[client] Fix lint issues in management and signal grpc clients

Rename ClientOption to Option in the management and signal client
packages so callers do not repeat the package name, and silence nilerr
on the offline-wait path where a cancelled context means shutdown
rather than a retryable failure.

.git-branches.toml

@@ -3,7 +3,7 @@
 [branches]
 main = "main"
 perennials = []
-perennial-regex = "^release-"
+perennial-regex = ""
 
 [create]
 new-branch-type = "feature"

.github/workflows/check-license-dependencies.yml

@@ -2,7 +2,7 @@ name: Check License Dependencies
 
 on:
   push:
-    branches: [main, "release-*"]
+    branches: [main]
     paths:
       - "go.mod"
       - "go.sum"

.github/workflows/frontend-ui.yml

@@ -10,7 +10,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
     paths:
       - "client/ui/frontend/**"
       - "client/ui/i18n/**"

.github/workflows/golang-test-darwin.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/golang-test-freebsd.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/golang-test-linux.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/golang-test-windows.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 env:

.github/workflows/install-script-test.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
     paths:
       - "release_files/install.sh"

.github/workflows/mobile-build-validation.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.github/workflows/release.yml

@@ -6,7 +6,6 @@ on:
       - "v*"
     branches:
       - main
-      - "release-*"
   pull_request:
 
 env:
@@ -255,23 +254,15 @@ jobs:
         id: tag_and_push_images
         if: |
           (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) ||
-          (github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')))
+          (github.event_name == 'push' && github.ref == 'refs/heads/main')
         run: |
           set -euo pipefail
 
-          # $GITHUB_REF / $GITHUB_EVENT_NAME are read from the runner
-          # environment rather than substituted into this script with the
-          # workflow expression syntax: branch names may legally contain
-          # $(…), and interpolating github.ref would execute it.
           resolve_tags() {
-            if [[ "$GITHUB_EVENT_NAME" == "pull_request" ]]; then
+            if [[ "${{ github.event_name }}" == "pull_request" ]]; then
               echo "pr-${{ github.event.pull_request.number }}"
-            elif [[ "$GITHUB_REF" == "refs/heads/main" ]]; then
-              echo "main sha-$(git rev-parse --short HEAD)"
             else
-              # Release branches get an immutable sha-* tag only — the floating
-              # "main" tag must never move from a release branch.
-              echo "sha-$(git rev-parse --short HEAD)"
+              echo "main sha-$(git rev-parse --short HEAD)"
             fi
           }
 

.github/workflows/sync-tag.yml

@@ -9,9 +9,21 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.head_ref || github.actor_id }}
   cancel-in-progress: true
 
-# The receiving bump-netbird workflows expect the short tag form
-# (e.g. v0.30.0), not refs/tags/v0.30.0 — github.ref_name, not github.ref.
+# Receiving workflows (cloud sync-tag, mobile bump-netbird) expect the short
+# tag form (e.g. v0.30.0), not refs/tags/v0.30.0 — github.ref_name, not github.ref.
 jobs:
+  trigger_sync_tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Trigger release tag sync
+        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1.3.2
+        with:
+          workflow: sync-tag.yml
+          ref: main
+          repo: ${{ secrets.UPSTREAM_REPO }}
+          token: ${{ secrets.NC_GITHUB_TOKEN }}
+          inputs: '{ "tag": "${{ github.ref_name }}" }'
+
   trigger_android_bump:
     runs-on: ubuntu-latest
     if: github.event.created && !github.event.deleted && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-')

.github/workflows/test-infrastructure-files.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
     paths:
       - "infrastructure_files/**"

.github/workflows/wasm-build-validation.yml

@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - main
-      - "release-*"
   pull_request:
 
 concurrency:

.goreleaser.yaml

@@ -468,13 +468,6 @@ checksum:
     - glob: ./infrastructure_files/migrate-to-enterprise.sh
 
 release:
-  # The signing pipeline (netbirdio/sign-pipelines, dispatched by
-  # trigger_signer) marks the release latest once the Windows and macOS
-  # artifacts are signed. Without this override goreleaser marks it latest
-  # at publish time, while those artifacts are still unsigned.
-  make_latest: false
-  # Mark x.y.z-rc.* and other prerelease tags as prereleases on GitHub.
-  prerelease: auto
   extra_files:
     - glob: ./infrastructure_files/getting-started-with-zitadel.sh
     - glob: ./release_files/install.sh

.goreleaser_ui.yaml

@@ -144,11 +144,3 @@ uploads:
     target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
     method: PUT
-
-release:
-  # Uploads into the release created by the main .goreleaser.yaml run.
-  # make_latest stays false everywhere: the signing pipeline
-  # (netbirdio/sign-pipelines) marks the release latest after the Windows
-  # and macOS artifacts are signed.
-  make_latest: false
-  prerelease: auto

.goreleaser_ui_darwin.yaml

@@ -43,11 +43,3 @@ checksum:
   name_template: "{{ .ProjectName }}_darwin_checksums.txt"
 changelog:
   disable: true
-
-release:
-  # Uploads into the release created by the main .goreleaser.yaml run.
-  # make_latest stays false everywhere: the signing pipeline
-  # (netbirdio/sign-pipelines) marks the release latest after the Windows
-  # and macOS artifacts are signed.
-  make_latest: false
-  prerelease: auto

.goreleaser_ui_gtk3.yaml

@@ -134,11 +134,3 @@ uploads:
     target: https://pkgs.wiretrustee.com/yum/{{ .Arch }}{{ if .Arm }}{{ .Arm }}{{ end }}
     username: dev@wiretrustee.com
     method: PUT
-
-release:
-  # Uploads into the release created by the main .goreleaser.yaml run.
-  # make_latest stays false everywhere: the signing pipeline
-  # (netbirdio/sign-pipelines) marks the release latest after the Windows
-  # and macOS artifacts are signed.
-  make_latest: false
-  prerelease: auto

client/android/client.go

@@ -26,6 +26,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -40,11 +42,6 @@ const (
 	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
 )
 
