remove status attr and unused function

client/Dockerfile

@@ -4,7 +4,7 @@
 #   sudo podman build -t localhost/netbird:latest -f client/Dockerfile --ignorefile .dockerignore-client .
 #   sudo podman run --rm -it --cap-add={BPF,NET_ADMIN,NET_RAW} localhost/netbird:latest
 
-FROM alpine:3.22.2
+FROM alpine:3.22.0
 # iproute2: busybox doesn't display ip rules properly
 RUN apk add --no-cache \
     bash \

client/cmd/debug.go

@@ -307,14 +307,8 @@ func getStatusOutput(cmd *cobra.Command, anon bool) string {
 	if err != nil {
 		cmd.PrintErrf("Failed to get status: %v\n", err)
 	} else {
-		pm := profilemanager.NewProfileManager()
-		var profName string
-		if activeProf, err := pm.GetActiveProfile(); err == nil {
-			profName = activeProf.Name
-		}
-
 		statusOutputString = nbstatus.ParseToFullDetailSummary(
-			nbstatus.ConvertToStatusOutputOverview(statusResp, anon, "", nil, nil, nil, "", profName),
+			nbstatus.ConvertToStatusOutputOverview(statusResp, anon, "", nil, nil, nil, "", ""),
 		)
 	}
 	return statusOutputString

client/cmd/login.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"os"
-	"os/exec"
 	"os/user"
 	"runtime"
 	"strings"
@@ -357,21 +356,13 @@ func openURL(cmd *cobra.Command, verificationURIComplete, userCode string, noBro
 	cmd.Println("")
 
 	if !noBrowser {
-		if err := openBrowser(verificationURIComplete); err != nil {
+		if err := open.Run(verificationURIComplete); err != nil {
 			cmd.Println("\nAlternatively, you may want to use a setup key, see:\n\n" +
 				"https://docs.netbird.io/how-to/register-machines-using-setup-keys")
 		}
 	}
 }
 
-// openBrowser opens the URL in a browser, respecting the BROWSER environment variable.
-func openBrowser(url string) error {
-	if browser := os.Getenv("BROWSER"); browser != "" {
-		return exec.Command(browser, url).Start()
-	}
-	return open.Run(url)
-}
-
 // isUnixRunningDesktop checks if a Linux OS is running desktop environment
 func isUnixRunningDesktop() bool {
 	if runtime.GOOS != "linux" && runtime.GOOS != "freebsd" {

client/firewall/iptables/acl_linux.go

@@ -400,6 +400,7 @@ func transformIPsetName(ipsetName string, sPort, dPort *firewall.Port, action fi
 		return ""
 	}
 
+	// Include action in the ipset name to prevent squashing rules with different actions
 	actionSuffix := ""
 	if action == firewall.ActionDrop {
 		actionSuffix = "-drop"

client/grpc/dialer.go

@@ -4,15 +4,12 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"errors"
-	"fmt"
 	"runtime"
 	"time"
 
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
 	"google.golang.org/grpc"
-	"google.golang.org/grpc/connectivity"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 	"google.golang.org/grpc/keepalive"
@@ -20,9 +17,6 @@ import (
 	"github.com/netbirdio/netbird/util/embeddedroots"
 )
 
-// ErrConnectionShutdown indicates that the connection entered shutdown state before becoming ready
-var ErrConnectionShutdown = errors.New("connection shutdown before ready")
-
 // Backoff returns a backoff configuration for gRPC calls
 func Backoff(ctx context.Context) backoff.BackOff {
 	b := backoff.NewExponentialBackOff()
@@ -31,26 +25,6 @@ func Backoff(ctx context.Context) backoff.BackOff {
 	return backoff.WithContext(b, ctx)
 }
 
-// waitForConnectionReady blocks until the connection becomes ready or fails.
-// Returns an error if the connection times out, is cancelled, or enters shutdown state.
-func waitForConnectionReady(ctx context.Context, conn *grpc.ClientConn) error {
-	conn.Connect()
-
-	state := conn.GetState()
-	for state != connectivity.Ready && state != connectivity.Shutdown {
-		if !conn.WaitForStateChange(ctx, state) {
-			return fmt.Errorf("wait state change from %s: %w", state, ctx.Err())
-		}
-		state = conn.GetState()
-	}
-
-	if state == connectivity.Shutdown {
-		return ErrConnectionShutdown
-	}
-
-	return nil
-}
-
 // CreateConnection creates a gRPC client connection with the appropriate transport options.
 // The component parameter specifies the WebSocket proxy component path (e.g., "/management", "/signal").
 func CreateConnection(ctx context.Context, addr string, tlsEnabled bool, component string) (*grpc.ClientConn, error) {
@@ -68,24 +42,22 @@ func CreateConnection(ctx context.Context, addr string, tlsEnabled bool, compone
 		}))
 	}
 
-	conn, err := grpc.NewClient(
+	connCtx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	conn, err := grpc.DialContext(
+		connCtx,
 		addr,
 		transportOption,
 		WithCustomDialer(tlsEnabled, component),
+		grpc.WithBlock(),
 		grpc.WithKeepaliveParams(keepalive.ClientParameters{
 			Time:    30 * time.Second,
 			Timeout: 10 * time.Second,
 		}),
 	)
 	if err != nil {
-		return nil, fmt.Errorf("new client: %w", err)
-	}
-
-	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
-	defer cancel()
-
-	if err := waitForConnectionReady(ctx, conn); err != nil {
-		_ = conn.Close()
+		log.Printf("DialContext error: %v", err)
 		return nil, err
 	}
 

client/grpc/dialer_generic.go

@@ -18,7 +18,7 @@ import (
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
-func WithCustomDialer(_ bool, _ string) grpc.DialOption {
+func WithCustomDialer(tlsEnabled bool, component string) grpc.DialOption {
 	return grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
 		if runtime.GOOS == "linux" {
 			currentUser, err := user.Current()
@@ -36,6 +36,7 @@ func WithCustomDialer(_ bool, _ string) grpc.DialOption {
 
 		conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
 		if err != nil {
+			log.Errorf("Failed to dial: %s", err)
 			return nil, fmt.Errorf("nbnet.NewDialer().DialContext: %w", err)
 		}
 		return conn, nil

client/iface/device.go

@@ -23,5 +23,4 @@ type WGTunDevice interface {
 	FilteredDevice() *device.FilteredDevice
 	Device() *wgdevice.Device
 	GetNet() *netstack.Net
-	GetICEBind() device.EndpointManager
 }

client/iface/device/device_android.go

@@ -150,11 +150,6 @@ func (t *WGTunDevice) GetNet() *netstack.Net {
 	return nil
 }
 
-// GetICEBind returns the ICEBind instance
-func (t *WGTunDevice) GetICEBind() EndpointManager {
-	return t.iceBind
-}
-
 func routesToString(routes []string) string {
 	return strings.Join(routes, ";")
 }

client/iface/device/device_darwin.go

@@ -154,8 +154,3 @@ func (t *TunDevice) assignAddr() error {
 func (t *TunDevice) GetNet() *netstack.Net {
 	return nil
 }
-
-// GetICEBind returns the ICEBind instance
-func (t *TunDevice) GetICEBind() EndpointManager {
-	return t.iceBind
-}

client/iface/device/device_ios.go

@@ -144,8 +144,3 @@ func (t *TunDevice) FilteredDevice() *FilteredDevice {
 func (t *TunDevice) GetNet() *netstack.Net {
 	return nil
 }
-
-// GetICEBind returns the ICEBind instance
-func (t *TunDevice) GetICEBind() EndpointManager {
-	return t.iceBind
-}

client/iface/device/device_kernel_unix.go

@@ -179,8 +179,3 @@ func (t *TunKernelDevice) assignAddr() error {
 func (t *TunKernelDevice) GetNet() *netstack.Net {
 	return nil
 }
-
-// GetICEBind returns nil for kernel mode devices
-func (t *TunKernelDevice) GetICEBind() EndpointManager {
-	return nil
-}

client/iface/device/device_netstack.go

@@ -21,7 +21,6 @@ type Bind interface {
 	conn.Bind
 	GetICEMux() (*udpmux.UniversalUDPMuxDefault, error)
 	ActivityRecorder() *bind.ActivityRecorder
-	EndpointManager
 }
 
 type TunNetstackDevice struct {
@@ -156,8 +155,3 @@ func (t *TunNetstackDevice) Device() *device.Device {
 func (t *TunNetstackDevice) GetNet() *netstack.Net {
 	return t.net
 }
-
-// GetICEBind returns the bind instance
-func (t *TunNetstackDevice) GetICEBind() EndpointManager {
-	return t.bind
-}

client/iface/device/device_usp_unix.go

@@ -146,8 +146,3 @@ func (t *USPDevice) assignAddr() error {
 func (t *USPDevice) GetNet() *netstack.Net {
 	return nil
 }
-
-// GetICEBind returns the ICEBind instance
-func (t *USPDevice) GetICEBind() EndpointManager {
-	return t.iceBind
-}

client/iface/device/device_windows.go

@@ -185,8 +185,3 @@ func (t *TunDevice) assignAddr() error {
 func (t *TunDevice) GetNet() *netstack.Net {
 	return nil
 }
-
-// GetICEBind returns the ICEBind instance
-func (t *TunDevice) GetICEBind() EndpointManager {
-	return t.iceBind
-}

client/iface/device/endpoint_manager.go

@@ -1,13 +0,0 @@
-package device
-
-import (
-	"net"
-	"net/netip"
-)
-
-// EndpointManager manages fake IP to connection mappings for userspace bind implementations.
-// Implemented by bind.ICEBind and bind.RelayBindJS.
-type EndpointManager interface {
-	SetEndpoint(fakeIP netip.Addr, conn net.Conn)
-	RemoveEndpoint(fakeIP netip.Addr)
-}

client/iface/device_android.go

@@ -21,5 +21,4 @@ type WGTunDevice interface {
 	FilteredDevice() *device.FilteredDevice
 	Device() *wgdevice.Device
 	GetNet() *netstack.Net
-	GetICEBind() device.EndpointManager
 }

client/iface/iface.go

@@ -80,17 +80,6 @@ func (w *WGIface) GetProxy() wgproxy.Proxy {
 	return w.wgProxyFactory.GetProxy()
 }
 
-// GetBind returns the EndpointManager userspace bind mode.
-func (w *WGIface) GetBind() device.EndpointManager {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	if w.tun == nil {
-		return nil
-	}
-	return w.tun.GetICEBind()
-}
-
 // IsUserspaceBind indicates whether this interfaces is userspace with bind.ICEBind
 func (w *WGIface) IsUserspaceBind() bool {
 	return w.userspaceBind

client/internal/acl/manager.go

@@ -29,6 +29,11 @@ type Manager interface {
 	ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRouteFeatureFlag bool)
 }
 
+type protoMatch struct {
+	ips      map[string]int
+	policyID []byte
+}
+
 // DefaultManager uses firewall manager to handle
 type DefaultManager struct {
 	firewall       firewall.Manager
@@ -81,14 +86,21 @@ func (d *DefaultManager) ApplyFiltering(networkMap *mgmProto.NetworkMap, dnsRout
 }
 
 func (d *DefaultManager) applyPeerACLs(networkMap *mgmProto.NetworkMap) {
-	rules := networkMap.FirewallRules
+	rules, squashedProtocols := d.squashAcceptRules(networkMap)
 
 	enableSSH := networkMap.PeerConfig != nil &&
 		networkMap.PeerConfig.SshConfig != nil &&
 		networkMap.PeerConfig.SshConfig.SshEnabled
+	if _, ok := squashedProtocols[mgmProto.RuleProtocol_ALL]; ok {
+		enableSSH = enableSSH && !ok
+	}
+	if _, ok := squashedProtocols[mgmProto.RuleProtocol_TCP]; ok {
+		enableSSH = enableSSH && !ok
+	}
 
-	// If SSH enabled, add default firewall rule which accepts connection to any peer
-	// in the network by SSH (TCP port defined by ssh.DefaultSSHPort).
+	// if TCP protocol rules not squashed and SSH enabled
+	// we add default firewall rule which accepts connection to any peer
+	// in the network by SSH (TCP 22 port).
 	if enableSSH {
 		rules = append(rules, &mgmProto.FirewallRule{
 			PeerIP:    "0.0.0.0",
@@ -356,6 +368,145 @@ func (d *DefaultManager) getPeerRuleID(
 	return id.RuleID(hex.EncodeToString(md5.New().Sum([]byte(idStr))))
 }
 
+// squashAcceptRules does complex logic to convert many rules which allows connection by traffic type
+// to all peers in the network map to one rule which just accepts that type of the traffic.
+//
+// NOTE: It will not squash two rules for same protocol if one covers all peers in the network,
+// but other has port definitions or has drop policy.
+func (d *DefaultManager) squashAcceptRules(
+	networkMap *mgmProto.NetworkMap,
+) ([]*mgmProto.FirewallRule, map[mgmProto.RuleProtocol]struct{}) {
+	totalIPs := 0
+	for _, p := range append(networkMap.RemotePeers, networkMap.OfflinePeers...) {
+		for range p.AllowedIps {
+			totalIPs++
+		}
+	}
+
+	in := map[mgmProto.RuleProtocol]*protoMatch{}
+	out := map[mgmProto.RuleProtocol]*protoMatch{}
+
+	// trace which type of protocols was squashed
+	squashedRules := []*mgmProto.FirewallRule{}
+	squashedProtocols := map[mgmProto.RuleProtocol]struct{}{}
+
+	// this function we use to do calculation, can we squash the rules by protocol or not.
+	// We summ amount of Peers IP for given protocol we found in original rules list.
+	// But we zeroed the IP's for protocol if:
+	// 1. Any of the rule has DROP action type.
+	// 2. Any of rule contains Port.
+	//
+	// We zeroed this to notify squash function that this protocol can't be squashed.
+	addRuleToCalculationMap := func(i int, r *mgmProto.FirewallRule, protocols map[mgmProto.RuleProtocol]*protoMatch) {
+		hasPortRestrictions := r.Action == mgmProto.RuleAction_DROP ||
+			r.Port != "" || !portInfoEmpty(r.PortInfo)
+
+		if hasPortRestrictions {
+			// Don't squash rules with port restrictions
+			protocols[r.Protocol] = &protoMatch{ips: map[string]int{}}
+			return
+		}
+
+		if _, ok := protocols[r.Protocol]; !ok {
+			protocols[r.Protocol] = &protoMatch{
+				ips: map[string]int{},
+				// store the first encountered PolicyID for this protocol
+				policyID: r.PolicyID,
+			}
+		}
+
+		// special case, when we receive this all network IP address
+		// it means that rules for that protocol was already optimized on the
+		// management side
+		if r.PeerIP == "0.0.0.0" {
+			squashedRules = append(squashedRules, r)
+			squashedProtocols[r.Protocol] = struct{}{}
+			return
+		}
+
+		ipset := protocols[r.Protocol].ips
+
+		if _, ok := ipset[r.PeerIP]; ok {
+			return
+		}
+		ipset[r.PeerIP] = i
+	}
+
+	for i, r := range networkMap.FirewallRules {
+		// calculate squash for different directions
+		if r.Direction == mgmProto.RuleDirection_IN {
+			addRuleToCalculationMap(i, r, in)
+		} else {
+			addRuleToCalculationMap(i, r, out)
+		}
+	}
+
+	// order of squashing by protocol is important
+	// only for their first element ALL, it must be done first
+	protocolOrders := []mgmProto.RuleProtocol{
+		mgmProto.RuleProtocol_ALL,
+		mgmProto.RuleProtocol_ICMP,
+		mgmProto.RuleProtocol_TCP,
+		mgmProto.RuleProtocol_UDP,
+	}
+
+	squash := func(matches map[mgmProto.RuleProtocol]*protoMatch, direction mgmProto.RuleDirection) {
+		for _, protocol := range protocolOrders {
+			match, ok := matches[protocol]
+			if !ok || len(match.ips) != totalIPs || len(match.ips) < 2 {
+				// don't squash if :
+				// 1. Rules not cover all peers in the network
+				// 2. Rules cover only one peer in the network.
+				continue
+			}
+
+			// add special rule 0.0.0.0 which allows all IP's in our firewall implementations
+			squashedRules = append(squashedRules, &mgmProto.FirewallRule{
+				PeerIP:    "0.0.0.0",
+				Direction: direction,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  protocol,
+				PolicyID:  match.policyID,
+			})
+			squashedProtocols[protocol] = struct{}{}
+
+			if protocol == mgmProto.RuleProtocol_ALL {
+				// if we have ALL traffic type squashed rule
+				// it allows all other type of traffic, so we can stop processing
+				break
+			}
+		}
+	}
+
+	squash(in, mgmProto.RuleDirection_IN)
+	squash(out, mgmProto.RuleDirection_OUT)
+
+	// if all protocol was squashed everything is allow and we can ignore all other rules
+	if _, ok := squashedProtocols[mgmProto.RuleProtocol_ALL]; ok {
+		return squashedRules, squashedProtocols
+	}
+
+	if len(squashedRules) == 0 {
+		return networkMap.FirewallRules, squashedProtocols
+	}
+
+	var rules []*mgmProto.FirewallRule
+	// filter out rules which was squashed from final list
+	// if we also have other not squashed rules.
+	for i, r := range networkMap.FirewallRules {
+		if _, ok := squashedProtocols[r.Protocol]; ok {
+			if m, ok := in[r.Protocol]; ok && m.ips[r.PeerIP] == i {
+				continue
+			} else if m, ok := out[r.Protocol]; ok && m.ips[r.PeerIP] == i {
+				continue
+			}
+		}
+		rules = append(rules, r)
+	}
+
+	return append(rules, squashedRules...), squashedProtocols
+}
+
 // getRuleGroupingSelector takes all rule properties except IP address to build selector
 func (d *DefaultManager) getRuleGroupingSelector(rule *mgmProto.FirewallRule) string {
 	return fmt.Sprintf("%v:%v:%v:%s:%v", strconv.Itoa(int(rule.Direction)), rule.Action, rule.Protocol, rule.Port, rule.PortInfo)

client/internal/acl/manager_test.go

@@ -188,6 +188,492 @@ func TestDefaultManagerStateless(t *testing.T) {
 	})
 }
 
+func TestDefaultManagerSquashRules(t *testing.T) {
+	networkMap := &mgmProto.NetworkMap{
+		RemotePeers: []*mgmProto.RemotePeerConfig{
+			{AllowedIps: []string{"10.93.0.1"}},
+			{AllowedIps: []string{"10.93.0.2"}},
+			{AllowedIps: []string{"10.93.0.3"}},
+			{AllowedIps: []string{"10.93.0.4"}},
+		},
+		FirewallRules: []*mgmProto.FirewallRule{
+			{
+				PeerIP:    "10.93.0.1",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.2",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.3",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.4",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.1",
+				Direction: mgmProto.RuleDirection_OUT,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.2",
+				Direction: mgmProto.RuleDirection_OUT,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.3",
+				Direction: mgmProto.RuleDirection_OUT,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.4",
+				Direction: mgmProto.RuleDirection_OUT,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+		},
+	}
+
+	manager := &DefaultManager{}
+	rules, _ := manager.squashAcceptRules(networkMap)
+	assert.Equal(t, 2, len(rules))
+
+	r := rules[0]
+	assert.Equal(t, "0.0.0.0", r.PeerIP)
+	assert.Equal(t, mgmProto.RuleDirection_IN, r.Direction)
+	assert.Equal(t, mgmProto.RuleProtocol_ALL, r.Protocol)
+	assert.Equal(t, mgmProto.RuleAction_ACCEPT, r.Action)
+
+	r = rules[1]
+	assert.Equal(t, "0.0.0.0", r.PeerIP)
+	assert.Equal(t, mgmProto.RuleDirection_OUT, r.Direction)
+	assert.Equal(t, mgmProto.RuleProtocol_ALL, r.Protocol)
+	assert.Equal(t, mgmProto.RuleAction_ACCEPT, r.Action)
+}
+
+func TestDefaultManagerSquashRulesNoAffect(t *testing.T) {
+	networkMap := &mgmProto.NetworkMap{
+		RemotePeers: []*mgmProto.RemotePeerConfig{
+			{AllowedIps: []string{"10.93.0.1"}},
+			{AllowedIps: []string{"10.93.0.2"}},
+			{AllowedIps: []string{"10.93.0.3"}},
+			{AllowedIps: []string{"10.93.0.4"}},
+		},
+		FirewallRules: []*mgmProto.FirewallRule{
+			{
+				PeerIP:    "10.93.0.1",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.2",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.3",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.4",
+				Direction: mgmProto.RuleDirection_IN,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_TCP,
+			},
+			{
+				PeerIP:    "10.93.0.1",
+				Direction: mgmProto.RuleDirection_OUT,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.2",
+				Direction: mgmProto.RuleDirection_OUT,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.3",
+				Direction: mgmProto.RuleDirection_OUT,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_ALL,
+			},
+			{
+				PeerIP:    "10.93.0.4",
+				Direction: mgmProto.RuleDirection_OUT,
+				Action:    mgmProto.RuleAction_ACCEPT,
+				Protocol:  mgmProto.RuleProtocol_UDP,
+			},
+		},
+	}
+
+	manager := &DefaultManager{}
+	rules, _ := manager.squashAcceptRules(networkMap)
+	assert.Equal(t, len(networkMap.FirewallRules), len(rules))
+}
+
+func TestDefaultManagerSquashRulesWithPortRestrictions(t *testing.T) {
+	tests := []struct {
+		name          string
+		rules         []*mgmProto.FirewallRule
+		expectedCount int
+		description   string
+	}{
+		{
+			name: "should not squash rules with port ranges",
+			rules: []*mgmProto.FirewallRule{
+				{
+					PeerIP:    "10.93.0.1",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					PortInfo: &mgmProto.PortInfo{
+						PortSelection: &mgmProto.PortInfo_Range_{
+							Range: &mgmProto.PortInfo_Range{
+								Start: 8080,
+								End:   8090,
+							},
+						},
+					},
+				},
+				{
+					PeerIP:    "10.93.0.2",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					PortInfo: &mgmProto.PortInfo{
+						PortSelection: &mgmProto.PortInfo_Range_{
+							Range: &mgmProto.PortInfo_Range{
+								Start: 8080,
+								End:   8090,
+							},
+						},
+					},
+				},
+				{
+					PeerIP:    "10.93.0.3",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					PortInfo: &mgmProto.PortInfo{
+						PortSelection: &mgmProto.PortInfo_Range_{
+							Range: &mgmProto.PortInfo_Range{
+								Start: 8080,
+								End:   8090,
+							},
+						},
+					},
+				},
+				{
+					PeerIP:    "10.93.0.4",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					PortInfo: &mgmProto.PortInfo{
+						PortSelection: &mgmProto.PortInfo_Range_{
+							Range: &mgmProto.PortInfo_Range{
+								Start: 8080,
+								End:   8090,
+							},
+						},
+					},
+				},
+			},
+			expectedCount: 4,
+			description:   "Rules with port ranges should not be squashed even if they cover all peers",
+		},
+		{
+			name: "should not squash rules with specific ports",
+			rules: []*mgmProto.FirewallRule{
+				{
+					PeerIP:    "10.93.0.1",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					PortInfo: &mgmProto.PortInfo{
+						PortSelection: &mgmProto.PortInfo_Port{
+							Port: 80,
+						},
+					},
+				},
+				{
+					PeerIP:    "10.93.0.2",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					PortInfo: &mgmProto.PortInfo{
+						PortSelection: &mgmProto.PortInfo_Port{
+							Port: 80,
+						},
+					},
+				},
+				{
+					PeerIP:    "10.93.0.3",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					PortInfo: &mgmProto.PortInfo{
+						PortSelection: &mgmProto.PortInfo_Port{
+							Port: 80,
+						},
+					},
+				},
+				{
+					PeerIP:    "10.93.0.4",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					PortInfo: &mgmProto.PortInfo{
+						PortSelection: &mgmProto.PortInfo_Port{
+							Port: 80,
+						},
+					},
+				},
+			},
+			expectedCount: 4,
+			description:   "Rules with specific ports should not be squashed even if they cover all peers",
+		},
+		{
+			name: "should not squash rules with legacy port field",
+			rules: []*mgmProto.FirewallRule{
+				{
+					PeerIP:    "10.93.0.1",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					Port:      "443",
+				},
+				{
+					PeerIP:    "10.93.0.2",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					Port:      "443",
+				},
+				{
+					PeerIP:    "10.93.0.3",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					Port:      "443",
+				},
+				{
+					PeerIP:    "10.93.0.4",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					Port:      "443",
+				},
+			},
+			expectedCount: 4,
+			description:   "Rules with legacy port field should not be squashed",
+		},
+		{
+			name: "should not squash rules with DROP action",
+			rules: []*mgmProto.FirewallRule{
+				{
+					PeerIP:    "10.93.0.1",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_DROP,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+				{
+					PeerIP:    "10.93.0.2",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_DROP,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+				{
+					PeerIP:    "10.93.0.3",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_DROP,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+				{
+					PeerIP:    "10.93.0.4",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_DROP,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+			},
+			expectedCount: 4,
+			description:   "Rules with DROP action should not be squashed",
+		},
+		{
+			name: "should squash rules without port restrictions",
+			rules: []*mgmProto.FirewallRule{
+				{
+					PeerIP:    "10.93.0.1",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+				{
+					PeerIP:    "10.93.0.2",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+				{
+					PeerIP:    "10.93.0.3",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+				{
+					PeerIP:    "10.93.0.4",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+			},
+			expectedCount: 1,
+			description:   "Rules without port restrictions should be squashed into a single 0.0.0.0 rule",
+		},
+		{
+			name: "mixed rules should not squash protocol with port restrictions",
+			rules: []*mgmProto.FirewallRule{
+				{
+					PeerIP:    "10.93.0.1",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+				{
+					PeerIP:    "10.93.0.2",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					PortInfo: &mgmProto.PortInfo{
+						PortSelection: &mgmProto.PortInfo_Port{
+							Port: 80,
+						},
+					},
+				},
+				{
+					PeerIP:    "10.93.0.3",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+				{
+					PeerIP:    "10.93.0.4",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+				},
+			},
+			expectedCount: 4,
+			description:   "TCP should not be squashed because one rule has port restrictions",
+		},
+		{
+			name: "should squash UDP but not TCP when TCP has port restrictions",
+			rules: []*mgmProto.FirewallRule{
+				// TCP rules with port restrictions - should NOT be squashed
+				{
+					PeerIP:    "10.93.0.1",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					Port:      "443",
+				},
+				{
+					PeerIP:    "10.93.0.2",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					Port:      "443",
+				},
+				{
+					PeerIP:    "10.93.0.3",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					Port:      "443",
+				},
+				{
+					PeerIP:    "10.93.0.4",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_TCP,
+					Port:      "443",
+				},
+				// UDP rules without port restrictions - SHOULD be squashed
+				{
+					PeerIP:    "10.93.0.1",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_UDP,
+				},
+				{
+					PeerIP:    "10.93.0.2",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_UDP,
+				},
+				{
+					PeerIP:    "10.93.0.3",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_UDP,
+				},
+				{
+					PeerIP:    "10.93.0.4",
+					Direction: mgmProto.RuleDirection_IN,
+					Action:    mgmProto.RuleAction_ACCEPT,
+					Protocol:  mgmProto.RuleProtocol_UDP,
+				},
+			},
+			expectedCount: 5, // 4 TCP rules + 1 squashed UDP rule (0.0.0.0)
+			description:   "UDP should be squashed to 0.0.0.0 rule, but TCP should remain as individual rules due to port restrictions",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			networkMap := &mgmProto.NetworkMap{
+				RemotePeers: []*mgmProto.RemotePeerConfig{
+					{AllowedIps: []string{"10.93.0.1"}},
+					{AllowedIps: []string{"10.93.0.2"}},
+					{AllowedIps: []string{"10.93.0.3"}},
+					{AllowedIps: []string{"10.93.0.4"}},
+				},
+				FirewallRules: tt.rules,
+			}
+
+			manager := &DefaultManager{}
+			rules, _ := manager.squashAcceptRules(networkMap)
+
+			assert.Equal(t, tt.expectedCount, len(rules), tt.description)
+
+			// For squashed rules, verify we get the expected 0.0.0.0 rule
+			if tt.expectedCount == 1 {
+				assert.Equal(t, "0.0.0.0", rules[0].PeerIP)
+				assert.Equal(t, mgmProto.RuleDirection_IN, rules[0].Direction)
+				assert.Equal(t, mgmProto.RuleAction_ACCEPT, rules[0].Action)
+			}
+		})
+	}
+}
+
 func TestPortInfoEmpty(t *testing.T) {
 	tests := []struct {
 		name     string

