
+		}
+		sessionPubKeys = append(sessionPubKeys, sshauth.SessionPubKey{
+			PubKey:      pub,
+			UserIDHash:  sshuserhash.UserIDHash(hash),
+			DisplayName: pk.GetDisplayName(),
+		})
+	}
+
+	vncSrv.UpdateVNCAuth(&sshauth.Config{
+		AuthorizedUsers: authorizedUsers,
+		MachineUsers:    machineUsers,
+		SessionPubKeys:  sessionPubKeys,
+	})
+}
+
+// GetVNCServerStatus returns whether the VNC server is running and the list
+// of active VNC sessions. The pointer is captured under syncMsgMux so a
+// concurrent updateVNC/stopVNCServer cannot swap it out between the nil
+// check and the ActiveSessions call.
+func (e *Engine) GetVNCServerStatus() (enabled bool, sessions []vncserver.ActiveSessionInfo) {
+	e.syncMsgMux.Lock()
+	vncSrv := e.vncSrv
+	e.syncMsgMux.Unlock()
+	if vncSrv == nil {
+		return false, nil
+	}
+	return true, vncSrv.ActiveSessions()
+}
+
+func (e *Engine) stopVNCServer() error {
+	if e.vncSrv == nil {
+		return nil
+	}
+
+	if err := e.cleanupVNCPortRedirection(); err != nil {
+		log.Warnf("cleanup VNC port redirection: %v", err)
+	}
+
+	if e.wgInterface != nil && e.wgInterface.GetNet() != nil {
+		if registrar, ok := e.firewall.(interface {
+			UnregisterNetstackService(protocol nftypes.Protocol, port uint16)
+		}); ok {
+			registrar.UnregisterNetstackService(nftypes.TCP, vnc.InternalPort)
+		}
+	}
+
+	log.Info("stopping VNC server")
+	err := e.vncSrv.Stop()
+	e.vncSrv = nil
+	if err != nil {
+		return fmt.Errorf("stop VNC server: %w", err)
+	}
+	return nil
+}
+
+// vncApprover adapts the generic approval.Broker for the VNC server.
+type vncApprover struct {
+	broker         *approval.Broker
+	statusRecorder *peer.Status
+}
+
+func (a *vncApprover) Request(ctx context.Context, info vncserver.ApprovalInfo) (vncserver.ApprovalDecision, error) {
+	// Resolve the source overlay IP to a peer FQDN for the prompt label.
+	if info.PeerName == "" && info.SourceIP != "" && a.statusRecorder != nil {
+		if fqdn, ok := a.statusRecorder.PeerByIP(info.SourceIP); ok {
+			info.PeerName = fqdn
+		}
+	}
+	subject := fmt.Sprintf("VNC connection from %s", displayPeer(info))
+	meta := map[string]string{
+		"peer_name":   info.PeerName,
+		"peer_pubkey": info.PeerPubKey,
+		"source_ip":   info.SourceIP,
+		"mode":        info.Mode,
+		"username":    info.Username,
+		"initiator":   info.Initiator,
+	}
+	d, err := a.broker.Request(ctx, approval.Prompt{
+		Kind:     approval.KindVNC,
+		Subject:  subject,
+		Metadata: meta,
+	})
+	if err != nil {
+		return vncserver.ApprovalDecision{}, err
+	}
+	return vncserver.ApprovalDecision{ViewOnly: d.ViewOnly}, nil
+}
+
+func displayPeer(info vncserver.ApprovalInfo) string {
+	if info.Initiator != "" {
+		return info.Initiator
+	}
+	if info.PeerName != "" {
+		return info.PeerName
+	}
+	if info.SourceIP != "" {
+		return info.SourceIP
+	}
+	if info.PeerPubKey != "" {
+		return info.PeerPubKey
+	}
+	return "unknown peer"
+}

client/internal/engine_vnc_console_freebsd.go

@@ -0,0 +1,31 @@
+//go:build freebsd
+
+package internal
+
+import (
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+
+	vncserver "github.com/netbirdio/netbird/client/vnc/server"
+)
+
+// newConsoleVNC builds the FreeBSD console fallback: vt(4) framebuffer
+// for capture, /dev/uinput for input. The uinput device requires the
+// `uinput` kernel module (`kldload uinput`); without it, input init
+// fails and we drop to a stub injector so the user still gets a
+// view-only screen mirror.
+func newConsoleVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, error) {
+	poller := vncserver.NewFBPoller("")
+	w, h := poller.Width(), poller.Height()
+	if w == 0 || h == 0 {
+		poller.Close()
+		return nil, nil, fmt.Errorf("vt framebuffer init failed (vt may not allow mmap on this driver)")
+	}
+	if inj, err := vncserver.NewUInputInjector(w, h); err == nil {
+		return poller, inj, nil
+	} else {
+		log.Infof("VNC console: uinput unavailable (%v); view-only mode. Run `kldload uinput` to enable input.", err)
+		return poller, &vncserver.StubInputInjector{}, nil
+	}
+}

client/internal/engine_vnc_console_linux.go

@@ -0,0 +1,30 @@
+//go:build linux && !android
+
+package internal
+
+import (
+	"fmt"
+
+	log "github.com/sirupsen/logrus"
+
+	vncserver "github.com/netbirdio/netbird/client/vnc/server"
+)
+
+// newConsoleVNC builds a framebuffer + uinput VNC backend for boxes
+// without a running X server. Used as the auto-fallback when
+// newPlatformVNC can't reach X. Returns an error when /dev/fb0 or
+// /dev/uinput aren't usable so the caller can drop back to a stub.
+func newConsoleVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, error) {
+	poller := vncserver.NewFBPoller("")
+	w, h := poller.Width(), poller.Height()
+	if w == 0 || h == 0 {
+		poller.Close()
+		return nil, nil, fmt.Errorf("framebuffer capturer init failed (is /dev/fb0 readable?)")
+	}
+	inj, err := vncserver.NewUInputInjector(w, h)
+	if err != nil {
+		log.Debugf("uinput unavailable, falling back to view-only VNC: %v", err)
+		return poller, &vncserver.StubInputInjector{}, nil
+	}
+	return poller, inj, nil
+}

client/internal/engine_vnc_darwin.go

@@ -0,0 +1,34 @@
+//go:build darwin && !ios
+
+package internal
+
+import (
+	"os"
+
+	log "github.com/sirupsen/logrus"
+
+	vncserver "github.com/netbirdio/netbird/client/vnc/server"
+)
+
+func newPlatformVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, bool) {
+	capturer := vncserver.NewMacPoller()
+	// Prompt for Screen Recording at server-enable time rather than first
+	// client-connect. The native prompt is far easier for users to act on
+	// in the moment they toggled VNC on than later when "the screen looks
+	// like wallpaper" would otherwise be the only clue.
+	vncserver.PrimeScreenCapturePermission()
+	injector, err := vncserver.NewMacInputInjector()
+	if err != nil {
+		log.Debugf("VNC: macOS input injector: %v", err)
+		return capturer, &vncserver.StubInputInjector{}, true
+	}
+	return capturer, injector, true
+}
+
+// vncNeedsServiceMode reports whether the running process is a system
+// LaunchDaemon (root, parented by launchd). Daemons sit in the global
+// bootstrap namespace and cannot talk to WindowServer; we route capture
+// through a per-user agent in that case.
+func vncNeedsServiceMode() bool {
+	return os.Geteuid() == 0 && os.Getppid() == 1
+}

client/internal/engine_vnc_stub.go

@@ -0,0 +1,23 @@
+//go:build js || ios || android
+
+package internal
+
+import (
+	log "github.com/sirupsen/logrus"
+
+	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
+)
+
+type vncServer interface{}
+
+func (e *Engine) updateVNC() error { return nil }
+
+func (e *Engine) updateVNCServerAuth(auth *mgmProto.VNCAuth) {
+	if auth == nil {
+		return
+	}
+	log.Debugf("ignoring VNC auth push on platform without a VNC server: %d session pubkeys, %d authorized users",
+		len(auth.GetSessionPubKeys()), len(auth.GetAuthorizedUsers()))
+}
+
+func (e *Engine) stopVNCServer() error { return nil }

client/internal/engine_vnc_windows.go

@@ -0,0 +1,13 @@
+//go:build windows
+
+package internal
+
+import vncserver "github.com/netbirdio/netbird/client/vnc/server"
+
+func newPlatformVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, bool) {
+	return vncserver.NewDesktopCapturer(), vncserver.NewWindowsInputInjector(), true
+}
+
+func vncNeedsServiceMode() bool {
+	return vncserver.GetCurrentSessionID() == 0
+}

client/internal/engine_vnc_x11.go

@@ -0,0 +1,35 @@
+//go:build (linux && !android) || freebsd
+
+package internal
+
+import (
+	log "github.com/sirupsen/logrus"
+
+	vncserver "github.com/netbirdio/netbird/client/vnc/server"
+)
+
+func newPlatformVNC() (vncserver.ScreenCapturer, vncserver.InputInjector, bool) {
+	// Prefer X11 when an X server is reachable. NewX11InputInjector probes
+	// DISPLAY (and /proc) eagerly, so a non-nil error here means no X.
+	injector, err := vncserver.NewX11InputInjector("", "", "")
+	if err == nil {
+		return vncserver.NewX11Poller("", ""), injector, true
+	}
+	log.Debugf("VNC: X11 not available: %v", err)
+
+	// Fallback for headless / pre-X states (kernel console, login manager
+	// without X, physical server in recovery): stream the framebuffer and
+	// inject input via /dev/uinput.
+	consoleCap, consoleInj, err := newConsoleVNC()
+	if err == nil {
+		log.Infof("VNC: using framebuffer console capture (%dx%d)", consoleCap.Width(), consoleCap.Height())
+		return consoleCap, consoleInj, true
+	}
+	log.Debugf("VNC: framebuffer console fallback unavailable: %v", err)
+
+	return &vncserver.StubCapturer{}, &vncserver.StubInputInjector{}, false
+}
+
+func vncNeedsServiceMode() bool {
+	return false
+}

client/internal/metrics/influxdb.go

@@ -120,6 +120,36 @@ func (m *influxDBMetrics) RecordSyncDuration(_ context.Context, agentInfo AgentI
 	m.trimLocked()
 }
 
+func (m *influxDBMetrics) RecordVNCSessionTick(_ context.Context, agentInfo AgentInfo, tick VNCSessionTick) {
+	tags := fmt.Sprintf("deployment_type=%s,version=%s,os=%s,arch=%s,peer_id=%s",
+		agentInfo.DeploymentType.String(),
+		agentInfo.Version,
+		agentInfo.OS,
+		agentInfo.Arch,
+		agentInfo.peerID,
+	)
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.samples = append(m.samples, influxSample{
+		measurement: "netbird_vnc_traffic",
+		tags:        tags,
+		fields: map[string]float64{
+			"period_seconds":     tick.Period.Seconds(),
+			"bytes_out":          float64(tick.BytesOut),
+			"writes":             float64(tick.Writes),
+			"fbus":               float64(tick.FBUs),
+			"max_fbu_bytes":      float64(tick.MaxFBUBytes),
+			"max_fbu_rects":      float64(tick.MaxFBURects),
+			"max_write_bytes":    float64(tick.MaxWriteBytes),
+			"write_time_seconds": float64(tick.WriteNanos) / 1e9,
+		},
+		timestamp: time.Now(),
+	})
+	m.trimLocked()
+}
+
 func (m *influxDBMetrics) RecordSyncPhase(_ context.Context, agentInfo AgentInfo, phase string, duration time.Duration) {
 	tags := fmt.Sprintf("deployment_type=%s,version=%s,os=%s,arch=%s,peer_id=%s,phase=%s",
 		agentInfo.DeploymentType.String(),

client/internal/metrics/metrics.go

@@ -63,6 +63,11 @@ type metricsImplementation interface {
 	// RecordLoginDuration records how long the login to management took
 	RecordLoginDuration(ctx context.Context, agentInfo AgentInfo, duration time.Duration, success bool)
 
+	// RecordVNCSessionTick records a periodic snapshot of one VNC
+	// session's wire activity. Called once per metricsConn tick interval
+	// (and once at session close), only when the tick saw activity.
+	RecordVNCSessionTick(ctx context.Context, agentInfo AgentInfo, tick VNCSessionTick)
+
 	// Export exports metrics in InfluxDB line protocol format
 	Export(w io.Writer) error
 
@@ -82,6 +87,21 @@ type ClientMetrics struct {
 	pushCancel context.CancelFunc
 }
 
+// VNCSessionTick is one sampling slice of a VNC session's wire activity.
+// BytesOut / Writes / FBUs / WriteNanos are deltas observed during this
+// tick; Max* fields are the high-water marks observed during the tick.
+// Period is the wall-clock duration the deltas cover.
+type VNCSessionTick struct {
+	Period        time.Duration
+	BytesOut      uint64
+	Writes        uint64
+	FBUs          uint64
+	MaxFBUBytes   uint64
+	MaxFBURects   uint64
+	MaxWriteBytes uint64
+	WriteNanos    uint64
+}
+
 // ConnectionStageTimestamps holds timestamps for each connection stage
 type ConnectionStageTimestamps struct {
 	SignalingReceived  time.Time // First signal received from remote peer (both initial and reconnection)
@@ -131,6 +151,18 @@ func (c *ClientMetrics) RecordSyncDuration(ctx context.Context, duration time.Du
 	c.impl.RecordSyncDuration(ctx, agentInfo, duration)
 }
 
+// RecordVNCSessionTick records a periodic snapshot of one VNC session.
+func (c *ClientMetrics) RecordVNCSessionTick(ctx context.Context, tick VNCSessionTick) {
+	if c == nil {
+		return
+	}
+	c.mu.RLock()
+	agentInfo := c.agentInfo
+	c.mu.RUnlock()
+
+	c.impl.RecordVNCSessionTick(ctx, agentInfo, tick)
+}
+
 // RecordSyncPhase records the duration of a single sub-phase of sync processing
 func (c *ClientMetrics) RecordSyncPhase(ctx context.Context, phase string, duration time.Duration) {
 	if c == nil {

client/internal/metrics/push_test.go

@@ -76,6 +76,9 @@ func (m *mockMetrics) RecordSyncPhase(_ context.Context, _ AgentInfo, _ string,
 func (m *mockMetrics) RecordLoginDuration(_ context.Context, _ AgentInfo, _ time.Duration, _ bool) {
 }
 
+func (m *mockMetrics) RecordVNCSessionTick(_ context.Context, _ AgentInfo, _ VNCSessionTick) {
+}
+
 func (m *mockMetrics) Export(w io.Writer) error {
 	if m.exportData != "" {
 		_, err := w.Write([]byte(m.exportData))

client/internal/peer/conn.go

@@ -203,6 +203,7 @@ func NewConn(config ConnConfig, services ServiceDependencies) (*Conn, error) {
 		statusICE:          worker.NewAtomicStatus(),
 		dumpState:          dumpState,
 		endpointUpdater:    NewEndpointUpdater(connLog, config.WgConfig, isController(config)),
+		wgWatcher:          NewWGWatcher(connLog, config.WgConfig.WgInterface, config.Key, dumpState),
 		metricsRecorder:    services.MetricsRecorder,
 	}
 