-// ConnectionListener export internal Listener for mobile
-type ConnectionListener interface {
-	peer.Listener
-}
-
 // TunAdapter export internal TunAdapter for mobile
 type TunAdapter interface {
 	device.TunAdapter
@@ -85,6 +82,13 @@ type Client struct {
 	deviceName            string
 	uiVersion             string
 	networkChangeListener listener.NetworkChangeListener
+	// netState outlives engine restarts: it mirrors the OS connectivity, not
+	// the engine lifecycle. Run and RunWithoutLogin inject it into each new
+	// ConnectClient, which distributes it to every reconnection loop.
+	netState *netstate.State
+
+	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
+	sweeper *netsweep.Sweeper
 
 	stateMu       sync.RWMutex
 	connectClient *internal.ConnectClient
@@ -156,6 +160,8 @@ func NewClient(androidSDKVersion int, deviceName string, uiVersion string, tunAd
 		recorder:              peer.NewRecorder(""),
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
+		netState:              netstate.New(),
+		sweeper:               netsweep.New(),
 	}
 }
 
@@ -196,7 +202,8 @@ func (c *Client) Run(platformFiles PlatformFiles, urlOpener URLOpener, isAndroid
 	}
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
+		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	// This path runs the interactive SSO flow, so reaching here means the peer
 	// is authenticated again — release the latch Status() reports from. Clear
@@ -237,7 +244,8 @@ func (c *Client) RunWithoutLogin(platformFiles PlatformFiles, dns *DNSList, dnsR
 
 	// todo do not throw error in case of cancelled context
 	ctx = internal.CtxInitState(ctx)
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
+		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
 	c.setState(cfg, cacheDir, cfgFile, connectClient)
 	return connectClient.RunOnAndroid(c.tunAdapter, c.iFaceDiscover, c.networkChangeListener, slices.Clone(dns.items), dnsReadyListener, stateFile, cacheDir)
 }
@@ -285,6 +293,23 @@ func (c *Client) GetTunSettings() (*TunSettings, error) {
 	}, nil
 }
 
+// SetNetworkAvailable feeds OS-reported network availability into the client.
+// While unavailable, the internal reconnect loops suspend their attempts and
+// the connection listener reports NoNetwork instead of Connecting; when
+// availability returns, the loops resume immediately with a fresh backoff.
+func (c *Client) SetNetworkAvailable(available bool) {
+	c.netState.Set(available)
+	c.recorder.SetNetworkAvailable(available)
+}
+
+// NotifyNetworkChange cuts the management, signal and relay connections
+// after the OS switched networks, so the reconnect loops redial immediately
+// on the new one. The engine and the TUN device stay untouched.
+func (c *Client) NotifyNetworkChange() {
+	n := c.sweeper.Sweep()
+	log.Infof("network change: swept %d connections", n)
+}
+
 // DebugBundle generates a debug bundle, uploads it, and returns the upload key.
 // It works both with and without a running engine. anonymizeLevel is "default"
 // or "strict"; strict also anonymizes internal IP ranges, peer names, and
@@ -525,7 +550,11 @@ func (c *Client) OnUpdatedHostDNS(list *DNSList) error {
 
 // SetConnectionListener set the network connection listener
 func (c *Client) SetConnectionListener(listener ConnectionListener) {
-	c.recorder.SetConnectionListener(listener)
+	if listener == nil {
+		c.recorder.RemoveConnectionListener()
+		return
+	}
+	c.recorder.SetConnectionListener(connectionListenerAdapter{listener})
 }
 
 // RemoveConnectionListener remove connection listener

client/android/connection_listener.go

@@ -0,0 +1,41 @@
+//go:build android
+
+package android
+
+import (
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// Client state values delivered via ConnectionListener.OnStateChanged,
+// re-exported as basic constants so gomobile emits them into the generated
+// Java bindings. They mirror peer.ClientState*: append-only, never reorder.
+const (
+	ClientStateDisconnected  = int(peer.ClientStateDisconnected)
+	ClientStateConnected     = int(peer.ClientStateConnected)
+	ClientStateConnecting    = int(peer.ClientStateConnecting)
+	ClientStateDisconnecting = int(peer.ClientStateDisconnecting)
+	ClientStateNoNetwork     = int(peer.ClientStateNoNetwork)
+)
+
+// ConnectionListener export internal Listener for mobile. It mirrors
+// peer.Listener with OnStateChanged taking a plain int (one of the
+// ClientState* constants), because gomobile cannot bind named types.
+type ConnectionListener interface {
+	OnStateChanged(state int)
+	OnConnected()
+	OnDisconnected()
+	OnConnecting()
+	OnDisconnecting()
+	OnAddressChanged(string, string)
+	OnPeersListChanged(int)
+}
+
+// connectionListenerAdapter adapts the gomobile-facing ConnectionListener to
+// peer.Listener, converting the typed state to the int the binding carries.
+type connectionListenerAdapter struct {
+	ConnectionListener
+}
+
+func (a connectionListenerAdapter) OnStateChanged(state peer.ClientState) {
+	a.ConnectionListener.OnStateChanged(int(state))
+}

client/firewall/iptables/acl_linux.go

@@ -42,7 +42,6 @@ type aclManager struct {
 	optionalEntries map[string][]entry
 	ipsetStore      *ipsetStore
 	v6              bool
-	ipsetSupported  bool
 
 	stateManager *statemanager.Manager
 }
@@ -61,8 +60,6 @@ func newAclManager(iptablesClient *iptables.IPTables, wgIface iFaceMapper) (*acl
 func (m *aclManager) init(stateManager *statemanager.Manager) error {
 	m.stateManager = stateManager
 