client/internal/connect.go

@@ -25,7 +25,6 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
@@ -35,6 +34,7 @@ import (
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 	signal "github.com/netbirdio/netbird/shared/signal/client"
 	"github.com/netbirdio/netbird/util"
+	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/version"
 )
 
@@ -289,18 +289,15 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}
 
 		<-engineCtx.Done()
-
 		c.engineMutex.Lock()
-		engine := c.engine
-		c.engine = nil
-		c.engineMutex.Unlock()
-
-		if engine != nil && engine.wgInterface != nil {
-			log.Infof("ensuring %s is removed, Netbird engine context cancelled", engine.wgInterface.Name())
-			if err := engine.Stop(); err != nil {
+		if c.engine != nil && c.engine.wgInterface != nil {
+			log.Infof("ensuring %s is removed, Netbird engine context cancelled", c.engine.wgInterface.Name())
+			if err := c.engine.Stop(); err != nil {
 				log.Errorf("Failed to stop engine: %v", err)
 			}
+			c.engine = nil
 		}
+		c.engineMutex.Unlock()
 		c.statusRecorder.ClientTeardown()
 
 		backOff.Reset()
@@ -385,12 +382,19 @@ func (c *ConnectClient) Status() StatusType {
 }
 
 func (c *ConnectClient) Stop() error {
-	engine := c.Engine()
-	if engine != nil {
-		if err := engine.Stop(); err != nil {
-			return fmt.Errorf("stop engine: %w", err)
-		}
+	if c == nil {
+		return nil
 	}
+	c.engineMutex.Lock()
+	defer c.engineMutex.Unlock()
+
+	if c.engine == nil {
+		return nil
+	}
+	if err := c.engine.Stop(); err != nil {
+		return fmt.Errorf("stop engine: %w", err)
+	}
+
 	return nil
 }
 

client/internal/debug/debug.go

@@ -47,7 +47,7 @@ nftables.txt: Anonymized nftables rules with packet counters, if --system-info f
 resolved_domains.txt: Anonymized resolved domain IP addresses from the status recorder.
 config.txt: Anonymized configuration information of the NetBird client.
 network_map.json: Anonymized sync response containing peer configurations, routes, DNS settings, and firewall rules.
-state.json: Anonymized client state dump containing netbird states for the active profile.
+state.json: Anonymized client state dump containing netbird states.
 mutex.prof: Mutex profiling information.
 goroutine.prof: Goroutine profiling information.
 block.prof: Block profiling information.
@@ -564,8 +564,6 @@ func (g *BundleGenerator) addStateFile() error {
 		return nil
 	}
 
-	log.Debugf("Adding state file from: %s", path)
-
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {

client/internal/debug/wgshow.go

@@ -14,9 +14,6 @@ type WGIface interface {
 }
 
 func (g *BundleGenerator) addWgShow() error {
-	if g.statusRecorder == nil {
-		return fmt.Errorf("no status recorder available for wg show")
-	}
 	result, err := g.statusRecorder.PeersStatus()
 	if err != nil {
 		return err

client/internal/dns/host_darwin.go

@@ -13,7 +13,6 @@ import (
 	"strings"
 
 	log "github.com/sirupsen/logrus"
-	"golang.org/x/exp/maps"
 
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
@@ -51,21 +50,28 @@ func (s *systemConfigurator) supportCustomPort() bool {
 }
 
 func (s *systemConfigurator) applyDNSConfig(config HostDNSConfig, stateManager *statemanager.Manager) error {
+	var err error
+
+	if err := stateManager.UpdateState(&ShutdownState{}); err != nil {
+		log.Errorf("failed to update shutdown state: %s", err)
+	}
+
 	var (
 		searchDomains []string
 		matchDomains  []string
 	)
 
-	if err := s.recordSystemDNSSettings(true); err != nil {
+	err = s.recordSystemDNSSettings(true)
+	if err != nil {
 		log.Errorf("unable to update record of System's DNS config: %s", err.Error())
 	}
 
 	if config.RouteAll {
 		searchDomains = append(searchDomains, "\"\"")
-		if err := s.addLocalDNS(); err != nil {
-			log.Warnf("failed to add local DNS: %v", err)
+		err = s.addLocalDNS()
+		if err != nil {
+			log.Infof("failed to enable split DNS")
 		}
-		s.updateState(stateManager)
 	}
 
 	for _, dConf := range config.Domains {
@@ -80,7 +86,6 @@ func (s *systemConfigurator) applyDNSConfig(config HostDNSConfig, stateManager *
 	}
 
 	matchKey := getKeyWithInput(netbirdDNSStateKeyFormat, matchSuffix)
-	var err error
 	if len(matchDomains) != 0 {
 		err = s.addMatchDomains(matchKey, strings.Join(matchDomains, " "), config.ServerIP, config.ServerPort)
 	} else {
@@ -90,7 +95,6 @@ func (s *systemConfigurator) applyDNSConfig(config HostDNSConfig, stateManager *
 	if err != nil {
 		return fmt.Errorf("add match domains: %w", err)
 	}
-	s.updateState(stateManager)
 
 	searchKey := getKeyWithInput(netbirdDNSStateKeyFormat, searchSuffix)
 	if len(searchDomains) != 0 {
@@ -102,7 +106,6 @@ func (s *systemConfigurator) applyDNSConfig(config HostDNSConfig, stateManager *
 	if err != nil {
 		return fmt.Errorf("add search domains: %w", err)
 	}
-	s.updateState(stateManager)
 
 	if err := s.flushDNSCache(); err != nil {
 		log.Errorf("failed to flush DNS cache: %v", err)
@@ -111,12 +114,6 @@ func (s *systemConfigurator) applyDNSConfig(config HostDNSConfig, stateManager *
 	return nil
 }
 
-func (s *systemConfigurator) updateState(stateManager *statemanager.Manager) {
-	if err := stateManager.UpdateState(&ShutdownState{CreatedKeys: maps.Keys(s.createdKeys)}); err != nil {
-		log.Errorf("failed to update shutdown state: %s", err)
-	}
-}
-
 func (s *systemConfigurator) string() string {
 	return "scutil"
 }
@@ -170,20 +167,18 @@ func (s *systemConfigurator) removeKeyFromSystemConfig(key string) error {
 func (s *systemConfigurator) addLocalDNS() error {
 	if !s.systemDNSSettings.ServerIP.IsValid() || len(s.systemDNSSettings.Domains) == 0 {
 		if err := s.recordSystemDNSSettings(true); err != nil {
+			log.Errorf("Unable to get system DNS configuration")
 			return fmt.Errorf("recordSystemDNSSettings(): %w", err)
 		}
 	}
 	localKey := getKeyWithInput(netbirdDNSStateKeyFormat, localSuffix)
-	if !s.systemDNSSettings.ServerIP.IsValid() || len(s.systemDNSSettings.Domains) == 0 {
+	if s.systemDNSSettings.ServerIP.IsValid() && len(s.systemDNSSettings.Domains) != 0 {
+		err := s.addSearchDomains(localKey, strings.Join(s.systemDNSSettings.Domains, " "), s.systemDNSSettings.ServerIP, s.systemDNSSettings.ServerPort)
+		if err != nil {
+			return fmt.Errorf("couldn't add local network DNS conf: %w", err)
+		}
+	} else {
 		log.Info("Not enabling local DNS server")
-		return nil
-	}
-
-	if err := s.addSearchDomains(
-		localKey,
-		strings.Join(s.systemDNSSettings.Domains, " "), s.systemDNSSettings.ServerIP, s.systemDNSSettings.ServerPort,
-	); err != nil {
-		return fmt.Errorf("add search domains: %w", err)
 	}
 
 	return nil

client/internal/dns/host_darwin_test.go

@@ -1,111 +0,0 @@
-//go:build !ios
-
-package dns
-
-import (
-	"context"
-	"net/netip"
-	"os/exec"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/statemanager"
-)
-
-func TestDarwinDNSUncleanShutdownCleanup(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping scutil integration test in short mode")
-	}
-
-	tmpDir := t.TempDir()
-	stateFile := filepath.Join(tmpDir, "state.json")
-
-	sm := statemanager.New(stateFile)
-	sm.RegisterState(&ShutdownState{})
-	sm.Start()
-	defer func() {
-		require.NoError(t, sm.Stop(context.Background()))
-	}()
-
-	configurator := &systemConfigurator{
-		createdKeys: make(map[string]struct{}),
-	}
-
-	config := HostDNSConfig{
-		ServerIP:   netip.MustParseAddr("100.64.0.1"),
-		ServerPort: 53,
-		RouteAll:   true,
-		Domains: []DomainConfig{
-			{Domain: "example.com", MatchOnly: true},
-		},
-	}
-
-	err := configurator.applyDNSConfig(config, sm)
-	require.NoError(t, err)
-
-	require.NoError(t, sm.PersistState(context.Background()))
-
-	searchKey := getKeyWithInput(netbirdDNSStateKeyFormat, searchSuffix)
-	matchKey := getKeyWithInput(netbirdDNSStateKeyFormat, matchSuffix)
-	localKey := getKeyWithInput(netbirdDNSStateKeyFormat, localSuffix)
-
-	defer func() {
-		for _, key := range []string{searchKey, matchKey, localKey} {
-			_ = removeTestDNSKey(key)
-		}
-	}()
-
-	for _, key := range []string{searchKey, matchKey, localKey} {
-		exists, err := checkDNSKeyExists(key)
-		require.NoError(t, err)
-		if exists {
-			t.Logf("Key %s exists before cleanup", key)
-		}
-	}
-
-	sm2 := statemanager.New(stateFile)
-	sm2.RegisterState(&ShutdownState{})
-	err = sm2.LoadState(&ShutdownState{})
-	require.NoError(t, err)
-
-	state := sm2.GetState(&ShutdownState{})
-	if state == nil {
-		t.Skip("State not saved, skipping cleanup test")
-	}
-
-	shutdownState, ok := state.(*ShutdownState)
-	require.True(t, ok)
-
-	err = shutdownState.Cleanup()
-	require.NoError(t, err)
-
-	for _, key := range []string{searchKey, matchKey, localKey} {
-		exists, err := checkDNSKeyExists(key)
-		require.NoError(t, err)
-		assert.False(t, exists, "Key %s should NOT exist after cleanup", key)
-	}
-}
-
-func checkDNSKeyExists(key string) (bool, error) {
-	cmd := exec.Command(scutilPath)
-	cmd.Stdin = strings.NewReader("show " + key + "\nquit\n")
-	output, err := cmd.CombinedOutput()
-	if err != nil {
-		if strings.Contains(string(output), "No such key") {
-			return false, nil
-		}
-		return false, err
-	}
-	return !strings.Contains(string(output), "No such key"), nil
-}
-
-func removeTestDNSKey(key string) error {
-	cmd := exec.Command(scutilPath)
-	cmd.Stdin = strings.NewReader("remove " + key + "\nquit\n")
-	_, err := cmd.CombinedOutput()
-	return err
-}

client/internal/dns/host_windows.go

@@ -17,7 +17,6 @@ import (
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
-	"github.com/netbirdio/netbird/client/internal/winregistry"
 )
 
 var (
@@ -179,7 +178,13 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 		log.Infof("removed %s as main DNS forwarder for this peer", config.ServerIP)
 	}
 
-	r.updateState(stateManager)
+	if err := stateManager.UpdateState(&ShutdownState{
+		Guid:           r.guid,
+		GPO:            r.gpo,
+		NRPTEntryCount: r.nrptEntryCount,
+	}); err != nil {
+		log.Errorf("failed to update shutdown state: %s", err)
+	}
 
 	var searchDomains, matchDomains []string
 	for _, dConf := range config.Domains {
@@ -192,10 +197,6 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 		matchDomains = append(matchDomains, "."+strings.TrimSuffix(dConf.Domain, "."))
 	}
 
-	if err := r.removeDNSMatchPolicies(); err != nil {
-		log.Errorf("cleanup old dns match policies: %s", err)
-	}
-
 	if len(matchDomains) != 0 {
 		count, err := r.addDNSMatchPolicy(matchDomains, config.ServerIP)
 		if err != nil {
@@ -203,10 +204,19 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 		}
 		r.nrptEntryCount = count
 	} else {
+		if err := r.removeDNSMatchPolicies(); err != nil {
+			return fmt.Errorf("remove dns match policies: %w", err)
+		}
 		r.nrptEntryCount = 0
 	}
 
-	r.updateState(stateManager)
+	if err := stateManager.UpdateState(&ShutdownState{
+		Guid:           r.guid,
+		GPO:            r.gpo,
+		NRPTEntryCount: r.nrptEntryCount,
+	}); err != nil {
+		log.Errorf("failed to update shutdown state: %s", err)
+	}
 
 	if err := r.updateSearchDomains(searchDomains); err != nil {
 		return fmt.Errorf("update search domains: %w", err)
@@ -217,16 +227,6 @@ func (r *registryConfigurator) applyDNSConfig(config HostDNSConfig, stateManager
 	return nil
 }
 
-func (r *registryConfigurator) updateState(stateManager *statemanager.Manager) {
-	if err := stateManager.UpdateState(&ShutdownState{
-		Guid:           r.guid,
-		GPO:            r.gpo,
-		NRPTEntryCount: r.nrptEntryCount,
-	}); err != nil {
-		log.Errorf("failed to update shutdown state: %s", err)
-	}
-}
-
 func (r *registryConfigurator) addDNSSetupForAll(ip netip.Addr) error {
 	if err := r.setInterfaceRegistryKeyStringValue(interfaceConfigNameServerKey, ip.String()); err != nil {
 		return fmt.Errorf("adding dns setup for all failed: %w", err)
@@ -273,9 +273,9 @@ func (r *registryConfigurator) configureDNSPolicy(policyPath string, domains []s
 		return fmt.Errorf("remove existing dns policy: %w", err)
 	}
 
-	regKey, _, err := winregistry.CreateVolatileKey(registry.LOCAL_MACHINE, policyPath, registry.SET_VALUE)
+	regKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, policyPath, registry.SET_VALUE)
 	if err != nil {
-		return fmt.Errorf("create volatile registry key HKEY_LOCAL_MACHINE\\%s: %w", policyPath, err)
+		return fmt.Errorf("create registry key HKEY_LOCAL_MACHINE\\%s: %w", policyPath, err)
 	}
 	defer closer(regKey)
 

client/internal/dns/host_windows_test.go

@@ -1,102 +0,0 @@
-package dns
-
-import (
-	"fmt"
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.org/x/sys/windows/registry"
-)
-
-// TestNRPTEntriesCleanupOnConfigChange tests that old NRPT entries are properly cleaned up
-// when the number of match domains decreases between configuration changes.
-func TestNRPTEntriesCleanupOnConfigChange(t *testing.T) {
-	if testing.Short() {
-		t.Skip("skipping registry integration test in short mode")
-	}
-
-	defer cleanupRegistryKeys(t)
-	cleanupRegistryKeys(t)
-
-	testIP := netip.MustParseAddr("100.64.0.1")
-
-	// Create a test interface registry key so updateSearchDomains doesn't fail
-	testGUID := "{12345678-1234-1234-1234-123456789ABC}"
-	interfacePath := `SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\` + testGUID
-	testKey, _, err := registry.CreateKey(registry.LOCAL_MACHINE, interfacePath, registry.SET_VALUE)
-	require.NoError(t, err, "Should create test interface registry key")
-	testKey.Close()
-	defer func() {
-		_ = registry.DeleteKey(registry.LOCAL_MACHINE, interfacePath)
-	}()
-
-	cfg := &registryConfigurator{
-		guid: testGUID,
-		gpo:  false,
-	}
-
-	config5 := HostDNSConfig{
-		ServerIP: testIP,
-		Domains: []DomainConfig{
-			{Domain: "domain1.com", MatchOnly: true},
-			{Domain: "domain2.com", MatchOnly: true},
-			{Domain: "domain3.com", MatchOnly: true},
-			{Domain: "domain4.com", MatchOnly: true},
-			{Domain: "domain5.com", MatchOnly: true},
-		},
-	}
-
-	err = cfg.applyDNSConfig(config5, nil)
-	require.NoError(t, err)
-
-	// Verify all 5 entries exist
-	for i := 0; i < 5; i++ {
-		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
-		require.NoError(t, err)
-		assert.True(t, exists, "Entry %d should exist after first config", i)
-	}
-
-	config2 := HostDNSConfig{
-		ServerIP: testIP,
-		Domains: []DomainConfig{
-			{Domain: "domain1.com", MatchOnly: true},
-			{Domain: "domain2.com", MatchOnly: true},
-		},
-	}
-
-	err = cfg.applyDNSConfig(config2, nil)
-	require.NoError(t, err)
-
-	// Verify first 2 entries exist
-	for i := 0; i < 2; i++ {
-		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
-		require.NoError(t, err)
-		assert.True(t, exists, "Entry %d should exist after second config", i)
-	}
-
-	// Verify entries 2-4 are cleaned up
-	for i := 2; i < 5; i++ {
-		exists, err := registryKeyExists(fmt.Sprintf("%s-%d", dnsPolicyConfigMatchPath, i))
-		require.NoError(t, err)
-		assert.False(t, exists, "Entry %d should NOT exist after reducing to 2 domains", i)
-	}
-}
-
-func registryKeyExists(path string) (bool, error) {
-	k, err := registry.OpenKey(registry.LOCAL_MACHINE, path, registry.QUERY_VALUE)
-	if err != nil {
-		if err == registry.ErrNotExist {
-			return false, nil
-		}
-		return false, err
-	}
-	k.Close()
-	return true, nil
-}
-
-func cleanupRegistryKeys(*testing.T) {
-	cfg := &registryConfigurator{nrptEntryCount: 10}
-	_ = cfg.removeDNSMatchPolicies()
-}

client/internal/dns/server.go

@@ -65,9 +65,8 @@ type hostManagerWithOriginalNS interface {
 
 // DefaultServer dns server object
 type DefaultServer struct {
-	ctx        context.Context
-	ctxCancel  context.CancelFunc
-	shutdownWg sync.WaitGroup
+	ctx       context.Context
+	ctxCancel context.CancelFunc
 	// disableSys disables system DNS management (e.g., /etc/resolv.conf updates) while keeping the DNS service running.
 	// This is different from ServiceEnable=false from management which completely disables the DNS service.
 	disableSys         bool
@@ -319,7 +318,6 @@ func (s *DefaultServer) DnsIP() netip.Addr {
 // Stop stops the server
 func (s *DefaultServer) Stop() {
 	s.ctxCancel()
-	s.shutdownWg.Wait()
 
 	s.mux.Lock()
 	defer s.mux.Unlock()
@@ -509,9 +507,8 @@ func (s *DefaultServer) applyConfiguration(update nbdns.Config) error {
 
 	s.applyHostConfig()
 
-	s.shutdownWg.Add(1)
 	go func() {
-		defer s.shutdownWg.Done()
+		// persist dns state right away
 		if err := s.stateManager.PersistState(s.ctx); err != nil {
 			log.Errorf("Failed to persist dns state: %v", err)
 		}

client/internal/dns/unclean_shutdown_darwin.go

@@ -7,7 +7,6 @@ import (
 )
 
 type ShutdownState struct {
-	CreatedKeys []string
 }
 
 func (s *ShutdownState) Name() string {
@@ -20,10 +19,6 @@ func (s *ShutdownState) Cleanup() error {
 		return fmt.Errorf("create host manager: %w", err)
 	}
 
-	for _, key := range s.CreatedKeys {
-		manager.createdKeys[key] = struct{}{}
-	}
-
 	if err := manager.restoreUncleanShutdownDNS(); err != nil {
 		return fmt.Errorf("restore unclean shutdown dns: %w", err)
 	}

client/internal/engine.go

@@ -200,10 +200,8 @@ type Engine struct {
 	flowManager         nftypes.FlowManager
 
 	// WireGuard interface monitor
-	wgIfaceMonitor *WGIfaceMonitor
-
-	// shutdownWg tracks all long-running goroutines to ensure clean shutdown
-	shutdownWg sync.WaitGroup
+	wgIfaceMonitor   *WGIfaceMonitor
+	wgIfaceMonitorWg sync.WaitGroup
 
 	// dns forwarder port
 	dnsFwdPort uint16
@@ -328,6 +326,10 @@ func (e *Engine) Stop() error {
 		e.cancel()
 	}
 
+	// very ugly but we want to remove peers from the WireGuard interface first before removing interface.
+	// Removing peers happens in the conn.Close() asynchronously
+	time.Sleep(500 * time.Millisecond)
+
 	e.close()
 
 	// stop flow manager after wg interface is gone
@@ -335,6 +337,8 @@ func (e *Engine) Stop() error {
 		e.flowManager.Close()
 	}
 
+	log.Infof("stopped Netbird Engine")
+
 	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
 	defer cancel()
 
@@ -345,52 +349,12 @@ func (e *Engine) Stop() error {
 		log.Errorf("failed to persist state: %v", err)
 	}
 