@@ -670,12 +671,11 @@ func (conn *Conn) onGuardEvent() {
 	}
 }
 
-func (conn *Conn) onWGDisconnected(watcherCtx context.Context) {
+func (conn *Conn) onWGDisconnected() {
 	conn.mu.Lock()
 	defer conn.mu.Unlock()
 
-	// watcherCtx guards against a stale watcher tearing down a connection that already superseded it.
-	if conn.ctx.Err() != nil || watcherCtx.Err() != nil {
+	if conn.ctx.Err() != nil {
 		return
 	}
 
@@ -833,39 +833,25 @@ func (conn *Conn) isConnectedOnAllWay() (status guard.ConnStatus) {
 	})
 }
 
-// enableWgWatcherIfNeeded starts a fresh watcher instance per connection attempt, so its
-// lifecycle stays bound to conn.mu and enable/disable can't race an old goroutine's shutdown.
-// Caller must hold conn.mu.
 func (conn *Conn) enableWgWatcherIfNeeded(enabledTime time.Time) {
-	if conn.wgWatcher != nil {
+	if !conn.wgWatcher.PrepareInitialHandshake() {
 		return
 	}
 
-	watcher := NewWGWatcher(conn.Log, conn.config.WgConfig.WgInterface, conn.config.Key, conn.dumpState)
-	watcher.PrepareInitialHandshake()
-
 	wgWatcherCtx, wgWatcherCancel := context.WithCancel(conn.ctx)
-	conn.wgWatcher = watcher
 	conn.wgWatcherCancel = wgWatcherCancel
-
 	conn.wgWatcherWg.Add(1)
 	go func() {
 		defer conn.wgWatcherWg.Done()
-		onDisconnected := func() { conn.onWGDisconnected(wgWatcherCtx) }
-		watcher.EnableWgWatcher(wgWatcherCtx, enabledTime, onDisconnected, conn.onWGHandshakeSuccess, conn.onWGCheckSuccess)
+		conn.wgWatcher.EnableWgWatcher(wgWatcherCtx, enabledTime, conn.onWGDisconnected, conn.onWGHandshakeSuccess, conn.onWGCheckSuccess)
 	}()
 }
 
-// disableWgWatcherIfNeeded cancels and drops the watcher once no transport is active. It never
-// waits for the goroutine: the timeout path reentrantly calls back here under conn.mu, so
-// blocking would deadlock. Caller must hold conn.mu.
 func (conn *Conn) disableWgWatcherIfNeeded() {
-	if conn.currentConnPriority != conntype.None || conn.wgWatcher == nil {
-		return
+	if conn.currentConnPriority == conntype.None && conn.wgWatcherCancel != nil {
+		conn.wgWatcherCancel()
+		conn.wgWatcherCancel = nil
 	}
-	conn.wgWatcherCancel()
-	conn.wgWatcher = nil
-	conn.wgWatcherCancel = nil
 }
 
 func (conn *Conn) newProxy(remoteConn net.Conn) (wgproxy.Proxy, error) {
@@ -888,9 +874,7 @@ func (conn *Conn) resetEndpoint() {
 		return
 	}
 	conn.Log.Infof("reset wg endpoint")
-	if conn.wgWatcher != nil {
-		conn.wgWatcher.Reset()
-	}
+	conn.wgWatcher.Reset()
 	if err := conn.endpointUpdater.RemoveEndpointAddress(); err != nil {
 		conn.Log.Warnf("failed to remove endpoint address before update: %v", err)
 	}

client/internal/peer/conn_test.go

@@ -339,20 +339,20 @@ func TestConn_onWGDisconnected_EscalatesToRosenpassReset(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected(conn.ctx)
+		conn.onWGDisconnected()
 	}
 	assert.Empty(t, disconnected, "escalation must not fire below the threshold")
 
-	conn.onWGDisconnected(conn.ctx)
+	conn.onWGDisconnected()
 	assert.Equal(t, []string{conn.config.WgConfig.RemoteKey}, disconnected,
 		"reaching the threshold must report the peer disconnected once")
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected(conn.ctx)
+		conn.onWGDisconnected()
 	}
 	assert.Len(t, disconnected, 1, "escalation must restart counting after firing")
 
-	conn.onWGDisconnected(conn.ctx)
+	conn.onWGDisconnected()
 	assert.Len(t, disconnected, 2, "continued timeouts must escalate again")
 }
 
@@ -364,12 +364,12 @@ func TestConn_onWGDisconnected_CheckSuccessResetsEscalation(t *testing.T) {
 	conn := newWGTimeoutTestConn(true, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected(conn.ctx)
+		conn.onWGDisconnected()
 	}
 	conn.onWGCheckSuccess()
 
 	for i := 0; i < wgTimeoutEscalationThreshold-1; i++ {
-		conn.onWGDisconnected(conn.ctx)
+		conn.onWGDisconnected()
 	}
 	assert.Empty(t, disconnected, "handshake success must reset the timeout count")
 }
@@ -382,7 +382,7 @@ func TestConn_onWGDisconnected_NoEscalationWithoutRosenpass(t *testing.T) {
 	conn := newWGTimeoutTestConn(false, &disconnected)
 
 	for i := 0; i < wgTimeoutEscalationThreshold*3; i++ {
-		conn.onWGDisconnected(conn.ctx)
+		conn.onWGDisconnected()
 	}
 	assert.Empty(t, disconnected, "escalation must be limited to rosenpass connections")
 }

client/internal/peer/status.go

@@ -1335,6 +1335,15 @@ func (d *Status) SubscribeToEvents() *EventSubscription {
 	}
 }
 
+// HasEventSubscribers reports whether any client is currently subscribed
+// to the daemon's SystemEvent stream. Used by the VNC approval broker to
+// fail closed when no UI is connected to prompt the user.
+func (d *Status) HasEventSubscribers() bool {
+	d.eventMux.Lock()
+	defer d.eventMux.Unlock()
+	return len(d.eventStreams) > 0
+}
+
 // UnsubscribeFromEvents removes an event subscription
 func (d *Status) UnsubscribeFromEvents(sub *EventSubscription) {
 	if sub == nil {

client/internal/peer/wg_watcher.go

@@ -3,6 +3,7 @@ package peer
 import (
 	"context"
 	"fmt"
+	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
@@ -23,14 +24,14 @@ type WGInterfaceStater interface {
 	GetStats() (map[string]configurer.WGStats, error)
 }
 
-// WGWatcher is single-shot: one instance per connection attempt, run once, then discarded.
-// Lifecycle is owned by Conn under conn.mu, so it keeps no "enabled" state to go stale.
 type WGWatcher struct {
 	log           *log.Entry
 	wgIfaceStater WGInterfaceStater
 	peerKey       string
 	stateDump     *stateDump
 
+	enabled   bool
+	muEnabled sync.Mutex
 	// initialHandshake is not thread-safe; never call PrepareInitialHandshake and EnableWgWatcher concurrently.
 	initialHandshake time.Time
 
@@ -47,14 +48,25 @@ func NewWGWatcher(log *log.Entry, wgIfaceStater WGInterfaceStater, peerKey strin
 	}
 }
 
-// PrepareInitialHandshake reads the peer's current WireGuard handshake time. It must be
-// called before the peer is (re)configured on the WireGuard interface, so the captured
-// baseline reflects the state prior to this connection attempt instead of racing with
-// that configuration.
-func (w *WGWatcher) PrepareInitialHandshake() {
+// PrepareInitialHandshake reserves the watcher and reads the peer's current WireGuard
+// handshake time. It must be called before the peer is (re)configured on the WireGuard
+// interface, so the captured baseline reflects the state prior to this connection attempt
+// instead of racing with that configuration. Returns ok=false if the watcher is already
+// running, in which case EnableWgWatcher must not be called.
+func (w *WGWatcher) PrepareInitialHandshake() (ok bool) {
+	w.muEnabled.Lock()
+	if w.enabled {
+		w.muEnabled.Unlock()
+		return false
+	}
+
 	w.log.Debugf("enable WireGuard watcher")
+	w.enabled = true
+	w.muEnabled.Unlock()
+
 	handshake, _ := w.wgState()
 	w.initialHandshake = handshake
+	return true
 }
 
 // EnableWgWatcher runs the WireGuard watcher loop using the handshake baseline captured by
@@ -64,6 +76,10 @@ func (w *WGWatcher) PrepareInitialHandshake() {
 // handshake, including the first.
 func (w *WGWatcher) EnableWgWatcher(ctx context.Context, enabledTime time.Time, onDisconnectedFn func(), onHandshakeSuccessFn func(when time.Time), onCheckSuccessFn func()) {
 	w.periodicHandshakeCheck(ctx, onDisconnectedFn, onHandshakeSuccessFn, onCheckSuccessFn, enabledTime, w.initialHandshake)
+
+	w.muEnabled.Lock()
+	w.enabled = false
+	w.muEnabled.Unlock()
 }
 
 // Reset signals the watcher that the WireGuard peer has been reset and a new
@@ -89,7 +105,6 @@ func (w *WGWatcher) periodicHandshakeCheck(ctx context.Context, onDisconnectedFn
 		case <-timer.C:
 			handshake, ok := w.handshakeCheck(lastHandshake)
 			if !ok {
-				// early ctx cancel check return
 				if ctx.Err() != nil {
 					return
 				}
@@ -138,9 +153,9 @@ func (w *WGWatcher) handshakeCheck(lastHandshake time.Time) (*time.Time, bool) {
 
 	w.log.Tracef("previous handshake, handshake: %v, %v", lastHandshake, handshake)
 
-	// the current known handshake did not change
+	// the current know handshake did not change
 	if handshake.Equal(lastHandshake) {
-		w.log.Warnf("WireGuard handshake not updated: %v", handshake)
+		w.log.Warnf("WireGuard handshake timed out: %v", handshake)
 		return nil, false
 	}
 

client/internal/peer/wg_watcher_test.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	log "github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface/configurer"
 )
@@ -61,7 +62,7 @@ func TestWGWatcher_CheckSuccessCallback(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	watcher.PrepareInitialHandshake()
+	require.True(t, watcher.PrepareInitialHandshake())
 
 	firstHandshake := make(chan struct{}, 1)
 	checkSuccess := make(chan struct{}, 1)
@@ -100,7 +101,8 @@ func TestWGWatcher_EnableWgWatcher(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	watcher.PrepareInitialHandshake()
+	ok := watcher.PrepareInitialHandshake()
+	require.True(t, ok, "watcher should not be enabled yet")
 
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {
@@ -130,7 +132,8 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	watcher := NewWGWatcher(mlog, mocWgIface, "", newStateDump("peer", mlog, &Status{}))
 
 	ctx, cancel := context.WithCancel(context.Background())
-	watcher.PrepareInitialHandshake()
+	ok := watcher.PrepareInitialHandshake()
+	require.True(t, ok, "watcher should not be enabled yet")
 
 	wg := &sync.WaitGroup{}
 	wg.Add(1)
@@ -146,7 +149,8 @@ func TestWGWatcher_ReEnable(t *testing.T) {
 	ctx, cancel = context.WithCancel(context.Background())
 	defer cancel()
 
-	watcher.PrepareInitialHandshake()
+	ok = watcher.PrepareInitialHandshake()
+	require.True(t, ok, "watcher should be re-enabled after the previous run stopped")
 
 	onDisconnected := make(chan struct{}, 1)
 	go watcher.EnableWgWatcher(ctx, time.Now(), func() {

client/internal/profilemanager/config.go

@@ -70,6 +70,8 @@ type ConfigInput struct {
 	StateFilePath                 string
 	PreSharedKey                  *string
 	ServerSSHAllowed              *bool
+	ServerVNCAllowed              *bool
+	DisableVNCApproval            *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -123,6 +125,8 @@ type Config struct {
 	RosenpassEnabled              bool
 	RosenpassPermissive           bool
 	ServerSSHAllowed              *bool
+	ServerVNCAllowed              *bool
+	DisableVNCApproval            *bool
 	EnableSSHRoot                 *bool
 	EnableSSHSFTP                 *bool
 	EnableSSHLocalPortForwarding  *bool
@@ -454,6 +458,33 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
+	if input.ServerVNCAllowed != nil {
+		if config.ServerVNCAllowed == nil || *input.ServerVNCAllowed != *config.ServerVNCAllowed {
+			if *input.ServerVNCAllowed {
+				log.Infof("enabling VNC server")
+			} else {
+				log.Infof("disabling VNC server")
+			}
+			config.ServerVNCAllowed = input.ServerVNCAllowed
+			updated = true
+		}
+	} else if config.ServerVNCAllowed == nil {
+		config.ServerVNCAllowed = util.False()
+		updated = true
+	}
+
+	if input.DisableVNCApproval != nil {
+		if config.DisableVNCApproval == nil || *input.DisableVNCApproval != *config.DisableVNCApproval {
+			if *input.DisableVNCApproval {
+				log.Infof("disabling VNC connection approval prompt")
+			} else {
+				log.Infof("enabling VNC connection approval prompt")
+			}
+			config.DisableVNCApproval = input.DisableVNCApproval
+			updated = true
+		}
+	}
+
 	if input.EnableSSHRoot != nil && (config.EnableSSHRoot == nil || *input.EnableSSHRoot != *config.EnableSSHRoot) {
 		if *input.EnableSSHRoot {
 			log.Infof("enabling SSH root login")
@@ -704,6 +735,8 @@ func (config *Config) applyMDMPolicy(policy *mdm.Policy) {
 	}
 
 	applyBool(mdm.KeyAllowServerSSH, func(v bool) { bv := v; config.ServerSSHAllowed = &bv })
+	applyBool(mdm.KeyAllowServerVNC, func(v bool) { bv := v; config.ServerVNCAllowed = &bv })
+	applyBool(mdm.KeyDisableVNCApproval, func(v bool) { bv := v; config.DisableVNCApproval = &bv })
 	applyBool(mdm.KeyDisableClientRoutes, func(v bool) { config.DisableClientRoutes = v })
 	applyBool(mdm.KeyDisableServerRoutes, func(v bool) { config.DisableServerRoutes = v })
 	applyBool(mdm.KeyBlockInbound, func(v bool) { config.BlockInbound = v })

client/internal/profilemanager/config_mdm_test.go

@@ -130,6 +130,36 @@ func TestApply_MDMBoolKeysOverrideOnDiskValue(t *testing.T) {
 	assert.True(t, cfg.Policy().HasKey(mdm.KeyRosenpassEnabled))
 }
 