-	m.ipsetSupported = m.probeIPSetSupport()
-
 	m.seedInitialEntries()
 	m.seedInitialOptionalEntries()
 
@@ -94,12 +91,6 @@ func (m *aclManager) AddPeerFiltering(
 	if m.v6 && ipsetName != "" {
 		ipsetName += "-v6"
 	}
-	// When the kernel lacks the required ipset hash module, fall back to
-	// per-IP iptables rules (pre-0.68 behavior) so ACLs keep working instead
-	// of silently leaving the chain empty.
-	if ipsetName != "" && !m.ipsetSupported {
-		ipsetName = ""
-	}
 	proto := protoForFamily(protocol, m.v6)
 	specs := filterRuleSpecs(ip, proto, sPort, dPort, action, ipsetName)
 
@@ -507,40 +498,6 @@ func transformIPsetName(ipsetName string, sPort, dPort *firewall.Port, action fi
 	}
 }
 
-// probeIPSetSupport checks whether the kernel can create the ipset type used for
-// ACL rules. On kernels lacking the required ipset hash module, ipset creation
-// fails (e.g. "invalid argument"), which would otherwise leave the ACL chain
-// empty and silently drop all policy-permitted inbound traffic. When unsupported,
-// the manager falls back to per-IP iptables rules.
-func (m *aclManager) probeIPSetSupport() bool {
-	// Use a unique name so concurrent processes don't collide and we only ever
-	// destroy the set we created ourselves. ipset names are limited to 31 chars,
-	// so use a short random suffix.
-	probeName := "nb-probe-" + uuid.New().String()[:8]
-
-	opts := ipset.CreateOptions{
-		Replace: true,
-	}
-	if m.v6 {
-		opts.Family = ipset.FamilyIPV6
-	}
-
-	if err := ipset.Create(probeName, ipset.TypeHashNet, opts); err != nil {
-		log.Warnf("ipset is not available (failed to create probe set: %v); "+
-			"falling back to per-IP iptables ACL rules. Ensure the kernel provides "+
-			"the ipset hash:net module (ip_set_hash_net) for better performance with large rule sets", err)
-		return false
-	}
-
-	defer func() {
-		if err := ipset.Destroy(probeName); err != nil {
-			log.Debugf("destroy ipset probe set %q: %v", probeName, err)
-		}
-	}()
-
-	return true
-}
-
 func (m *aclManager) createIPSet(name string) error {
 	opts := ipset.CreateOptions{
 		Replace: true,

client/firewall/iptables/dnat_refcount_linux_test.go

@@ -1,240 +0,0 @@
-//go:build privileged
-
-package iptables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func iptRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-			}
-		},
-	}
-}
-
-func iptRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("10.20.0.1"),
-				Network: netip.MustParsePrefix("10.20.0.0/24"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newIptRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = iptRefcountIfaceDual()
-	} else {
-		ifMock = iptRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func iptDnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("10.20.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func iptDnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestIptablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestIptablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestIptablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestIptablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestIptablesDNAT_RefcountBalancedV4 covers a Balanced Add/Delete pair on v4.
-func TestIptablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newIptRefcountManager(t, false)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV4(7081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(iptDnatV4(7082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestIptablesDNAT_RefcountBalancedV6 checks the v6 path increments v6 only and
-// decrements back to zero.
-func TestIptablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	require.NotNil(t, m.router6, "v6 router")
-	require.Same(t, m.router.ipFwdState, m.router6.ipFwdState, "shared state")
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9081))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(iptDnatV6(9082))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2))
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestIptablesDNAT_DuplicateAddNoLeak verifies the duplicate-rule path returns
-// without bumping the refcount.
-func TestIptablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	rule := iptDnatV4(7083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err)
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1))
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestIptablesDNAT_DeleteMissingNoUnderflow verifies Delete on an unknown rule
-// neither errors nor releases the refcount.
-func TestIptablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	phantom := iptDnatV4(7099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	phantom6 := iptDnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6)
-
-	r1, err := m.AddDNATRule(iptDnatV4(7100))
-	require.NoError(t, err)
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestIptablesDNAT_DoubleDeleteNoUnderflow verifies a second Delete on the same
-// rule is a no-op.
-func TestIptablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newIptRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(iptDnatV6(9083))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}

client/firewall/iptables/manager_linux.go

@@ -89,7 +89,7 @@ func (m *Manager) createIPv6Components(wgIface iFaceMapper, mtu uint16) error {
 	}
 
 	// Share the same IP forwarding state with the v4 router, since
-	// Forwarding refcounter is per-family but shared between v4 and v6 routers.
+	// EnableIPForwarding controls both v4 and v6 sysctls.
 	m.router6.ipFwdState = m.router.ipFwdState
 
 	m.aclMgr6, err = newAclManager(ip6Client, wgIface)
@@ -402,12 +402,17 @@ func (m *Manager) SetLogLevel(log.Level) {
 }
 
 func (m *Manager) EnableRouting() error {
-	// v6 only when the overlay actually has v6.
-	return m.router.ipFwdState.RequestRouting(m.router6 != nil)
+	if err := m.router.ipFwdState.RequestForwarding(); err != nil {
+		return fmt.Errorf("enable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 func (m *Manager) DisableRouting() error {
-	return m.router.ipFwdState.ReleaseRouting()
+	if err := m.router.ipFwdState.ReleaseForwarding(); err != nil {
+		return fmt.Errorf("disable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 // AddDNATRule adds a DNAT rule