-	timeout := e.calculateShutdownTimeout()
-	log.Debugf("waiting for goroutines to finish with timeout: %v", timeout)
-	shutdownCtx, cancel := context.WithTimeout(context.Background(), timeout)
-	defer cancel()
-
-	if err := waitWithContext(shutdownCtx, &e.shutdownWg); err != nil {
-		log.Warnf("shutdown timeout exceeded after %v, some goroutines may still be running", timeout)
-	}
-
-	log.Infof("stopped Netbird Engine")
+	// Stop WireGuard interface monitor and wait for it to exit
+	e.wgIfaceMonitorWg.Wait()
 
 	return nil
 }
 
-// calculateShutdownTimeout returns shutdown timeout: 10s base + 100ms per peer, capped at 30s.
-func (e *Engine) calculateShutdownTimeout() time.Duration {
-	peerCount := len(e.peerStore.PeersPubKey())
-
-	baseTimeout := 10 * time.Second
-	perPeerTimeout := time.Duration(peerCount) * 100 * time.Millisecond
-	timeout := baseTimeout + perPeerTimeout
-
-	maxTimeout := 30 * time.Second
-	if timeout > maxTimeout {
-		timeout = maxTimeout
-	}
-
-	return timeout
-}
-
-// waitWithContext waits for WaitGroup with timeout, returns ctx.Err() on timeout.
-func waitWithContext(ctx context.Context, wg *sync.WaitGroup) error {
-	done := make(chan struct{})
-	go func() {
-		wg.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		return nil
-	case <-ctx.Done():
-		return ctx.Err()
-	}
-}
-
 // Start creates a new WireGuard tunnel interface and listens to events from Signal and Management services
 // Connections to remote peers are not established here.
 // However, they will be established once an event with a list of peers to connect to will be received from Management Service
@@ -520,14 +484,14 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 
 	// monitor WireGuard interface lifecycle and restart engine on changes
 	e.wgIfaceMonitor = NewWGIfaceMonitor()
-	e.shutdownWg.Add(1)
+	e.wgIfaceMonitorWg.Add(1)
 
 	go func() {
-		defer e.shutdownWg.Done()
+		defer e.wgIfaceMonitorWg.Done()
 
 		if shouldRestart, err := e.wgIfaceMonitor.Start(e.ctx, e.wgInterface.Name()); shouldRestart {
 			log.Infof("WireGuard interface monitor: %s, restarting engine", err)
-			e.triggerClientRestart()
+			e.restartEngine()
 		} else if err != nil {
 			log.Warnf("WireGuard interface monitor: %s", err)
 		}
@@ -928,9 +892,7 @@ func (e *Engine) updateSSH(sshConf *mgmProto.SSHConfig) error {
 			if err != nil {
 				return fmt.Errorf("create ssh server: %w", err)
 			}
-			e.shutdownWg.Add(1)
 			go func() {
-				defer e.shutdownWg.Done()
 				// blocking
 				err = e.sshServer.Start()
 				if err != nil {
@@ -988,9 +950,7 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 // receiveManagementEvents connects to the Management Service event stream to receive updates from the management service
 // E.g. when a new peer has been registered and we are allowed to connect to it.
 func (e *Engine) receiveManagementEvents() {
-	e.shutdownWg.Add(1)
 	go func() {
-		defer e.shutdownWg.Done()
 		info, err := system.GetInfoWithChecks(e.ctx, e.checks)
 		if err != nil {
 			log.Warnf("failed to get system info with checks: %v", err)
@@ -1408,9 +1368,7 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 
 // receiveSignalEvents connects to the Signal Service event stream to negotiate connection with remote peers
 func (e *Engine) receiveSignalEvents() {
-	e.shutdownWg.Add(1)
 	go func() {
-		defer e.shutdownWg.Done()
 		// connect to a stream of messages coming from the signal server
 		err := e.signal.Receive(e.ctx, func(msg *sProto.Message) error {
 			e.syncMsgMux.Lock()
@@ -1766,10 +1724,8 @@ func (e *Engine) probeICE(stuns, turns []*stun.URI) []relay.ProbeResult {
 	)
 }
 
-// triggerClientRestart triggers a full client restart by cancelling the client context.
-// Note: This does NOT just restart the engine - it cancels the entire client context,
-// which causes the connect client's retry loop to create a completely new engine.
-func (e *Engine) triggerClientRestart() {
+// restartEngine restarts the engine by cancelling the client context
+func (e *Engine) restartEngine() {
 	e.syncMsgMux.Lock()
 	defer e.syncMsgMux.Unlock()
 
@@ -1791,9 +1747,7 @@ func (e *Engine) startNetworkMonitor() {
 	}
 
 	e.networkMonitor = networkmonitor.New()
-	e.shutdownWg.Add(1)
 	go func() {
-		defer e.shutdownWg.Done()
 		if err := e.networkMonitor.Listen(e.ctx); err != nil {
 			if errors.Is(err, context.Canceled) {
 				log.Infof("network monitor stopped")
@@ -1803,8 +1757,8 @@ func (e *Engine) startNetworkMonitor() {
 			return
 		}
 
-		log.Infof("Network monitor: detected network change, triggering client restart")
-		e.triggerClientRestart()
+		log.Infof("Network monitor: detected network change, restarting engine")
+		e.restartEngine()
 	}()
 }
 

client/internal/lazyconn/activity/lazy_conn.go

@@ -1,82 +0,0 @@
-package activity
-
-import (
-	"context"
-	"io"
-	"net"
-	"time"
-)
-
-// lazyConn detects activity when WireGuard attempts to send packets.
-// It does not deliver packets, only signals that activity occurred.
-type lazyConn struct {
-	activityCh chan struct{}
-	ctx        context.Context
-	cancel     context.CancelFunc
-}
-
-// newLazyConn creates a new lazyConn for activity detection.
-func newLazyConn() *lazyConn {
-	ctx, cancel := context.WithCancel(context.Background())
-	return &lazyConn{
-		activityCh: make(chan struct{}, 1),
-		ctx:        ctx,
-		cancel:     cancel,
-	}
-}
-
-// Read blocks until the connection is closed.
-func (c *lazyConn) Read(_ []byte) (n int, err error) {
-	<-c.ctx.Done()
-	return 0, io.EOF
-}
-
-// Write signals activity detection when ICEBind routes packets to this endpoint.
-func (c *lazyConn) Write(b []byte) (n int, err error) {
-	if c.ctx.Err() != nil {
-		return 0, io.EOF
-	}
-
-	select {
-	case c.activityCh <- struct{}{}:
-	default:
-	}
-
-	return len(b), nil
-}
-
-// ActivityChan returns the channel that signals when activity is detected.
-func (c *lazyConn) ActivityChan() <-chan struct{} {
-	return c.activityCh
-}
-
-// Close closes the connection.
-func (c *lazyConn) Close() error {
-	c.cancel()
-	return nil
-}
-
-// LocalAddr returns the local address.
-func (c *lazyConn) LocalAddr() net.Addr {
-	return &net.UDPAddr{IP: net.IP{127, 0, 0, 1}, Port: lazyBindPort}
-}
-
-// RemoteAddr returns the remote address.
-func (c *lazyConn) RemoteAddr() net.Addr {
-	return &net.UDPAddr{IP: net.IP{127, 0, 0, 1}, Port: lazyBindPort}
-}
-
-// SetDeadline sets the read and write deadlines.
-func (c *lazyConn) SetDeadline(_ time.Time) error {
-	return nil
-}
-
-// SetReadDeadline sets the deadline for future Read calls.
-func (c *lazyConn) SetReadDeadline(_ time.Time) error {
-	return nil
-}
-
-// SetWriteDeadline sets the deadline for future Write calls.
-func (c *lazyConn) SetWriteDeadline(_ time.Time) error {
-	return nil
-}

client/internal/lazyconn/activity/listener.go

@@ -11,27 +11,26 @@ import (
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 )
 
-// UDPListener uses UDP sockets for activity detection in kernel mode.
-type UDPListener struct {
+// Listener it is not a thread safe implementation, do not call Close before ReadPackets. It will cause blocking
+type Listener struct {
 	wgIface  WgInterface
 	peerCfg  lazyconn.PeerConfig
 	conn     *net.UDPConn
 	endpoint *net.UDPAddr
 	done     sync.Mutex
 
-	isClosed atomic.Bool
+	isClosed atomic.Bool // use to avoid error log when closing the listener
 }
 
-// NewUDPListener creates a listener that detects activity via UDP socket reads.
-func NewUDPListener(wgIface WgInterface, cfg lazyconn.PeerConfig) (*UDPListener, error) {
-	d := &UDPListener{
+func NewListener(wgIface WgInterface, cfg lazyconn.PeerConfig) (*Listener, error) {
+	d := &Listener{
 		wgIface: wgIface,
 		peerCfg: cfg,
 	}
 
 	conn, err := d.newConn()
 	if err != nil {
-		return nil, fmt.Errorf("create UDP connection: %v", err)
+		return nil, fmt.Errorf("failed to creating activity listener: %v", err)
 	}
 	d.conn = conn
 	d.endpoint = conn.LocalAddr().(*net.UDPAddr)
@@ -39,14 +38,12 @@ func NewUDPListener(wgIface WgInterface, cfg lazyconn.PeerConfig) (*UDPListener,
 	if err := d.createEndpoint(); err != nil {
 		return nil, err
 	}
-
 	d.done.Lock()
-	cfg.Log.Infof("created activity listener: %s", d.conn.LocalAddr().(*net.UDPAddr).String())
+	cfg.Log.Infof("created activity listener: %s", conn.LocalAddr().(*net.UDPAddr).String())
 	return d, nil
 }
 
-// ReadPackets blocks reading from the UDP socket until activity is detected or the listener is closed.
-func (d *UDPListener) ReadPackets() {
+func (d *Listener) ReadPackets() {
 	for {
 		n, remoteAddr, err := d.conn.ReadFromUDP(make([]byte, 1))
 		if err != nil {
@@ -67,17 +64,15 @@ func (d *UDPListener) ReadPackets() {
 	}
 
 	d.peerCfg.Log.Debugf("removing lazy endpoint: %s", d.endpoint.String())
-	if err := d.wgIface.RemovePeer(d.peerCfg.PublicKey); err != nil {
+	if err := d.removeEndpoint(); err != nil {
 		d.peerCfg.Log.Errorf("failed to remove endpoint: %s", err)
 	}
 
-	// Ignore close error as it may return "use of closed network connection" if already closed.
-	_ = d.conn.Close()
+	_ = d.conn.Close() // do not care err because some cases it will return "use of closed network connection"
 	d.done.Unlock()
 }
 
-// Close stops the listener and cleans up resources.
-func (d *UDPListener) Close() {
+func (d *Listener) Close() {
 	d.peerCfg.Log.Infof("closing activity listener: %s", d.conn.LocalAddr().String())
 	d.isClosed.Store(true)
 
@@ -87,12 +82,16 @@ func (d *UDPListener) Close() {
 	d.done.Lock()
 }
 
-func (d *UDPListener) createEndpoint() error {
+func (d *Listener) removeEndpoint() error {
+	return d.wgIface.RemovePeer(d.peerCfg.PublicKey)
+}
+
+func (d *Listener) createEndpoint() error {
 	d.peerCfg.Log.Debugf("creating lazy endpoint: %s", d.endpoint.String())
 	return d.wgIface.UpdatePeer(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, 0, d.endpoint, nil)
 }
 
-func (d *UDPListener) newConn() (*net.UDPConn, error) {
+func (d *Listener) newConn() (*net.UDPConn, error) {
 	addr := &net.UDPAddr{
 		Port: 0,
 		IP:   listenIP,

client/internal/lazyconn/activity/listener_bind.go

@@ -1,127 +0,0 @@
-package activity
-
-import (
-	"fmt"
-	"net"
-	"net/netip"
-	"sync"
-
-	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/internal/lazyconn"
-)
-
-type bindProvider interface {
-	GetBind() device.EndpointManager
-}
-
-const (
-	// lazyBindPort is an obscure port used for lazy peer endpoints to avoid confusion with real peers.
-	// The actual routing is done via fakeIP in ICEBind, not by this port.
-	lazyBindPort = 17473
-)
-
-// BindListener uses lazyConn with bind implementations for direct data passing in userspace bind mode.
-type BindListener struct {
-	wgIface WgInterface
-	peerCfg lazyconn.PeerConfig
-	done    sync.WaitGroup
-
-	lazyConn *lazyConn
-	bind     device.EndpointManager
-	fakeIP   netip.Addr
-}
-
-// NewBindListener creates a listener that passes data directly through bind using LazyConn.
-// It automatically derives a unique fake IP from the peer's NetBird IP in the 127.2.x.x range.
-func NewBindListener(wgIface WgInterface, bind device.EndpointManager, cfg lazyconn.PeerConfig) (*BindListener, error) {
-	fakeIP, err := deriveFakeIP(wgIface, cfg.AllowedIPs)
-	if err != nil {
-		return nil, fmt.Errorf("derive fake IP: %w", err)
-	}
-
-	d := &BindListener{
-		wgIface: wgIface,
-		peerCfg: cfg,
-		bind:    bind,
-		fakeIP:  fakeIP,
-	}
-
-	if err := d.setupLazyConn(); err != nil {
-		return nil, fmt.Errorf("setup lazy connection: %v", err)
-	}
-
-	d.done.Add(1)
-	return d, nil
-}
-
-// deriveFakeIP creates a deterministic fake IP for bind mode based on peer's NetBird IP.
-// Maps peer IP 100.64.x.y to fake IP 127.2.x.y (similar to relay proxy using 127.1.x.y).
-// It finds the peer's actual NetBird IP by checking which allowedIP is in the same subnet as our WG interface.
-func deriveFakeIP(wgIface WgInterface, allowedIPs []netip.Prefix) (netip.Addr, error) {
-	if len(allowedIPs) == 0 {
-		return netip.Addr{}, fmt.Errorf("no allowed IPs for peer")
-	}
-
-	ourNetwork := wgIface.Address().Network
-
-	var peerIP netip.Addr
-	for _, allowedIP := range allowedIPs {
-		ip := allowedIP.Addr()
-		if !ip.Is4() {
-			continue
-		}
-		if ourNetwork.Contains(ip) {
-			peerIP = ip
-			break
-		}
-	}
-
-	if !peerIP.IsValid() {
-		return netip.Addr{}, fmt.Errorf("no peer NetBird IP found in allowed IPs")
-	}
-
-	octets := peerIP.As4()
-	fakeIP := netip.AddrFrom4([4]byte{127, 2, octets[2], octets[3]})
-	return fakeIP, nil
-}
-
-func (d *BindListener) setupLazyConn() error {
-	d.lazyConn = newLazyConn()
-	d.bind.SetEndpoint(d.fakeIP, d.lazyConn)
-
-	endpoint := &net.UDPAddr{
-		IP:   d.fakeIP.AsSlice(),
-		Port: lazyBindPort,
-	}
-	return d.wgIface.UpdatePeer(d.peerCfg.PublicKey, d.peerCfg.AllowedIPs, 0, endpoint, nil)
-}
-
-// ReadPackets blocks until activity is detected on the LazyConn or the listener is closed.
-func (d *BindListener) ReadPackets() {
-	select {
-	case <-d.lazyConn.ActivityChan():
-		d.peerCfg.Log.Infof("activity detected via LazyConn")
-	case <-d.lazyConn.ctx.Done():
-		d.peerCfg.Log.Infof("exit from activity listener")
-	}
-
-	d.peerCfg.Log.Debugf("removing lazy endpoint for peer %s", d.peerCfg.PublicKey)
-	if err := d.wgIface.RemovePeer(d.peerCfg.PublicKey); err != nil {
-		d.peerCfg.Log.Errorf("failed to remove endpoint: %s", err)
-	}
-
-	_ = d.lazyConn.Close()
-	d.bind.RemoveEndpoint(d.fakeIP)
-	d.done.Done()
-}
-
-// Close stops the listener and cleans up resources.
-func (d *BindListener) Close() {
-	d.peerCfg.Log.Infof("closing activity listener (LazyConn)")
-
-	if err := d.lazyConn.Close(); err != nil {
-		d.peerCfg.Log.Errorf("failed to close LazyConn: %s", err)
-	}
-
-	d.done.Wait()
-}

client/internal/lazyconn/activity/listener_bind_test.go

@@ -1,291 +0,0 @@
-package activity
-
-import (
-	"net"
-	"net/netip"
-	"runtime"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-
-	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-	"github.com/netbirdio/netbird/client/internal/lazyconn"
-	peerid "github.com/netbirdio/netbird/client/internal/peer/id"
-)
-
-func isBindListenerPlatform() bool {
-	return runtime.GOOS == "windows" || runtime.GOOS == "js"
-}
-
-// mockEndpointManager implements device.EndpointManager for testing
-type mockEndpointManager struct {
-	endpoints map[netip.Addr]net.Conn
-}
-
-func newMockEndpointManager() *mockEndpointManager {
-	return &mockEndpointManager{
-		endpoints: make(map[netip.Addr]net.Conn),
-	}
-}
-
-func (m *mockEndpointManager) SetEndpoint(fakeIP netip.Addr, conn net.Conn) {
-	m.endpoints[fakeIP] = conn
-}
-
-func (m *mockEndpointManager) RemoveEndpoint(fakeIP netip.Addr) {
-	delete(m.endpoints, fakeIP)
-}
-
-func (m *mockEndpointManager) GetEndpoint(fakeIP netip.Addr) net.Conn {
-	return m.endpoints[fakeIP]
-}
-
-// MockWGIfaceBind mocks WgInterface with bind support
-type MockWGIfaceBind struct {
-	endpointMgr *mockEndpointManager
-}
-
-func (m *MockWGIfaceBind) RemovePeer(string) error {
-	return nil
-}
-
-func (m *MockWGIfaceBind) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
-	return nil
-}
-
-func (m *MockWGIfaceBind) IsUserspaceBind() bool {
-	return true
-}
-
-func (m *MockWGIfaceBind) Address() wgaddr.Address {
-	return wgaddr.Address{
-		IP:      netip.MustParseAddr("100.64.0.1"),
-		Network: netip.MustParsePrefix("100.64.0.0/16"),
-	}
-}
-
-func (m *MockWGIfaceBind) GetBind() device.EndpointManager {
-	return m.endpointMgr
-}
-
-func TestBindListener_Creation(t *testing.T) {
-	mockEndpointMgr := newMockEndpointManager()
-	mockIface := &MockWGIfaceBind{endpointMgr: mockEndpointMgr}
-
-	peer := &MocPeer{PeerID: "testPeer1"}
-	cfg := lazyconn.PeerConfig{
-		PublicKey:  peer.PeerID,
-		PeerConnID: peer.ConnID(),
-		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
-		Log:        log.WithField("peer", "testPeer1"),
-	}
-
-	listener, err := NewBindListener(mockIface, mockEndpointMgr, cfg)
-	require.NoError(t, err)
-
-	expectedFakeIP := netip.MustParseAddr("127.2.0.2")
-	conn := mockEndpointMgr.GetEndpoint(expectedFakeIP)
-	require.NotNil(t, conn, "Endpoint should be registered in mock endpoint manager")
-
-	_, ok := conn.(*lazyConn)
-	assert.True(t, ok, "Registered endpoint should be a lazyConn")
-
-	readPacketsDone := make(chan struct{})
-	go func() {
-		listener.ReadPackets()
-		close(readPacketsDone)
-	}()
-
-	listener.Close()
-
-	select {
-	case <-readPacketsDone:
-	case <-time.After(2 * time.Second):
-		t.Fatal("timeout waiting for ReadPackets to exit after Close")
-	}
-}
-
-func TestBindListener_ActivityDetection(t *testing.T) {
-	mockEndpointMgr := newMockEndpointManager()
-	mockIface := &MockWGIfaceBind{endpointMgr: mockEndpointMgr}
-
-	peer := &MocPeer{PeerID: "testPeer1"}
-	cfg := lazyconn.PeerConfig{
-		PublicKey:  peer.PeerID,
-		PeerConnID: peer.ConnID(),
-		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
-		Log:        log.WithField("peer", "testPeer1"),
-	}
-
-	listener, err := NewBindListener(mockIface, mockEndpointMgr, cfg)
-	require.NoError(t, err)
-
-	activityDetected := make(chan struct{})
-	go func() {
-		listener.ReadPackets()
-		close(activityDetected)
-	}()
-
-	fakeIP := listener.fakeIP
-	conn := mockEndpointMgr.GetEndpoint(fakeIP)
-	require.NotNil(t, conn, "Endpoint should be registered")
-
-	_, err = conn.Write([]byte{0x01, 0x02, 0x03})
-	require.NoError(t, err)
-
-	select {
-	case <-activityDetected:
-	case <-time.After(2 * time.Second):
-		t.Fatal("timeout waiting for activity detection")
-	}
-
-	assert.Nil(t, mockEndpointMgr.GetEndpoint(fakeIP), "Endpoint should be removed after activity detection")
-}
-
-func TestBindListener_Close(t *testing.T) {
-	mockEndpointMgr := newMockEndpointManager()
-	mockIface := &MockWGIfaceBind{endpointMgr: mockEndpointMgr}
-
-	peer := &MocPeer{PeerID: "testPeer1"}
-	cfg := lazyconn.PeerConfig{
-		PublicKey:  peer.PeerID,
-		PeerConnID: peer.ConnID(),
-		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
-		Log:        log.WithField("peer", "testPeer1"),
-	}
-
-	listener, err := NewBindListener(mockIface, mockEndpointMgr, cfg)
-	require.NoError(t, err)
-
-	readPacketsDone := make(chan struct{})
-	go func() {
-		listener.ReadPackets()
-		close(readPacketsDone)
-	}()
-
-	fakeIP := listener.fakeIP
-	listener.Close()
-
-	select {
-	case <-readPacketsDone:
-	case <-time.After(2 * time.Second):
-		t.Fatal("timeout waiting for ReadPackets to exit after Close")
-	}
-
-	assert.Nil(t, mockEndpointMgr.GetEndpoint(fakeIP), "Endpoint should be removed after Close")
-}
-
-func TestManager_BindMode(t *testing.T) {
-	if !isBindListenerPlatform() {
-		t.Skip("BindListener only used on Windows/JS platforms")
-	}
-
-	mockEndpointMgr := newMockEndpointManager()
-	mockIface := &MockWGIfaceBind{endpointMgr: mockEndpointMgr}
-
-	peer := &MocPeer{PeerID: "testPeer1"}
-	mgr := NewManager(mockIface)
-	defer mgr.Close()
-
-	cfg := lazyconn.PeerConfig{
-		PublicKey:  peer.PeerID,
-		PeerConnID: peer.ConnID(),
-		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
-		Log:        log.WithField("peer", "testPeer1"),
-	}
-
-	err := mgr.MonitorPeerActivity(cfg)
-	require.NoError(t, err)
-
-	listener, exists := mgr.GetPeerListener(cfg.PeerConnID)
-	require.True(t, exists, "Peer listener should be found")
-
-	bindListener, ok := listener.(*BindListener)
-	require.True(t, ok, "Listener should be BindListener, got %T", listener)
-
-	fakeIP := bindListener.fakeIP
-	conn := mockEndpointMgr.GetEndpoint(fakeIP)
-	require.NotNil(t, conn, "Endpoint should be registered")
-
-	_, err = conn.Write([]byte{0x01, 0x02, 0x03})
-	require.NoError(t, err)
-
-	select {
-	case peerConnID := <-mgr.OnActivityChan:
-		assert.Equal(t, cfg.PeerConnID, peerConnID, "Received peer connection ID should match")
-	case <-time.After(2 * time.Second):
-		t.Fatal("timeout waiting for activity notification")
-	}
-
-	assert.Nil(t, mockEndpointMgr.GetEndpoint(fakeIP), "Endpoint should be removed after activity")
-}
-
-func TestManager_BindMode_MultiplePeers(t *testing.T) {
-	if !isBindListenerPlatform() {
-		t.Skip("BindListener only used on Windows/JS platforms")
-	}
-
-	mockEndpointMgr := newMockEndpointManager()
-	mockIface := &MockWGIfaceBind{endpointMgr: mockEndpointMgr}
-
-	peer1 := &MocPeer{PeerID: "testPeer1"}
-	peer2 := &MocPeer{PeerID: "testPeer2"}
-	mgr := NewManager(mockIface)
-	defer mgr.Close()
-
-	cfg1 := lazyconn.PeerConfig{
-		PublicKey:  peer1.PeerID,
-		PeerConnID: peer1.ConnID(),
-		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
-		Log:        log.WithField("peer", "testPeer1"),
-	}
-
-	cfg2 := lazyconn.PeerConfig{
-		PublicKey:  peer2.PeerID,
-		PeerConnID: peer2.ConnID(),
-		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.3/32")},
-		Log:        log.WithField("peer", "testPeer2"),
-	}
-
-	err := mgr.MonitorPeerActivity(cfg1)
-	require.NoError(t, err)
-
-	err = mgr.MonitorPeerActivity(cfg2)
-	require.NoError(t, err)
-
-	listener1, exists := mgr.GetPeerListener(cfg1.PeerConnID)
-	require.True(t, exists, "Peer1 listener should be found")
-	bindListener1 := listener1.(*BindListener)
-
-	listener2, exists := mgr.GetPeerListener(cfg2.PeerConnID)
-	require.True(t, exists, "Peer2 listener should be found")
-	bindListener2 := listener2.(*BindListener)
-
-	conn1 := mockEndpointMgr.GetEndpoint(bindListener1.fakeIP)
-	require.NotNil(t, conn1, "Peer1 endpoint should be registered")
-	_, err = conn1.Write([]byte{0x01})
-	require.NoError(t, err)
-
-	conn2 := mockEndpointMgr.GetEndpoint(bindListener2.fakeIP)
-	require.NotNil(t, conn2, "Peer2 endpoint should be registered")
-	_, err = conn2.Write([]byte{0x02})
-	require.NoError(t, err)
-
-	receivedPeers := make(map[peerid.ConnID]bool)
-	for i := 0; i < 2; i++ {
-		select {
-		case peerConnID := <-mgr.OnActivityChan:
-			receivedPeers[peerConnID] = true
-		case <-time.After(2 * time.Second):
-			t.Fatal("timeout waiting for activity notifications")
-		}
-	}
-
-	assert.True(t, receivedPeers[cfg1.PeerConnID], "Peer1 activity should be received")
-	assert.True(t, receivedPeers[cfg2.PeerConnID], "Peer2 activity should be received")
-}