+func TestApply_MDMVNCKeys(t *testing.T) {
+	tmp := filepath.Join(t.TempDir(), "config.json")
+
+	// Seed without MDM: VNC off, approval prompt on.
+	withMDMPolicy(t, mdm.NewPolicy(nil))
+	_, err := UpdateOrCreateConfig(ConfigInput{
+		ConfigPath:         tmp,
+		ServerVNCAllowed:   boolPtr(false),
+		DisableVNCApproval: boolPtr(false),
+	})
+	require.NoError(t, err)
+
+	// MDM enforces VNC on and disables the approval prompt.
+	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+		mdm.KeyAllowServerVNC:     true,
+		mdm.KeyDisableVNCApproval: true,
+	}))
+
+	cfg, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: tmp})
+	require.NoError(t, err)
+	require.NotNil(t, cfg)
+
+	require.NotNil(t, cfg.ServerVNCAllowed)
+	assert.True(t, *cfg.ServerVNCAllowed, "MDM override should flip on-disk false to true")
+	require.NotNil(t, cfg.DisableVNCApproval)
+	assert.True(t, *cfg.DisableVNCApproval)
+	assert.True(t, cfg.Policy().HasKey(mdm.KeyAllowServerVNC))
+	assert.True(t, cfg.Policy().HasKey(mdm.KeyDisableVNCApproval))
+}
+
 func TestApply_MDMLazyConnection(t *testing.T) {
 	cases := []struct {
 		name string

client/internal/routemanager/dynamic/route.go

@@ -185,7 +185,7 @@ func (r *Route) startResolver(ctx context.Context) {
 }
 
 func (r *Route) update(ctx context.Context) error {
-	resolved, err := r.resolveDomains(ctx)
+	resolved, err := r.resolveDomains()
 	if err != nil {
 		if len(resolved) == 0 {
 			return fmt.Errorf("resolve domains: %w", err)
@@ -199,9 +199,9 @@ func (r *Route) update(ctx context.Context) error {
 	return nil
 }
 
-func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
+func (r *Route) resolveDomains() (domainMap, error) {
 	results := make(chan resolveResult)
-	go r.resolve(ctx, results)
+	go r.resolve(results)
 
 	resolved := domainMap{}
 	var merr *multierror.Error
@@ -217,7 +217,7 @@ func (r *Route) resolveDomains(ctx context.Context) (domainMap, error) {
 	return resolved, nberrors.FormatErrorOrNil(merr)
 }
 
-func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
+func (r *Route) resolve(results chan resolveResult) {
 	var wg sync.WaitGroup
 
 	for _, d := range r.route.Domains {
@@ -225,10 +225,10 @@ func (r *Route) resolve(ctx context.Context, results chan resolveResult) {
 		go func(domain domain.Domain) {
 			defer wg.Done()
 
-			ips, err := r.getIPsFromResolver(ctx, domain)
+			ips, err := r.getIPsFromResolver(domain)
 			if err != nil {
 				log.Tracef("Failed to resolve domain %s with private resolver: %v", domain.SafeString(), err)
-				ips, err = lookupHostIPs(ctx, domain)
+				ips, err = net.LookupIP(domain.PunycodeString())
 				if err != nil {
 					results <- resolveResult{domain: domain, err: fmt.Errorf("resolve d %s: %w", domain.SafeString(), err)}
 					return
@@ -364,20 +364,6 @@ func determinePrefixChanges(oldPrefixes, newPrefixes []netip.Prefix) (toAdd, toR
 	return
 }
 
-// lookupHostIPs resolves d via the system resolver, honoring ctx cancellation.
-func lookupHostIPs(ctx context.Context, d domain.Domain) ([]net.IP, error) {
-	addrs, err := net.DefaultResolver.LookupIPAddr(ctx, d.PunycodeString())
-	if err != nil {
-		return nil, err
-	}
-
-	ips := make([]net.IP, 0, len(addrs))
-	for _, addr := range addrs {
-		ips = append(ips, addr.IP)
-	}
-	return ips, nil
-}
-
 func combinePrefixes(oldPrefixes, removedPrefixes, addedPrefixes []netip.Prefix) []netip.Prefix {
 	prefixSet := make(map[netip.Prefix]struct{})
 	for _, prefix := range oldPrefixes {

client/internal/routemanager/dynamic/route_generic.go

@@ -3,12 +3,11 @@
 package dynamic
 
 import (
-	"context"
 	"net"
 
 	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
-func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
-	return lookupHostIPs(ctx, domain)
+func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
+	return net.LookupIP(domain.PunycodeString())
 }

client/internal/routemanager/dynamic/route_ios.go

@@ -3,7 +3,6 @@
 package dynamic
 
 import (
-	"context"
 	"fmt"
 	"net"
 	"time"
@@ -17,7 +16,7 @@ import (
 
 const dialTimeout = 10 * time.Second
 
-func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([]net.IP, error) {
+func (r *Route) getIPsFromResolver(domain domain.Domain) ([]net.IP, error) {
 	privateClient, err := nbdns.GetClientPrivate(r.wgInterface, r.resolverAddr.Addr(), dialTimeout)
 	if err != nil {
 		return nil, fmt.Errorf("error while creating private client: %s", err)
@@ -33,7 +32,7 @@ func (r *Route) getIPsFromResolver(ctx context.Context, domain domain.Domain) ([
 		msg := new(dns.Msg)
 		msg.SetQuestion(fqdn, qtype)
 
-		response, _, err := nbdns.ExchangeWithFallback(ctx, privateClient, msg, r.resolverAddr.String())
+		response, _, err := nbdns.ExchangeWithFallback(nil, privateClient, msg, r.resolverAddr.String())
 		if err != nil {
 			if queryErr == nil {
 				queryErr = fmt.Errorf("DNS query for %s (type %d) after %s: %w", domain.SafeString(), qtype, time.Since(startTime), err)

client/internal/statemanager/manager.go

@@ -1,7 +1,6 @@
 package statemanager
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -75,6 +74,14 @@ func New(filePath string) *Manager {
 	}
 }
 
+// FilePath returns the path of the underlying state file.
+func (m *Manager) FilePath() string {
+	if m == nil {
+		return ""
+	}
+	return m.filePath
+}
+
 // Start starts the state manager periodic save routine
 func (m *Manager) Start() {
 	if m == nil {
@@ -306,11 +313,6 @@ func (m *Manager) loadStateFile(deleteCorrupt bool) (map[string]json.RawMessage,
 
 	var rawStates map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawStates); err != nil {
-		if len(bytes.TrimSpace(data)) == 0 {
-			log.Warnf("state file %s is empty (%d bytes)", m.filePath, len(data))
-		} else {
-			log.Warnf("state file %s has malformed content (%d bytes)", m.filePath, len(data))
-		}
 		m.handleCorruptedState(deleteCorrupt)
 		return nil, fmt.Errorf("unmarshal states: %w", err)
 	}

client/ios/NetBirdSDK/client.go

@@ -233,9 +233,6 @@ func (c *Client) DebugBundle(anonymize bool) (string, error) {
 		deps.SyncResponse = resp
 
 		if e := cc.Engine(); e != nil {
-			deps.RefreshStatus = func() {
-				e.RunHealthProbes(context.Background(), true)
-			}
 			if cm := e.GetClientMetrics(); cm != nil {
 				deps.ClientMetrics = cm
 			}

client/ios/NetBirdSDK/login.go

@@ -44,25 +44,10 @@ type Auth struct {
 // NewAuth instantiate Auth struct and validate the management URL
 func NewAuth(cfgPath string, mgmURL string) (*Auth, error) {
 	inputCfg := profilemanager.ConfigInput{
-		ConfigPath:    cfgPath,
 		ManagementURL: mgmURL,
 	}
 
-	// Load the existing config when a config file is already present so an
-	// interactive re-login reuses the peer's persisted WireGuard private key
-	// (and thus its identity) instead of generating a fresh one. Generating a
-	// new key registers a brand-new peer on the management server on every
-	// re-auth (named after the fallback hostname). Only fall back to a fresh
-	// in-memory config for the first-time login when no config file exists yet.
-	// DirectUpdateOrCreateConfig uses non-atomic writes so it also works inside
-	// the tvOS App Group sandbox where atomic temp-file+rename is blocked.
-	var cfg *profilemanager.Config
-	var err error
-	if cfgPath != "" {
-		cfg, err = profilemanager.DirectUpdateOrCreateConfig(inputCfg)
-	} else {
-		cfg, err = profilemanager.CreateInMemoryConfig(inputCfg)
-	}
+	cfg, err := profilemanager.CreateInMemoryConfig(inputCfg)
 	if err != nil {
 		return nil, err
 	}

client/mdm/canonical_loaders.go

@@ -21,8 +21,9 @@ var allKeys = []string{
 	KeyBlockInbound,
 	KeyDisableMetricsCollection,
 	KeyAllowServerSSH,
+	KeyAllowServerVNC,
+	KeyDisableVNCApproval,
 	KeyDisableAutoConnect,
-	KeyDisableAutostart,
 	KeyPreSharedKey,
 	KeyRosenpassEnabled,
 	KeyRosenpassPermissive,

client/mdm/policy.go

@@ -36,17 +36,13 @@ const (
 	KeyBlockInbound             = "blockInbound"
 	KeyDisableMetricsCollection = "disableMetricsCollection"
 	KeyAllowServerSSH           = "allowServerSSH"
+	KeyAllowServerVNC           = "allowServerVNC"
+	KeyDisableVNCApproval       = "disableVNCApproval"
 	KeyDisableAutoConnect       = "disableAutoConnect"
-	// KeyDisableAutostart suppresses the GUI's fresh-install
-	// launch-on-login default and marks the Settings toggle as
-	// MDM-managed. UI-only: NOT stored on Config and not applied by
-	// applyMDMPolicy; the GUI reads it directly and it appears in
-	// GetConfigResponse.mDMManagedFields when set.
-	KeyDisableAutostart    = "disableAutostart"
-	KeyPreSharedKey        = "preSharedKey"
-	KeyRosenpassEnabled    = "rosenpassEnabled"
-	KeyRosenpassPermissive = "rosenpassPermissive"
-	KeyWireguardPort       = "wireguardPort"
+	KeyPreSharedKey             = "preSharedKey"
+	KeyRosenpassEnabled         = "rosenpassEnabled"
+	KeyRosenpassPermissive      = "rosenpassPermissive"
+	KeyWireguardPort            = "wireguardPort"
 
 	// Split tunnel is modeled as a single conceptual policy with two
 	// registry/plist values. KeySplitTunnelMode is the discriminator

client/proto/daemon.pb.gw.go

@@ -1099,6 +1099,30 @@ func request_DaemonService_ExposeService_0(ctx context.Context, marshaler runtim
 	return stream, metadata, nil
 }
 
+func request_DaemonService_RespondApproval_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RespondApprovalRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := client.RespondApproval(ctx, &protoReq, grpc.Header(&metadata.HeaderMD), grpc.Trailer(&metadata.TrailerMD))
+	return msg, metadata, err
+}
+
+func local_request_DaemonService_RespondApproval_0(ctx context.Context, marshaler runtime.Marshaler, server DaemonServiceServer, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
+	var (
+		protoReq RespondApprovalRequest
+		metadata runtime.ServerMetadata
+	)
+	if err := marshaler.NewDecoder(req.Body).Decode(&protoReq); err != nil && !errors.Is(err, io.EOF) {
+		return nil, metadata, status.Errorf(codes.InvalidArgument, "%v", err)
+	}
+	msg, err := server.RespondApproval(ctx, &protoReq)
+	return msg, metadata, err
+}
+
 func request_DaemonService_WailsUIReady_0(ctx context.Context, marshaler runtime.Marshaler, client DaemonServiceClient, req *http.Request, pathParams map[string]string) (proto.Message, runtime.ServerMetadata, error) {
 	var (
 		protoReq WailsUIReadyRequest
@@ -1977,6 +2001,26 @@ func RegisterDaemonServiceHandlerServer(ctx context.Context, mux *runtime.ServeM
 		runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
 		return
 	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RespondApproval_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		var stream runtime.ServerTransportStream
+		ctx = grpc.NewContextWithServerTransportStream(ctx, &stream)
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateIncomingContext(ctx, mux, req, "/daemon.DaemonService/RespondApproval", runtime.WithHTTPPathPattern("/daemon.DaemonService/RespondApproval"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := local_request_DaemonService_RespondApproval_0(annotatedContext, inboundMarshaler, server, req, pathParams)
+		md.HeaderMD, md.TrailerMD = metadata.Join(md.HeaderMD, stream.Header()), metadata.Join(md.TrailerMD, stream.Trailer())
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RespondApproval_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	mux.Handle(http.MethodPost, pattern_DaemonService_WailsUIReady_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -2802,6 +2846,23 @@ func RegisterDaemonServiceHandlerClient(ctx context.Context, mux *runtime.ServeM
 		}
 		forward_DaemonService_ExposeService_0(annotatedContext, mux, outboundMarshaler, w, req, func() (proto.Message, error) { return resp.Recv() }, mux.GetForwardResponseOptions()...)
 	})
+	mux.Handle(http.MethodPost, pattern_DaemonService_RespondApproval_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
+		ctx, cancel := context.WithCancel(req.Context())
+		defer cancel()
+		inboundMarshaler, outboundMarshaler := runtime.MarshalerForRequest(mux, req)
+		annotatedContext, err := runtime.AnnotateContext(ctx, mux, req, "/daemon.DaemonService/RespondApproval", runtime.WithHTTPPathPattern("/daemon.DaemonService/RespondApproval"))
+		if err != nil {
+			runtime.HTTPError(ctx, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		resp, md, err := request_DaemonService_RespondApproval_0(annotatedContext, inboundMarshaler, client, req, pathParams)
+		annotatedContext = runtime.NewServerMetadataContext(annotatedContext, md)
+		if err != nil {
+			runtime.HTTPError(annotatedContext, mux, outboundMarshaler, w, req, err)
+			return
+		}
+		forward_DaemonService_RespondApproval_0(annotatedContext, mux, outboundMarshaler, w, req, resp, mux.GetForwardResponseOptions()...)
+	})
 	mux.Handle(http.MethodPost, pattern_DaemonService_WailsUIReady_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
 		ctx, cancel := context.WithCancel(req.Context())
 		defer cancel()
@@ -2868,6 +2929,7 @@ var (
 	pattern_DaemonService_StopCPUProfile_0             = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "StopCPUProfile"}, ""))
 	pattern_DaemonService_GetInstallerResult_0         = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "GetInstallerResult"}, ""))
 	pattern_DaemonService_ExposeService_0              = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "ExposeService"}, ""))
+	pattern_DaemonService_RespondApproval_0            = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "RespondApproval"}, ""))
 	pattern_DaemonService_WailsUIReady_0               = runtime.MustPattern(runtime.NewPattern(1, []int{2, 0, 2, 1}, []string{"daemon.DaemonService", "WailsUIReady"}, ""))
 )
 
@@ -2917,5 +2979,6 @@ var (
 	forward_DaemonService_StopCPUProfile_0             = runtime.ForwardResponseMessage
 	forward_DaemonService_GetInstallerResult_0         = runtime.ForwardResponseMessage
 	forward_DaemonService_ExposeService_0              = runtime.ForwardResponseStream
+	forward_DaemonService_RespondApproval_0            = runtime.ForwardResponseMessage
 	forward_DaemonService_WailsUIReady_0               = runtime.ForwardResponseMessage
 )

client/proto/daemon.proto

@@ -152,6 +152,14 @@ service DaemonService {
   // ExposeService exposes a local port via the NetBird reverse proxy
   rpc ExposeService(ExposeServiceRequest) returns (stream ExposeServiceEvent) {}
 