client/firewall/iptables/manager_linux_test.go

@@ -291,40 +291,3 @@ func TestIptablesCreatePerformance(t *testing.T) {
 		})
 	}
 }
-
-// TestIptablesACLIPSetFallback verifies that when the kernel lacks ipset support,
-// the ACL manager falls back to per-IP iptables rules (-s <ip>) instead of
-// silently leaving the chain empty. See discussion #6125.
-func TestIptablesACLIPSetFallback(t *testing.T) {
-	ipv4Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
-	require.NoError(t, err)
-
-	// Use Create()/Init() so the router-owned chains (chainRTFWDIN/OUT) are
-	// created before the ACL manager's createDefaultChains() references them.
-	manager, err := Create(ifaceMock, iface.DefaultMTU)
-	require.NoError(t, err)
-	require.NoError(t, manager.Init(nil))
-
-	aclMgr := manager.aclMgr
-	// Simulate a kernel without the ipset hash module.
-	aclMgr.ipsetSupported = false
-
-	defer func() {
-		require.NoError(t, manager.Close(nil))
-	}()
-
-	ip := netip.MustParseAddr("10.20.0.42")
-	port := &fw.Port{Values: []uint16{22}}
-
-	rules, err := aclMgr.AddPeerFiltering(nil, ip.AsSlice(), "tcp", nil, port, fw.ActionAccept, "nb0000001")
-	require.NoError(t, err, "AddPeerFiltering should succeed via fallback")
-	require.NotEmpty(t, rules)
-
-	rule := rules[0].(*Rule)
-	require.Empty(t, rule.ipsetName, "fallback rule must not reference an ipset")
-	require.Contains(t, strings.Join(rule.specs, " "), "-s 10.20.0.42", "fallback rule must match by source IP")
-	require.NotContains(t, strings.Join(rule.specs, " "), "--match-set", "fallback rule must not use ipset matching")
-
-	// The rule must actually be present in the ACL chain (not silently dropped).
-	checkRuleSpecs(t, ipv4Client, rule.chain, true, rule.specs...)
-}

client/firewall/iptables/router_linux.go

@@ -102,7 +102,7 @@ func newRouter(iptablesClient *iptables.IPTables, wgIface iFaceMapper, mtu uint1
 		wgIface:        wgIface,
 		mtu:            mtu,
 		v6:             iptablesClient.Proto() == iptables.ProtocolIPv6,
-		ipFwdState:     ipfwdstate.NewIPForwardingState(wgIface.Name()),
+		ipFwdState:     ipfwdstate.NewIPForwardingState(),
 	}
 
 	r.ipsetCounter = refcounter.New(
@@ -770,6 +770,10 @@ func (r *router) updateState() {
 }
 
 func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
+	if err := r.ipFwdState.RequestForwarding(); err != nil {
+		return nil, err
+	}
+
 	ruleKey := rule.ID()
 	if _, exists := r.rules[ruleKey+dnatSuffix]; exists {
 		return rule, nil
@@ -836,34 +840,18 @@ func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
 
 	for key, ruleInfo := range rules {
 		if err := r.iptablesClient.Append(ruleInfo.table, ruleInfo.chain, ruleInfo.rule...); err != nil {
-			r.cleanupFailedDNATAdd(rules)
+			if rollbackErr := r.rollbackRules(rules); rollbackErr != nil {
+				log.Errorf("rollback failed: %v", rollbackErr)
+			}
 			return nil, fmt.Errorf("add rule %s: %w", key, err)
 		}
 		r.rules[key] = ruleInfo.rule
 	}
 
-	if err := r.ipFwdState.RequestForwarding(r.v6); err != nil {
-		r.cleanupFailedDNATAdd(rules)
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
 	r.updateState()
 	return rule, nil
 }
 
-// cleanupFailedDNATAdd removes the bookkeeping written by a partially applied
-// AddDNATRule before rolling back the kernel rules, so no entries remain that
-// never got a forwarding refcount. rollbackRules re-adds entries it failed to
-// remove from the kernel.
-func (r *router) cleanupFailedDNATAdd(rules map[string]ruleInfo) {
-	for key := range rules {
-		delete(r.rules, key)
-	}
-	if err := r.rollbackRules(rules); err != nil {
-		log.Errorf("rollback failed: %v", err)
-	}
-}
-
 func (r *router) rollbackRules(rules map[string]ruleInfo) error {
 	var merr *multierror.Error
 	for key, ruleInfo := range rules {
@@ -880,47 +868,32 @@ func (r *router) rollbackRules(rules map[string]ruleInfo) error {
 }
 
 func (r *router) DeleteDNATRule(rule firewall.Rule) error {
-	ruleKey := rule.ID()
-
-	_, hadDNAT := r.rules[ruleKey+dnatSuffix]
-	_, hadSNAT := r.rules[ruleKey+snatSuffix]
-	_, hadFWD := r.rules[ruleKey+fwdSuffix]
-	if !hadDNAT && !hadSNAT && !hadFWD {
-		return nil
+	if err := r.ipFwdState.ReleaseForwarding(); err != nil {
+		log.Errorf("%v", err)
 	}
 
+	ruleKey := rule.ID()
+
 	var merr *multierror.Error
 	if dnatRule, exists := r.rules[ruleKey+dnatSuffix]; exists {
 		if err := r.iptablesClient.Delete(tableNat, chainRTRDR, dnatRule...); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("delete DNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleKey+dnatSuffix)
 		}
+		delete(r.rules, ruleKey+dnatSuffix)
 	}
 
 	if snatRule, exists := r.rules[ruleKey+snatSuffix]; exists {
 		if err := r.iptablesClient.Delete(tableNat, chainRTNAT, snatRule...); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("delete SNAT rule: %w", err))
-		} else {
-			delete(r.rules, ruleKey+snatSuffix)
 		}
+		delete(r.rules, ruleKey+snatSuffix)
 	}
 