client/internal/lazyconn/activity/listener_test.go

@@ -0,0 +1,41 @@
+package activity
+
+import (
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/lazyconn"
+)
+
+func TestNewListener(t *testing.T) {
+	peer := &MocPeer{
+		PeerID: "examplePublicKey1",
+	}
+
+	cfg := lazyconn.PeerConfig{
+		PublicKey:  peer.PeerID,
+		PeerConnID: peer.ConnID(),
+		Log:        log.WithField("peer", "examplePublicKey1"),
+	}
+
+	l, err := NewListener(MocWGIface{}, cfg)
+	if err != nil {
+		t.Fatalf("failed to create listener: %v", err)
+	}
+
+	chanClosed := make(chan struct{})
+	go func() {
+		defer close(chanClosed)
+		l.ReadPackets()
+	}()
+
+	time.Sleep(1 * time.Second)
+	l.Close()
+
+	select {
+	case <-chanClosed:
+	case <-time.After(time.Second):
+	}
+}

client/internal/lazyconn/activity/listener_udp_test.go

@@ -1,110 +0,0 @@
-package activity
-
-import (
-	"net"
-	"net/netip"
-	"testing"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/netbirdio/netbird/client/internal/lazyconn"
-)
-
-func TestUDPListener_Creation(t *testing.T) {
-	mockIface := &MocWGIface{}
-
-	peer := &MocPeer{PeerID: "testPeer1"}
-	cfg := lazyconn.PeerConfig{
-		PublicKey:  peer.PeerID,
-		PeerConnID: peer.ConnID(),
-		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
-		Log:        log.WithField("peer", "testPeer1"),
-	}
-
-	listener, err := NewUDPListener(mockIface, cfg)
-	require.NoError(t, err)
-	require.NotNil(t, listener.conn)
-	require.NotNil(t, listener.endpoint)
-
-	readPacketsDone := make(chan struct{})
-	go func() {
-		listener.ReadPackets()
-		close(readPacketsDone)
-	}()
-
-	listener.Close()
-
-	select {
-	case <-readPacketsDone:
-	case <-time.After(2 * time.Second):
-		t.Fatal("timeout waiting for ReadPackets to exit after Close")
-	}
-}
-
-func TestUDPListener_ActivityDetection(t *testing.T) {
-	mockIface := &MocWGIface{}
-
-	peer := &MocPeer{PeerID: "testPeer1"}
-	cfg := lazyconn.PeerConfig{
-		PublicKey:  peer.PeerID,
-		PeerConnID: peer.ConnID(),
-		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
-		Log:        log.WithField("peer", "testPeer1"),
-	}
-
-	listener, err := NewUDPListener(mockIface, cfg)
-	require.NoError(t, err)
-
-	activityDetected := make(chan struct{})
-	go func() {
-		listener.ReadPackets()
-		close(activityDetected)
-	}()
-
-	conn, err := net.Dial("udp", listener.conn.LocalAddr().String())
-	require.NoError(t, err)
-	defer conn.Close()
-
-	_, err = conn.Write([]byte{0x01, 0x02, 0x03})
-	require.NoError(t, err)
-
-	select {
-	case <-activityDetected:
-	case <-time.After(2 * time.Second):
-		t.Fatal("timeout waiting for activity detection")
-	}
-}
-
-func TestUDPListener_Close(t *testing.T) {
-	mockIface := &MocWGIface{}
-
-	peer := &MocPeer{PeerID: "testPeer1"}
-	cfg := lazyconn.PeerConfig{
-		PublicKey:  peer.PeerID,
-		PeerConnID: peer.ConnID(),
-		AllowedIPs: []netip.Prefix{netip.MustParsePrefix("100.64.0.2/32")},
-		Log:        log.WithField("peer", "testPeer1"),
-	}
-
-	listener, err := NewUDPListener(mockIface, cfg)
-	require.NoError(t, err)
-
-	readPacketsDone := make(chan struct{})
-	go func() {
-		listener.ReadPackets()
-		close(readPacketsDone)
-	}()
-
-	listener.Close()
-
-	select {
-	case <-readPacketsDone:
-	case <-time.After(2 * time.Second):
-		t.Fatal("timeout waiting for ReadPackets to exit after Close")
-	}
-
-	assert.True(t, listener.isClosed.Load(), "Listener should be marked as closed")
-}

client/internal/lazyconn/activity/manager.go

@@ -1,32 +1,21 @@
 package activity
 
 import (
-	"errors"
 	"net"
 	"net/netip"
-	"runtime"
 	"sync"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	peerid "github.com/netbirdio/netbird/client/internal/peer/id"
 )
 
-// listener defines the contract for activity detection listeners.
-type listener interface {
-	ReadPackets()
-	Close()
-}
-
 type WgInterface interface {
 	RemovePeer(peerKey string) error
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
-	IsUserspaceBind() bool
-	Address() wgaddr.Address
 }
 
 type Manager struct {
@@ -34,7 +23,7 @@ type Manager struct {
 
 	wgIface WgInterface
 
-	peers map[peerid.ConnID]listener
+	peers map[peerid.ConnID]*Listener
 	done  chan struct{}
 
 	mu sync.Mutex
@@ -44,7 +33,7 @@ func NewManager(wgIface WgInterface) *Manager {
 	m := &Manager{
 		OnActivityChan: make(chan peerid.ConnID, 1),
 		wgIface:        wgIface,
-		peers:          make(map[peerid.ConnID]listener),
+		peers:          make(map[peerid.ConnID]*Listener),
 		done:           make(chan struct{}),
 	}
 	return m
@@ -59,38 +48,16 @@ func (m *Manager) MonitorPeerActivity(peerCfg lazyconn.PeerConfig) error {
 		return nil
 	}
 
-	listener, err := m.createListener(peerCfg)
+	listener, err := NewListener(m.wgIface, peerCfg)
 	if err != nil {
 		return err
 	}
-
 	m.peers[peerCfg.PeerConnID] = listener
+
 	go m.waitForTraffic(listener, peerCfg.PeerConnID)
 	return nil
 }
 
-func (m *Manager) createListener(peerCfg lazyconn.PeerConfig) (listener, error) {
-	if !m.wgIface.IsUserspaceBind() {
-		return NewUDPListener(m.wgIface, peerCfg)
-	}
-
-	// BindListener is only used on Windows and JS platforms:
-	// - JS: Cannot listen to UDP sockets
-	// - Windows: IP_UNICAST_IF socket option forces packets out the interface the default
-	//   gateway points to, preventing them from reaching the loopback interface.
-	//   BindListener bypasses this by passing data directly through the bind.
-	if runtime.GOOS != "windows" && runtime.GOOS != "js" {
-		return NewUDPListener(m.wgIface, peerCfg)
-	}
-
-	provider, ok := m.wgIface.(bindProvider)
-	if !ok {
-		return nil, errors.New("interface claims userspace bind but doesn't implement bindProvider")
-	}
-
-	return NewBindListener(m.wgIface, provider.GetBind(), peerCfg)
-}
-
 func (m *Manager) RemovePeer(log *log.Entry, peerConnID peerid.ConnID) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -115,8 +82,8 @@ func (m *Manager) Close() {
 	}
 }
 
-func (m *Manager) waitForTraffic(l listener, peerConnID peerid.ConnID) {
-	l.ReadPackets()
+func (m *Manager) waitForTraffic(listener *Listener, peerConnID peerid.ConnID) {
+	listener.ReadPackets()
 
 	m.mu.Lock()
 	if _, ok := m.peers[peerConnID]; !ok {

client/internal/lazyconn/activity/manager_test.go

@@ -9,7 +9,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/lazyconn"
 	peerid "github.com/netbirdio/netbird/client/internal/peer/id"
 )
@@ -31,26 +30,16 @@ func (m MocWGIface) RemovePeer(string) error {
 
 func (m MocWGIface) UpdatePeer(string, []netip.Prefix, time.Duration, *net.UDPAddr, *wgtypes.Key) error {
 	return nil
+
 }
 
-func (m MocWGIface) IsUserspaceBind() bool {
-	return false
-}
-
-func (m MocWGIface) Address() wgaddr.Address {
-	return wgaddr.Address{
-		IP:      netip.MustParseAddr("100.64.0.1"),
-		Network: netip.MustParsePrefix("100.64.0.0/16"),
-	}
-}
-
-// GetPeerListener is a test helper to access listeners
-func (m *Manager) GetPeerListener(peerConnID peerid.ConnID) (listener, bool) {
+// Add this method to the Manager struct
+func (m *Manager) GetPeerListener(peerConnID peerid.ConnID) (*Listener, bool) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
-	l, exists := m.peers[peerConnID]
-	return l, exists
+	listener, exists := m.peers[peerConnID]
+	return listener, exists
 }
 
 func TestManager_MonitorPeerActivity(t *testing.T) {
@@ -76,12 +65,7 @@ func TestManager_MonitorPeerActivity(t *testing.T) {
 		t.Fatalf("peer listener not found")
 	}
 
-	// Get the UDP listener's address for triggering
-	udpListener, ok := listener.(*UDPListener)
-	if !ok {
-		t.Fatalf("expected UDPListener")
-	}
-	if err := trigger(udpListener.conn.LocalAddr().String()); err != nil {
+	if err := trigger(listener.conn.LocalAddr().String()); err != nil {
 		t.Fatalf("failed to trigger activity: %v", err)
 	}
 
@@ -113,9 +97,7 @@ func TestManager_RemovePeerActivity(t *testing.T) {
 		t.Fatalf("failed to monitor peer activity: %v", err)
 	}
 
-	listener, _ := mgr.GetPeerListener(peerCfg1.PeerConnID)
-	udpListener, _ := listener.(*UDPListener)
-	addr := udpListener.conn.LocalAddr().String()
+	addr := mgr.peers[peerCfg1.PeerConnID].conn.LocalAddr().String()
 
 	mgr.RemovePeer(peerCfg1.Log, peerCfg1.PeerConnID)
 
@@ -165,8 +147,7 @@ func TestManager_MultiPeerActivity(t *testing.T) {
 		t.Fatalf("peer listener for peer1 not found")
 	}
 
-	udpListener1, _ := listener.(*UDPListener)
-	if err := trigger(udpListener1.conn.LocalAddr().String()); err != nil {
+	if err := trigger(listener.conn.LocalAddr().String()); err != nil {
 		t.Fatalf("failed to trigger activity: %v", err)
 	}
 
@@ -175,8 +156,7 @@ func TestManager_MultiPeerActivity(t *testing.T) {
 		t.Fatalf("peer listener for peer2 not found")
 	}
 
-	udpListener2, _ := listener.(*UDPListener)
-	if err := trigger(udpListener2.conn.LocalAddr().String()); err != nil {
+	if err := trigger(listener.conn.LocalAddr().String()); err != nil {
 		t.Fatalf("failed to trigger activity: %v", err)
 	}
 

client/internal/lazyconn/wgiface.go

@@ -7,7 +7,6 @@ import (
 
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/monotime"
 )
 
@@ -15,6 +14,5 @@ type WGIface interface {
 	RemovePeer(peerKey string) error
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	IsUserspaceBind() bool
-	Address() wgaddr.Address
 	LastActivities() map[string]monotime.Time
 }

client/internal/netflow/manager.go

@@ -24,7 +24,6 @@ import (
 // Manager handles netflow tracking and logging
 type Manager struct {
 	mux            sync.Mutex
-	shutdownWg     sync.WaitGroup
 	logger         nftypes.FlowLogger
 	flowConfig     *nftypes.FlowConfig
 	conntrack      nftypes.ConnTracker
@@ -106,15 +105,8 @@ func (m *Manager) resetClient() error {
 	ctx, cancel := context.WithCancel(context.Background())
 	m.cancel = cancel
 
-	m.shutdownWg.Add(2)
-	go func() {
-		defer m.shutdownWg.Done()
-		m.receiveACKs(ctx, flowClient)
-	}()
-	go func() {
-		defer m.shutdownWg.Done()
-		m.startSender(ctx)
-	}()
+	go m.receiveACKs(ctx, flowClient)
+	go m.startSender(ctx)
 
 	return nil
 }
@@ -184,12 +176,11 @@ func (m *Manager) Update(update *nftypes.FlowConfig) error {
 // Close cleans up all resources
 func (m *Manager) Close() {
 	m.mux.Lock()
+	defer m.mux.Unlock()
+
 	if err := m.disableFlow(); err != nil {
 		log.Warnf("failed to disable flow manager: %v", err)
 	}
-	m.mux.Unlock()
-
-	m.shutdownWg.Wait()
 }
 
 // GetLogger returns the flow logger

client/internal/networkmonitor/check_change_bsd.go

@@ -1,4 +1,4 @@
-//go:build dragonfly || freebsd || netbsd || openbsd
+//go:build (darwin && !ios) || dragonfly || freebsd || netbsd || openbsd
 
 package networkmonitor
 

client/internal/networkmonitor/check_change_darwin.go

@@ -1,344 +0,0 @@
-//go:build darwin && !ios
-
-package networkmonitor
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"hash/fnv"
-	"net/netip"
-	"os/exec"
-	"syscall"
-	"time"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/net/route"
-	"golang.org/x/sys/unix"
-
-	"github.com/netbirdio/netbird/client/internal/routemanager/systemops"
-)
-
-// todo: refactor to not use static functions
-
-func checkChange(ctx context.Context, nexthopv4, nexthopv6 systemops.Nexthop) error {
-	fd, err := unix.Socket(syscall.AF_ROUTE, syscall.SOCK_RAW, syscall.AF_UNSPEC)
-	if err != nil {
-		return fmt.Errorf("open routing socket: %v", err)
-	}
-
-	defer func() {
-		err := unix.Close(fd)
-		if err != nil && !errors.Is(err, unix.EBADF) {
-			log.Warnf("Network monitor: failed to close routing socket: %v", err)
-		}
-	}()
-
-	routeChanged := make(chan struct{})
-	go func() {
-		routeCheck(ctx, fd, nexthopv4, nexthopv6)
-		close(routeChanged)
-	}()
-
-	wakeUp := make(chan struct{})
-	go func() {
-		wakeUpListen(ctx)
-		close(wakeUp)
-	}()
-
-	gatewayChanged := make(chan string)
-	go func() {
-		gatewayPoll(ctx, nexthopv4, nexthopv6, gatewayChanged)
-	}()
-
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	case <-routeChanged:
-		log.Infof("route change detected via routing socket")
-		return nil
-	case <-wakeUp:
-		log.Infof("wakeup detected via sleep hash change")
-		return nil
-	case reason := <-gatewayChanged:
-		log.Infof("gateway change detected via polling: %s", reason)
-		return nil
-	}
-}
-
-func routeCheck(ctx context.Context, fd int, nexthopv4 systemops.Nexthop, nexthopv6 systemops.Nexthop) {
-	for {
-		if ctx.Err() != nil {
-			return
-		}
-
-		buf := make([]byte, 2048)
-		n, err := unix.Read(fd, buf)
-		if err != nil {
-			if !errors.Is(err, unix.EBADF) && !errors.Is(err, unix.EINVAL) {
-				log.Warnf("Network monitor: failed to read from routing socket: %v", err)
-			}
-			continue
-		}
-		if n < unix.SizeofRtMsghdr {
-			log.Debugf("Network monitor: read from routing socket returned less than expected: %d bytes", n)
-			continue
-		}
-
-		msg := (*unix.RtMsghdr)(unsafe.Pointer(&buf[0]))
-
-		switch msg.Type {
-		// handle route changes
-		case unix.RTM_ADD, syscall.RTM_DELETE:
-			route, err := parseRouteMessage(buf[:n])
-			if err != nil {
-				log.Debugf("Network monitor: error parsing routing message: %v", err)
-				continue
-			}
-
-			if route.Dst.Bits() != 0 {
-				continue
-			}
-
-			intf := "<nil>"
-			if route.Interface != nil {
-				intf = route.Interface.Name
-			}
-			switch msg.Type {
-			case unix.RTM_ADD:
-				log.Infof("Network monitor: default route changed: via %s, interface %s", route.Gw, intf)
-				return
-			case unix.RTM_DELETE:
-				if nexthopv4.Intf != nil && route.Gw.Compare(nexthopv4.IP) == 0 || nexthopv6.Intf != nil && route.Gw.Compare(nexthopv6.IP) == 0 {
-					log.Infof("Network monitor: default route removed: via %s, interface %s", route.Gw, intf)
-					return
-				}
-			}
-		}
-	}
-}
-
-func parseRouteMessage(buf []byte) (*systemops.Route, error) {
-	msgs, err := route.ParseRIB(route.RIBTypeRoute, buf)
-	if err != nil {
-		return nil, fmt.Errorf("parse RIB: %v", err)
-	}
-
-	if len(msgs) != 1 {
-		return nil, fmt.Errorf("unexpected RIB message msgs: %v", msgs)
-	}
-
-	msg, ok := msgs[0].(*route.RouteMessage)
-	if !ok {
-		return nil, fmt.Errorf("unexpected RIB message type: %T", msgs[0])
-	}
-
-	return systemops.MsgToRoute(msg)
-}
-
-func wakeUpListen(ctx context.Context) {
-	log.Infof("start to watch for system wakeups")
-	var (
-		initialHash uint32
-		err         error
-	)
-
-	// Keep retrying until initial sysctl succeeds or context is canceled
-	for {
-		select {
-		case <-ctx.Done():
-			log.Info("exit from wakeUpListen initial hash detection due to context cancellation")
-			return
-		default:
-			initialHash, err = readSleepTimeHash()
-			if err != nil {
-				log.Errorf("failed to detect initial sleep time: %v", err)
-				select {
-				case <-ctx.Done():
-					log.Info("exit from wakeUpListen initial hash detection due to context cancellation")
-					return
-				case <-time.After(3 * time.Second):
-					continue
-				}
-			}
-			log.Infof("initial wakeup hash: %d", initialHash)
-			break
-		}
-		break
-	}
-
-	ticker := time.NewTicker(5 * time.Second)
-	defer ticker.Stop()
-
-	lastCheck := time.Now()
-	const maxTickerDrift = 1 * time.Minute
-
-	for {
-		select {
-		case <-ctx.Done():
-			log.Info("context canceled, stopping wakeUpListen")
-			return
-
-		case <-ticker.C:
-			now := time.Now()
-			elapsed := now.Sub(lastCheck)
-
-			// If more time passed than expected, system likely slept (informational only)
-			if elapsed > maxTickerDrift {
-				upOut, err := exec.Command("uptime").Output()
-				if err != nil {
-					log.Errorf("failed to run uptime command: %v", err)
-					upOut = []byte("unknown")
-				}
-				log.Infof("Time drift detected (potential wakeup): expected ~5s, actual %s, uptime: %s", elapsed, upOut)
-
-				currentV4, errV4 := systemops.GetNextHop(netip.IPv4Unspecified())
-				currentV6, errV6 := systemops.GetNextHop(netip.IPv6Unspecified())
-				if errV4 == nil {
-					log.Infof("Current IPv4 default gateway: %s via %s", currentV4.IP, currentV4.Intf.Name)
-				} else {
-					log.Debugf("No IPv4 default gateway: %v", errV4)
-				}
-				if errV6 == nil {
-					log.Infof("Current IPv6 default gateway: %s via %s", currentV6.IP, currentV6.Intf.Name)
-				} else {
-					log.Debugf("No IPv6 default gateway: %v", errV6)
-				}
-			}
-
-			newHash, err := readSleepTimeHash()
-			if err != nil {
-				log.Errorf("failed to read sleep time hash: %v", err)
-				lastCheck = now
-				continue
-			}
-
-			if newHash == initialHash {
-				log.Debugf("no wakeup detected (hash unchanged: %d, time drift: %s)", initialHash, elapsed)
-				lastCheck = now
-				continue
-			}
-
-			upOut, err := exec.Command("uptime").Output()
-			if err != nil {
-				log.Errorf("failed to run uptime command: %v", err)
-				upOut = []byte("unknown")
-			}
-			log.Infof("Wakeup detected via hash change: %d -> %d, uptime: %s", initialHash, newHash, upOut)
-
-			currentV4, errV4 := systemops.GetNextHop(netip.IPv4Unspecified())
-			currentV6, errV6 := systemops.GetNextHop(netip.IPv6Unspecified())
-			if errV4 == nil {
-				log.Infof("Current IPv4 default gateway after wakeup: %s via %s", currentV4.IP, currentV4.Intf.Name)
-			} else {
-				log.Debugf("No IPv4 default gateway after wakeup: %v", errV4)
-			}
-			if errV6 == nil {
-				log.Infof("Current IPv6 default gateway after wakeup: %s via %s", currentV6.IP, currentV6.Intf.Name)
-			} else {
-				log.Debugf("No IPv6 default gateway after wakeup: %v", errV6)
-			}
-
-			return
-		}
-	}
-}
-
-func readSleepTimeHash() (uint32, error) {
-	cmd := exec.Command("sysctl", "kern.sleeptime")
-	out, err := cmd.Output()
-	if err != nil {
-		return 0, fmt.Errorf("failed to run sysctl: %w", err)
-	}
-
-	h, err := hash(out)
-	if err != nil {
-		return 0, fmt.Errorf("failed to compute hash: %w", err)
-	}
-
-	return h, nil
-}
-
-func hash(data []byte) (uint32, error) {
-	hasher := fnv.New32a()
-	if _, err := hasher.Write(data); err != nil {
-		return 0, err
-	}
-	return hasher.Sum32(), nil
-}
-
-// gatewayPoll polls the default gateway every 5 seconds to detect changes that might be missed by routing socket or wake-up detection.
-func gatewayPoll(ctx context.Context, initialV4, initialV6 systemops.Nexthop, changed chan<- string) {
-	ticker := time.NewTicker(5 * time.Second)
-	defer ticker.Stop()
-
-	log.Infof("Gateway polling started - initial v4: %s via %v, v6: %s via %v",
-		initialV4.IP, initialV4.Intf, initialV6.IP, initialV6.Intf)
-
-	for {
-		select {
-		case <-ctx.Done():
-			log.Debug("context canceled, stopping gateway polling")
-			return
-
-		case <-ticker.C:
-			currentV4, errV4 := systemops.GetNextHop(netip.IPv4Unspecified())
-			currentV6, errV6 := systemops.GetNextHop(netip.IPv6Unspecified())
-
-			var reason string
-
-			if errV4 == nil && initialV4.IP.IsValid() {
-				if currentV4.IP.Compare(initialV4.IP) != 0 {
-					reason = fmt.Sprintf("IPv4 gateway changed from %s to %s", initialV4.IP, currentV4.IP)
-					log.Infof("Gateway poll detected change: %s", reason)
-					changed <- reason
-					return
-				}
-				if initialV4.Intf != nil && currentV4.Intf != nil && currentV4.Intf.Name != initialV4.Intf.Name {
-					reason = fmt.Sprintf("IPv4 interface changed from %s to %s", initialV4.Intf.Name, currentV4.Intf.Name)
-					log.Infof("Gateway poll detected change: %s", reason)
-					changed <- reason
-					return
-				}
-			} else if errV4 == nil && !initialV4.IP.IsValid() {
-				reason = "IPv4 gateway appeared"
-				log.Infof("Gateway poll detected change: %s (new: %s)", reason, currentV4.IP)
-				changed <- reason
-				return
-			} else if errV4 != nil && initialV4.IP.IsValid() {
-				reason = "IPv4 gateway disappeared"
-				log.Infof("Gateway poll detected change: %s", reason)
-				changed <- reason
-				return
-			}
-
-			if errV6 == nil && initialV6.IP.IsValid() {
-				if currentV6.IP.Compare(initialV6.IP) != 0 {
-					reason = fmt.Sprintf("IPv6 gateway changed from %s to %s", initialV6.IP, currentV6.IP)
-					log.Infof("Gateway poll detected change: %s", reason)
-					changed <- reason
-					return
-				}
-				if initialV6.Intf != nil && currentV6.Intf != nil && currentV6.Intf.Name != initialV6.Intf.Name {
-					reason = fmt.Sprintf("IPv6 interface changed from %s to %s", initialV6.Intf.Name, currentV6.Intf.Name)
-					log.Infof("Gateway poll detected change: %s", reason)
-					changed <- reason
-					return
-				}
-			} else if errV6 == nil && !initialV6.IP.IsValid() {
-				reason = "IPv6 gateway appeared"
-				log.Infof("Gateway poll detected change: %s (new: %s)", reason, currentV6.IP)
-				changed <- reason
-				return
-			} else if errV6 != nil && initialV6.IP.IsValid() {
-				reason = "IPv6 gateway disappeared"
-				log.Infof("Gateway poll detected change: %s", reason)
-				changed <- reason
-				return
-			}
-
-			log.Debugf("Gateway poll: no change detected")
-		}
-	}
-}

client/internal/networkmonitor/monitor.go

@@ -88,7 +88,6 @@ func (nw *NetworkMonitor) Listen(ctx context.Context) (err error) {
 	event := make(chan struct{}, 1)
 	go nw.checkChanges(ctx, event, nexthop4, nexthop6)
 