+  // RespondApproval delivers the user's accept/deny decision for a
+  // pending user-approval prompt. The daemon pushes the prompt as a
+  // SystemEvent with category APPROVAL and metadata key "request_id";
+  // the UI calls this RPC with the same request_id to unblock whichever
+  // subsystem (VNC, SSH, ...) is waiting. The "kind" metadata key tells
+  // the UI which subsystem the prompt belongs to.
+  rpc RespondApproval(RespondApprovalRequest) returns (RespondApprovalResponse) {}
+
   // WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
   // only cares whether the daemon implements it: an Unimplemented response
   // means the daemon predates this UI and is too old to drive it.
@@ -242,6 +250,10 @@ message LoginRequest {
   optional bool disableSSHAuth = 38;
   optional int32 sshJWTCacheTTL = 39;
   optional bool disable_ipv6 = 40;
+
+  optional bool serverVNCAllowed = 41;
+
+  optional bool disableVNCApproval = 42;
 }
 
 message LoginResponse {
@@ -362,12 +374,16 @@ message GetConfigResponse {
 
   bool disable_ipv6 = 27;
 
+  bool serverVNCAllowed = 28;
+
+  bool disableVNCApproval = 29;
+
   // mDMManagedFields lists the names of configuration keys whose value is
   // currently enforced by an MDM policy. Names match mdm.Key* constants
   // (e.g. "managementURL", "disableClientRoutes"). UI/CLI clients should
   // render the corresponding inputs as read-only and display a "managed
   // by MDM" indicator.
-  repeated string mDMManagedFields = 28;
+  repeated string mDMManagedFields = 30;
 }
 
 // PeerState contains the latest state of a peer
@@ -452,6 +468,25 @@ message SSHServerState {
   repeated SSHSessionInfo sessions = 2;
 }
 
+// VNCSessionInfo contains information about an active VNC session
+message VNCSessionInfo {
+  string remoteAddress = 1;
+  string mode = 2;
+  string username = 3;
+  // userID is the Noise-verified session identity (hashed user ID from
+  // the ACL session-key entry), empty when auth is disabled.
+  string userID = 4;
+  // initiator is the human-readable display name of the dashboard user
+  // who minted the SessionPubKey, when known.
+  string initiator = 5;
+}
+
+// VNCServerState contains the latest state of the VNC server
+message VNCServerState {
+  bool enabled = 1;
+  repeated VNCSessionInfo sessions = 2;
+}
+
 // FullStatus contains the full state held by the Status instance
 message FullStatus {
   ManagementState managementState = 1;
@@ -472,6 +507,7 @@ message FullStatus {
   // on it to know when to re-fetch ListNetworks via the push stream, instead
   // of polling on every status snapshot.
   uint64 networksRevision = 11;
+  VNCServerState vncServerState = 12;
 }
 
 // Networks
@@ -667,6 +703,7 @@ message SystemEvent {
     AUTHENTICATION = 2;
     CONNECTIVITY = 3;
     SYSTEM = 4;
+    APPROVAL = 5;
   }
 
   string id = 1;
@@ -757,6 +794,10 @@ message SetConfigRequest {
   optional bool disableSSHAuth = 33;
   optional int32 sshJWTCacheTTL = 34;
   optional bool disable_ipv6 = 35;
+
+  optional bool serverVNCAllowed = 36;
+
+  optional bool disableVNCApproval = 37;
 }
 
 message SetConfigResponse{}
@@ -1046,3 +1087,18 @@ message StartBundleCaptureRequest {
 message StartBundleCaptureResponse {}
 message StopBundleCaptureRequest {}
 message StopBundleCaptureResponse {}
+
+message RespondApprovalRequest {
+  // request_id matches the SystemEvent metadata key emitted by the daemon
+  // when a subsystem awaits user approval for an inbound connection.
+  string request_id = 1;
+  // accept is true if the user approved the request, false if they
+  // denied it. A missing or unknown request_id is treated as a no-op.
+  bool accept = 2;
+  // view_only signals that the user granted the connection but withheld
+  // input control. Only meaningful when accept is true; ignored when
+  // accept is false.
+  bool view_only = 3;
+}
+
+message RespondApprovalResponse {}

client/proto/daemon_grpc.pb.go

@@ -64,6 +64,7 @@ const (
 	DaemonService_StopCPUProfile_FullMethodName             = "/daemon.DaemonService/StopCPUProfile"
 	DaemonService_GetInstallerResult_FullMethodName         = "/daemon.DaemonService/GetInstallerResult"
 	DaemonService_ExposeService_FullMethodName              = "/daemon.DaemonService/ExposeService"
+	DaemonService_RespondApproval_FullMethodName            = "/daemon.DaemonService/RespondApproval"
 	DaemonService_WailsUIReady_FullMethodName               = "/daemon.DaemonService/WailsUIReady"
 )
 
@@ -167,6 +168,13 @@ type DaemonServiceClient interface {
 	GetInstallerResult(ctx context.Context, in *InstallerResultRequest, opts ...grpc.CallOption) (*InstallerResultResponse, error)
 	// ExposeService exposes a local port via the NetBird reverse proxy
 	ExposeService(ctx context.Context, in *ExposeServiceRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ExposeServiceEvent], error)
+	// RespondApproval delivers the user's accept/deny decision for a
+	// pending user-approval prompt. The daemon pushes the prompt as a
+	// SystemEvent with category APPROVAL and metadata key "request_id";
+	// the UI calls this RPC with the same request_id to unblock whichever
+	// subsystem (VNC, SSH, ...) is waiting. The "kind" metadata key tells
+	// the UI which subsystem the prompt belongs to.
+	RespondApproval(ctx context.Context, in *RespondApprovalRequest, opts ...grpc.CallOption) (*RespondApprovalResponse, error)
 	// WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
 	// only cares whether the daemon implements it: an Unimplemented response
 	// means the daemon predates this UI and is too old to drive it.
@@ -667,6 +675,16 @@ func (c *daemonServiceClient) ExposeService(ctx context.Context, in *ExposeServi
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type DaemonService_ExposeServiceClient = grpc.ServerStreamingClient[ExposeServiceEvent]
 
+func (c *daemonServiceClient) RespondApproval(ctx context.Context, in *RespondApprovalRequest, opts ...grpc.CallOption) (*RespondApprovalResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RespondApprovalResponse)
+	err := c.cc.Invoke(ctx, DaemonService_RespondApproval_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *daemonServiceClient) WailsUIReady(ctx context.Context, in *WailsUIReadyRequest, opts ...grpc.CallOption) (*WailsUIReadyResponse, error) {
 	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
 	out := new(WailsUIReadyResponse)
@@ -777,6 +795,13 @@ type DaemonServiceServer interface {
 	GetInstallerResult(context.Context, *InstallerResultRequest) (*InstallerResultResponse, error)
 	// ExposeService exposes a local port via the NetBird reverse proxy
 	ExposeService(*ExposeServiceRequest, grpc.ServerStreamingServer[ExposeServiceEvent]) error
+	// RespondApproval delivers the user's accept/deny decision for a
+	// pending user-approval prompt. The daemon pushes the prompt as a
+	// SystemEvent with category APPROVAL and metadata key "request_id";
+	// the UI calls this RPC with the same request_id to unblock whichever
+	// subsystem (VNC, SSH, ...) is waiting. The "kind" metadata key tells
+	// the UI which subsystem the prompt belongs to.
+	RespondApproval(context.Context, *RespondApprovalRequest) (*RespondApprovalResponse, error)
 	// WailsUIReady is a no-op probe the Wails UI calls once at startup. The UI
 	// only cares whether the daemon implements it: an Unimplemented response
 	// means the daemon predates this UI and is too old to drive it.
@@ -926,6 +951,9 @@ func (UnimplementedDaemonServiceServer) GetInstallerResult(context.Context, *Ins
 func (UnimplementedDaemonServiceServer) ExposeService(*ExposeServiceRequest, grpc.ServerStreamingServer[ExposeServiceEvent]) error {
 	return status.Error(codes.Unimplemented, "method ExposeService not implemented")
 }
+func (UnimplementedDaemonServiceServer) RespondApproval(context.Context, *RespondApprovalRequest) (*RespondApprovalResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RespondApproval not implemented")
+}
 func (UnimplementedDaemonServiceServer) WailsUIReady(context.Context, *WailsUIReadyRequest) (*WailsUIReadyResponse, error) {
 	return nil, status.Error(codes.Unimplemented, "method WailsUIReady not implemented")
 }
@@ -1732,6 +1760,24 @@ func _DaemonService_ExposeService_Handler(srv interface{}, stream grpc.ServerStr
 // This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
 type DaemonService_ExposeServiceServer = grpc.ServerStreamingServer[ExposeServiceEvent]
 
+func _DaemonService_RespondApproval_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RespondApprovalRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServiceServer).RespondApproval(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: DaemonService_RespondApproval_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServiceServer).RespondApproval(ctx, req.(*RespondApprovalRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 func _DaemonService_WailsUIReady_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
 	in := new(WailsUIReadyRequest)
 	if err := dec(in); err != nil {
@@ -1921,6 +1967,10 @@ var DaemonService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "GetInstallerResult",
 			Handler:    _DaemonService_GetInstallerResult_Handler,
 		},
+		{
+			MethodName: "RespondApproval",
+			Handler:    _DaemonService_RespondApproval_Handler,
+		},
 		{
 			MethodName: "WailsUIReady",
 			Handler:    _DaemonService_WailsUIReady_Handler,

client/server/capture.go

@@ -111,7 +111,7 @@ func (s *Server) StartCapture(req *proto.StartCaptureRequest, stream proto.Daemo
 		return status.Errorf(codes.Internal, "create capture session: %v", err)
 	}
 
-	engine, err := s.claimCapture(sess)
+	engine, err := s.claimCapture(sess, func() { pw.Close() })
 	if err != nil {
 		sess.Stop()
 		pw.Close()
@@ -190,10 +190,7 @@ func (s *Server) StartBundleCapture(_ context.Context, req *proto.StartBundleCap
 
 	s.stopBundleCaptureLocked()
 	s.cleanupBundleCapture()
-
-	if s.activeCapture != nil {
-		return nil, status.Error(codes.FailedPrecondition, "another capture is already running")
-	}
+	s.evictActiveCaptureLocked()
 
 	engine, err := s.getCaptureEngineLocked()
 	if err != nil {
@@ -304,29 +301,58 @@ func (s *Server) cleanupBundleCapture() {
 	s.bundleCapture = nil
 }
 
-// claimCapture reserves the engine's capture slot for sess. Returns
-// FailedPrecondition if another capture is already active.
-func (s *Server) claimCapture(sess *capture.Session) (*internal.Engine, error) {
+// claimCapture reserves the engine's capture slot for sess. If another
+// capture is already running it is evicted: a previous streaming session
+// whose gRPC client died and never freed the slot stays stuck otherwise,
+// and a bundle capture is just informational state.
+func (s *Server) claimCapture(sess *capture.Session, cancel func()) (*internal.Engine, error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	if s.activeCapture != nil {
-		return nil, status.Error(codes.FailedPrecondition, "another capture is already running")
-	}
+	s.evictActiveCaptureLocked()
 	engine, err := s.getCaptureEngineLocked()
 	if err != nil {
 		return nil, err
 	}
 	s.activeCapture = sess
+	s.activeCaptureCancel = cancel
 	return engine, nil
 }
 
+// evictActiveCaptureLocked tears down whatever capture currently owns
+// the engine slot so a fresh claim can succeed. Caller must hold mutex.
+func (s *Server) evictActiveCaptureLocked() {
+	if s.activeCapture == nil {
+		return
+	}
+	if s.bundleCapture != nil && s.bundleCapture.sess == s.activeCapture {
+		log.Infof("evicting running bundle capture to start a new capture")
+		s.stopBundleCaptureLocked()
+		return
+	}
+	log.Infof("evicting previous streaming capture to start a new one")
+	prev := s.activeCapture
+	cancel := s.activeCaptureCancel
+	if engine, err := s.getCaptureEngineLocked(); err == nil {
+		if err := engine.SetCapture(nil); err != nil {
+			log.Debugf("clear previous capture: %v", err)
+		}
+	}
+	s.activeCapture = nil
+	s.activeCaptureCancel = nil
+	prev.Stop()
+	if cancel != nil {
+		cancel()
+	}
+}
+
 // releaseCapture clears the active-capture owner if it still matches sess.
 func (s *Server) releaseCapture(sess *capture.Session) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 	if s.activeCapture == sess {
 		s.activeCapture = nil
+		s.activeCaptureCancel = nil
 	}
 }
 
@@ -341,6 +367,7 @@ func (s *Server) clearCaptureIfOwner(sess *capture.Session, engine *internal.Eng
 		log.Debugf("clear capture: %v", err)
 	}
 	s.activeCapture = nil
+	s.activeCaptureCancel = nil
 }
 
 func (s *Server) getCaptureEngineLocked() (*internal.Engine, error) {

client/server/mdm.go

@@ -297,6 +297,8 @@ func mdmManagedFieldConflicts(msg *proto.SetConfigRequest, policy *mdm.Policy) [
 		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
 		conflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
 		conflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
+		conflictBool(mdm.KeyAllowServerVNC, msg.ServerVNCAllowed),
+		conflictBool(mdm.KeyDisableVNCApproval, msg.DisableVNCApproval),
 		conflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
 		conflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
 		conflictBool(mdm.KeyBlockInbound, msg.BlockInbound),
@@ -332,6 +334,8 @@ func setConfigRequestHasConfigOverrides(msg *proto.SetConfigRequest) bool {
 		msg.Mtu != nil ||
 		msg.DisableAutoConnect != nil ||
 		msg.ServerSSHAllowed != nil ||
+		msg.ServerVNCAllowed != nil ||
+		msg.DisableVNCApproval != nil ||
 		msg.NetworkMonitor != nil ||
 		msg.DisableClientRoutes != nil ||
 		msg.DisableServerRoutes != nil ||
@@ -370,6 +374,8 @@ func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
 		msg.WireguardPort != nil ||
 		msg.DisableAutoConnect != nil ||
 		msg.ServerSSHAllowed != nil ||
+		msg.ServerVNCAllowed != nil ||
+		msg.DisableVNCApproval != nil ||
 		msg.RosenpassPermissive != nil ||
 		len(msg.ExtraIFaceBlacklist) > 0 ||
 		msg.NetworkMonitor != nil ||
@@ -418,6 +424,8 @@ func loginRequestMDMConflicts(msg *proto.LoginRequest, policy *mdm.Policy) []str
 		conflictBool(mdm.KeyRosenpassPermissive, msg.RosenpassPermissive),
 		conflictBool(mdm.KeyDisableAutoConnect, msg.DisableAutoConnect),
 		conflictBool(mdm.KeyAllowServerSSH, msg.ServerSSHAllowed),
+		conflictBool(mdm.KeyAllowServerVNC, msg.ServerVNCAllowed),
+		conflictBool(mdm.KeyDisableVNCApproval, msg.DisableVNCApproval),
 		conflictBool(mdm.KeyDisableClientRoutes, msg.DisableClientRoutes),
 		conflictBool(mdm.KeyDisableServerRoutes, msg.DisableServerRoutes),
 		conflictBool(mdm.KeyBlockInbound, msg.BlockInbound),

client/server/server.go

@@ -113,8 +113,12 @@ type Server struct {
 	captureEnabled         bool
 	bundleCapture          *bundleCapture
 	// activeCapture is the session currently installed on the engine; guarded by s.mutex.
-	activeCapture    *capture.Session
-	networksDisabled bool
+	activeCapture *capture.Session
+	// activeCaptureCancel tears down the streaming pipe/cancel for the
+	// active streaming capture so eviction unblocks the StartCapture RPC
+	// handler. Nil for bundle captures (they own their own context).
+	activeCaptureCancel func()
+	networksDisabled    bool
 
 	sleepHandler *sleephandler.SleepHandler
 
@@ -181,7 +185,7 @@ func (s *Server) Start() error {
 		log.Warnf("failed to redirect stderr: %v", err)
 	}
 