 	if fwdRule, exists := r.rules[ruleKey+fwdSuffix]; exists {
 		if err := r.iptablesClient.Delete(tableFilter, chainRTFWDOUT, fwdRule...); err != nil {
 			merr = multierror.Append(merr, fmt.Errorf("delete forward rule: %w", err))
-		} else {
-			delete(r.rules, ruleKey+fwdSuffix)
-		}
-	}
-
-	// Release the refcount only once all rules are gone from the kernel. On
-	// partial failure the failed entries stay in r.rules so a retry can remove
-	// them and release then.
-	if merr == nil {
-		if err := r.ipFwdState.ReleaseForwarding(r.v6); err != nil {
-			log.Errorf("%v", err)
 		}
+		delete(r.rules, ruleKey+fwdSuffix)
 	}
 
 	r.updateState()

client/firewall/nftables/dnat_refcount_linux_test.go

@@ -1,249 +0,0 @@
-//go:build privileged
-
-package nftables
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-)
-
-func nftRefcountIfaceV4() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-			}
-		},
-	}
-}
-
-func nftRefcountIfaceDual() *iFaceMock {
-	return &iFaceMock{
-		NameFunc: func() string { return "wt-refcount" },
-		AddressFunc: func() wgaddr.Address {
-			return wgaddr.Address{
-				IP:      netip.MustParseAddr("100.96.0.1"),
-				Network: netip.MustParsePrefix("100.96.0.0/16"),
-				IPv6:    netip.MustParseAddr("fd00::1"),
-				IPv6Net: netip.MustParsePrefix("fd00::/64"),
-			}
-		},
-	}
-}
-
-func newNftRefcountManager(t *testing.T, dual bool) *Manager {
-	t.Helper()
-	if check() != NFTABLES {
-		t.Skip("nftables not supported on this system")
-	}
-	var ifMock *iFaceMock
-	if dual {
-		ifMock = nftRefcountIfaceDual()
-	} else {
-		ifMock = nftRefcountIfaceV4()
-	}
-	m, err := Create(ifMock, iface.DefaultMTU)
-	require.NoError(t, err, "create manager")
-	require.NoError(t, m.Init(nil), "init manager")
-	t.Cleanup(func() {
-		require.NoError(t, m.Close(nil), "close manager")
-	})
-	return m
-}
-
-func dnatV4(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("100.96.0.2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-func dnatV6(port uint16) fw.ForwardRule {
-	return fw.ForwardRule{
-		Protocol:          fw.ProtocolTCP,
-		DestinationPort:   fw.Port{Values: []uint16{port}},
-		TranslatedAddress: netip.MustParseAddr("fd00::2"),
-		TranslatedPort:    fw.Port{Values: []uint16{80}},
-	}
-}
-
-// TestNftablesDNAT_RefcountBalancedV4 verifies that Add/Delete pairs leave the
-// v4 refcount at zero.
-func TestNftablesDNAT_RefcountBalancedV4(t *testing.T) {
-	m := newNftRefcountManager(t, false)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV4(8081))
-	require.NoError(t, err, "add v4 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	r2, err := m.AddDNATRule(dnatV4(8082))
-	require.NoError(t, err, "add v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 2, v4, "v4 refcount after second add")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 1, v4, "v4 refcount after first delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v4 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount after second delete")
-	assert.Equal(t, 0, v6, "v6 refcount unchanged")
-}
-
-// TestNftablesDNAT_RefcountBalancedV6 verifies the v6 path increments v6 only
-// and decrements back to zero on Delete.
-func TestNftablesDNAT_RefcountBalancedV6(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	require.NotNil(t, m.router6, "v6 router")
-	require.Same(t, m.router.ipFwdState, m.router6.ipFwdState, "shared state")
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9091))
-	require.NoError(t, err, "add v6 dnat 1")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first add")
-
-	r2, err := m.AddDNATRule(dnatV6(9092))
-	require.NoError(t, err, "add v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 2, v6, "v6 refcount after second add")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat 1")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unchanged")
-	assert.Equal(t, 1, v6, "v6 refcount after first delete")
-
-	require.NoError(t, m.DeleteDNATRule(r2), "delete v6 dnat 2")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount after second delete")
-}
-
-// TestNftablesDNAT_DuplicateAddNoLeak verifies that a duplicate Add (same
-// ForwardRule) does not double-increment the refcount.
-func TestNftablesDNAT_DuplicateAddNoLeak(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	rule := dnatV4(8083)
-	r1, err := m.AddDNATRule(rule)
-	require.NoError(t, err, "add v4 dnat")
-	v4, _ := state.Counts()
-	assert.Equal(t, 1, v4)
-
-	// duplicate add: same rule ID, must be a no-op for the refcount.
-	_, err = m.AddDNATRule(rule)
-	require.NoError(t, err, "duplicate add")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "duplicate add must not increment")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v4 dnat")
-	v4, _ = state.Counts()
-	assert.Equal(t, 0, v4, "single delete must drop to zero")
-}
-
-// TestNftablesDNAT_DeleteMissingNoUnderflow verifies deleting a rule that was
-// never added does not underflow the refcount.
-func TestNftablesDNAT_DeleteMissingNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	// Construct a Rule reference for something never added. The router stores
-	// rules by ID(), and DeleteDNATRule looks them up in r.rules; a missing
-	// entry must be a no-op rather than calling Release.
-	phantom := dnatV4(8099)
-	require.NoError(t, m.DeleteDNATRule(&phantom), "delete missing v4 dnat")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 0, v4, "v4 refcount unaffected by missing delete")
-	assert.Equal(t, 0, v6, "v6 refcount unaffected")
-
-	phantom6 := dnatV6(9099)
-	require.NoError(t, m.DeleteDNATRule(&phantom6), "delete missing v6 dnat")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4)
-	assert.Equal(t, 0, v6, "v6 refcount unaffected by missing delete")
-
-	// And after a phantom delete, a real add still results in count=1.
-	r1, err := m.AddDNATRule(dnatV4(8100))
-	require.NoError(t, err, "add v4 dnat after phantom delete")
-	v4, _ = state.Counts()
-	assert.Equal(t, 1, v4, "real add still increments after phantom delete")
-	require.NoError(t, m.DeleteDNATRule(r1))
-}
-
-// TestNftablesRouting_RepeatedEnableSingleReference verifies that EnableRouting
-// (called on every network-map update) holds at most one reference per family
-// and a single DisableRouting drops both back to zero.
-func TestNftablesRouting_RepeatedEnableSingleReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	require.NoError(t, m.EnableRouting(), "first enable")
-	require.NoError(t, m.EnableRouting(), "second enable")
-	require.NoError(t, m.EnableRouting(), "third enable")
-	v4, v6 := state.Counts()
-	assert.Equal(t, 1, v4, "repeated enable holds a single v4 reference")
-	assert.Equal(t, 1, v6, "repeated enable holds a single v6 reference")
-
-	require.NoError(t, m.DisableRouting(), "disable")
-	v4, v6 = state.Counts()
-	assert.Equal(t, 0, v4, "single disable releases the v4 reference")
-	assert.Equal(t, 0, v6, "single disable releases the v6 reference")
-}
-
-// TestNftablesRouting_DisableKeepsDNATReference verifies that an unpaired
-// DisableRouting does not release references held by active DNAT rules.
-func TestNftablesRouting_DisableKeepsDNATReference(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9095))
-	require.NoError(t, err, "add v6 dnat")
-
-	require.NoError(t, m.DisableRouting(), "unpaired disable")
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6, "DNAT-held reference survives unpaired DisableRouting")
-
-	require.NoError(t, m.DeleteDNATRule(r1), "delete v6 dnat")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "delete releases the DNAT reference")
-}
-
-// TestNftablesDNAT_DoubleDeleteNoUnderflow verifies that deleting the same rule
-// twice does not underflow the refcount (the second delete is a no-op).
-func TestNftablesDNAT_DoubleDeleteNoUnderflow(t *testing.T) {
-	m := newNftRefcountManager(t, true)
-	state := m.router.ipFwdState
-
-	r1, err := m.AddDNATRule(dnatV6(9093))
-	require.NoError(t, err)
-	_, v6 := state.Counts()
-	assert.Equal(t, 1, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "first delete")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6)
-
-	require.NoError(t, m.DeleteDNATRule(r1), "second delete must be no-op")
-	_, v6 = state.Counts()
-	assert.Equal(t, 0, v6, "double delete must not underflow")
-}