-	log.Infof("start watching for network changes")
 	// debounce changes
 	timer := time.NewTimer(0)
 	timer.Stop()

client/internal/peer/guard/sr_watcher.go

@@ -19,11 +19,11 @@ type SRWatcher struct {
 	signalClient chNotifier
 	relayManager chNotifier
 
-	listeners        map[chan struct{}]struct{}
-	mu               sync.Mutex
-	shutdownWg       sync.WaitGroup
-	iFaceDiscover    stdnet.ExternalIFaceDiscover
-	iceConfig        ice.Config
+	listeners     map[chan struct{}]struct{}
+	mu            sync.Mutex
+	iFaceDiscover stdnet.ExternalIFaceDiscover
+	iceConfig     ice.Config
+
 	cancelIceMonitor context.CancelFunc
 }
 
@@ -52,11 +52,7 @@ func (w *SRWatcher) Start() {
 	w.cancelIceMonitor = cancel
 
 	iceMonitor := NewICEMonitor(w.iFaceDiscover, w.iceConfig, GetICEMonitorPeriod())
-	w.shutdownWg.Add(1)
-	go func() {
-		defer w.shutdownWg.Done()
-		iceMonitor.Start(ctx, w.onICEChanged)
-	}()
+	go iceMonitor.Start(ctx, w.onICEChanged)
 	w.signalClient.SetOnReconnectedListener(w.onReconnected)
 	w.relayManager.SetOnReconnectedListener(w.onReconnected)
 
@@ -64,16 +60,14 @@ func (w *SRWatcher) Start() {
 
 func (w *SRWatcher) Close() {
 	w.mu.Lock()
+	defer w.mu.Unlock()
+
 	if w.cancelIceMonitor == nil {
-		w.mu.Unlock()
 		return
 	}
 	w.cancelIceMonitor()
 	w.signalClient.SetOnReconnectedListener(nil)
 	w.relayManager.SetOnReconnectedListener(nil)
-	w.mu.Unlock()
-
-	w.shutdownWg.Wait()
 }
 
 func (w *SRWatcher) NewListener() chan struct{} {

client/internal/profilemanager/config.go

@@ -195,7 +195,6 @@ func createNewConfig(input ConfigInput) (*Config, error) {
 	config := &Config{
 		// defaults to false only for new (post 0.26) configurations
 		ServerSSHAllowed: util.False(),
-		WgPort:           iface.DefaultWgPort,
 	}
 
 	if _, err := config.apply(input); err != nil {

client/internal/profilemanager/config_test.go

@@ -5,14 +5,11 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
-	"runtime"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/internal/routemanager/dynamic"
 	"github.com/netbirdio/netbird/util"
 )
 
@@ -144,95 +141,6 @@ func TestHiddenPreSharedKey(t *testing.T) {
 	}
 }
 
-func TestNewProfileDefaults(t *testing.T) {
-	tempDir := t.TempDir()
-	configPath := filepath.Join(tempDir, "config.json")
-
-	config, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath: configPath,
-	})
-	require.NoError(t, err, "should create new config")
-
-	assert.Equal(t, DefaultManagementURL, config.ManagementURL.String(), "ManagementURL should have default")
-	assert.Equal(t, DefaultAdminURL, config.AdminURL.String(), "AdminURL should have default")
-	assert.NotEmpty(t, config.PrivateKey, "PrivateKey should be generated")
-	assert.NotEmpty(t, config.SSHKey, "SSHKey should be generated")
-	assert.Equal(t, iface.WgInterfaceDefault, config.WgIface, "WgIface should have default")
-	assert.Equal(t, iface.DefaultWgPort, config.WgPort, "WgPort should default to 51820")
-	assert.Equal(t, uint16(iface.DefaultMTU), config.MTU, "MTU should have default")
-	assert.Equal(t, dynamic.DefaultInterval, config.DNSRouteInterval, "DNSRouteInterval should have default")
-	assert.NotNil(t, config.ServerSSHAllowed, "ServerSSHAllowed should be set")
-	assert.NotNil(t, config.DisableNotifications, "DisableNotifications should be set")
-	assert.NotEmpty(t, config.IFaceBlackList, "IFaceBlackList should have defaults")
-
-	if runtime.GOOS == "windows" || runtime.GOOS == "darwin" {
-		assert.NotNil(t, config.NetworkMonitor, "NetworkMonitor should be set on Windows/macOS")
-		assert.True(t, *config.NetworkMonitor, "NetworkMonitor should be enabled by default on Windows/macOS")
-	}
-}
-
-func TestWireguardPortZeroExplicit(t *testing.T) {
-	tempDir := t.TempDir()
-	configPath := filepath.Join(tempDir, "config.json")
-
-	// Create a new profile with explicit port 0 (random port)
-	explicitZero := 0
-	config, err := UpdateOrCreateConfig(ConfigInput{
-		ConfigPath:    configPath,
-		WireguardPort: &explicitZero,
-	})
-	require.NoError(t, err, "should create config with explicit port 0")
-
-	assert.Equal(t, 0, config.WgPort, "WgPort should be 0 when explicitly set by user")
-
-	// Verify it persists
-	readConfig, err := GetConfig(configPath)
-	require.NoError(t, err)
-	assert.Equal(t, 0, readConfig.WgPort, "WgPort should remain 0 after reading from file")
-}
-
-func TestWireguardPortDefaultVsExplicit(t *testing.T) {
-	tests := []struct {
-		name           string
-		wireguardPort  *int
-		expectedPort   int
-		description    string
-	}{
-		{
-			name:          "no port specified uses default",
-			wireguardPort: nil,
-			expectedPort:  iface.DefaultWgPort,
-			description:   "When user doesn't specify port, default to 51820",
-		},
-		{
-			name:          "explicit zero for random port",
-			wireguardPort: func() *int { v := 0; return &v }(),
-			expectedPort:  0,
-			description:   "When user explicitly sets 0, use 0 for random port",
-		},
-		{
-			name:          "explicit custom port",
-			wireguardPort: func() *int { v := 52000; return &v }(),
-			expectedPort:  52000,
-			description:   "When user sets custom port, use that port",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			tempDir := t.TempDir()
-			configPath := filepath.Join(tempDir, "config.json")
-
-			config, err := UpdateOrCreateConfig(ConfigInput{
-				ConfigPath:    configPath,
-				WireguardPort: tt.wireguardPort,
-			})
-			require.NoError(t, err, tt.description)
-			assert.Equal(t, tt.expectedPort, config.WgPort, tt.description)
-		})
-	}
-}
-
 func TestUpdateOldManagementURL(t *testing.T) {
 	tests := []struct {
 		name                  string

client/internal/routemanager/manager.go

@@ -78,7 +78,6 @@ type DefaultManager struct {
 	ctx                  context.Context
 	stop                 context.CancelFunc
 	mux                  sync.Mutex
-	shutdownWg           sync.WaitGroup
 	clientNetworks       map[route.HAUniqueID]*client.Watcher
 	routeSelector        *routeselector.RouteSelector
 	serverRouter         *server.Router
@@ -107,7 +106,7 @@ type DefaultManager struct {
 func NewManager(config ManagerConfig) *DefaultManager {
 	mCTX, cancel := context.WithCancel(config.Context)
 	notifier := notifier.NewNotifier()
-	sysOps := systemops.New(config.WGInterface, notifier)
+	sysOps := systemops.NewSysOps(config.WGInterface, notifier)
 
 	if runtime.GOOS == "windows" && config.WGInterface != nil {
 		nbnet.SetVPNInterfaceName(config.WGInterface.Name())
@@ -274,7 +273,6 @@ func (m *DefaultManager) SetFirewall(firewall firewall.Manager) error {
 // Stop stops the manager watchers and clean firewall rules
 func (m *DefaultManager) Stop(stateManager *statemanager.Manager) {
 	m.stop()
-	m.shutdownWg.Wait()
 	if m.serverRouter != nil {
 		m.serverRouter.CleanUp()
 	}
@@ -476,11 +474,7 @@ func (m *DefaultManager) TriggerSelection(networks route.HAMap) {
 		}
 		clientNetworkWatcher := client.NewWatcher(config)
 		m.clientNetworks[id] = clientNetworkWatcher
-		m.shutdownWg.Add(1)
-		go func() {
-			defer m.shutdownWg.Done()
-			clientNetworkWatcher.Start()
-		}()
+		go clientNetworkWatcher.Start()
 		clientNetworkWatcher.SendUpdate(client.RoutesUpdate{Routes: routes})
 	}
 
@@ -522,11 +516,7 @@ func (m *DefaultManager) updateClientNetworks(updateSerial uint64, networks rout
 			}
 			clientNetworkWatcher = client.NewWatcher(config)
 			m.clientNetworks[id] = clientNetworkWatcher
-			m.shutdownWg.Add(1)
-			go func() {
-				defer m.shutdownWg.Done()
-				clientNetworkWatcher.Start()
-			}()
+			go clientNetworkWatcher.Start()
 		}
 		update := client.RoutesUpdate{
 			UpdateSerial: updateSerial,

client/internal/routemanager/systemops/flush_nonbsd.go

@@ -1,8 +0,0 @@
-//go:build !((darwin && !ios) || dragonfly || freebsd || netbsd || openbsd)
-
-package systemops
-
-// FlushMarkedRoutes is a no-op on non-BSD platforms.
-func (r *SysOps) FlushMarkedRoutes() error {
-	return nil
-}

client/internal/routemanager/systemops/state.go

@@ -13,11 +13,11 @@ func (s *ShutdownState) Name() string {
 }
 
 func (s *ShutdownState) Cleanup() error {
-	sysOps := New(nil, nil)
-	sysOps.refCounter = refcounter.New[netip.Prefix, struct{}, Nexthop](nil, sysOps.removeFromRouteTable)
-	sysOps.refCounter.LoadData((*ExclusionCounter)(s))
+	sysops := NewSysOps(nil, nil)
+	sysops.refCounter = refcounter.New[netip.Prefix, struct{}, Nexthop](nil, sysops.removeFromRouteTable)
+	sysops.refCounter.LoadData((*ExclusionCounter)(s))
 
-	return sysOps.refCounter.Flush()
+	return sysops.refCounter.Flush()
 }
 
 func (s *ShutdownState) MarshalJSON() ([]byte, error) {

client/internal/routemanager/systemops/systemops.go

@@ -83,7 +83,7 @@ type SysOps struct {
 	localSubnetsCacheTime time.Time
 }
 
-func New(wgInterface wgIface, notifier *notifier.Notifier) *SysOps {
+func NewSysOps(wgInterface wgIface, notifier *notifier.Notifier) *SysOps {
 	return &SysOps{
 		wgInterface: wgInterface,
 		notifier:    notifier,

client/internal/routemanager/systemops/systemops_bsd_test.go

@@ -42,7 +42,7 @@ func TestConcurrentRoutes(t *testing.T) {
 	_, intf = setupDummyInterface(t)
 	nexthop = Nexthop{netip.Addr{}, intf}
 
-	r := New(nil, nil)
+	r := NewSysOps(nil, nil)
 
 	var wg sync.WaitGroup
 	for i := 0; i < 1024; i++ {
@@ -146,7 +146,7 @@ func createAndSetupDummyInterface(t *testing.T, intf string, ipAddressCIDR strin
 
 	nexthop := Nexthop{netip.Addr{}, netIntf}
 
-	r := New(nil, nil)
+	r := NewSysOps(nil, nil)
 	err = r.addToRouteTable(prefix, nexthop)
 	require.NoError(t, err, "Failed to add route to table")
 

client/internal/routemanager/systemops/systemops_generic_test.go

@@ -143,7 +143,7 @@ func TestAddVPNRoute(t *testing.T) {
 
 			wgInterface := createWGInterface(t, fmt.Sprintf("utun53%d", n), "100.65.75.2/24", 33100+n)
 
-			r := New(wgInterface, nil)
+			r := NewSysOps(wgInterface, nil)
 			advancedRouting := nbnet.AdvancedRouting()
 			err := r.SetupRouting(nil, nil, advancedRouting)
 			require.NoError(t, err)
@@ -342,7 +342,7 @@ func TestAddRouteToNonVPNIntf(t *testing.T) {
 
 			wgInterface := createWGInterface(t, fmt.Sprintf("utun54%d", n), "100.65.75.2/24", 33200+n)
 
-			r := New(wgInterface, nil)
+			r := NewSysOps(wgInterface, nil)
 			advancedRouting := nbnet.AdvancedRouting()
 			err := r.SetupRouting(nil, nil, advancedRouting)
 			require.NoError(t, err)
@@ -486,7 +486,7 @@ func setupTestEnv(t *testing.T) {
 		assert.NoError(t, wgInterface.Close())
 	})
 
-	r := New(wgInterface, nil)
+	r := NewSysOps(wgInterface, nil)
 	advancedRouting := nbnet.AdvancedRouting()
 	err := r.SetupRouting(nil, nil, advancedRouting)
 	require.NoError(t, err, "setupRouting should not return err")

client/internal/routemanager/systemops/systemops_unix.go

@@ -7,39 +7,19 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"os"
 	"strconv"
 	"syscall"
 	"time"
 	"unsafe"
 
 	"github.com/cenkalti/backoff/v4"
-	"github.com/hashicorp/go-multierror"
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/net/route"
 	"golang.org/x/sys/unix"
 
-	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
 
-const (
-	envRouteProtoFlag = "NB_ROUTE_PROTO_FLAG"
-)
-
-var routeProtoFlag int
-
-func init() {
-	switch os.Getenv(envRouteProtoFlag) {
-	case "2":
-		routeProtoFlag = unix.RTF_PROTO2
-	case "3":
-		routeProtoFlag = unix.RTF_PROTO3
-	default:
-		routeProtoFlag = unix.RTF_PROTO1
-	}
-}
-
 func (r *SysOps) SetupRouting(initAddresses []net.IP, stateManager *statemanager.Manager, advancedRouting bool) error {
 	return r.setupRefCounter(initAddresses, stateManager)
 }
@@ -48,88 +28,12 @@ func (r *SysOps) CleanupRouting(stateManager *statemanager.Manager, advancedRout
 	return r.cleanupRefCounter(stateManager)
 }
 
-// FlushMarkedRoutes removes single IP exclusion routes marked with the configured RTF_PROTO flag.
-func (r *SysOps) FlushMarkedRoutes() error {
-	rib, err := retryFetchRIB()
-	if err != nil {
-		return fmt.Errorf("fetch routing table: %w", err)
-	}
-
-	msgs, err := route.ParseRIB(route.RIBTypeRoute, rib)
-	if err != nil {
-		return fmt.Errorf("parse routing table: %w", err)
-	}
-
-	var merr *multierror.Error
-	flushedCount := 0
-
-	for _, msg := range msgs {
-		rtMsg, ok := msg.(*route.RouteMessage)
-		if !ok {
-			continue
-		}
-
-		if rtMsg.Flags&routeProtoFlag == 0 {
-			continue
-		}
-
-		routeInfo, err := MsgToRoute(rtMsg)
-		if err != nil {
-			log.Debugf("Skipping route flush: %v", err)
-			continue
-		}
-
-		if !routeInfo.Dst.IsValid() || !routeInfo.Dst.IsSingleIP() {
-			continue
-		}
-
-		nexthop := Nexthop{
-			IP:   routeInfo.Gw,
-			Intf: routeInfo.Interface,
-		}
-
-		if err := r.removeFromRouteTable(routeInfo.Dst, nexthop); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("remove route %s: %w", routeInfo.Dst, err))
-			continue
-		}
-
-		flushedCount++
-		log.Debugf("Flushed marked route: %s", routeInfo.Dst)
-	}
-
-	if flushedCount > 0 {
-		log.Infof("Flushed %d residual NetBird routes from previous session", flushedCount)
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}
-
 func (r *SysOps) addToRouteTable(prefix netip.Prefix, nexthop Nexthop) error {
-	if prefix.IsSingleIP() {
-		log.Debugf("Adding single IP route: %s via %s", prefix, formatNexthop(nexthop))
-	}
 	return r.routeSocket(unix.RTM_ADD, prefix, nexthop)
 }
 
 func (r *SysOps) removeFromRouteTable(prefix netip.Prefix, nexthop Nexthop) error {
-	if prefix.IsSingleIP() {
-		log.Debugf("Removing single IP route: %s via %s", prefix, formatNexthop(nexthop))
-	}
-
-	if err := r.routeSocket(unix.RTM_DELETE, prefix, nexthop); err != nil {
-		return err
-	}
-
-	if prefix.IsSingleIP() {
-		log.Debugf("Route removal completed for %s, verifying...", prefix)
-		if exists := r.verifyRouteRemoved(prefix); exists {
-			log.Warnf("Route %s still exists in routing table after removal", prefix)
-		} else {
-			log.Debugf("Verified route %s successfully removed", prefix)
-		}
-	}
-
-	return nil
+	return r.routeSocket(unix.RTM_DELETE, prefix, nexthop)
 }
 
 func (r *SysOps) routeSocket(action int, prefix netip.Prefix, nexthop Nexthop) error {
@@ -201,7 +105,7 @@ func (r *SysOps) routeOp(action int, prefix netip.Prefix, nexthop Nexthop) func(
 func (r *SysOps) buildRouteMessage(action int, prefix netip.Prefix, nexthop Nexthop) (msg *route.RouteMessage, err error) {
 	msg = &route.RouteMessage{
 		Type:    action,
-		Flags:   unix.RTF_UP | routeProtoFlag,
+		Flags:   unix.RTF_UP,
 		Version: unix.RTM_VERSION,
 		Seq:     r.getSeq(),
 	}
@@ -296,51 +200,3 @@ func prefixToRouteNetmask(prefix netip.Prefix) (route.Addr, error) {
 
 	return nil, fmt.Errorf("unknown IP version in prefix: %s", prefix.Addr().String())
 }
-
-// formatNexthop returns a string representation of the nexthop for logging.
-func formatNexthop(nexthop Nexthop) string {
-	if nexthop.IP.IsValid() {
-		return nexthop.IP.String()
-	}
-	if nexthop.Intf != nil {
-		return nexthop.Intf.Name
-	}
-	return "direct"
-}
-
-// verifyRouteRemoved checks if a route still exists in the routing table.
-func (r *SysOps) verifyRouteRemoved(prefix netip.Prefix) bool {
-	rib, err := retryFetchRIB()
-	if err != nil {
-		log.Debugf("Failed to fetch RIB for route verification: %v", err)
-		return false
-	}
-
-	msgs, err := route.ParseRIB(route.RIBTypeRoute, rib)
-	if err != nil {
-		log.Debugf("Failed to parse RIB for route verification: %v", err)
-		return false
-	}
-
-	for _, msg := range msgs {
-		rtMsg, ok := msg.(*route.RouteMessage)
-		if !ok {
-			continue
-		}
-
-		if rtMsg.Flags&routeProtoFlag == 0 {
-			continue
-		}
-
-		routeInfo, err := MsgToRoute(rtMsg)
-		if err != nil {
-			continue
-		}
-
-		if routeInfo.Dst == prefix {
-			return true
-		}
-	}
-
-	return false
-}

client/internal/statemanager/manager.go

@@ -295,7 +295,7 @@ func (m *Manager) loadStateFile(deleteCorrupt bool) (map[string]json.RawMessage,
 	data, err := os.ReadFile(m.filePath)
 	if err != nil {
 		if errors.Is(err, fs.ErrNotExist) {
-			log.Debugf("state file %s does not exist", m.filePath)
+			log.Debug("state file does not exist")
 			return nil, nil // nolint:nilnil
 		}
 		return nil, fmt.Errorf("read state file: %w", err)

client/internal/winregistry/volatile_windows.go

@@ -1,59 +0,0 @@
-package winregistry
-
-import (
-	"syscall"
-	"unsafe"
-
-	"golang.org/x/sys/windows/registry"
-)
-
-var (
-	advapi          = syscall.NewLazyDLL("advapi32.dll")
-	regCreateKeyExW = advapi.NewProc("RegCreateKeyExW")
-)
-
-const (
-	// Registry key options
-	regOptionNonVolatile = 0x0 // Key is preserved when system is rebooted
-	regOptionVolatile    = 0x1 // Key is not preserved when system is rebooted
-
-	// Registry disposition values
-	regCreatedNewKey     = 0x1
-	regOpenedExistingKey = 0x2
-)
-
-// CreateVolatileKey creates a volatile registry key named path under open key root.
-// CreateVolatileKey returns the new key and a boolean flag that reports whether the key already existed.
-// The access parameter specifies the access rights for the key to be created.
-//
-// Volatile keys are stored in memory and are automatically deleted when the system is shut down.
-// This provides automatic cleanup without requiring manual registry maintenance.
-func CreateVolatileKey(root registry.Key, path string, access uint32) (registry.Key, bool, error) {
-	pathPtr, err := syscall.UTF16PtrFromString(path)
-	if err != nil {
-		return 0, false, err
-	}
-
-	var (
-		handle      syscall.Handle
-		disposition uint32
-	)
-
-	ret, _, _ := regCreateKeyExW.Call(
-		uintptr(root),
-		uintptr(unsafe.Pointer(pathPtr)),
-		0,                          // reserved
-		0,                          // class
-		uintptr(regOptionVolatile), // options - volatile key
-		uintptr(access),            // desired access
-		0,                          // security attributes
-		uintptr(unsafe.Pointer(&handle)),
-		uintptr(unsafe.Pointer(&disposition)),
-	)
-
-	if ret != 0 {
-		return 0, false, syscall.Errno(ret)
-	}
-
-	return registry.Key(handle), disposition == regOpenedExistingKey, nil
-}

client/net/conn.go

@@ -17,7 +17,8 @@ type Conn struct {
 	ID hooks.ConnectionID
 }
 
-// Close overrides the net.Conn Close method to execute all registered hooks after closing the connection.
+// Close overrides the net.Conn Close method to execute all registered hooks after closing the connection
+// Close overrides the net.Conn Close method to execute all registered hooks before closing the connection.
 func (c *Conn) Close() error {
 	return closeConn(c.ID, c.Conn)
 }
@@ -28,7 +29,7 @@ type TCPConn struct {
 	ID hooks.ConnectionID
 }
 
-// Close overrides the net.TCPConn Close method to execute all registered hooks after closing the connection.
+// Close overrides the net.TCPConn Close method to execute all registered hooks before closing the connection.
 func (c *TCPConn) Close() error {
 	return closeConn(c.ID, c.TCPConn)
 }
@@ -36,16 +37,13 @@ func (c *TCPConn) Close() error {
 // closeConn is a helper function to close connections and execute close hooks.
 func closeConn(id hooks.ConnectionID, conn io.Closer) error {
 	err := conn.Close()
-	cleanupConnID(id)
-	return err
-}
 