-	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -492,6 +496,8 @@ func (s *Server) setConfigInputFromRequest(msg *proto.SetConfigRequest) (profile
 	config.RosenpassPermissive = msg.RosenpassPermissive
 	config.DisableAutoConnect = msg.DisableAutoConnect
 	config.ServerSSHAllowed = msg.ServerSSHAllowed
+	config.ServerVNCAllowed = msg.ServerVNCAllowed
+	config.DisableVNCApproval = msg.DisableVNCApproval
 	config.NetworkMonitor = msg.NetworkMonitor
 	config.DisableClientRoutes = msg.DisableClientRoutes
 	config.DisableServerRoutes = msg.DisableServerRoutes
@@ -551,7 +557,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.actCancel = cancel
 	s.mutex.Unlock()
 
-	if err := RestoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -858,7 +864,7 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 
 		return s.waitForUp(callerCtx)
 	}
-	if err := RestoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := restoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
@@ -1081,10 +1087,7 @@ func (s *Server) Down(ctx context.Context, _ *proto.DownRequest) (*proto.DownRes
 
 	if err := s.cleanupConnection(); err != nil {
 		s.mutex.Unlock()
-		if errors.Is(err, ErrServiceNotUp) {
-			log.Debugf("Down called while service not up: %v", err)
-			return nil, err
-		}
+		// todo review to update the status in case any type of error
 		log.Errorf("failed to shut down properly: %v", err)
 		return nil, err
 	}
@@ -1157,7 +1160,7 @@ func (s *Server) cleanupConnection() error {
 	// making the run loop the sole owner of engine shutdown.
 	if engine != nil {
 		if err := engine.Stop(); err != nil {
-			log.Errorf("failed to stop engine during cleanup: %v", err)
+			return err
 		}
 	}
 
@@ -1440,6 +1443,7 @@ func (s *Server) buildStatusResponse(ctx context.Context, msg *proto.StatusReque
 		pbFullStatus := fullStatus.ToProto()
 		pbFullStatus.Events = s.statusRecorder.GetEventHistory()
 		pbFullStatus.SshServerState = s.getSSHServerState()
+		pbFullStatus.VncServerState = s.getVNCServerState()
 		pbFullStatus.NetworksRevision = s.statusRecorder.GetNetworksRevision()
 		statusResponse.FullStatus = pbFullStatus
 	}
@@ -1480,6 +1484,38 @@ func (s *Server) getSSHServerState() *proto.SSHServerState {
 	return sshServerState
 }
 
+// getVNCServerState retrieves the current VNC server state.
+func (s *Server) getVNCServerState() *proto.VNCServerState {
+	s.mutex.Lock()
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+
+	if connectClient == nil {
+		return nil
+	}
+
+	engine := connectClient.Engine()
+	if engine == nil {
+		return nil
+	}
+
+	enabled, sessions := engine.GetVNCServerStatus()
+	pbSessions := make([]*proto.VNCSessionInfo, 0, len(sessions))
+	for _, sess := range sessions {
+		pbSessions = append(pbSessions, &proto.VNCSessionInfo{
+			RemoteAddress: sess.RemoteAddress,
+			Mode:          sess.Mode,
+			Username:      sess.Username,
+			UserID:        sess.UserID,
+			Initiator:     sess.Initiator,
+		})
+	}
+	return &proto.VNCServerState{
+		Enabled:  enabled,
+		Sessions: pbSessions,
+	}
+}
+
 // GetPeerSSHHostKey retrieves SSH host key for a specific peer
 func (s *Server) GetPeerSSHHostKey(
 	ctx context.Context,
@@ -1865,6 +1901,30 @@ func (s *Server) ExposeService(req *proto.ExposeServiceRequest, srv proto.Daemon
 	return nil
 }
 
+// RespondApproval relays the user's accept/deny decision for a pending
+// approval prompt to the engine's broker. Unknown or already-resolved
+// request_ids are silently no-op'd so a slow UI cannot deny a prompt the
+// user already handled (or that already timed out).
+func (s *Server) RespondApproval(_ context.Context, msg *proto.RespondApprovalRequest) (*proto.RespondApprovalResponse, error) {
+	if msg.GetRequestId() == "" {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "request_id is required")
+	}
+	s.mutex.Lock()
+	connectClient := s.connectClient
+	s.mutex.Unlock()
+	if connectClient == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "client not initialized")
+	}
+	engine := connectClient.Engine()
+	if engine == nil {
+		return nil, gstatus.Errorf(codes.FailedPrecondition, "engine not running")
+	}
+	if !engine.RespondApproval(msg.GetRequestId(), msg.GetAccept(), msg.GetViewOnly()) {
+		log.Debugf("approval response for unknown request_id %s", msg.GetRequestId())
+	}
+	return &proto.RespondApprovalResponse{}, nil
+}
+
 func isUnixRunningDesktop() bool {
 	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {
 		return false
@@ -1972,6 +2032,8 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		Mtu:                           int64(cfg.MTU),
 		DisableAutoConnect:            cfg.DisableAutoConnect,
 		ServerSSHAllowed:              *cfg.ServerSSHAllowed,
+		ServerVNCAllowed:              cfg.ServerVNCAllowed != nil && *cfg.ServerVNCAllowed,
+		DisableVNCApproval:            cfg.DisableVNCApproval != nil && *cfg.DisableVNCApproval,
 		RosenpassEnabled:              cfg.RosenpassEnabled,
 		RosenpassPermissive:           cfg.RosenpassPermissive,
 		BlockInbound:                  cfg.BlockInbound,

client/server/setconfig_mdm_test.go

@@ -105,6 +105,30 @@ func TestSetConfig_MDMReject_SingleField(t *testing.T) {
 	assert.Equal(t, []string{mdm.KeyManagementURL}, v.GetFields())
 }
 
+func TestSetConfig_MDMReject_VNCFields(t *testing.T) {
+	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
+		mdm.KeyAllowServerVNC:     true,
+		mdm.KeyDisableVNCApproval: false,
+	}))
+
+	s, ctx, profName, username, _ := setupServerWithProfile(t)
+
+	vncAllowed := false
+	disableApproval := true
+	_, err := s.SetConfig(ctx, &proto.SetConfigRequest{
+		ProfileName:        profName,
+		Username:           username,
+		ServerVNCAllowed:   &vncAllowed,
+		DisableVNCApproval: &disableApproval,
+	})
+
+	v := extractViolation(t, err)
+	assert.ElementsMatch(t, []string{
+		mdm.KeyAllowServerVNC,
+		mdm.KeyDisableVNCApproval,
+	}, v.GetFields())
+}
+
 func TestSetConfig_MDMReject_MultipleFields(t *testing.T) {
 	withMDMPolicy(t, mdm.NewPolicy(map[string]any{
 		mdm.KeyManagementURL:    "https://mdm.example.com:443",

client/server/setconfig_test.go

@@ -58,6 +58,8 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	rosenpassEnabled := true
 	rosenpassPermissive := true
 	serverSSHAllowed := true
+	serverVNCAllowed := true
+	disableVNCApproval := true
 	interfaceName := "utun100"
 	wireguardPort := int64(51820)
 	preSharedKey := "test-psk"
@@ -82,6 +84,8 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 		RosenpassEnabled:     &rosenpassEnabled,
 		RosenpassPermissive:  &rosenpassPermissive,
 		ServerSSHAllowed:     &serverSSHAllowed,
+		ServerVNCAllowed:     &serverVNCAllowed,
+		DisableVNCApproval:   &disableVNCApproval,
 		InterfaceName:        &interfaceName,
 		WireguardPort:        &wireguardPort,
 		OptionalPreSharedKey: &preSharedKey,
@@ -125,6 +129,10 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.Equal(t, rosenpassPermissive, cfg.RosenpassPermissive)
 	require.NotNil(t, cfg.ServerSSHAllowed)
 	require.Equal(t, serverSSHAllowed, *cfg.ServerSSHAllowed)
+	require.NotNil(t, cfg.ServerVNCAllowed)
+	require.Equal(t, serverVNCAllowed, *cfg.ServerVNCAllowed)
+	require.NotNil(t, cfg.DisableVNCApproval)
+	require.Equal(t, disableVNCApproval, *cfg.DisableVNCApproval)
 	require.Equal(t, interfaceName, cfg.WgIface)
 	require.Equal(t, int(wireguardPort), cfg.WgPort)
 	require.Equal(t, preSharedKey, cfg.PreSharedKey)
@@ -177,6 +185,8 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"RosenpassEnabled":              true,
 		"RosenpassPermissive":           true,
 		"ServerSSHAllowed":              true,
+		"ServerVNCAllowed":              true,
+		"DisableVNCApproval":            true,
 		"InterfaceName":                 true,
 		"WireguardPort":                 true,
 		"OptionalPreSharedKey":          true,
@@ -237,6 +247,8 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 		"enable-rosenpass":                  "RosenpassEnabled",
 		"rosenpass-permissive":              "RosenpassPermissive",
 		"allow-server-ssh":                  "ServerSSHAllowed",
+		"allow-server-vnc":                  "ServerVNCAllowed",
+		"disable-vnc-approval":              "DisableVNCApproval",
 		"interface-name":                    "InterfaceName",
 		"wireguard-port":                    "WireguardPort",
 		"preshared-key":                     "OptionalPreSharedKey",

client/server/state.go

@@ -46,7 +46,7 @@ func (s *Server) CleanState(ctx context.Context, req *proto.CleanStateRequest) (
 
 	if req.All {
 		// Reuse existing cleanup logic for all states
-		if err := RestoreResidualState(ctx, statePath); err != nil {
+		if err := restoreResidualState(ctx, statePath); err != nil {
 			return nil, status.Errorf(codes.Internal, "failed to clean all states: %v", err)
 		}
 
@@ -113,9 +113,9 @@ func (s *Server) DeleteState(ctx context.Context, req *proto.DeleteStateRequest)
 	}, nil
 }
 
-// RestoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
+// restoreResidualState checks if the client was not shut down in a clean way and restores residual if required.
 // Otherwise, we might not be able to connect to the management server to retrieve new config.
-func RestoreResidualState(ctx context.Context, statePath string) error {
+func restoreResidualState(ctx context.Context, statePath string) error {
 	if statePath == "" {
 		return nil
 	}

client/ssh/config/manager.go

@@ -14,7 +14,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	nbssh "github.com/netbirdio/netbird/client/ssh"
-	"github.com/netbirdio/netbird/shared/management/domain"
 )
 
 const (
@@ -219,20 +218,11 @@ func (m *Manager) buildHostPatterns(peer PeerSSHInfo) []string {
 	if peer.IPv6.IsValid() {
 		hostPatterns = append(hostPatterns, peer.IPv6.String())
 	}
-	// Peer FQDNs and hostnames originate from remote peers, so they must be
-	// validated as plain DNS names before being embedded in the ssh_config
-	// "Match host" pattern list. This prevents injection of arbitrary
-	// ssh_config directives via embedded quotes, whitespace, newlines, the
-	// comma pattern separator, or the "*"/"?" pattern metacharacters.
-	if domain.IsValidDomainNoWildcard(peer.FQDN) {
+	if peer.FQDN != "" {
 		hostPatterns = append(hostPatterns, peer.FQDN)
-	} else if peer.FQDN != "" {
-		log.Warnf("skipping peer FQDN with invalid characters in SSH config: %q", peer.FQDN)
 	}
-	if peer.Hostname != peer.FQDN && domain.IsValidDomainNoWildcard(peer.Hostname) {
+	if peer.Hostname != "" && peer.Hostname != peer.FQDN {
 		hostPatterns = append(hostPatterns, peer.Hostname)
-	} else if peer.Hostname != "" && peer.Hostname != peer.FQDN {
-		log.Warnf("skipping peer hostname with invalid characters in SSH config: %q", peer.Hostname)
 	}
 	return hostPatterns
 }

client/ssh/config/manager_test.go

@@ -148,45 +148,6 @@ func TestManager_MatchHostFormat(t *testing.T) {
 		"should use Match host with comma-separated patterns")
 }
 
-func TestManager_HostPatternInjection(t *testing.T) {
-	tempDir, err := os.MkdirTemp("", "netbird-ssh-config-test")
-	require.NoError(t, err)
-	defer func() { assert.NoError(t, os.RemoveAll(tempDir)) }()
-
-	manager := &Manager{
-		sshConfigDir:  filepath.Join(tempDir, "ssh_config.d"),
-		sshConfigFile: "99-netbird.conf",
-	}
-
-	// A malicious peer FQDN/hostname attempts to break out of the Match host
-	// directive and inject arbitrary ssh_config (a ProxyCommand executing a
-	// command). It must be rejected, not written to the config.
-	peers := []PeerSSHInfo{
-		{
-			Hostname: "evil\"\n    ProxyCommand touch /tmp/pwned\nHost x",
-			IP:       netip.MustParseAddr("100.125.1.1"),
-			FQDN:     "evil\"\n    ProxyCommand touch /tmp/pwned\nHost x.nb.internal",
-		},
-		{Hostname: "peer2", IP: netip.MustParseAddr("100.125.1.2"), FQDN: "peer2.nb.internal"},
-	}
-
-	err = manager.SetupSSHClientConfig(peers)
-	require.NoError(t, err)
-
-	configPath := filepath.Join(manager.sshConfigDir, manager.sshConfigFile)
-	content, err := os.ReadFile(configPath)
-	require.NoError(t, err)
-	configStr := string(content)
-
-	assert.NotContains(t, configStr, "ProxyCommand touch /tmp/pwned",
-		"injected directive must not appear in generated config")
-	assert.NotContains(t, configStr, "evil",
-		"malicious pattern must be dropped entirely")
-	// The valid peer must still be present, on a single Match host line.
-	assert.Contains(t, configStr, "Match host \"100.125.1.1,100.125.1.2,peer2.nb.internal,peer2\"",
-		"valid peers must survive, injected patterns dropped")
-}
-
 func TestManager_ForcedSSHConfig(t *testing.T) {
 	// Set force environment variable
 	t.Setenv(EnvForceSSHConfig, "true")

client/ssh/proxy/proxy_privileged_test.go

@@ -26,10 +26,10 @@ import (
 	cryptossh "golang.org/x/crypto/ssh"
 
 	nbssh "github.com/netbirdio/netbird/client/ssh"
-	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	"github.com/netbirdio/netbird/client/ssh/server"
 	"github.com/netbirdio/netbird/client/ssh/testutil"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
+	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
 	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
 )
 

client/ssh/server/getent_unix.go

@@ -69,8 +69,7 @@ func parseGetentPasswd(output string) (*user.User, string, error) {
 
 // validateGetentInput checks that the input is safe to pass to getent or id.
 // Allows POSIX usernames, numeric UIDs, and common NSS extensions
-// (@ for Kerberos, $ for Samba, + for NIS compat). A leading hyphen is
-// rejected so the input can never be parsed as a command-line flag.
+// (@ for Kerberos, $ for Samba, + for NIS compat).
 func validateGetentInput(input string) bool {
 	maxLen := 32
 	if runtime.GOOS == "linux" {
@@ -81,10 +80,6 @@ func validateGetentInput(input string) bool {
 		return false
 	}
 