client/firewall/nftables/manager_linux.go

@@ -105,8 +105,8 @@ func (m *Manager) createIPv6Components(tableName string, wgIface iFaceMapper, mt
 		return fmt.Errorf("create v6 router: %w", err)
 	}
 
-	// Share the per-family forwarding refcounter with the v4 router so a v4
-	// rule and a v6 rule against the same state machine cooperate cleanly.
+	// Share the same IP forwarding state with the v4 router, since
+	// EnableIPForwarding controls both v4 and v6 sysctls.
 	m.router6.ipFwdState = m.router.ipFwdState
 
 	m.aclManager6, err = newAclManager(workTable6, wgIface, chainNameRoutingFw)
@@ -530,12 +530,17 @@ func (m *Manager) SetLogLevel(log.Level) {
 }
 
 func (m *Manager) EnableRouting() error {
-	// v6 only when the overlay actually has v6.
-	return m.router.ipFwdState.RequestRouting(m.router6 != nil)
+	if err := m.router.ipFwdState.RequestForwarding(); err != nil {
+		return fmt.Errorf("enable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 func (m *Manager) DisableRouting() error {
-	return m.router.ipFwdState.ReleaseRouting()
+	if err := m.router.ipFwdState.ReleaseForwarding(); err != nil {
+		return fmt.Errorf("disable IP forwarding: %w", err)
+	}
+	return nil
 }
 
 // Flush rule/chain/set operations from the buffer

client/firewall/nftables/router_linux.go

@@ -93,7 +93,7 @@ func newRouter(workTable *nftables.Table, wgIface iFaceMapper, mtu uint16) (*rou
 		rules:      make(map[string]*nftables.Rule),
 		af:         familyForAddr(workTable.Family == nftables.TableFamilyIPv4),
 		wgIface:    wgIface,
-		ipFwdState: ipfwdstate.NewIPForwardingState(wgIface.Name()),
+		ipFwdState: ipfwdstate.NewIPForwardingState(),
 		mtu:        mtu,
 	}
 
@@ -1553,6 +1553,10 @@ func (r *router) refreshRulesMap() error {
 }
 
 func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
+	if err := r.ipFwdState.RequestForwarding(); err != nil {
+		return nil, err
+	}
+
 	ruleKey := rule.ID()
 	if _, exists := r.rules[ruleKey+dnatSuffix]; exists {
 		return rule, nil
@@ -1563,18 +1567,7 @@ func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
 		return nil, fmt.Errorf("convert protocol to number: %w", err)
 	}
 
-	// Request forwarding before queueing rules: addDnatRedirect/addDnatMasq
-	// buffer netlink messages on r.conn that the next caller's Flush would
-	// commit if we returned without flushing them ourselves.
-	v6 := r.af.tableFamily == nftables.TableFamilyIPv6
-	if err := r.ipFwdState.RequestForwarding(v6); err != nil {
-		return nil, fmt.Errorf("enable forwarding: %w", err)
-	}
-
 	if err := r.addDnatRedirect(rule, protoNum, ruleKey); err != nil {
-		if rerr := r.ipFwdState.ReleaseForwarding(v6); rerr != nil {
-			log.Warnf("rollback forwarding refcount: %v", rerr)
-		}
 		return nil, err
 	}
 