-// cleanupConnID executes close hooks for a connection ID.
-func cleanupConnID(id hooks.ConnectionID) {
 	closeHooks := hooks.GetCloseHooks()
 	for _, hook := range closeHooks {
 		if err := hook(id); err != nil {
 			log.Errorf("Error executing close hook: %v", err)
 		}
 	}
+
+	return err
 }

client/net/dial.go

@@ -74,6 +74,7 @@ func DialTCP(network string, laddr, raddr *net.TCPAddr) (transport.TCPConn, erro
 		}
 		return &TCPConn{TCPConn: tcpConn, ID: c.ID}, nil
 	}
+
 	if err := conn.Close(); err != nil {
 		log.Errorf("failed to close connection: %v", err)
 	}

client/net/dialer_dial.go

@@ -30,7 +30,6 @@ func (d *Dialer) DialContext(ctx context.Context, network, address string) (net.
 
 	conn, err := d.Dialer.DialContext(ctx, network, address)
 	if err != nil {
-		cleanupConnID(connID)
 		return nil, fmt.Errorf("d.Dialer.DialContext: %w", err)
 	}
 
@@ -65,7 +64,7 @@ func callDialerHooks(ctx context.Context, connID hooks.ConnectionID, address str
 
 	ips, err := resolver.LookupIPAddr(ctx, host)
 	if err != nil {
-		return fmt.Errorf("resolve address %s: %w", address, err)
+		return fmt.Errorf("failed to resolve address %s: %w", address, err)
 	}
 
 	log.Debugf("Dialer resolved IPs for %s: %v", address, ips)

client/net/listener_listen.go

@@ -48,7 +48,7 @@ func (c *PacketConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
 	return c.PacketConn.WriteTo(b, addr)
 }
 
-// Close overrides the net.PacketConn Close method to execute all registered hooks after closing the connection.
+// Close overrides the net.PacketConn Close method to execute all registered hooks before closing the connection.
 func (c *PacketConn) Close() error {
 	defer c.seenAddrs.Clear()
 	return closeConn(c.ID, c.PacketConn)
@@ -69,7 +69,7 @@ func (c *UDPConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
 	return c.UDPConn.WriteTo(b, addr)
 }
 
-// Close overrides the net.UDPConn Close method to execute all registered hooks after closing the connection.
+// Close overrides the net.UDPConn Close method to execute all registered hooks before closing the connection.
 func (c *UDPConn) Close() error {
 	defer c.seenAddrs.Clear()
 	return closeConn(c.ID, c.UDPConn)

client/server/server.go

@@ -353,13 +353,6 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 		config.CustomDNSAddress = []byte{}
 	}
 
-	config.ExtraIFaceBlackList = msg.ExtraIFaceBlacklist
-
-	if msg.DnsRouteInterval != nil {
-		interval := msg.DnsRouteInterval.AsDuration()
-		config.DNSRouteInterval = &interval
-	}
-
 	config.RosenpassEnabled = msg.RosenpassEnabled
 	config.RosenpassPermissive = msg.RosenpassPermissive
 	config.DisableAutoConnect = msg.DisableAutoConnect

client/server/setconfig_test.go

@@ -1,298 +0,0 @@
-package server
-
-import (
-	"context"
-	"os/user"
-	"path/filepath"
-	"reflect"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-	"google.golang.org/protobuf/types/known/durationpb"
-
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// TestSetConfig_AllFieldsSaved ensures that all fields in SetConfigRequest are properly saved to the config.
-// This test uses reflection to detect when new fields are added but not handled in SetConfig.
-func TestSetConfig_AllFieldsSaved(t *testing.T) {
-	tempDir := t.TempDir()
-	origDefaultProfileDir := profilemanager.DefaultConfigPathDir
-	origDefaultConfigPath := profilemanager.DefaultConfigPath
-	origActiveProfileStatePath := profilemanager.ActiveProfileStatePath
-	profilemanager.ConfigDirOverride = tempDir
-	profilemanager.DefaultConfigPathDir = tempDir
-	profilemanager.ActiveProfileStatePath = tempDir + "/active_profile.json"
-	profilemanager.DefaultConfigPath = filepath.Join(tempDir, "default.json")
-	t.Cleanup(func() {
-		profilemanager.DefaultConfigPathDir = origDefaultProfileDir
-		profilemanager.ActiveProfileStatePath = origActiveProfileStatePath
-		profilemanager.DefaultConfigPath = origDefaultConfigPath
-		profilemanager.ConfigDirOverride = ""
-	})
-
-	currUser, err := user.Current()
-	require.NoError(t, err)
-
-	profName := "test-profile"
-
-	ic := profilemanager.ConfigInput{
-		ConfigPath:    filepath.Join(tempDir, profName+".json"),
-		ManagementURL: "https://api.netbird.io:443",
-	}
-	_, err = profilemanager.UpdateOrCreateConfig(ic)
-	require.NoError(t, err)
-
-	pm := profilemanager.ServiceManager{}
-	err = pm.SetActiveProfileState(&profilemanager.ActiveProfileState{
-		Name:     profName,
-		Username: currUser.Username,
-	})
-	require.NoError(t, err)
-
-	ctx := context.Background()
-	s := New(ctx, "console", "", false, false)
-
-	rosenpassEnabled := true
-	rosenpassPermissive := true
-	serverSSHAllowed := true
-	interfaceName := "utun100"
-	wireguardPort := int64(51820)
-	preSharedKey := "test-psk"
-	disableAutoConnect := true
-	networkMonitor := true
-	disableClientRoutes := true
-	disableServerRoutes := true
-	disableDNS := true
-	disableFirewall := true
-	blockLANAccess := true
-	disableNotifications := true
-	lazyConnectionEnabled := true
-	blockInbound := true
-	mtu := int64(1280)
-
-	req := &proto.SetConfigRequest{
-		ProfileName:           profName,
-		Username:              currUser.Username,
-		ManagementUrl:         "https://new-api.netbird.io:443",
-		AdminURL:              "https://new-admin.netbird.io",
-		RosenpassEnabled:      &rosenpassEnabled,
-		RosenpassPermissive:   &rosenpassPermissive,
-		ServerSSHAllowed:      &serverSSHAllowed,
-		InterfaceName:         &interfaceName,
-		WireguardPort:         &wireguardPort,
-		OptionalPreSharedKey:  &preSharedKey,
-		DisableAutoConnect:    &disableAutoConnect,
-		NetworkMonitor:        &networkMonitor,
-		DisableClientRoutes:   &disableClientRoutes,
-		DisableServerRoutes:   &disableServerRoutes,
-		DisableDns:            &disableDNS,
-		DisableFirewall:       &disableFirewall,
-		BlockLanAccess:        &blockLANAccess,
-		DisableNotifications:  &disableNotifications,
-		LazyConnectionEnabled: &lazyConnectionEnabled,
-		BlockInbound:          &blockInbound,
-		NatExternalIPs:        []string{"1.2.3.4", "5.6.7.8"},
-		CleanNATExternalIPs:   false,
-		CustomDNSAddress:      []byte("1.1.1.1:53"),
-		ExtraIFaceBlacklist:   []string{"eth1", "eth2"},
-		DnsLabels:             []string{"label1", "label2"},
-		CleanDNSLabels:        false,
-		DnsRouteInterval:      durationpb.New(2 * time.Minute),
-		Mtu:                   &mtu,
-	}
-
-	_, err = s.SetConfig(ctx, req)
-	require.NoError(t, err)
-
-	profState := profilemanager.ActiveProfileState{
-		Name:     profName,
-		Username: currUser.Username,
-	}
-	cfgPath, err := profState.FilePath()
-	require.NoError(t, err)
-
-	cfg, err := profilemanager.GetConfig(cfgPath)
-	require.NoError(t, err)
-
-	require.Equal(t, "https://new-api.netbird.io:443", cfg.ManagementURL.String())
-	require.Equal(t, "https://new-admin.netbird.io:443", cfg.AdminURL.String())
-	require.Equal(t, rosenpassEnabled, cfg.RosenpassEnabled)
-	require.Equal(t, rosenpassPermissive, cfg.RosenpassPermissive)
-	require.NotNil(t, cfg.ServerSSHAllowed)
-	require.Equal(t, serverSSHAllowed, *cfg.ServerSSHAllowed)
-	require.Equal(t, interfaceName, cfg.WgIface)
-	require.Equal(t, int(wireguardPort), cfg.WgPort)
-	require.Equal(t, preSharedKey, cfg.PreSharedKey)
-	require.Equal(t, disableAutoConnect, cfg.DisableAutoConnect)
-	require.NotNil(t, cfg.NetworkMonitor)
-	require.Equal(t, networkMonitor, *cfg.NetworkMonitor)
-	require.Equal(t, disableClientRoutes, cfg.DisableClientRoutes)
-	require.Equal(t, disableServerRoutes, cfg.DisableServerRoutes)
-	require.Equal(t, disableDNS, cfg.DisableDNS)
-	require.Equal(t, disableFirewall, cfg.DisableFirewall)
-	require.Equal(t, blockLANAccess, cfg.BlockLANAccess)
-	require.NotNil(t, cfg.DisableNotifications)
-	require.Equal(t, disableNotifications, *cfg.DisableNotifications)
-	require.Equal(t, lazyConnectionEnabled, cfg.LazyConnectionEnabled)
-	require.Equal(t, blockInbound, cfg.BlockInbound)
-	require.Equal(t, []string{"1.2.3.4", "5.6.7.8"}, cfg.NATExternalIPs)
-	require.Equal(t, "1.1.1.1:53", cfg.CustomDNSAddress)
-	// IFaceBlackList contains defaults + extras
-	require.Contains(t, cfg.IFaceBlackList, "eth1")
-	require.Contains(t, cfg.IFaceBlackList, "eth2")
-	require.Equal(t, []string{"label1", "label2"}, cfg.DNSLabels.ToPunycodeList())
-	require.Equal(t, 2*time.Minute, cfg.DNSRouteInterval)
-	require.Equal(t, uint16(mtu), cfg.MTU)
-
-	verifyAllFieldsCovered(t, req)
-}
-
-// verifyAllFieldsCovered uses reflection to ensure we're testing all fields in SetConfigRequest.
-// If a new field is added to SetConfigRequest, this function will fail the test,
-// forcing the developer to update both the SetConfig handler and this test.
-func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
-	t.Helper()
-
-	metadataFields := map[string]bool{
-		"state":               true, // protobuf internal
-		"sizeCache":           true, // protobuf internal
-		"unknownFields":       true, // protobuf internal
-		"Username":            true, // metadata
-		"ProfileName":         true, // metadata
-		"CleanNATExternalIPs": true, // control flag for clearing
-		"CleanDNSLabels":      true, // control flag for clearing
-	}
-
-	expectedFields := map[string]bool{
-		"ManagementUrl":         true,
-		"AdminURL":              true,
-		"RosenpassEnabled":      true,
-		"RosenpassPermissive":   true,
-		"ServerSSHAllowed":      true,
-		"InterfaceName":         true,
-		"WireguardPort":         true,
-		"OptionalPreSharedKey":  true,
-		"DisableAutoConnect":    true,
-		"NetworkMonitor":        true,
-		"DisableClientRoutes":   true,
-		"DisableServerRoutes":   true,
-		"DisableDns":            true,
-		"DisableFirewall":       true,
-		"BlockLanAccess":        true,
-		"DisableNotifications":  true,
-		"LazyConnectionEnabled": true,
-		"BlockInbound":          true,
-		"NatExternalIPs":        true,
-		"CustomDNSAddress":      true,
-		"ExtraIFaceBlacklist":   true,
-		"DnsLabels":             true,
-		"DnsRouteInterval":      true,
-		"Mtu":                   true,
-	}
-
-	val := reflect.ValueOf(req).Elem()
-	typ := val.Type()
-
-	var unexpectedFields []string
-	for i := 0; i < val.NumField(); i++ {
-		field := typ.Field(i)
-		fieldName := field.Name
-
-		if metadataFields[fieldName] {
-			continue
-		}
-
-		if !expectedFields[fieldName] {
-			unexpectedFields = append(unexpectedFields, fieldName)
-		}
-	}
-
-	if len(unexpectedFields) > 0 {
-		t.Fatalf("New field(s) detected in SetConfigRequest: %v", unexpectedFields)
-	}
-}
-
-// TestCLIFlags_MappedToSetConfig ensures all CLI flags that modify config are properly mapped to SetConfigRequest.
-// This test catches bugs where a new CLI flag is added but not wired to the SetConfigRequest in setupSetConfigReq.
-func TestCLIFlags_MappedToSetConfig(t *testing.T) {
-	// Map of CLI flag names to their corresponding SetConfigRequest field names.
-	// This map must be updated when adding new config-related CLI flags.
-	flagToField := map[string]string{
-		"management-url":         "ManagementUrl",
-		"admin-url":              "AdminURL",
-		"enable-rosenpass":       "RosenpassEnabled",
-		"rosenpass-permissive":   "RosenpassPermissive",
-		"allow-server-ssh":       "ServerSSHAllowed",
-		"interface-name":         "InterfaceName",
-		"wireguard-port":         "WireguardPort",
-		"preshared-key":          "OptionalPreSharedKey",
-		"disable-auto-connect":   "DisableAutoConnect",
-		"network-monitor":        "NetworkMonitor",
-		"disable-client-routes":  "DisableClientRoutes",
-		"disable-server-routes":  "DisableServerRoutes",
-		"disable-dns":            "DisableDns",
-		"disable-firewall":       "DisableFirewall",
-		"block-lan-access":       "BlockLanAccess",
-		"block-inbound":          "BlockInbound",
-		"enable-lazy-connection": "LazyConnectionEnabled",
-		"external-ip-map":        "NatExternalIPs",
-		"dns-resolver-address":   "CustomDNSAddress",
-		"extra-iface-blacklist":  "ExtraIFaceBlacklist",
-		"extra-dns-labels":       "DnsLabels",
-		"dns-router-interval":    "DnsRouteInterval",
-		"mtu":                    "Mtu",
-	}
-
-	// SetConfigRequest fields that don't have CLI flags (settable only via UI or other means).
-	fieldsWithoutCLIFlags := map[string]bool{
-		"DisableNotifications": true, // Only settable via UI
-	}
-
-	// Get all SetConfigRequest fields to verify our map is complete.
-	req := &proto.SetConfigRequest{}
-	val := reflect.ValueOf(req).Elem()
-	typ := val.Type()
-
-	var unmappedFields []string
-	for i := 0; i < val.NumField(); i++ {
-		field := typ.Field(i)
-		fieldName := field.Name
-
-		// Skip protobuf internal fields and metadata fields.
-		if fieldName == "state" || fieldName == "sizeCache" || fieldName == "unknownFields" {
-			continue
-		}
-		if fieldName == "Username" || fieldName == "ProfileName" {
-			continue
-		}
-		if fieldName == "CleanNATExternalIPs" || fieldName == "CleanDNSLabels" {
-			continue
-		}
-
-		// Check if this field is either mapped to a CLI flag or explicitly documented as having no CLI flag.
-		mappedToCLI := false
-		for _, mappedField := range flagToField {
-			if mappedField == fieldName {
-				mappedToCLI = true
-				break
-			}
-		}
-
-		hasNoCLIFlag := fieldsWithoutCLIFlags[fieldName]
-
-		if !mappedToCLI && !hasNoCLIFlag {
-			unmappedFields = append(unmappedFields, fieldName)
-		}
-	}
-
-	if len(unmappedFields) > 0 {
-		t.Fatalf("SetConfigRequest field(s) not documented: %v\n"+
-			"Either add the CLI flag to flagToField map, or if there's no CLI flag for this field, "+
-			"add it to fieldsWithoutCLIFlags map with a comment explaining why.", unmappedFields)
-	}
-
-	t.Log("All SetConfigRequest fields are properly documented")
-}

client/server/state.go

@@ -10,9 +10,7 @@ import (
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/routemanager/systemops"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/client/proto"
 )
 
@@ -137,12 +135,5 @@ func restoreResidualState(ctx context.Context, statePath string) error {
 		merr = multierror.Append(merr, fmt.Errorf("persist state: %w", err))
 	}
 
-	// clean up any remaining routes independently of the state file
-	if !nbnet.AdvancedRouting() {
-		if err := systemops.New(nil, nil).FlushMarkedRoutes(); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("flush marked routes: %w", err))
-		}
-	}
-
 	return nberrors.FormatErrorOrNil(merr)
 }

client/status/status.go

@@ -205,18 +205,15 @@ func mapPeers(
 		localICEEndpoint := ""
 		remoteICEEndpoint := ""
 		relayServerAddress := ""
-		connType := "-"
+		connType := "P2P"
 		lastHandshake := time.Time{}
 		transferReceived := int64(0)
 		transferSent := int64(0)
 
 		isPeerConnected := pbPeerState.ConnStatus == peer.StatusConnected.String()
 
-		if isPeerConnected {
-			connType = "P2P"
-			if pbPeerState.Relayed {
-				connType = "Relayed"
-			}
+		if pbPeerState.Relayed {
+			connType = "Relayed"
 		}
 
 		if skipDetailByFilters(pbPeerState, pbPeerState.ConnStatus, statusFilter, prefixNamesFilter, prefixNamesFilterMap, ipsFilter, connectionTypeFilter, connType) {

client/ui/client_ui.go

@@ -31,6 +31,7 @@ import (
 	"fyne.io/systray"
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
+	"github.com/skratchdot/open-golang/open"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -632,7 +633,7 @@ func (s *serviceClient) login(openURL bool) (*proto.LoginResponse, error) {
 }
 
 func (s *serviceClient) handleSSOLogin(loginResp *proto.LoginResponse, conn proto.DaemonServiceClient) error {
-	err := openURL(loginResp.VerificationURIComplete)
+	err := open.Run(loginResp.VerificationURIComplete)
 	if err != nil {
 		log.Errorf("opening the verification uri in the browser failed: %v", err)
 		return err
@@ -1486,10 +1487,6 @@ func (s *serviceClient) showLoginURL() context.CancelFunc {
 }
 
 func openURL(url string) error {
-	if browser := os.Getenv("BROWSER"); browser != "" {
-		return exec.Command(browser, url).Start()
-	}
-
 	var err error
 	switch runtime.GOOS {
 	case "windows":

client/ui/debug.go

@@ -18,7 +18,6 @@ import (
 	"github.com/skratchdot/open-golang/open"
 
 	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
 	"github.com/netbirdio/netbird/client/proto"
 	nbstatus "github.com/netbirdio/netbird/client/status"
 	uptypes "github.com/netbirdio/netbird/upload-server/types"
@@ -427,12 +426,6 @@ func (s *serviceClient) collectDebugData(
 		return "", err
 	}
 
-	pm := profilemanager.NewProfileManager()
-	var profName string
-	if activeProf, err := pm.GetActiveProfile(); err == nil {
-		profName = activeProf.Name
-	}
-
 	postUpStatus, err := conn.Status(s.ctx, &proto.StatusRequest{GetFullPeerStatus: true})
 	if err != nil {
 		log.Warnf("Failed to get post-up status: %v", err)
@@ -440,7 +433,7 @@ func (s *serviceClient) collectDebugData(
 
 	var postUpStatusOutput string
 	if postUpStatus != nil {
-		overview := nbstatus.ConvertToStatusOutputOverview(postUpStatus, params.anonymize, "", nil, nil, nil, "", profName)
+		overview := nbstatus.ConvertToStatusOutputOverview(postUpStatus, params.anonymize, "", nil, nil, nil, "", "")
 		postUpStatusOutput = nbstatus.ParseToFullDetailSummary(overview)
 	}
 	headerPostUp := fmt.Sprintf("----- NetBird post-up - Timestamp: %s", time.Now().Format(time.RFC3339))
@@ -457,7 +450,7 @@ func (s *serviceClient) collectDebugData(
 
 	var preDownStatusOutput string
 	if preDownStatus != nil {
-		overview := nbstatus.ConvertToStatusOutputOverview(preDownStatus, params.anonymize, "", nil, nil, nil, "", profName)
+		overview := nbstatus.ConvertToStatusOutputOverview(preDownStatus, params.anonymize, "", nil, nil, nil, "", "")
 		preDownStatusOutput = nbstatus.ParseToFullDetailSummary(overview)
 	}
 	headerPreDown := fmt.Sprintf("----- NetBird pre-down - Timestamp: %s - Duration: %s",
@@ -581,12 +574,6 @@ func (s *serviceClient) createDebugBundle(anonymize bool, systemInfo bool, uploa
 		return nil, fmt.Errorf("get client: %v", err)
 	}
 
-	pm := profilemanager.NewProfileManager()
-	var profName string
-	if activeProf, err := pm.GetActiveProfile(); err == nil {
-		profName = activeProf.Name
-	}
-
 	statusResp, err := conn.Status(s.ctx, &proto.StatusRequest{GetFullPeerStatus: true})
 	if err != nil {
 		log.Warnf("failed to get status for debug bundle: %v", err)
@@ -594,7 +581,7 @@ func (s *serviceClient) createDebugBundle(anonymize bool, systemInfo bool, uploa
 
 	var statusOutput string
 	if statusResp != nil {
-		overview := nbstatus.ConvertToStatusOutputOverview(statusResp, anonymize, "", nil, nil, nil, "", profName)
+		overview := nbstatus.ConvertToStatusOutputOverview(statusResp, anonymize, "", nil, nil, nil, "", "")
 		statusOutput = nbstatus.ParseToFullDetailSummary(overview)
 	}
 

go.mod

@@ -62,7 +62,7 @@ require (
 	github.com/miekg/dns v1.1.59
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/nadoo/ipset v0.5.0
-	github.com/netbirdio/management-integrations/integrations v0.0.0-20251027212525-d751b79f5d48
+	github.com/netbirdio/management-integrations/integrations v0.0.0-20251010134843-7af36217ac1f
 	github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45
 	github.com/okta/okta-sdk-golang/v2 v2.18.0
 	github.com/oschwald/maxminddb-golang v1.12.0

go.sum

@@ -503,8 +503,8 @@ github.com/netbirdio/go-netroute v0.0.0-20240611143515-f59b0e1d3944 h1:TDtJKmM6S
 github.com/netbirdio/go-netroute v0.0.0-20240611143515-f59b0e1d3944/go.mod h1:sHA6TRxjQ6RLbnI+3R4DZo2Eseg/iKiPRfNmcuNySVQ=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51 h1:Ov4qdafATOgGMB1wbSuh+0aAHcwz9hdvB6VZjh1mVMI=
 github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51/go.mod h1:ZSIbPdBn5hePO8CpF1PekH2SfpTxg1PDhEwtbqZS7R8=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20251027212525-d751b79f5d48 h1:moJbL1uuaWR35yUgHZ6suijjqqW8/qGCuPPBXu5MeWQ=
-github.com/netbirdio/management-integrations/integrations v0.0.0-20251027212525-d751b79f5d48/go.mod h1:ifKa2jGPsOzZhJFo72v2AE5nMP3GYvlhoZ9JV6lHlJ8=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20251010134843-7af36217ac1f h1:XIpRDlpPz3zFUkpwaqDRHjwpQRsf2ZKHggoex1MTafs=
+github.com/netbirdio/management-integrations/integrations v0.0.0-20251010134843-7af36217ac1f/go.mod h1:v0nUbbHbuQnqR7yKIYnKzsLBCswLtp2JctmKYmGgVhc=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9axERMVN63dqyFqnvuD+EMJHzM7mNGON8=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502/go.mod h1:CIMRFEJVL+0DS1a3Nx06NaMn4Dz63Ng6O7dl0qH0zVM=
 github.com/netbirdio/signal-dispatcher/dispatcher v0.0.0-20250805121659-6b4ac470ca45 h1:ujgviVYmx243Ksy7NdSwrdGPSRNE3pb8kEDSpH0QuAQ=

infrastructure_files/configure.sh

@@ -185,15 +185,12 @@ if [[ "$NETBIRD_DISABLE_LETSENCRYPT" == "true" ]]; then
   echo "You are also free to remove any occurrences of the Letsencrypt-volume $LETSENCRYPT_VOLUMENAME"
   echo ""
 
+  export NETBIRD_SIGNAL_PROTOCOL="https"
   unset NETBIRD_LETSENCRYPT_DOMAIN
   unset NETBIRD_MGMT_API_CERT_FILE
   unset NETBIRD_MGMT_API_CERT_KEY_FILE
 fi
 
-if [[ -n "$NETBIRD_MGMT_API_CERT_FILE" && -n "$NETBIRD_MGMT_API_CERT_KEY_FILE" ]]; then
-  export NETBIRD_SIGNAL_PROTOCOL="https"
-fi
-
 # Check if management identity provider is set
 if [ -n "$NETBIRD_MGMT_IDP" ]; then
   EXTRA_CONFIG={}

infrastructure_files/docker-compose.yml.tmpl

@@ -40,21 +40,13 @@ services:
   signal:
     <<: *default
     image: netbirdio/signal:$NETBIRD_SIGNAL_TAG
-    depends_on:
-          - dashboard
     volumes:
       - $SIGNAL_VOLUMENAME:/var/lib/netbird
-      - $LETSENCRYPT_VOLUMENAME:/etc/letsencrypt:ro
     ports:
       - $NETBIRD_SIGNAL_PORT:80
   #      # port and command for Let's Encrypt validation
   #      - 443:443
   #    command: ["--letsencrypt-domain", "$NETBIRD_LETSENCRYPT_DOMAIN", "--log-file", "console"]
-    command: [
-      "--cert-file", "$NETBIRD_MGMT_API_CERT_FILE",
-      "--cert-key", "$NETBIRD_MGMT_API_CERT_KEY_FILE",
-      "--log-file", "console"
-    ]
 