-	if input[0] == '-' {
-		return false
-	}
-
 	for _, r := range input {
 		if isAllowedGetentChar(r) {
 			continue

client/ssh/server/getent_unix_test.go

@@ -157,9 +157,6 @@ func TestValidateGetentInput(t *testing.T) {
 		{"numeric UID", "1001", true},
 		{"dots and underscores", "alice.bob_test", true},
 		{"hyphen", "alice-bob", true},
-		{"leading hyphen rejected", "-i", false},
-		{"leading double hyphen rejected", "--no-idn", false},
-		{"lone hyphen rejected", "-", false},
 		{"kerberos principal", "user@REALM", true},
 		{"samba machine account", "MACHINE$", true},
 		{"NIS compat", "+user", true},

client/ssh/server/jwt_test.go

@@ -23,11 +23,11 @@ import (
 	"github.com/stretchr/testify/require"
 
 	nbssh "github.com/netbirdio/netbird/client/ssh"
-	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	"github.com/netbirdio/netbird/client/ssh/client"
 	"github.com/netbirdio/netbird/client/ssh/detection"
 	"github.com/netbirdio/netbird/client/ssh/testutil"
 	nbjwt "github.com/netbirdio/netbird/shared/auth/jwt"
+	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
 	sshuserhash "github.com/netbirdio/netbird/shared/sshauth"
 )
 

client/ssh/server/server.go

@@ -23,10 +23,10 @@ import (
 	"golang.zx2c4.com/wireguard/tun/netstack"
 
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
-	sshauth "github.com/netbirdio/netbird/client/ssh/auth"
 	"github.com/netbirdio/netbird/client/ssh/detection"
 	"github.com/netbirdio/netbird/shared/auth"
 	"github.com/netbirdio/netbird/shared/auth/jwt"
+	sshauth "github.com/netbirdio/netbird/shared/sessionauth"
 	"github.com/netbirdio/netbird/util/netrelay"
 	"github.com/netbirdio/netbird/version"
 )
@@ -197,6 +197,14 @@ type Config struct {
 
 	// HostKey is the SSH server host key in PEM format
 	HostKeyPEM []byte
+
+	// NetstackNet, when non-nil, makes the SSH server listen via the
+	// supplied userspace network stack instead of an OS socket.
+	NetstackNet *netstack.Net
+
+	// NetworkValidation, when non-zero, restricts inbound connections to
+	// peers inside the NetBird overlay defined by this WireGuard address.
+	NetworkValidation wgaddr.Address
 }
 
 // SessionInfo contains information about an active SSH session
@@ -208,12 +216,15 @@ type SessionInfo struct {
 	PortForwards  []string
 }
 
-// New creates an SSH server instance with the provided host key and optional JWT configuration
-// If jwtConfig is nil, JWT authentication is disabled
+// New creates an SSH server instance from the supplied Config. Fields are
+// read once at construction; mutating Config afterwards has no effect.
+// JWT == nil disables JWT authentication.
 func New(config *Config) *Server {
 	s := &Server{
 		mu:                     sync.RWMutex{},
 		hostKeyPEM:             config.HostKeyPEM,
+		netstackNet:            config.NetstackNet,
+		wgAddress:              config.NetworkValidation,
 		sessions:               make(map[sessionKey]*sessionState),
 		pendingAuthJWT:         make(map[authKey]string),
 		remoteForwardListeners: make(map[forwardKey]net.Listener),
@@ -434,20 +445,6 @@ func (s *Server) buildSessionInfo(state *sessionState) SessionInfo {
 	return info
 }
 
-// SetNetstackNet sets the netstack network for userspace networking
-func (s *Server) SetNetstackNet(net *netstack.Net) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.netstackNet = net
-}
-
-// SetNetworkValidation configures network-based connection filtering
-func (s *Server) SetNetworkValidation(addr wgaddr.Address) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.wgAddress = addr
-}
-
 // UpdateSSHAuth updates the SSH fine-grained access control configuration
 // This should be called when network map updates include new SSH auth configuration
 func (s *Server) UpdateSSHAuth(config *sshauth.Config) {

client/status/status.go

@@ -136,6 +136,19 @@ type SSHServerStateOutput struct {
 	Sessions []SSHSessionOutput `json:"sessions" yaml:"sessions"`
 }
 
+type VNCSessionOutput struct {
+	RemoteAddress string `json:"remoteAddress" yaml:"remoteAddress"`
+	Mode          string `json:"mode" yaml:"mode"`
+	Username      string `json:"username,omitempty" yaml:"username,omitempty"`
+	UserID        string `json:"userID,omitempty" yaml:"userID,omitempty"`
+	Initiator     string `json:"initiator,omitempty" yaml:"initiator,omitempty"`
+}
+
+type VNCServerStateOutput struct {
+	Enabled  bool               `json:"enabled" yaml:"enabled"`
+	Sessions []VNCSessionOutput `json:"sessions" yaml:"sessions"`
+}
+
 type OutputOverview struct {
 	Peers                   PeersStateOutput           `json:"peers" yaml:"peers"`
 	CliVersion              string                     `json:"cliVersion" yaml:"cliVersion"`
@@ -159,6 +172,7 @@ type OutputOverview struct {
 	LazyConnectionEnabled   bool                       `json:"lazyConnectionEnabled" yaml:"lazyConnectionEnabled"`
 	ProfileName             string                     `json:"profileName" yaml:"profileName"`
 	SSHServerState          SSHServerStateOutput       `json:"sshServer" yaml:"sshServer"`
+	VNCServerState          VNCServerStateOutput       `json:"vncServer" yaml:"vncServer"`
 	// SessionExpiresAt is the absolute UTC instant at which the peer's SSO
 	// session expires. nil when the peer is not SSO-tracked or login
 	// expiration is disabled. Pointer (rather than zero-value time.Time) so
@@ -184,6 +198,7 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 
 	relayOverview := mapRelays(pbFullStatus.GetRelays())
 	sshServerOverview := mapSSHServer(pbFullStatus.GetSshServerState())
+	vncServerOverview := mapVNCServer(pbFullStatus.GetVncServerState())
 	peersOverview := mapPeers(pbFullStatus.GetPeers(), opts.StatusFilter, opts.PrefixNamesFilter, opts.PrefixNamesFilterMap, opts.IPsFilter, opts.ConnectionTypeFilter)
 
 	overview := OutputOverview{
@@ -209,6 +224,7 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 		LazyConnectionEnabled:   pbFullStatus.GetLazyConnectionEnabled(),
 		ProfileName:             opts.ProfileName,
 		SSHServerState:          sshServerOverview,
+		VNCServerState:          vncServerOverview,
 	}
 	if !opts.SessionExpiresAt.IsZero() {
 		t := opts.SessionExpiresAt
@@ -294,6 +310,26 @@ func mapSSHServer(sshServerState *proto.SSHServerState) SSHServerStateOutput {
 	}
 }
 
+func mapVNCServer(state *proto.VNCServerState) VNCServerStateOutput {
+	if state == nil {
+		return VNCServerStateOutput{Sessions: []VNCSessionOutput{}}
+	}
+	sessions := make([]VNCSessionOutput, 0, len(state.GetSessions()))
+	for _, sess := range state.GetSessions() {
+		sessions = append(sessions, VNCSessionOutput{
+			RemoteAddress: sess.GetRemoteAddress(),
+			Mode:          sess.GetMode(),
+			Username:      sess.GetUsername(),
+			UserID:        sess.GetUserID(),
+			Initiator:     sess.GetInitiator(),
+		})
+	}
+	return VNCServerStateOutput{
+		Enabled:  state.GetEnabled(),
+		Sessions: sessions,
+	}
+}
+
 func mapPeers(
 	peers []*proto.PeerState,
 	statusFilter string,
@@ -558,6 +594,26 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		}
 	}
 
+	vncServerStatus := "Disabled"
+	if o.VNCServerState.Enabled {
+		vncSessionCount := len(o.VNCServerState.Sessions)
+		if vncSessionCount > 0 {
+			sessionWord := "session"
+			if vncSessionCount > 1 {
+				sessionWord = "sessions"
+			}
+			vncServerStatus = fmt.Sprintf("Enabled (%d active %s)", vncSessionCount, sessionWord)
+		} else {
+			vncServerStatus = "Enabled"
+		}
+
+		if showSSHSessions && vncSessionCount > 0 {
+			for _, sess := range o.VNCServerState.Sessions {
+				vncServerStatus += "\n  " + formatVNCSessionLine(sess)
+			}
+		}
+	}
+
 	peersCountString := fmt.Sprintf("%d/%d Connected", o.Peers.Connected, o.Peers.Total)
 
 	var sessionExpiryString string
@@ -613,6 +669,7 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 			"Quantum resistance: %s\n"+
 			"Lazy connection: %s\n"+
 			"SSH Server: %s\n"+
+			"VNC Server: %s\n"+
 			"Networks: %s\n"+
 			"%s"+
 			"%s"+
@@ -633,6 +690,7 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		rosenpassEnabledStatus,
 		lazyConnectionEnabledStatus,
 		sshServerStatus,
+		vncServerStatus,
 		networks,
 		forwardingRulesString,
 		sessionExpiryString,
@@ -746,8 +804,6 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 		pbFullStatus.DnsServers = append(pbFullStatus.DnsServers, pbDnsState)
 	}
 
-	pbFullStatus.Events = fullStatus.Events
-
 	return &pbFullStatus
 }
 
@@ -995,6 +1051,26 @@ func anonymizePeerDetail(a *anonymize.Anonymizer, peer *PeerStateDetailOutput) {
 	}
 }
 
+// formatVNCSessionLine renders a single VNC session row for the detailed
+// status output. The leading slot identifies the initiator (display name
+// when known, hashed UserID otherwise); the post-arrow slot is the OS
+// user the session targets and is omitted in attach mode where the
+// destination is the current console user (unknown to the daemon).
+func formatVNCSessionLine(sess VNCSessionOutput) string {
+	who := sess.Initiator
+	if who == "" {
+		who = sess.UserID
+	}
+	prefix := sess.RemoteAddress
+	if who != "" {
+		prefix = fmt.Sprintf("%s@%s", who, sess.RemoteAddress)
+	}
+	if sess.Username != "" {
+		return fmt.Sprintf("[%s -> %s] mode=%s", prefix, sess.Username, sess.Mode)
+	}
+	return fmt.Sprintf("[%s] mode=%s", prefix, sess.Mode)
+}
+
 func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 	for i, peer := range overview.Peers.Details {
 		peer := peer
@@ -1015,6 +1091,19 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 		overview.Relays.Details[i] = detail
 	}
 
+	anonymizeNSServerGroups(a, overview)
+
+	for i, route := range overview.Networks {
+		overview.Networks[i] = a.AnonymizeRoute(route)
+	}
+
+	overview.FQDN = a.AnonymizeDomain(overview.FQDN)
+
+	anonymizeEvents(a, overview)
+	anonymizeServerSessions(a, overview)
+}
+
+func anonymizeNSServerGroups(a *anonymize.Anonymizer, overview *OutputOverview) {
 	for i, nsGroup := range overview.NSServerGroups {
 		for j, domain := range nsGroup.Domains {
 			overview.NSServerGroups[i].Domains[j] = a.AnonymizeDomain(domain)
@@ -1026,13 +1115,9 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 			}
 		}
 	}
+}
 
-	for i, route := range overview.Networks {
-		overview.Networks[i] = a.AnonymizeRoute(route)
-	}
-
-	overview.FQDN = a.AnonymizeDomain(overview.FQDN)
-
+func anonymizeEvents(a *anonymize.Anonymizer, overview *OutputOverview) {
 	for i, event := range overview.Events {
 		overview.Events[i].Message = a.AnonymizeString(event.Message)
 		overview.Events[i].UserMessage = a.AnonymizeString(event.UserMessage)
@@ -1041,15 +1126,26 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 			event.Metadata[k] = a.AnonymizeString(v)
 		}
 	}
+}
 
+func anonymizeRemoteAddress(a *anonymize.Anonymizer, addr string) string {
+	if host, port, err := net.SplitHostPort(addr); err == nil {
+		return fmt.Sprintf("%s:%s", a.AnonymizeIPString(host), port)
+	}
+	return a.AnonymizeIPString(addr)
+}
+
+func anonymizeServerSessions(a *anonymize.Anonymizer, overview *OutputOverview) {
 	for i, session := range overview.SSHServerState.Sessions {
-		if host, port, err := net.SplitHostPort(session.RemoteAddress); err == nil {
-			overview.SSHServerState.Sessions[i].RemoteAddress = fmt.Sprintf("%s:%s", a.AnonymizeIPString(host), port)
-		} else {
-			overview.SSHServerState.Sessions[i].RemoteAddress = a.AnonymizeIPString(session.RemoteAddress)
-		}
+		overview.SSHServerState.Sessions[i].RemoteAddress = anonymizeRemoteAddress(a, session.RemoteAddress)
 		overview.SSHServerState.Sessions[i].Command = a.AnonymizeString(session.Command)
 	}
+	for i, sess := range overview.VNCServerState.Sessions {
+		overview.VNCServerState.Sessions[i].RemoteAddress = anonymizeRemoteAddress(a, sess.RemoteAddress)
+		overview.VNCServerState.Sessions[i].Username = a.AnonymizeString(sess.Username)
+		overview.VNCServerState.Sessions[i].UserID = a.AnonymizeString(sess.UserID)
+		overview.VNCServerState.Sessions[i].Initiator = a.AnonymizeString(sess.Initiator)
+	}
 }
 
 // FormatRemainingDuration renders a time.Duration for the "Session expires"

client/status/status_test.go

@@ -242,6 +242,10 @@ var overview = OutputOverview{
 		Enabled:  false,
 		Sessions: []SSHSessionOutput{},
 	},
+	VNCServerState: VNCServerStateOutput{
+		Enabled:  false,
+		Sessions: []VNCSessionOutput{},
+	},
 }
 
 func TestConversionFromFullStatusToOutputOverview(t *testing.T) {
@@ -407,6 +411,10 @@ func TestParsingToJSON(t *testing.T) {
 		  "sshServer":{
 		    "enabled":false,
 			"sessions":[]
+		  },
+		  "vncServer":{
+		    "enabled":false,
+			"sessions":[]
 		  }
         }`
 	// @formatter:on
@@ -517,6 +525,9 @@ profileName: ""
 sshServer:
     enabled: false
     sessions: []
+vncServer:
+    enabled: false
+    sessions: []
 `
 
 	assert.Equal(t, expectedYAML, yaml)
@@ -587,6 +598,7 @@ Wireguard port: %d
 Quantum resistance: false
 Lazy connection: false
 SSH Server: Disabled
+VNC Server: Disabled
 Networks: 10.10.0.0/24
 Peers count: 2/2 Connected
 `, lastConnectionUpdate1, lastHandshake1, lastConnectionUpdate2, lastHandshake2, runtime.GOOS, runtime.GOARCH, overview.CliVersion, overview.WgPort)
@@ -613,6 +625,7 @@ Wireguard port: 51820
 Quantum resistance: false
 Lazy connection: false
 SSH Server: Disabled
+VNC Server: Disabled
 Networks: 10.10.0.0/24
 Peers count: 2/2 Connected
 `

client/system/info.go

@@ -65,6 +65,7 @@ type Info struct {
 	RosenpassEnabled    bool
 	RosenpassPermissive bool
 	ServerSSHAllowed    bool
+	ServerVNCAllowed    bool
 