@@ -1586,11 +1579,6 @@ func (r *router) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error) {
 	// TODO: find chains with drop policies and add rules there
 
 	if err := r.conn.Flush(); err != nil {
-		if rerr := r.ipFwdState.ReleaseForwarding(v6); rerr != nil {
-			log.Warnf("rollback forwarding refcount: %v", rerr)
-		}
-		delete(r.rules, ruleKey+dnatSuffix)
-		delete(r.rules, ruleKey+snatSuffix)
 		return nil, fmt.Errorf("flush rules: %w", err)
 	}
 
@@ -1793,18 +1781,16 @@ func (r *router) addDnatMasq(rule firewall.ForwardRule, protoNum uint8, ruleKey
 }
 
 func (r *router) DeleteDNATRule(rule firewall.Rule) error {
+	if err := r.ipFwdState.ReleaseForwarding(); err != nil {
+		log.Errorf("%v", err)
+	}
+
 	ruleKey := rule.ID()
 
 	if err := r.refreshRulesMap(); err != nil {
 		return fmt.Errorf(refreshRulesMapError, err)
 	}
 
-	_, hadDNAT := r.rules[ruleKey+dnatSuffix]
-	_, hadSNAT := r.rules[ruleKey+snatSuffix]
-	if !hadDNAT && !hadSNAT {
-		return nil
-	}
-
 	var merr *multierror.Error
 	var needsFlush bool
 
@@ -1836,16 +1822,9 @@ func (r *router) DeleteDNATRule(rule firewall.Rule) error {
 		}
 	}
 
-	// Release the refcount only once the rules are gone from the kernel. On
-	// failure (including the refreshRulesMap error above) the rules and their
-	// map entries remain, keeping forwarding on until a retry removes them.
 	if merr == nil {
 		delete(r.rules, ruleKey+dnatSuffix)
 		delete(r.rules, ruleKey+snatSuffix)
-
-		if err := r.ipFwdState.ReleaseForwarding(r.af.tableFamily == nftables.TableFamilyIPv6); err != nil {
-			log.Errorf("%v", err)
-		}
 	}
 
 	return nberrors.FormatErrorOrNil(merr)

client/grpc/dialer_generic.go

@@ -16,28 +16,47 @@ import (
 	"google.golang.org/grpc"
 
 	nbnet "github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/client/netsweep"
 )
 
 func WithCustomDialer(_ bool, _ string) grpc.DialOption {
+	return grpc.WithContextDialer(dialContext)
+}
+
+// WithSweeper dials like WithCustomDialer but registers connections and
+// dials with the sweeper. Append it after WithCustomDialer: gRPC applies
+// dial options in order, so the later context dialer wins.
+func WithSweeper(sweeper *netsweep.Sweeper) grpc.DialOption {
 	return grpc.WithContextDialer(func(ctx context.Context, addr string) (net.Conn, error) {
-		if runtime.GOOS == "linux" {
-			currentUser, err := user.Current()
-			if err != nil {
-				return nil, status.Errorf(codes.FailedPrecondition, "failed to get current user: %v", err)
-			}
+		dial := sweeper.StartDial(ctx)
+		defer dial.Release()
 
-			// the custom dialer requires root permissions which are not required for use cases run as non-root
-			if currentUser.Uid != "0" {
-				log.Debug("Not running as root, using standard dialer")
-				dialer := &net.Dialer{}
-				return dialer.DialContext(ctx, "tcp", addr)
-			}
-		}
-
-		conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
+		conn, err := dialContext(dial.Ctx(), addr)
 		if err != nil {
-			return nil, fmt.Errorf("nbnet.NewDialer().DialContext: %w", err)
+			return nil, err
 		}
-		return conn, nil
+		return dial.WrapConn(conn)
 	})
 }
+
+func dialContext(ctx context.Context, addr string) (net.Conn, error) {
+	if runtime.GOOS == "linux" {
+		currentUser, err := user.Current()
+		if err != nil {
+			return nil, status.Errorf(codes.FailedPrecondition, "failed to get current user: %v", err)
+		}
+
+		// the custom dialer requires root permissions which are not required for use cases run as non-root
+		if currentUser.Uid != "0" {
+			log.Debug("Not running as root, using standard dialer")
+			dialer := &net.Dialer{}
+			return dialer.DialContext(ctx, "tcp", addr)
+		}
+	}
+
+	conn, err := nbnet.NewDialer().DialContext(ctx, "tcp", addr)
+	if err != nil {
+		return nil, fmt.Errorf("nbnet.NewDialer().DialContext: %w", err)
+	}
+	return conn, nil
+}

client/grpc/dialer_js.go

@@ -3,6 +3,7 @@ package grpc
 import (
 	"google.golang.org/grpc"
 
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/util/wsproxy/client"
 )
 
@@ -11,3 +12,8 @@ import (
 func WithCustomDialer(tlsEnabled bool, component string) grpc.DialOption {
 	return client.WithWebSocketDialer(tlsEnabled, component)
 }
+
+// WithSweeper is a no-op on WASM/JS: there is no network change signal.
+func WithSweeper(_ *netsweep.Sweeper) grpc.DialOption {
+	return grpc.EmptyDialOption{}
+}

client/installer.nsis

@@ -22,6 +22,8 @@
 !define UI_REG_APP_PATH "Software\Microsoft\Windows\CurrentVersion\App Paths\${UI_APP_EXE}"
 !define UI_UNINSTALL_PATH "Software\Microsoft\Windows\CurrentVersion\Uninstall\${UI_APP_NAME}"
 
+!define AUTOSTART_REG_KEY "Software\Microsoft\Windows\CurrentVersion\Run"
+
 !define NETBIRD_DATA_DIR "$COMMONPROGRAMDATA\Netbird"
 
 Unicode True
@@ -226,6 +228,13 @@ WriteRegStr ${REG_ROOT} "${UNINSTALL_PATH}"  "Publisher" "${COMP_NAME}"
 
 WriteRegStr ${REG_ROOT} "${UI_REG_APP_PATH}" "" "$INSTDIR\${UI_APP_EXE}"
 