   # Relay
   relay:

infrastructure_files/getting-started-with-zitadel.sh

@@ -682,6 +682,17 @@ renderManagementJson() {
             "URI": "stun:$NETBIRD_DOMAIN:3478"
         }
     ],
+    "TURNConfig": {
+        "Turns": [
+            {
+                "Proto": "udp",
+                "URI": "turn:$NETBIRD_DOMAIN:3478",
+                "Username": "$TURN_USER",
+                "Password": "$TURN_PASSWORD"
+            }
+        ],
+        "TimeBasedCredentials": false
+    },
     "Relay": {
         "Addresses": ["$NETBIRD_RELAY_PROTO://$NETBIRD_DOMAIN:$NETBIRD_PORT"],
         "CredentialsTTL": "24h",

management/internals/server/modules.go

@@ -35,13 +35,7 @@ func (s *BaseServer) GeoLocationManager() geolocation.Geolocation {
 
 func (s *BaseServer) PermissionsManager() permissions.Manager {
 	return Create(s, func() permissions.Manager {
-		manager := integrations.InitPermissionsManager(s.Store(), s.Metrics().GetMeter())
-
-		s.AfterInit(func(s *BaseServer) {
-			manager.SetAccountManager(s.AccountManager())
-		})
-
-		return manager
+		return integrations.InitPermissionsManager(s.Store())
 	})
 }
 

management/server/account/manager.go

@@ -109,7 +109,7 @@ type Manager interface {
 	GetIdpManager() idp.Manager
 	UpdateIntegratedValidator(ctx context.Context, accountID, userID, validator string, groups []string) error
 	GroupValidation(ctx context.Context, accountId string, groups []string) (bool, error)
-	GetValidatedPeers(ctx context.Context, accountID string) (map[string]struct{}, map[string]string, error)
+	GetValidatedPeers(ctx context.Context, accountID string) (map[string]struct{}, error)
 	SyncAndMarkPeer(ctx context.Context, accountID string, peerPubKey string, meta nbpeer.PeerSystemMeta, realIP net.IP) (*nbpeer.Peer, *types.NetworkMap, []*posture.Checks, error)
 	OnPeerDisconnected(ctx context.Context, accountID string, peerPubKey string) error
 	SyncPeerMeta(ctx context.Context, peerPubKey string, meta nbpeer.PeerSystemMeta) error

management/server/http/handlers/peers/peers_handler.go

@@ -78,7 +78,7 @@ func (h *Handler) getPeer(ctx context.Context, accountID, peerID, userID string,
 	grps, _ := h.accountManager.GetPeerGroups(ctx, accountID, peerID)
 	grpsInfoMap := groups.ToGroupsInfoMap(grps, 0)
 
-	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	validPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
 	if err != nil {
 		log.WithContext(ctx).Errorf("failed to list approved peers: %v", err)
 		util.WriteError(ctx, fmt.Errorf("internal error"), w)
@@ -86,9 +86,7 @@ func (h *Handler) getPeer(ctx context.Context, accountID, peerID, userID string,
 	}
 
 	_, valid := validPeers[peer.ID]
-	reason := invalidPeers[peer.ID]
-
-	util.WriteJSONObject(ctx, w, toSinglePeerResponse(peerToReturn, grpsInfoMap[peerID], dnsDomain, valid, reason))
+	util.WriteJSONObject(ctx, w, toSinglePeerResponse(peerToReturn, grpsInfoMap[peerID], dnsDomain, valid))
 }
 
 func (h *Handler) updatePeer(ctx context.Context, accountID, userID, peerID string, w http.ResponseWriter, r *http.Request) {
@@ -149,17 +147,16 @@ func (h *Handler) updatePeer(ctx context.Context, accountID, userID, peerID stri
 
 	grpsInfoMap := groups.ToGroupsInfoMap(peerGroups, 0)
 
-	validPeers, invalidPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
+	validPeers, err := h.accountManager.GetValidatedPeers(ctx, accountID)
 	if err != nil {
-		log.WithContext(ctx).Errorf("failed to get validated peers: %v", err)
+		log.WithContext(ctx).Errorf("failed to list appreoved peers: %v", err)
 		util.WriteError(ctx, fmt.Errorf("internal error"), w)
 		return
 	}
 
 	_, valid := validPeers[peer.ID]
-	reason := invalidPeers[peer.ID]
 
-	util.WriteJSONObject(r.Context(), w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid, reason))
+	util.WriteJSONObject(r.Context(), w, toSinglePeerResponse(peer, grpsInfoMap[peerID], dnsDomain, valid))
 }
 
 func (h *Handler) deletePeer(ctx context.Context, accountID, userID string, peerID string, w http.ResponseWriter) {
@@ -243,25 +240,22 @@ func (h *Handler) GetAllPeers(w http.ResponseWriter, r *http.Request) {
 		respBody = append(respBody, toPeerListItemResponse(peerToReturn, grpsInfoMap[peer.ID], dnsDomain, 0))
 	}
 
-	validPeersMap, invalidPeersMap, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
+	validPeersMap, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
 	if err != nil {
-		log.WithContext(r.Context()).Errorf("failed to get validated peers: %v", err)
+		log.WithContext(r.Context()).Errorf("failed to list appreoved peers: %v", err)
 		util.WriteError(r.Context(), fmt.Errorf("internal error"), w)
 		return
 	}
-	h.setApprovalRequiredFlag(respBody, validPeersMap, invalidPeersMap)
+	h.setApprovalRequiredFlag(respBody, validPeersMap)
 
 	util.WriteJSONObject(r.Context(), w, respBody)
 }
 
-func (h *Handler) setApprovalRequiredFlag(respBody []*api.PeerBatch, validPeersMap map[string]struct{}, invalidPeersMap map[string]string) {
+func (h *Handler) setApprovalRequiredFlag(respBody []*api.PeerBatch, approvedPeersMap map[string]struct{}) {
 	for _, peer := range respBody {
-		_, ok := validPeersMap[peer.Id]
+		_, ok := approvedPeersMap[peer.Id]
 		if !ok {
 			peer.ApprovalRequired = true
-
-			reason := invalidPeersMap[peer.Id]
-			peer.DisapprovalReason = &reason
 		}
 	}
 }
@@ -310,7 +304,7 @@ func (h *Handler) GetAccessiblePeers(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	validPeers, _, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
+	validPeers, err := h.accountManager.GetValidatedPeers(r.Context(), accountID)
 	if err != nil {
 		log.WithContext(r.Context()).Errorf("failed to list approved peers: %v", err)
 		util.WriteError(r.Context(), fmt.Errorf("internal error"), w)
@@ -436,13 +430,13 @@ func peerToAccessiblePeer(peer *nbpeer.Peer, dnsDomain string) api.AccessiblePee
 	}
 }
 
-func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsDomain string, approved bool, reason string) *api.Peer {
+func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsDomain string, approved bool) *api.Peer {
 	osVersion := peer.Meta.OSVersion
 	if osVersion == "" {
 		osVersion = peer.Meta.Core
 	}
 
-	apiPeer := &api.Peer{
+	return &api.Peer{
 		CreatedAt:                   peer.CreatedAt,
 		Id:                          peer.ID,
 		Name:                        peer.Name,
@@ -471,12 +465,6 @@ func toSinglePeerResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsD
 		InactivityExpirationEnabled: peer.InactivityExpirationEnabled,
 		Ephemeral:                   peer.Ephemeral,
 	}
-
-	if !approved {
-		apiPeer.DisapprovalReason = &reason
-	}
-
-	return apiPeer
 }
 
 func toPeerListItemResponse(peer *nbpeer.Peer, groupsInfo []api.GroupMinimum, dnsDomain string, accessiblePeersCount int) *api.PeerBatch {

management/server/http/testing/testing_tools/channel/channel.go

@@ -7,9 +7,8 @@ import (
 	"time"
 
 	"github.com/golang-jwt/jwt/v5"
-	"github.com/stretchr/testify/assert"
-
 	"github.com/netbirdio/management-integrations/integrations"
+	"github.com/stretchr/testify/assert"
 
 	"github.com/netbirdio/netbird/management/server"
 	"github.com/netbirdio/netbird/management/server/account"

management/server/idp/auth0_test.go

@@ -26,11 +26,9 @@ type mockHTTPClient struct {
 }
 
 func (c *mockHTTPClient) Do(req *http.Request) (*http.Response, error) {
-	if req.Body != nil {
-		body, err := io.ReadAll(req.Body)
-		if err == nil {
-			c.reqBody = string(body)
-		}
+	body, err := io.ReadAll(req.Body)
+	if err == nil {
+		c.reqBody = string(body)
 	}
 	return &http.Response{
 		StatusCode: c.code,

management/server/idp/idp.go

@@ -201,12 +201,6 @@ func NewManager(ctx context.Context, config Config, appMetrics telemetry.AppMetr
 			APIToken: config.ExtraConfig["ApiToken"],
 		}
 		return NewJumpCloudManager(jumpcloudConfig, appMetrics)
-	case "pocketid":
-		pocketidConfig := PocketIdClientConfig{
-			APIToken:           config.ExtraConfig["ApiToken"],
-			ManagementEndpoint: config.ExtraConfig["ManagementEndpoint"],
-		}
-		return NewPocketIdManager(pocketidConfig, appMetrics)
 	default:
 		return nil, fmt.Errorf("invalid manager type: %s", config.ManagerType)
 	}

management/server/idp/pocketid.go

@@ -1,384 +0,0 @@
-package idp
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"slices"
-	"strings"
-	"time"
-
-	"github.com/netbirdio/netbird/management/server/telemetry"
-)
-
-type PocketIdManager struct {
-	managementEndpoint string
-	apiToken           string
-	httpClient         ManagerHTTPClient
-	credentials        ManagerCredentials
-	helper             ManagerHelper
-	appMetrics         telemetry.AppMetrics
-}
-
-type pocketIdCustomClaimDto struct {
-	Key   string `json:"key"`
-	Value string `json:"value"`
-}
-
-type pocketIdUserDto struct {
-	CustomClaims []pocketIdCustomClaimDto `json:"customClaims"`
-	Disabled     bool                     `json:"disabled"`
-	DisplayName  string                   `json:"displayName"`
-	Email        string                   `json:"email"`
-	FirstName    string                   `json:"firstName"`
-	ID           string                   `json:"id"`
-	IsAdmin      bool                     `json:"isAdmin"`
-	LastName     string                   `json:"lastName"`
-	LdapID       string                   `json:"ldapId"`
-	Locale       string                   `json:"locale"`
-	UserGroups   []pocketIdUserGroupDto   `json:"userGroups"`
-	Username     string                   `json:"username"`
-}
-
-type pocketIdUserCreateDto struct {
-	Disabled    bool   `json:"disabled,omitempty"`
-	DisplayName string `json:"displayName"`
-	Email       string `json:"email"`
-	FirstName   string `json:"firstName"`
-	IsAdmin     bool   `json:"isAdmin,omitempty"`
-	LastName    string `json:"lastName,omitempty"`
-	Locale      string `json:"locale,omitempty"`
-	Username    string `json:"username"`
-}
-
-type pocketIdPaginatedUserDto struct {
-	Data       []pocketIdUserDto     `json:"data"`
-	Pagination pocketIdPaginationDto `json:"pagination"`
-}
-
-type pocketIdPaginationDto struct {
-	CurrentPage  int `json:"currentPage"`
-	ItemsPerPage int `json:"itemsPerPage"`
-	TotalItems   int `json:"totalItems"`
-	TotalPages   int `json:"totalPages"`
-}
-
-func (p *pocketIdUserDto) userData() *UserData {
-	return &UserData{
-		Email:       p.Email,
-		Name:        p.DisplayName,
-		ID:          p.ID,
-		AppMetadata: AppMetadata{},
-	}
-}
-
-type pocketIdUserGroupDto struct {
-	CreatedAt    string                   `json:"createdAt"`
-	CustomClaims []pocketIdCustomClaimDto `json:"customClaims"`
-	FriendlyName string                   `json:"friendlyName"`
-	ID           string                   `json:"id"`
-	LdapID       string                   `json:"ldapId"`
-	Name         string                   `json:"name"`
-}
-
-func NewPocketIdManager(config PocketIdClientConfig, appMetrics telemetry.AppMetrics) (*PocketIdManager, error) {
-	httpTransport := http.DefaultTransport.(*http.Transport).Clone()
-	httpTransport.MaxIdleConns = 5
-
-	httpClient := &http.Client{
-		Timeout:   10 * time.Second,
-		Transport: httpTransport,
-	}
-	helper := JsonParser{}
-
-	if config.ManagementEndpoint == "" {
-		return nil, fmt.Errorf("pocketId IdP configuration is incomplete, ManagementEndpoint is missing")
-	}
-
-	if config.APIToken == "" {
-		return nil, fmt.Errorf("pocketId IdP configuration is incomplete, APIToken is missing")
-	}
-
-	credentials := &PocketIdCredentials{
-		clientConfig: config,
-		httpClient:   httpClient,
-		helper:       helper,
-		appMetrics:   appMetrics,
-	}
-
-	return &PocketIdManager{
-		managementEndpoint: config.ManagementEndpoint,
-		apiToken:           config.APIToken,
-		httpClient:         httpClient,
-		credentials:        credentials,
-		helper:             helper,
-		appMetrics:         appMetrics,
-	}, nil
-}
-
-func (p *PocketIdManager) request(ctx context.Context, method, resource string, query *url.Values, body string) ([]byte, error) {
-	var MethodsWithBody = []string{http.MethodPost, http.MethodPut}
-	if !slices.Contains(MethodsWithBody, method) && body != "" {
-		return nil, fmt.Errorf("Body provided to unsupported method: %s", method)
-	}
-
-	reqURL := fmt.Sprintf("%s/api/%s", p.managementEndpoint, resource)
-	if query != nil {
-		reqURL = fmt.Sprintf("%s?%s", reqURL, query.Encode())
-	}
-	var req *http.Request
-	var err error
-	if body != "" {
-		req, err = http.NewRequestWithContext(ctx, method, reqURL, strings.NewReader(body))
-	} else {
-		req, err = http.NewRequestWithContext(ctx, method, reqURL, nil)
-	}
-	if err != nil {
-		return nil, err
-	}
-
-	req.Header.Add("X-API-KEY", p.apiToken)
-
-	if body != "" {
-		req.Header.Add("content-type", "application/json")
-		req.Header.Add("content-length", fmt.Sprintf("%d", req.ContentLength))
-	}
-
-	resp, err := p.httpClient.Do(req)
-	if err != nil {
-		if p.appMetrics != nil {
-			p.appMetrics.IDPMetrics().CountRequestError()
-		}
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
-		if p.appMetrics != nil {
-			p.appMetrics.IDPMetrics().CountRequestStatusError()
-		}
-
-		return nil, fmt.Errorf("received unexpected status code from PocketID API: %d", resp.StatusCode)
-	}
-
-	return io.ReadAll(resp.Body)
-}
-
-// getAllUsersPaginated fetches all users from PocketID API using pagination
-func (p *PocketIdManager) getAllUsersPaginated(ctx context.Context, searchParams url.Values) ([]pocketIdUserDto, error) {
-	var allUsers []pocketIdUserDto
-	currentPage := 1
-
-	for {
-		params := url.Values{}
-		// Copy existing search parameters
-		for key, values := range searchParams {
-			params[key] = values
-		}
-
-		params.Set("pagination[limit]", "100")
-		params.Set("pagination[page]", fmt.Sprintf("%d", currentPage))
-
-		body, err := p.request(ctx, http.MethodGet, "users", &params, "")
-		if err != nil {
-			return nil, err
-		}
-
-		var profiles pocketIdPaginatedUserDto
-		err = p.helper.Unmarshal(body, &profiles)
-		if err != nil {
-			return nil, err
-		}
-
-		allUsers = append(allUsers, profiles.Data...)
-
-		// Check if we've reached the last page
-		if currentPage >= profiles.Pagination.TotalPages {
-			break
-		}
-
-		currentPage++
-	}
-
-	return allUsers, nil
-}
-
-func (p *PocketIdManager) UpdateUserAppMetadata(_ context.Context, _ string, _ AppMetadata) error {
-	return nil
-}
-
-func (p *PocketIdManager) GetUserDataByID(ctx context.Context, userId string, appMetadata AppMetadata) (*UserData, error) {
-	body, err := p.request(ctx, http.MethodGet, "users/"+userId, nil, "")
-	if err != nil {
-		return nil, err
-	}
-
-	if p.appMetrics != nil {
-		p.appMetrics.IDPMetrics().CountGetUserDataByID()
-	}
-
-	var user pocketIdUserDto
-	err = p.helper.Unmarshal(body, &user)
-	if err != nil {
-		return nil, err
-	}
-
-	userData := user.userData()
-	userData.AppMetadata = appMetadata
-
-	return userData, nil
-}
-
-func (p *PocketIdManager) GetAccount(ctx context.Context, accountId string) ([]*UserData, error) {
-	// Get all users using pagination
-	allUsers, err := p.getAllUsersPaginated(ctx, url.Values{})
-	if err != nil {
-		return nil, err
-	}
-
-	if p.appMetrics != nil {
-		p.appMetrics.IDPMetrics().CountGetAccount()
-	}
-
-	users := make([]*UserData, 0)
-	for _, profile := range allUsers {
-		userData := profile.userData()
-		userData.AppMetadata.WTAccountID = accountId
-
-		users = append(users, userData)
-	}
-	return users, nil
-}
-
-func (p *PocketIdManager) GetAllAccounts(ctx context.Context) (map[string][]*UserData, error) {
-	// Get all users using pagination
-	allUsers, err := p.getAllUsersPaginated(ctx, url.Values{})
-	if err != nil {
-		return nil, err
-	}
-
-	if p.appMetrics != nil {
-		p.appMetrics.IDPMetrics().CountGetAllAccounts()
-	}
-
-	indexedUsers := make(map[string][]*UserData)
-	for _, profile := range allUsers {
-		userData := profile.userData()
-		indexedUsers[UnsetAccountID] = append(indexedUsers[UnsetAccountID], userData)
-	}
-
-	return indexedUsers, nil
-}
-
-func (p *PocketIdManager) CreateUser(ctx context.Context, email, name, accountID, invitedByEmail string) (*UserData, error) {
-	firstLast := strings.Split(name, " ")
-
-	createUser := pocketIdUserCreateDto{
-		Disabled:    false,
-		DisplayName: name,
-		Email:       email,
-		FirstName:   firstLast[0],
-		LastName:    firstLast[1],
-		Username:    firstLast[0] + "." + firstLast[1],
-	}
-	payload, err := p.helper.Marshal(createUser)
-	if err != nil {
-		return nil, err
-	}
-
-	body, err := p.request(ctx, http.MethodPost, "users", nil, string(payload))
-	if err != nil {
-		return nil, err
-	}
-	var newUser pocketIdUserDto
-	err = p.helper.Unmarshal(body, &newUser)
-	if err != nil {
-		return nil, err
-	}
-
-	if p.appMetrics != nil {
-		p.appMetrics.IDPMetrics().CountCreateUser()
-	}
-	var pending bool = true
-	ret := &UserData{
-		Email: email,
-		Name:  name,
-		ID:    newUser.ID,
-		AppMetadata: AppMetadata{
-			WTAccountID:     accountID,
-			WTPendingInvite: &pending,
-			WTInvitedBy:     invitedByEmail,
-		},
-	}
-	return ret, nil
-}
-
-func (p *PocketIdManager) GetUserByEmail(ctx context.Context, email string) ([]*UserData, error) {
-	params := url.Values{
-		// This value a
-		"search": []string{email},
-	}
-	body, err := p.request(ctx, http.MethodGet, "users", &params, "")
-	if err != nil {
-		return nil, err
-	}
-
-	if p.appMetrics != nil {
-		p.appMetrics.IDPMetrics().CountGetUserByEmail()
-	}
-
-	var profiles struct{ data []pocketIdUserDto }
-	err = p.helper.Unmarshal(body, &profiles)
-	if err != nil {
-		return nil, err
-	}
-
-	users := make([]*UserData, 0)
-	for _, profile := range profiles.data {
-		users = append(users, profile.userData())
-	}
-	return users, nil
-}
-
-func (p *PocketIdManager) InviteUserByID(ctx context.Context, userID string) error {
-	_, err := p.request(ctx, http.MethodPut, "users/"+userID+"/one-time-access-email", nil, "")
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func (p *PocketIdManager) DeleteUser(ctx context.Context, userID string) error {
-	_, err := p.request(ctx, http.MethodDelete, "users/"+userID, nil, "")
-	if err != nil {
-		return err
-	}
-
-	if p.appMetrics != nil {
-		p.appMetrics.IDPMetrics().CountDeleteUser()
-	}
-
-	return nil
-}
-
-var _ Manager = (*PocketIdManager)(nil)
-
-type PocketIdClientConfig struct {
-	APIToken           string
-	ManagementEndpoint string
-}
-
-type PocketIdCredentials struct {
-	clientConfig PocketIdClientConfig
-	helper       ManagerHelper
-	httpClient   ManagerHTTPClient
-	appMetrics   telemetry.AppMetrics
-}
-
-var _ ManagerCredentials = (*PocketIdCredentials)(nil)
-
-func (p PocketIdCredentials) Authenticate(_ context.Context) (JWTToken, error) {
-	return JWTToken{}, nil
-}

management/server/idp/pocketid_test.go

@@ -1,138 +0,0 @@
-package idp
-
-import (
-    "context"
-    "testing"
-
-    "github.com/stretchr/testify/assert"
-    "github.com/stretchr/testify/require"
-
-    "github.com/netbirdio/netbird/management/server/telemetry"
-)
-
-
-func TestNewPocketIdManager(t *testing.T) {
-    type test struct {
-        name                 string
-        inputConfig          PocketIdClientConfig
-        assertErrFunc        require.ErrorAssertionFunc
-        assertErrFuncMessage string
-    }
-
-    defaultTestConfig := PocketIdClientConfig{
-        APIToken:           "api_token",
-        ManagementEndpoint: "http://localhost",
-    }
-
-    tests := []test{
-        {
-            name:                 "Good Configuration",
-            inputConfig:          defaultTestConfig,
-            assertErrFunc:        require.NoError,
-            assertErrFuncMessage: "shouldn't return error",
-        },
-        {
-            name: "Missing ManagementEndpoint",
-            inputConfig: PocketIdClientConfig{
-                APIToken:           defaultTestConfig.APIToken,
-                ManagementEndpoint: "",
-            },
-            assertErrFunc:        require.Error,
-            assertErrFuncMessage: "should return error when field empty",
-        },
-        {
-            name: "Missing APIToken",
-            inputConfig: PocketIdClientConfig{
-                APIToken:           "",
-                ManagementEndpoint: defaultTestConfig.ManagementEndpoint,
-            },
-            assertErrFunc:        require.Error,
-            assertErrFuncMessage: "should return error when field empty",
-        },
-    }
-
-    for _, tc := range tests {
-        t.Run(tc.name, func(t *testing.T) {
-            _, err := NewPocketIdManager(tc.inputConfig, &telemetry.MockAppMetrics{})
-            tc.assertErrFunc(t, err, tc.assertErrFuncMessage)
-        })
-    }
-}
-
-func TestPocketID_GetUserDataByID(t *testing.T) {
-    client := &mockHTTPClient{code: 200, resBody: `{"id":"u1","email":"user1@example.com","displayName":"User One"}`}
-
-    mgr, err := NewPocketIdManager(PocketIdClientConfig{APIToken: "tok", ManagementEndpoint: "http://localhost"}, nil)
-    require.NoError(t, err)
-    mgr.httpClient = client
-
-    md := AppMetadata{WTAccountID: "acc1"}
-    got, err := mgr.GetUserDataByID(context.Background(), "u1", md)
-    require.NoError(t, err)
-    assert.Equal(t, "u1", got.ID)
-    assert.Equal(t, "user1@example.com", got.Email)
-    assert.Equal(t, "User One", got.Name)
-    assert.Equal(t, "acc1", got.AppMetadata.WTAccountID)
-}
-
-func TestPocketID_GetAccount_WithPagination(t *testing.T) {
-    // Single page response with two users
-    client := &mockHTTPClient{code: 200, resBody: `{"data":[{"id":"u1","email":"e1","displayName":"n1"},{"id":"u2","email":"e2","displayName":"n2"}],"pagination":{"currentPage":1,"itemsPerPage":100,"totalItems":2,"totalPages":1}}`}
-
-    mgr, err := NewPocketIdManager(PocketIdClientConfig{APIToken: "tok", ManagementEndpoint: "http://localhost"}, nil)
-    require.NoError(t, err)
-    mgr.httpClient = client
-
-    users, err := mgr.GetAccount(context.Background(), "accX")
-    require.NoError(t, err)
-    require.Len(t, users, 2)
-    assert.Equal(t, "u1", users[0].ID)
-    assert.Equal(t, "accX", users[0].AppMetadata.WTAccountID)
-    assert.Equal(t, "u2", users[1].ID)
-}
-
-func TestPocketID_GetAllAccounts_WithPagination(t *testing.T) {
-    client := &mockHTTPClient{code: 200, resBody: `{"data":[{"id":"u1","email":"e1","displayName":"n1"},{"id":"u2","email":"e2","displayName":"n2"}],"pagination":{"currentPage":1,"itemsPerPage":100,"totalItems":2,"totalPages":1}}`}
-
-    mgr, err := NewPocketIdManager(PocketIdClientConfig{APIToken: "tok", ManagementEndpoint: "http://localhost"}, nil)
-    require.NoError(t, err)
-    mgr.httpClient = client
-
-    accounts, err := mgr.GetAllAccounts(context.Background())
-    require.NoError(t, err)
-    require.Len(t, accounts[UnsetAccountID], 2)
-}
-
-func TestPocketID_CreateUser(t *testing.T) {
-    client := &mockHTTPClient{code: 201, resBody: `{"id":"newid","email":"new@example.com","displayName":"New User"}`}
-
-    mgr, err := NewPocketIdManager(PocketIdClientConfig{APIToken: "tok", ManagementEndpoint: "http://localhost"}, nil)
-    require.NoError(t, err)
-    mgr.httpClient = client
-
-    ud, err := mgr.CreateUser(context.Background(), "new@example.com", "New User", "acc1", "inviter@example.com")
-    require.NoError(t, err)
-    assert.Equal(t, "newid", ud.ID)
-    assert.Equal(t, "new@example.com", ud.Email)
-    assert.Equal(t, "New User", ud.Name)
-    assert.Equal(t, "acc1", ud.AppMetadata.WTAccountID)
-    if assert.NotNil(t, ud.AppMetadata.WTPendingInvite) {
-        assert.True(t, *ud.AppMetadata.WTPendingInvite)
-    }
-    assert.Equal(t, "inviter@example.com", ud.AppMetadata.WTInvitedBy)
-}
-
-func TestPocketID_InviteAndDeleteUser(t *testing.T) {
-    // Same mock for both calls; returns OK with empty JSON
-    client := &mockHTTPClient{code: 200, resBody: `{}`}
-
-    mgr, err := NewPocketIdManager(PocketIdClientConfig{APIToken: "tok", ManagementEndpoint: "http://localhost"}, nil)
-    require.NoError(t, err)
-    mgr.httpClient = client
-
-    err = mgr.InviteUserByID(context.Background(), "u1")
-    require.NoError(t, err)
-
-    err = mgr.DeleteUser(context.Background(), "u1")
-    require.NoError(t, err)
-}

management/server/integrated_validator.go

@@ -88,7 +88,7 @@ func (am *DefaultAccountManager) GroupValidation(ctx context.Context, accountID
 	return true, nil
 }
 