 	DisableClientRoutes bool
 	DisableServerRoutes bool
@@ -84,6 +85,7 @@ type Info struct {
 func (i *Info) SetFlags(
 	rosenpassEnabled, rosenpassPermissive bool,
 	serverSSHAllowed *bool,
+	serverVNCAllowed *bool,
 	disableClientRoutes, disableServerRoutes,
 	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6 bool,
 	enableSSHRoot, enableSSHSFTP, enableSSHLocalPortForwarding, enableSSHRemotePortForwarding *bool,
@@ -94,6 +96,9 @@ func (i *Info) SetFlags(
 	if serverSSHAllowed != nil {
 		i.ServerSSHAllowed = *serverSSHAllowed
 	}
+	if serverVNCAllowed != nil {
+		i.ServerVNCAllowed = *serverVNCAllowed
+	}
 
 	i.DisableClientRoutes = disableClientRoutes
 	i.DisableServerRoutes = disableServerRoutes

client/ui/autostart_default.go

@@ -1,107 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"context"
-	"os"
-	"path/filepath"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/mdm"
-	"github.com/netbirdio/netbird/client/ui/preferences"
-	"github.com/netbirdio/netbird/client/ui/services"
-)
-
-// autostartDefaultState carries the guard inputs of the one-time autostart
-// default decision so the decision itself stays a pure, testable function.
-type autostartDefaultState struct {
-	supported    bool
-	mdmDisabled  bool
-	priorInstall bool
-}
-
-// shouldEnableAutostartDefault applies the first-run guards in order and
-// returns whether autostart may be enabled, plus the reason when it may not.
-func shouldEnableAutostartDefault(s autostartDefaultState) (bool, string) {
-	switch {
-	case !s.supported:
-		return false, "autostart not supported on this platform"
-	case s.mdmDisabled:
-		return false, "autostart disabled by MDM policy"
-	case s.priorInstall:
-		return false, "existing NetBird installation"
-	}
-	return true, ""
-}
-
-// autostartDisabledByMDM reports whether the MDM policy manages the
-// disableAutostart key in a way that must suppress the default. An
-// unparseable managed value is treated as disabled to stay on the safe side.
-func autostartDisabledByMDM(policy *mdm.Policy) bool {
-	if !policy.HasKey(mdm.KeyDisableAutostart) {
-		return false
-	}
-	disabled, ok := policy.GetBool(mdm.KeyDisableAutostart)
-	return !ok || disabled
-}
-
-// netbirdFootprintExists reports whether the machine already carries NetBird
-// daemon config or state, meaning this is not a genuinely fresh install. It is
-// the update-safety gate for the autostart default: upgrading users always
-// have a footprint, so an update can never trigger a login-item write.
-func netbirdFootprintExists() bool {
-	candidates := []string{
-		profilemanager.DefaultConfigPath,
-		filepath.Join(profilemanager.DefaultConfigPathDir, "config.json"),
-		filepath.Join(profilemanager.DefaultConfigPathDir, "state.json"),
-	}
-	for _, path := range candidates {
-		if path != "" && fileExists(path) {
-			return true
-		}
-	}
-	return false
-}
-
-// applyAutostartDefault runs the one-time launch-on-login default for genuinely
-// fresh installs. The autostartInitialized marker is persisted before any
-// enable attempt so a crash mid-flow degrades to "never enabled" instead of
-// retrying login-item writes on every launch. A user's later disable in
-// Settings is never overridden: the marker guarantees at-most-once, ever.
-func applyAutostartDefault(ctx context.Context, autostart *services.Autostart, prefs *preferences.Store, prefsFileExisted bool) {
-	priorFootprint := netbirdFootprintExists() || prefsFileExisted
-
-	if prefs.Get().AutostartInitialized {
-		return
-	}
-	if err := prefs.SetAutostartInitialized(true); err != nil {
-		log.Warnf("persist autostart marker, skipping autostart default: %v", err)
-		return
-	}
-
-	state := autostartDefaultState{
-		supported:    autostart.Supported(ctx),
-		mdmDisabled:  autostartDisabledByMDM(mdm.LoadPolicy()),
-		priorInstall: priorFootprint,
-	}
-	enable, reason := shouldEnableAutostartDefault(state)
-	if !enable {
-		log.Debugf("skipping autostart default: %s", reason)
-		return
-	}
-
-	if err := autostart.SetEnabled(ctx, true); err != nil {
-		log.Warnf("enable autostart on fresh install: %v", err)
-		return
-	}
-	log.Info("autostart enabled by default on fresh install")
-}
-
-// fileExists reports whether path exists.
-func fileExists(path string) bool {
-	_, err := os.Stat(path)
-	return err == nil
-}

client/ui/autostart_default_test.go

@@ -1,125 +0,0 @@
-//go:build !android && !ios && !freebsd && !js
-
-package main
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-
-	"github.com/netbirdio/netbird/client/mdm"
-)
-
-func TestShouldEnableAutostartDefault(t *testing.T) {
-	allPass := autostartDefaultState{
-		supported:    true,
-		mdmDisabled:  false,
-		priorInstall: false,
-	}
-
-	tests := []struct {
-		name       string
-		mutate     func(*autostartDefaultState)
-		wantEnable bool
-		wantReason string
-	}{
-		{
-			name:       "fresh install with all guards passing enables",
-			mutate:     func(*autostartDefaultState) {},
-			wantEnable: true,
-		},
-		{
-			name:       "unsupported platform skips",
-			mutate:     func(s *autostartDefaultState) { s.supported = false },
-			wantReason: "autostart not supported on this platform",
-		},
-		{
-			name:       "MDM disable skips",
-			mutate:     func(s *autostartDefaultState) { s.mdmDisabled = true },
-			wantReason: "autostart disabled by MDM policy",
-		},
-		{
-			name:       "existing installation (upgrade) skips",
-			mutate:     func(s *autostartDefaultState) { s.priorInstall = true },
-			wantReason: "existing NetBird installation",
-		},
-		{
-			name: "unsupported wins over every other guard",
-			mutate: func(s *autostartDefaultState) {
-				s.supported = false
-				s.mdmDisabled = true
-				s.priorInstall = true
-			},
-			wantReason: "autostart not supported on this platform",
-		},
-		{
-			name: "MDM disable wins over prior install",
-			mutate: func(s *autostartDefaultState) {
-				s.mdmDisabled = true
-				s.priorInstall = true
-			},
-			wantReason: "autostart disabled by MDM policy",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			state := allPass
-			tc.mutate(&state)
-			enable, reason := shouldEnableAutostartDefault(state)
-			assert.Equal(t, tc.wantEnable, enable, "enable decision should match for state %+v", state)
-			assert.Equal(t, tc.wantReason, reason, "skip reason should identify the failing guard")
-		})
-	}
-}
-
-func TestAutostartDisabledByMDM(t *testing.T) {
-	tests := []struct {
-		name   string
-		values map[string]any
-		want   bool
-	}{
-		{
-			name:   "empty policy does not disable",
-			values: nil,
-			want:   false,
-		},
-		{
-			name:   "unrelated managed keys do not disable",
-			values: map[string]any{mdm.KeyDisableAutoConnect: true},
-			want:   false,
-		},
-		{
-			name:   "disableAutostart true disables",
-			values: map[string]any{mdm.KeyDisableAutostart: true},
-			want:   true,
-		},
-		{
-			name:   "disableAutostart registry DWORD 1 disables",
-			values: map[string]any{mdm.KeyDisableAutostart: int64(1)},
-			want:   true,
-		},
-		{
-			name:   "disableAutostart string true disables",
-			values: map[string]any{mdm.KeyDisableAutostart: "true"},
-			want:   true,
-		},
-		{
-			name:   "disableAutostart explicit false allows",
-			values: map[string]any{mdm.KeyDisableAutostart: false},
-			want:   false,
-		},
-		{
-			name:   "unparseable managed value is treated as disabled",
-			values: map[string]any{mdm.KeyDisableAutostart: "not-a-bool"},
-			want:   true,
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			got := autostartDisabledByMDM(mdm.NewPolicy(tc.values))
-			assert.Equal(t, tc.want, got, "MDM disable decision should match for values %v", tc.values)
-		})
-	}
-}

client/ui/frontend/src/app.tsx

@@ -3,6 +3,7 @@ import ReactDOM from "react-dom/client";
 import "./globals.css";
 import { HashRouter, Navigate, Route, Routes } from "react-router-dom";
 import SessionExpirationDialog from "@/modules/session/SessionExpirationDialog.tsx";
+import ApprovalDialog from "@/modules/approval/ApprovalDialog.tsx";
 import UpdateInProgressDialog from "@/modules/auto-update/UpdateInProgressDialog.tsx";
 import WelcomeDialog from "@/modules/welcome/WelcomeDialog.tsx";
 import ErrorDialog from "@/modules/error/ErrorDialog.tsx";
@@ -48,6 +49,7 @@ Promise.all([
                                 path={"session-expiration"}
                                 element={<SessionExpirationDialog />}
                             />
+                            <Route path={"approval"} element={<ApprovalDialog />} />
                             <Route path={"welcome"} element={<WelcomeDialog />} />
                             <Route path={"error"} element={<ErrorDialog />} />
                         </Route>

client/ui/frontend/src/components/empty-state/DaemonOutdatedOverlay.tsx

@@ -1,13 +1,10 @@
-import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { AlertTriangleIcon, DownloadIcon } from "lucide-react";
 import { Browser } from "@wailsio/runtime";
-import { Version } from "@bindings/services";
 import { Button } from "@/components/buttons/Button";
 import { useStatus } from "@/contexts/StatusContext.tsx";
 
 const RELEASES_URL = "https://github.com/netbirdio/netbird/releases/latest";
-const RC_RELEASES_URL = "https://pkgs.netbird.io/releases/rc";
 
 function openUrl(url: string) {
     Browser.OpenURL(url).catch(() => globalThis.open(url, "_blank"));
@@ -15,26 +12,7 @@ function openUrl(url: string) {
 
 export const DaemonOutdatedOverlay = () => {
     const { t } = useTranslation();
-    const { status, isDaemonOutdated } = useStatus();
-
-    const [guiVersion, setGuiVersion] = useState<string>("-");
-    const clientVersion = status?.daemonVersion ?? "—";
-
-    const isRc = /-rc/i.test(guiVersion) || /-rc/i.test(clientVersion);
-    const downloadUrl = isRc ? RC_RELEASES_URL : RELEASES_URL;
-
-    useEffect(() => {
-        if (!isDaemonOutdated) return;
-        let cancelled = false;
-        Version.GUI()
-            .then((v) => {
-                if (!cancelled) setGuiVersion(v);
-            })
-            .catch((err) => console.error("[DaemonOutdatedOverlay] GUI version error", err));
-        return () => {
-            cancelled = true;
-        };
-    }, [isDaemonOutdated]);
+    const { isDaemonOutdated } = useStatus();
 
     if (!isDaemonOutdated) return null;
 
@@ -60,37 +38,10 @@ export const DaemonOutdatedOverlay = () => {
                     <p className={"text-sm text-nb-gray-300"}>{t("daemon.outdated.description")}</p>
                 </div>
 
-                <div className={"flex flex-col items-center gap-0.5 text-center"}>
-                    <p className={"text-sm font-semibold text-nb-gray-100"}>
-                        {clientVersion === "development" ? (
-                            <span>
-                                {t("settings.about.clientName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
-                                    {t("settings.about.development")}
-                                </span>
-                            </span>
-                        ) : (
-                            t("settings.about.client", { version: clientVersion })
-                        )}
-                    </p>
-                    <p className={"text-sm font-medium text-nb-gray-250"}>
-                        {guiVersion === "development" ? (
-                            <span>
-                                {t("settings.about.guiName")}{" "}
-                                <span className={"font-mono text-yellow-400"}>
-                                    {t("settings.about.development")}
-                                </span>
-                            </span>
-                        ) : (
-                            t("settings.about.gui", { version: guiVersion })
-                        )}
-                    </p>
-                </div>
-
                 <div className={"wails-no-draggable"}>
-                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(downloadUrl)}>
+                    <Button variant={"primary"} size={"xs"} onClick={() => openUrl(RELEASES_URL)}>
                         <DownloadIcon size={14} />
-                        {t("daemon.outdated.download")}
+                        {t("update.card.getInstaller")}
                     </Button>
                 </div>
             </div>

client/ui/frontend/src/contexts/ProfileContext.tsx

@@ -28,7 +28,6 @@ type ProfileContextValue = {
     loaded: boolean;
     refresh: () => Promise<void>;
     switchProfile: (id: string) => Promise<void>;
-    switchProfileNoConnect: (id: string) => Promise<void>;
     addProfile: (name: string) => Promise<string>;
     removeProfile: (id: string) => Promise<void>;
     renameProfile: (id: string, newName: string) => Promise<void>;
@@ -113,16 +112,6 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
         [username, refresh],
     );
 