-func (am *DefaultAccountManager) GetValidatedPeers(ctx context.Context, accountID string) (map[string]struct{}, map[string]string, error) {
+func (am *DefaultAccountManager) GetValidatedPeers(ctx context.Context, accountID string) (map[string]struct{}, error) {
 	var err error
 	var groups []*types.Group
 	var peers []*nbpeer.Peer
@@ -96,30 +96,20 @@ func (am *DefaultAccountManager) GetValidatedPeers(ctx context.Context, accountI
 
 	groups, err = am.Store.GetAccountGroups(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 
 	peers, err = am.Store.GetAccountPeers(ctx, store.LockingStrengthNone, accountID, "", "")
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 
 	settings, err = am.Store.GetAccountSettings(ctx, store.LockingStrengthNone, accountID)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 
-	validPeers, err := am.integratedPeerValidator.GetValidatedPeers(ctx, accountID, groups, peers, settings.Extra)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	invalidPeers, err := am.integratedPeerValidator.GetInvalidPeers(ctx, accountID, settings.Extra)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	return validPeers, invalidPeers, nil
+	return am.integratedPeerValidator.GetValidatedPeers(ctx, accountID, groups, peers, settings.Extra)
 }
 
 type MockIntegratedValidator struct {
@@ -146,10 +136,6 @@ func (a MockIntegratedValidator) GetValidatedPeers(_ context.Context, accountID
 	return validatedPeers, nil
 }
 
-func (a MockIntegratedValidator) GetInvalidPeers(_ context.Context, accountID string, extraSettings *types.ExtraSettings) (map[string]string, error) {
-	return make(map[string]string), nil
-}
-
 func (MockIntegratedValidator) PreparePeer(_ context.Context, accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings, temporary bool) *nbpeer.Peer {
 	return peer
 }

management/server/integrations/integrated_validator/interface.go

@@ -15,7 +15,6 @@ type IntegratedValidator interface {
 	PreparePeer(ctx context.Context, accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings, temporary bool) *nbpeer.Peer
 	IsNotValidPeer(ctx context.Context, accountID string, peer *nbpeer.Peer, peersGroup []string, extraSettings *types.ExtraSettings) (bool, bool, error)
 	GetValidatedPeers(ctx context.Context, accountID string, groups []*types.Group, peers []*nbpeer.Peer, extraSettings *types.ExtraSettings) (map[string]struct{}, error)
-	GetInvalidPeers(ctx context.Context, accountID string, extraSettings *types.ExtraSettings) (map[string]string, error)
 	PeerDeleted(ctx context.Context, accountID, peerID string, extraSettings *types.ExtraSettings) error
 	SetPeerInvalidationListener(fn func(accountID string, peerIDs []string))
 	Stop(ctx context.Context)

management/server/mock_server/account_mock.go

@@ -189,17 +189,17 @@ func (am *MockAccountManager) OnPeerDisconnected(_ context.Context, accountID st
 	panic("implement me")
 }
 
-func (am *MockAccountManager) GetValidatedPeers(ctx context.Context, accountID string) (map[string]struct{}, map[string]string, error) {
+func (am *MockAccountManager) GetValidatedPeers(ctx context.Context, accountID string) (map[string]struct{}, error) {
 	account, err := am.GetAccountFunc(ctx, accountID)
 	if err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 
 	approvedPeers := make(map[string]struct{})
 	for id := range account.Peers {
 		approvedPeers[id] = struct{}{}
 	}
-	return approvedPeers, nil, nil
+	return approvedPeers, nil
 }
 
 // GetGroup mock implementation of GetGroup from server.AccountManager interface

management/server/permissions/manager.go

@@ -7,7 +7,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/management/server/account"
 	"github.com/netbirdio/netbird/management/server/activity"
 	"github.com/netbirdio/netbird/management/server/permissions/modules"
 	"github.com/netbirdio/netbird/management/server/permissions/operations"
@@ -23,7 +22,6 @@ type Manager interface {
 	ValidateAccountAccess(ctx context.Context, accountID string, user *types.User, allowOwnerAndAdmin bool) error
 
 	GetPermissionsByRole(ctx context.Context, role types.UserRole) (roles.Permissions, error)
-	SetAccountManager(accountManager account.Manager)
 }
 
 type managerImpl struct {
@@ -123,7 +121,3 @@ func (m *managerImpl) GetPermissionsByRole(ctx context.Context, role types.UserR
 
 	return permissions, nil
 }
-
-func (m *managerImpl) SetAccountManager(accountManager account.Manager) {
-	// no-op
-}

management/server/permissions/manager_mock.go

@@ -9,7 +9,6 @@ import (
 	reflect "reflect"
 
 	gomock "github.com/golang/mock/gomock"
-	account "github.com/netbirdio/netbird/management/server/account"
 	modules "github.com/netbirdio/netbird/management/server/permissions/modules"
 	operations "github.com/netbirdio/netbird/management/server/permissions/operations"
 	roles "github.com/netbirdio/netbird/management/server/permissions/roles"
@@ -54,18 +53,6 @@ func (mr *MockManagerMockRecorder) GetPermissionsByRole(ctx, role interface{}) *
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetPermissionsByRole", reflect.TypeOf((*MockManager)(nil).GetPermissionsByRole), ctx, role)
 }
 
-// SetAccountManager mocks base method.
-func (m *MockManager) SetAccountManager(accountManager account.Manager) {
-	m.ctrl.T.Helper()
-	m.ctrl.Call(m, "SetAccountManager", accountManager)
-}
-
-// SetAccountManager indicates an expected call of SetAccountManager.
-func (mr *MockManagerMockRecorder) SetAccountManager(accountManager interface{}) *gomock.Call {
-	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "SetAccountManager", reflect.TypeOf((*MockManager)(nil).SetAccountManager), accountManager)
-}
-
 // ValidateAccountAccess mocks base method.
 func (m *MockManager) ValidateAccountAccess(ctx context.Context, accountID string, user *types.User, allowOwnerAndAdmin bool) error {
 	m.ctrl.T.Helper()

management/server/telemetry/store_metrics.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"time"
 
+	"go.opentelemetry.io/otel/attribute"
 	"go.opentelemetry.io/otel/metric"
 )
 
@@ -14,6 +15,8 @@ type StoreMetrics struct {
 	persistenceDurationMicro           metric.Int64Histogram
 	persistenceDurationMs              metric.Int64Histogram
 	transactionDurationMs              metric.Int64Histogram
+	queryDurationMs                    metric.Int64Histogram
+	queryCounter                       metric.Int64Counter
 	ctx                                context.Context
 }
 
@@ -59,12 +62,29 @@ func NewStoreMetrics(ctx context.Context, meter metric.Meter) (*StoreMetrics, er
 		return nil, err
 	}
 
+	queryDurationMs, err := meter.Int64Histogram("management.store.query.duration.ms",
+		metric.WithUnit("milliseconds"),
+		metric.WithDescription("Duration of database query operations with operation type and table name"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	queryCounter, err := meter.Int64Counter("management.store.query.count",
+		metric.WithDescription("Count of database query operations with operation type, table name, and status"),
+	)
+	if err != nil {
+		return nil, err
+	}
+
 	return &StoreMetrics{
 		globalLockAcquisitionDurationMicro: globalLockAcquisitionDurationMicro,
 		globalLockAcquisitionDurationMs:    globalLockAcquisitionDurationMs,
 		persistenceDurationMicro:           persistenceDurationMicro,
 		persistenceDurationMs:              persistenceDurationMs,
 		transactionDurationMs:              transactionDurationMs,
+		queryDurationMs:                    queryDurationMs,
+		queryCounter:                       queryCounter,
 		ctx:                                ctx,
 	}, nil
 }
@@ -85,3 +105,13 @@ func (metrics *StoreMetrics) CountPersistenceDuration(duration time.Duration) {
 func (metrics *StoreMetrics) CountTransactionDuration(duration time.Duration) {
 	metrics.transactionDurationMs.Record(metrics.ctx, duration.Milliseconds())
 }
+
+// CountStoreOperation records a store operation with its method name, status, and duration
+func (metrics *StoreMetrics) CountStoreOperation(method string, duration time.Duration) {
+	attrs := []attribute.KeyValue{
+		attribute.String("method", method),
+	}
+
+	metrics.queryDurationMs.Record(metrics.ctx, duration.Milliseconds(), metric.WithAttributes(attrs...))
+	metrics.queryCounter.Add(metrics.ctx, 1, metric.WithAttributes(attrs...))
+}

management/server/types/account.go

@@ -301,7 +301,7 @@ func (a *Account) GetPeerNetworkMap(
 	if dnsManagementStatus {
 		var zones []nbdns.CustomZone
 		if peersCustomZone.Domain != "" {
-			records := filterZoneRecordsForPeers(peer, peersCustomZone, peersToConnectIncludingRouters, expiredPeers)
+			records := filterZoneRecordsForPeers(peer, peersCustomZone, peersToConnect)
 			zones = append(zones, nbdns.CustomZone{
 				Domain:  peersCustomZone.Domain,
 				Records: records,
@@ -1682,7 +1682,7 @@ func peerSupportsPortRanges(peerVer string) bool {
 }
 
 // filterZoneRecordsForPeers filters DNS records to only include peers to connect.
-func filterZoneRecordsForPeers(peer *nbpeer.Peer, customZone nbdns.CustomZone, peersToConnect, expiredPeers []*nbpeer.Peer) []nbdns.SimpleRecord {
+func filterZoneRecordsForPeers(peer *nbpeer.Peer, customZone nbdns.CustomZone, peersToConnect []*nbpeer.Peer) []nbdns.SimpleRecord {
 	filteredRecords := make([]nbdns.SimpleRecord, 0, len(customZone.Records))
 	peerIPs := make(map[string]struct{})
 
@@ -1693,10 +1693,6 @@ func filterZoneRecordsForPeers(peer *nbpeer.Peer, customZone nbdns.CustomZone, p
 		peerIPs[peerToConnect.IP.String()] = struct{}{}
 	}
 
-	for _, expiredPeer := range expiredPeers {
-		peerIPs[expiredPeer.IP.String()] = struct{}{}
-	}
-
 	for _, record := range customZone.Records {
 		if _, exists := peerIPs[record.RData]; exists {
 			filteredRecords = append(filteredRecords, record)

management/server/types/account_test.go

@@ -845,7 +845,6 @@ func Test_FilterZoneRecordsForPeers(t *testing.T) {
 		peer            *nbpeer.Peer
 		customZone      nbdns.CustomZone
 		peersToConnect  []*nbpeer.Peer
-		expiredPeers    []*nbpeer.Peer
 		expectedRecords []nbdns.SimpleRecord
 	}{
 		{
@@ -858,7 +857,6 @@ func Test_FilterZoneRecordsForPeers(t *testing.T) {
 				},
 			},
 			peersToConnect: []*nbpeer.Peer{},
-			expiredPeers:   []*nbpeer.Peer{},
 			peer:           &nbpeer.Peer{ID: "router", IP: net.ParseIP("10.0.0.100")},
 			expectedRecords: []nbdns.SimpleRecord{
 				{Name: "router.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.100"},
@@ -892,8 +890,7 @@ func Test_FilterZoneRecordsForPeers(t *testing.T) {
 				}
 				return peers
 			}(),
-			expiredPeers: []*nbpeer.Peer{},
-			peer:         &nbpeer.Peer{ID: "router", IP: net.ParseIP("10.0.0.100")},
+			peer: &nbpeer.Peer{ID: "router", IP: net.ParseIP("10.0.0.100")},
 			expectedRecords: func() []nbdns.SimpleRecord {
 				var records []nbdns.SimpleRecord
 				for _, i := range []int{1, 5, 10, 25, 50, 75, 100} {
@@ -927,8 +924,7 @@ func Test_FilterZoneRecordsForPeers(t *testing.T) {
 				{ID: "peer1", IP: net.ParseIP("10.0.0.1"), DNSLabel: "peer1", ExtraDNSLabels: []string{"peer1-alt", "peer1-backup"}},
 				{ID: "peer2", IP: net.ParseIP("10.0.0.2"), DNSLabel: "peer2", ExtraDNSLabels: []string{"peer2-service"}},
 			},
-			expiredPeers: []*nbpeer.Peer{},
-			peer:         &nbpeer.Peer{ID: "router", IP: net.ParseIP("10.0.0.100")},
+			peer: &nbpeer.Peer{ID: "router", IP: net.ParseIP("10.0.0.100")},
 			expectedRecords: []nbdns.SimpleRecord{
 				{Name: "peer1.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
 				{Name: "peer1-alt.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
@@ -938,35 +934,11 @@ func Test_FilterZoneRecordsForPeers(t *testing.T) {
 				{Name: "router.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.100"},
 			},
 		},
-		{
-			name: "expired peers are included in DNS entries",
-			customZone: nbdns.CustomZone{
-				Domain: "netbird.cloud.",
-				Records: []nbdns.SimpleRecord{
-					{Name: "peer1.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-					{Name: "peer2.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.2"},
-					{Name: "expired-peer.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.99"},
-					{Name: "router.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.100"},
-				},
-			},
-			peersToConnect: []*nbpeer.Peer{
-				{ID: "peer1", IP: net.ParseIP("10.0.0.1")},
-			},
-			expiredPeers: []*nbpeer.Peer{
-				{ID: "expired-peer", IP: net.ParseIP("10.0.0.99")},
-			},
-			peer: &nbpeer.Peer{ID: "router", IP: net.ParseIP("10.0.0.100")},
-			expectedRecords: []nbdns.SimpleRecord{
-				{Name: "peer1.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-				{Name: "expired-peer.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.99"},
-				{Name: "router.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.100"},
-			},
-		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			result := filterZoneRecordsForPeers(tt.peer, tt.customZone, tt.peersToConnect, tt.expiredPeers)
+			result := filterZoneRecordsForPeers(tt.peer, tt.customZone, tt.peersToConnect)
 			assert.Equal(t, len(tt.expectedRecords), len(result))
 			assert.ElementsMatch(t, tt.expectedRecords, result)
 		})

release_files/install.sh

@@ -29,8 +29,6 @@ if [ -z ${NETBIRD_RELEASE+x} ]; then
     NETBIRD_RELEASE=latest
 fi
 
-TAG_NAME=""
-
 get_release() {
     local RELEASE=$1
     if [ "$RELEASE" = "latest" ]; then
@@ -40,19 +38,17 @@ get_release() {
         local TAG="tags/${RELEASE}"
         local URL="https://api.github.com/repos/${OWNER}/${REPO}/releases/${TAG}"
     fi
-	OUTPUT=""
     if [ -n "$GITHUB_TOKEN" ]; then
-          OUTPUT=$(curl -H  "Authorization: token ${GITHUB_TOKEN}" -s "${URL}")
+          curl -H  "Authorization: token ${GITHUB_TOKEN}" -s "${URL}" \
+              | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/'
     else
-          OUTPUT=$(curl -s "${URL}") 
+          curl -s "${URL}" \
+              | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/'
     fi
-	TAG_NAME=$(echo ${OUTPUT} |  grep -Eo '\"tag_name\":\s*\"v([0-9]+\.){2}[0-9]+"' | tail -n 1)
-	echo "${TAG_NAME}" | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+'
 }
 
 download_release_binary() {
     VERSION=$(get_release "$NETBIRD_RELEASE")
-	echo "Using the following tag name for binary installation: ${TAG_NAME}"
     BASE_URL="https://github.com/${OWNER}/${REPO}/releases/download"
     BINARY_BASE_NAME="${VERSION#v}_${OS_TYPE}_${ARCH}.tar.gz"
 

shared/management/client/grpc.go

@@ -55,7 +55,8 @@ func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsE
 		var err error
 		conn, err = nbgrpc.CreateConnection(ctx, addr, tlsEnabled, wsproxy.ManagementComponent)
 		if err != nil {
-			return fmt.Errorf("create connection: %w", err)
+			log.Printf("createConnection error: %v", err)
+			return err
 		}
 		return nil
 	}

shared/management/http/api/openapi.yml

@@ -463,9 +463,6 @@ components:
               description: (Cloud only) Indicates whether peer needs approval
               type: boolean
               example: true
-            disapproval_reason:
-              description: (Cloud only) Reason why the peer requires approval
-              type: string
             country_code:
               $ref: '#/components/schemas/CountryCode'
             city_name:

shared/management/http/api/types.gen.go

@@ -1037,9 +1037,6 @@ type Peer struct {
 	// CreatedAt Peer creation date (UTC)
 	CreatedAt time.Time `json:"created_at"`
 
-	// DisapprovalReason (Cloud only) Reason why the peer requires approval
-	DisapprovalReason *string `json:"disapproval_reason,omitempty"`
-
 	// DnsLabel Peer's DNS label is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's domain to the peer label. e.g. peer-dns-label.netbird.cloud
 	DnsLabel string `json:"dns_label"`
 
@@ -1127,9 +1124,6 @@ type PeerBatch struct {
 	// CreatedAt Peer creation date (UTC)
 	CreatedAt time.Time `json:"created_at"`
 
-	// DisapprovalReason (Cloud only) Reason why the peer requires approval
-	DisapprovalReason *string `json:"disapproval_reason,omitempty"`
-
 	// DnsLabel Peer's DNS label is the parsed peer name for domain resolution. It is used to form an FQDN by appending the account's domain to the peer label. e.g. peer-dns-label.netbird.cloud
 	DnsLabel string `json:"dns_label"`
 

shared/signal/client/grpc.go

@@ -60,7 +60,8 @@ func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled boo
 		var err error
 		conn, err = nbgrpc.CreateConnection(ctx, addr, tlsEnabled, wsproxy.SignalComponent)
 		if err != nil {
-			return fmt.Errorf("create connection: %w", err)
+			log.Printf("createConnection error: %v", err)
+			return err
 		}
 		return nil
 	}

signal/cmd/run.go

@@ -94,7 +94,7 @@ var (
 
 			startPprof()
 
-			opts, certManager, tlsConfig, err := getTLSConfigurations()
+			opts, certManager, err := getTLSConfigurations()
 			if err != nil {
 				return err
 			}
@@ -132,7 +132,7 @@ var (
 
 			// Start the main server - always serve HTTP with WebSocket proxy support
 			// If certManager is configured and signalPort == 443, it's already handled by startServerWithCertManager
-			if tlsConfig == nil {
+			if certManager == nil {
 				// Without TLS, serve plain HTTP
 				httpListener, err = net.Listen("tcp", fmt.Sprintf(":%d", signalPort))
 				if err != nil {
@@ -140,10 +140,9 @@ var (
 				}
 				log.Infof("running HTTP server with WebSocket proxy (no TLS): %s", httpListener.Addr().String())
 				serveHTTP(httpListener, grpcRootHandler)
-			} else if certManager == nil || signalPort != 443 {
-				// Serve HTTPS if not already handled by startServerWithCertManager
-				// (custom certificates or Let's Encrypt with custom port)
-				httpListener, err = tls.Listen("tcp", fmt.Sprintf(":%d", signalPort), tlsConfig)
+			} else if signalPort != 443 {
+				// With TLS but not on port 443, serve HTTPS
+				httpListener, err = tls.Listen("tcp", fmt.Sprintf(":%d", signalPort), certManager.TLSConfig())
 				if err != nil {
 					return err
 				}
@@ -203,7 +202,7 @@ func startPprof() {
 	}()
 }
 
-func getTLSConfigurations() ([]grpc.ServerOption, *autocert.Manager, *tls.Config, error) {
+func getTLSConfigurations() ([]grpc.ServerOption, *autocert.Manager, error) {
 	var (
 		err         error
 		certManager *autocert.Manager
@@ -212,33 +211,33 @@ func getTLSConfigurations() ([]grpc.ServerOption, *autocert.Manager, *tls.Config
 
 	if signalLetsencryptDomain == "" && signalCertFile == "" && signalCertKey == "" {
 		log.Infof("running without TLS")
-		return nil, nil, nil, nil
+		return nil, nil, nil
 	}
 
 	if signalLetsencryptDomain != "" {
 		certManager, err = encryption.CreateCertManager(signalSSLDir, signalLetsencryptDomain)
 		if err != nil {
-			return nil, certManager, nil, err
+			return nil, certManager, err
 		}
 		tlsConfig = certManager.TLSConfig()
 		log.Infof("setting up TLS with LetsEncrypt.")
 	} else {
 		if signalCertFile == "" || signalCertKey == "" {
 			log.Errorf("both cert-file and cert-key must be provided when not using LetsEncrypt")
-			return nil, certManager, nil, errors.New("both cert-file and cert-key must be provided when not using LetsEncrypt")
+			return nil, certManager, errors.New("both cert-file and cert-key must be provided when not using LetsEncrypt")
 		}
 
 		tlsConfig, err = loadTLSConfig(signalCertFile, signalCertKey)
 		if err != nil {
 			log.Errorf("cannot load TLS credentials: %v", err)
-			return nil, certManager, nil, err
+			return nil, certManager, err
 		}
 		log.Infof("setting up TLS with custom certificates.")
 	}
 
 	transportCredentials := credentials.NewTLS(tlsConfig)
 
-	return []grpc.ServerOption{grpc.Creds(transportCredentials)}, certManager, tlsConfig, err
+	return []grpc.ServerOption{grpc.Creds(transportCredentials)}, certManager, err
 }
 
 func startServerWithCertManager(certManager *autocert.Manager, grpcRootHandler http.Handler) {