-    // Manage-profiles variant: switches without connecting, so the user can
-    // still adjust the management URL before bringing the connection up.
-    const switchProfileNoConnect = useCallback(
-        async (id: string) => {
-            await ProfileSwitcher.SwitchActiveNoConnect({ profileName: id, username });
-            await refresh();
-        },
-        [username, refresh],
-    );
-
     // addProfile creates a profile by display name and returns the
     // daemon-generated ID, so the caller can immediately address it by ID.
     const addProfile = useCallback(
@@ -169,7 +158,6 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
             loaded,
             refresh,
             switchProfile,
-            switchProfileNoConnect,
             addProfile,
             removeProfile,
             renameProfile,
@@ -183,7 +171,6 @@ export const ProfileProvider = ({ children }: { children: ReactNode }) => {
             loaded,
             refresh,
             switchProfile,
-            switchProfileNoConnect,
             addProfile,
             removeProfile,
             renameProfile,

client/ui/frontend/src/lib/connection.ts

@@ -51,14 +51,7 @@ async function runSsoLogin(
     if (uri) await openBrowserLoginUri(uri);
 
     const cancelPromise = buildSsoCancelPromise(state, signal);
-    // Combine wait + up in Go so the connection comes up the moment SSO
-    // completes. During SSO the tray window is hidden and the webview is
-    // suspended, so a frontend-driven Up (a promise continuation) would not
-    // fire until the user woke the window (e.g. hovering the tray icon).
-    const waitPromise = Connection.WaitSSOLoginAndUp(
-        { userCode: result.userCode, hostname: "" },
-        { profileName: "", username: "" },
-    );
+    const waitPromise = Connection.WaitSSOLogin({ userCode: result.userCode, hostname: "" });
 
     try {
         await Promise.race([waitPromise, cancelPromise]);
@@ -96,13 +89,13 @@ export async function startConnection(onSettled?: () => void, signal?: AbortSign
         if (signal?.aborted) state.cancelled = true;
 
         if (!state.cancelled && result.needsSsoLogin) {
-            // runSsoLogin brings the connection up in Go once SSO completes.
             await runSsoLogin(result, state, signal);
-        } else {
-            if (!state.cancelled && signal?.aborted) state.cancelled = true;
-            if (!state.cancelled) {
-                await Connection.Up({ profileName: "", username: "" });
-            }
+        }
+
+        if (!state.cancelled && signal?.aborted) state.cancelled = true;
+
+        if (!state.cancelled) {
+            await Connection.Up({ profileName: "", username: "" });
         }
     } catch (e) {
         WindowManager.CloseBrowserLogin().catch(console.error);

client/ui/frontend/src/modules/approval/ApprovalDialog.tsx

@@ -0,0 +1,170 @@
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { useSearchParams } from "react-router-dom";
+import { MonitorIcon } from "lucide-react";
+import { Button } from "@/components/buttons/Button";
+import { ConfirmDialog } from "@/components/dialog/ConfirmDialog";
+import { DialogActions } from "@/components/dialog/DialogActions";
+import { DialogHeading } from "@/components/dialog/DialogHeading";
+import { SquareIcon } from "@/components/SquareIcon";
+import { Approval, WindowManager } from "@bindings/services";
+import { useAutoSizeWindow } from "@/hooks/useAutoSizeWindow";
+
+const WINDOW_WIDTH = 360;
+// Fallback window so a missing/unparseable expires_at can't leave the prompt open forever.
+const FALLBACK_SECONDS = 13;
+
+// shortFingerprint groups a hex key as XXXX-XXXX-XXXX-XXXX (16 chars). Mirrors the
+// daemon's approval.ShortKeyFingerprint so the value matches an out-of-band reference.
+function shortFingerprint(hexKey: string): string {
+    if (hexKey.length < 8) return "";
+    const src = hexKey.slice(0, 16);
+    return src.match(/.{1,4}/g)?.join("-") ?? src;
+}
+
+type Row = { label: string; value: string; mono?: boolean };
+
+export default function ApprovalDialog() {
+    const { t } = useTranslation();
+    const contentRef = useAutoSizeWindow<HTMLDivElement>(WINDOW_WIDTH);
+    const [params] = useSearchParams();
+    const [busy, setBusy] = useState(false);
+
+    const requestID = params.get("request_id") ?? "";
+    const kind = params.get("kind") ?? "";
+    const initiator = params.get("initiator") ?? "";
+    const peerName = params.get("peer_name") ?? "";
+    const sourceIP = params.get("source_ip") ?? "";
+    const username = params.get("username") ?? "";
+    const peerPubKey = params.get("peer_pubkey") ?? "";
+    const expiresAt = params.get("expires_at") ?? "";
+
+    const deadline = useMemo(() => {
+        const parsed = Date.parse(expiresAt);
+        return Number.isFinite(parsed) ? parsed : Date.now() + FALLBACK_SECONDS * 1000;
+    }, [expiresAt]);
+
+    const title = useMemo(() => {
+        switch (kind) {
+            case "vnc":
+                return t("approval.title.vnc");
+            case "ssh":
+                return t("approval.title.ssh");
+            default:
+                return t("approval.title.default");
+        }
+    }, [kind, t]);
+
+    const rows = useMemo<Row[]>(() => {
+        const out: Row[] = [];
+        // The display name is dashboard-supplied and not cryptographically
+        // asserted; the key fingerprint below IS, so show both.
+        if (initiator) out.push({ label: t("approval.field.user"), value: initiator });
+        const fp = shortFingerprint(peerPubKey);
+        if (fp) out.push({ label: t("approval.field.keyFingerprint"), value: fp, mono: true });
+        if (peerName) out.push({ label: t("approval.field.peer"), value: peerName });
+        if (sourceIP && sourceIP !== peerName)
+            out.push({ label: t("approval.field.sourceIp"), value: sourceIP, mono: true });
+        if (username) out.push({ label: t("approval.field.osUser"), value: username });
+        return out;
+    }, [initiator, peerPubKey, peerName, sourceIP, username, t]);
+
+    const respond = useCallback(
+        async (accept: boolean, viewOnly: boolean) => {
+            if (busy) return;
+            setBusy(true);
+            try {
+                if (requestID) {
+                    await Approval.Respond(requestID, accept, viewOnly);
+                }
+            } catch (e) {
+                console.error("respond approval failed", e);
+            } finally {
+                WindowManager.CloseApproval().catch(console.error);
+            }
+        },
+        [busy, requestID],
+    );
+
+    const secondsLeft = () => Math.max(0, Math.ceil((deadline - Date.now()) / 1000));
+    const [remaining, setRemaining] = useState(secondsLeft);
+    const closedRef = useRef(false);
+    useEffect(() => {
+        const id = globalThis.setInterval(() => {
+            const left = secondsLeft();
+            setRemaining(left);
+            // On the deadline the daemon auto-denies; just close the prompt.
+            if (left <= 0 && !closedRef.current) {
+                closedRef.current = true;
+                WindowManager.CloseApproval().catch(console.error);
+            }
+        }, 1000);
+        return () => globalThis.clearInterval(id);
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [deadline]);
+
+    const showViewOnly = kind === "vnc";
+
+    return (
+        <ConfirmDialog ref={contentRef} aria-labelledby={"nb-approval-title"}>
+            <SquareIcon icon={MonitorIcon} />
+
+            <DialogHeading id={"nb-approval-title"}>{title}</DialogHeading>
+
+            {rows.length > 0 && (
+                <dl className={"w-full space-y-1 text-left text-sm"}>
+                    {rows.map((row) => (
+                        <div key={row.label} className={"flex justify-between gap-4"}>
+                            <dt className={"shrink-0 text-nb-gray-400"}>{row.label}</dt>
+                            <dd
+                                className={`min-w-0 truncate text-nb-gray-100 ${
+                                    row.mono ? "font-mono" : ""
+                                }`}
+                                title={row.value}
+                            >
+                                {row.value}
+                            </dd>
+                        </div>
+                    ))}
+                </dl>
+            )}
+
+            <div className={"text-sm tabular-nums text-nb-gray-400"} aria-live={"polite"}>
+                {t("approval.countdown", { seconds: remaining })}
+            </div>
+
+            <DialogActions>
+                <Button
+                    autoFocus
+                    variant={"primary"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={() => respond(true, false)}
+                    disabled={busy}
+                >
+                    {t("approval.action.allow")}
+                </Button>
+                {showViewOnly && (
+                    <Button
+                        variant={"secondary"}
+                        size={"md"}
+                        className={"w-full"}
+                        onClick={() => respond(true, true)}
+                        disabled={busy}
+                    >
+                        {t("approval.action.allowViewOnly")}
+                    </Button>
+                )}
+                <Button
+                    variant={"danger"}
+                    size={"md"}
+                    className={"w-full"}
+                    onClick={() => respond(false, false)}
+                    disabled={busy}
+                >
+                    {t("approval.action.deny")}
+                </Button>
+            </DialogActions>
+        </ConfirmDialog>
+    );
+}

client/ui/frontend/src/modules/profiles/ProfilesTab.tsx

@@ -45,7 +45,7 @@ export function ProfilesTab() {
         activeProfileId,
         loaded,
         username,
-        switchProfileNoConnect,
+        switchProfile,
         addProfile,
         removeProfile,
         renameProfile,
@@ -100,7 +100,7 @@ export function ProfilesTab() {
             confirmLabel: t("profile.switch.confirm"),
         });
         if (!ok) return;
-        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfileNoConnect(id));
+        await guarded(i18next.t("profile.error.switchTitle"), () => switchProfile(id));
     };
 
     const handleDeregister = async (id: string, name: string) => {
@@ -129,13 +129,14 @@ export function ProfilesTab() {
         await guarded(i18next.t("profile.error.createTitle"), async () => {
             const id = await addProfile(name);
             // SetConfig is keyed by the new profile's ID, so it writes the
-            // not-yet-active profile before the switch makes it current.
+            // not-yet-active profile. Write before switching so any reconnect
+            // targets the right deployment.
             if (!isNetbirdCloud(managementUrl)) {
                 await SettingsSvc.SetConfig(
                     new SetConfigParams({ profileName: id, username, managementUrl }),
                 );
             }
-            await switchProfileNoConnect(id);
+            await switchProfile(id);
         });
     };
 

client/ui/frontend/src/modules/session/SessionExpirationDialog.tsx

@@ -73,13 +73,6 @@ export default function SessionExpirationDialog() {
 
         let offCancel: (() => void) | undefined;
 
-        // Return the dialog to its interactive state and dismiss the browser popup
-        const resetDialog = () => {
-            offCancel?.();
-            WindowManager.CloseBrowserLogin().catch(console.error);
-            setBusy(false);
-        };
-
         try {
             const start = await Session.RequestExtend({ hint: "" });
             const uri = start.verificationUriComplete || start.verificationUri;
@@ -112,22 +105,25 @@ export default function SessionExpirationDialog() {
             if (outcome.kind === "cancel") {
                 waitPromise.cancel?.();
                 waitPromise.catch(() => {});
-                resetDialog();
                 return;
             }
 
             // Another surface owns this flow; keep the dialog open to retry.
             if (outcome.result.preempted) {
-                resetDialog();
                 return;
             }
-            WindowManager.CloseRenewFlow().catch(console.error);
+
+            // Close before the popup so the restore can't flash this window back.
+            WindowManager.CloseSessionExpiration().catch(console.error);
         } catch (e) {
-            resetDialog();
             await errorDialog({
                 Title: t("sessionExpiration.extendFailedTitle"),
                 Message: formatErrorMessage(e),
             });
+        } finally {
+            offCancel?.();
+            WindowManager.CloseBrowserLogin().catch(console.error);
+            setBusy(false);
         }
     }, [busy, t]);
 
@@ -143,11 +139,12 @@ export default function SessionExpirationDialog() {
             });
             WindowManager.CloseSessionExpiration().catch(console.error);
         } catch (e) {
-            setBusy(false);
             await errorDialog({
                 Title: t("sessionExpiration.logoutFailedTitle"),
                 Message: formatErrorMessage(e),
             });
+        } finally {
+            setBusy(false);
         }
     }, [busy, t]);
 

client/ui/frontend/src/modules/settings/SettingsNavigation.tsx

@@ -8,6 +8,7 @@ import {
     BoltIcon,
     InfoIcon,
     LifeBuoyIcon,
+    MonitorIcon,
     NetworkIcon,
     ShieldIcon,
     SlidersHorizontalIcon,
@@ -20,6 +21,7 @@ export const SettingsNavigation = () => {
     const { updateAvailable } = useClientVersion();
     const { mdm, features } = useRestrictions();
     const showSsh = mdm.allowServerSSH ?? !features.disableUpdateSettings;
+    const showVnc = mdm.allowServerVNC ?? !features.disableUpdateSettings;
 
     const aboutAdornment = updateAvailable ? (
         <Tooltip content={t("settings.tabs.updateAvailable")} side={"right"}>
@@ -63,6 +65,13 @@ export const SettingsNavigation = () => {
                         title={t("settings.tabs.ssh")}
                     />
                 )}
+                {showVnc && (
+                    <VerticalTabs.Trigger
+                        value={"vnc"}
+                        icon={MonitorIcon}
+                        title={t("settings.tabs.vnc")}
+                    />
+                )}
                 {!features.disableUpdateSettings && (
                     <VerticalTabs.Trigger
                         value={"advanced"}

client/ui/frontend/src/modules/settings/SettingsPage.tsx

@@ -13,6 +13,7 @@ import { SettingsNetwork } from "@/modules/settings/SettingsNetwork.tsx";
 import { SettingsSecurity } from "@/modules/settings/SettingsSecurity.tsx";
 import { ProfilesTab } from "@/modules/profiles/ProfilesTab.tsx";
 import { SettingsSSH } from "@/modules/settings/SettingsSSH.tsx";
+import { SettingsVNC } from "@/modules/settings/SettingsVNC.tsx";
 import { SettingsAdvanced } from "@/modules/settings/SettingsAdvanced.tsx";
 import { SettingsTroubleshooting } from "@/modules/settings/SettingsTroubleshooting.tsx";
 import { SettingsAbout } from "@/modules/settings/SettingsAbout.tsx";
@@ -26,6 +27,7 @@ const enum Tab {
     Security = "security",
     Profiles = "profiles",
     SSH = "ssh",
+    VNC = "vnc",
     Advanced = "advanced",
     Troubleshooting = "troubleshooting",
     About = "about",
@@ -37,6 +39,7 @@ const TAB_CONTENT: Record<Tab, ReactNode> = {
     [Tab.Security]: <SettingsSecurity />,
     [Tab.Profiles]: <ProfilesTab />,
     [Tab.SSH]: <SettingsSSH />,
+    [Tab.VNC]: <SettingsVNC />,
     [Tab.Advanced]: <SettingsAdvanced />,
     [Tab.Troubleshooting]: <SettingsTroubleshooting />,
     [Tab.About]: <SettingsAbout />,
@@ -55,12 +58,18 @@ export const SettingsPage = () => {
             [Tab.Security]: editable,
             [Tab.Profiles]: !features.disableProfiles,
             [Tab.SSH]: mdm.allowServerSSH ?? editable,
+            [Tab.VNC]: mdm.allowServerVNC ?? editable,
             [Tab.Advanced]: editable,
             [Tab.Troubleshooting]: true,
             [Tab.About]: true,
         };
         return (Object.keys(visibility) as Tab[]).filter((t) => visibility[t]);
-    }, [features.disableUpdateSettings, features.disableProfiles, mdm.allowServerSSH]);
+    }, [
+        features.disableUpdateSettings,
+        features.disableProfiles,
+        mdm.allowServerSSH,
+        mdm.allowServerVNC,
+    ]);
 
     const defaultTab = visibleTabs[0];
     const [active, setActive] = useState<string>(() => navState?.tab ?? defaultTab);

client/ui/frontend/src/modules/settings/SettingsVNC.tsx

@@ -0,0 +1,41 @@
+import { useTranslation } from "react-i18next";
+import FancyToggleSwitch from "@/components/switches/FancyToggleSwitch";
+import { SectionGroup } from "@/modules/settings/SettingsSection.tsx";
+import { useSettings } from "@/contexts/SettingsContext.tsx";
+import { useRestrictions } from "@/contexts/RestrictionsContext.tsx";
+
+export function SettingsVNC() {
+    const { t } = useTranslation();
+    const { config, setField } = useSettings();
+    const { mdm } = useRestrictions();
+    const isVNCServerEnabled = config.serverVncAllowed;
+    const vncServerManaged = mdm.allowServerVNC != null;
+
+    return (
+        <>
+            <SectionGroup title={t("settings.vnc.section.server")}>
+                <FancyToggleSwitch
+                    value={config.serverVncAllowed}
+                    onChange={(v) => setField("serverVncAllowed", v)}
+                    label={t("settings.vnc.server.label")}
+                    helpText={t("settings.vnc.server.help")}
+                    disabled={vncServerManaged}
+                />
+            </SectionGroup>
+
+            {!mdm.disableVNCApproval && (
+                <SectionGroup
+                    title={t("settings.vnc.section.approval")}
+                    disabled={!isVNCServerEnabled}
+                >
+                    <FancyToggleSwitch
+                        value={!config.disableVncApproval}
+                        onChange={(v) => setField("disableVncApproval", !v)}
+                        label={t("settings.vnc.approval.label")}
+                        helpText={t("settings.vnc.approval.help")}
+                    />
+                </SectionGroup>
+            )}
+        </>
+    );
+}