+; Autostart is owned by the UI's per-user setting (HKCU\...\Run via Wails),
+; not the installer. Drop the machine-wide entry older installers wrote so the
+; toggle is the single source of truth. HKCU is left untouched -- it may hold
+; the user's own toggle state, which must survive upgrades.
+DetailPrint "Removing installer-managed autostart registry entry if present..."
+DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+
 EnVar::SetHKLM
 EnVar::AddValueEx "path" "$INSTDIR"
 
@@ -290,6 +299,15 @@ ExecWait '"$INSTDIR\${MAIN_APP_EXE}" service uninstall'
 DetailPrint "Terminating Netbird UI process..."
 ExecWait `taskkill /im ${UI_APP_EXE}.exe /f`
 
+; Remove autostart registry entries
+DetailPrint "Removing autostart registry entries if they exist..."
+; Legacy machine-wide entry written by older installers.
+DeleteRegValue HKLM "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+; Per-user entry the UI toggle writes via Wails (value name is the lowercase
+; app-name slug). Uninstall removes the app, so drop it too.
+DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "${APP_NAME}"
+DeleteRegValue HKCU "${AUTOSTART_REG_KEY}" "netbird"
+
 ; Handle data deletion based on checkbox
 DetailPrint "Checking if user requested data deletion..."
 ${If} $DeleteDataEnabled == "1"

client/internal/connect.go

@@ -38,6 +38,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/internal/updater/installer"
 	nbnet "github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/ssh"
 	sshconfig "github.com/netbirdio/netbird/client/ssh/config"
@@ -70,18 +72,42 @@ type ConnectClient struct {
 	updateManager *updater.Manager
 
 	persistSyncResponse bool
+
+	// netState gates every reconnection loop on OS-reported network
+	// availability. Nil (the default) disables gating; mobile platforms
+	// inject it via WithNetworkState.
+	netState *netstate.State
+
+	// sweeper cuts the management, signal and relay connections on network
+	// change; nil disables it.
+	sweeper *netsweep.Sweeper
+}
+
+// ConnectClientOption configures optional ConnectClient behavior.
+type ConnectClientOption func(*ConnectClient)
+
+// WithNetworkState injects the OS network availability state that gates every
+// reconnection loop; without it gating is disabled.
+func WithNetworkState(netState *netstate.State) ConnectClientOption {
+	return func(c *ConnectClient) { c.netState = netState }
+}
+
+// WithSweeper injects the network change sweeper.
+func WithSweeper(sweeper *netsweep.Sweeper) ConnectClientOption {
+	return func(c *ConnectClient) { c.sweeper = sweeper }
 }
 
 func NewConnectClient(
 	ctx context.Context,
 	config *profilemanager.Config,
 	statusRecorder *peer.Status,
+	opts ...ConnectClientOption,
 ) *ConnectClient {
 	// Derive the run context here so Stop owns the cancel that unblocks the run
 	// loop. runCancel is set once at construction, so Stop can call it without
 	// racing the run loop's startup. Callers therefore need not cancel before Stop.
 	runCtx, runCancel := context.WithCancel(ctx)
-	return &ConnectClient{
+	c := &ConnectClient{
 		ctx:            runCtx,
 		runCancel:      runCancel,
 		runExited:      make(chan struct{}),
@@ -89,6 +115,10 @@ func NewConnectClient(
 		statusRecorder: statusRecorder,
 		engineMutex:    sync.Mutex{},
 	}
+	for _, opt := range opts {
+		opt(c)
+	}
+	return c
 }
 
 func (c *ConnectClient) SetUpdateManager(um *updater.Manager) {
@@ -274,6 +304,13 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return nil
 		}
 
+		// suspend connection attempts while the OS reports no usable network
+		if waited, err := c.netState.Wait(c.ctx); err != nil {
+			return nil
+		} else if waited {
+			backOff.Reset()
+		}
+
 		state.Set(StatusConnecting)
 
 		engineCtx, cancel := context.WithCancel(c.ctx)
@@ -285,7 +322,8 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		log.Debugf("connecting to the Management service %s", c.config.ManagementURL.Host)
-		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled)
+		mgmClient, err := mgm.NewClient(engineCtx, c.config.ManagementURL.Host, myPrivateKey, mgmTlsEnabled,
+			mgm.WithNetworkState(c.netState), mgm.WithSweeper(c.sweeper))
 		if err != nil {
 			// On daemon shutdown / Down() the parent context is cancelled
 			// and the dial fails with "context canceled". Wrapping that
@@ -360,7 +398,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 		}()
 
 		// with the global Netbird config in hand connect (just a connection, no stream yet) Signal
-		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey)
+		signalClient, err := connectToSignal(engineCtx, loginResp.GetNetbirdConfig(), myPrivateKey, c.netState, c.sweeper)
 		if err != nil {
 			log.Error(err)
 			return wrapErr(err)
@@ -396,7 +434,8 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			engineConfig.StateDir = filepath.Dir(path)
 		}
 
-		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU)
+		relayManager := relayClient.NewManager(engineCtx, relayURLs, myPrivateKey.PublicKey().String(), engineConfig.MTU,
+			relayClient.WithNetworkState(c.netState), relayClient.WithSweeper(c.sweeper))
 		c.statusRecorder.SetRelayMgr(relayManager)
 		if len(relayURLs) > 0 {
 			if token != nil {
@@ -424,6 +463,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			UpdateManager:  c.updateManager,
 			ClientMetrics:  c.clientMetrics,
 			MetricsCtx:     c.ctx,
+			NetState:       c.netState,
 		}, mobileDependency)
 		engine.SetSyncResponsePersistence(c.persistSyncResponse)
 		c.engine = engine
@@ -480,6 +520,16 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 	// status stream stuck at Connecting.
 	err = backoff.Retry(operation, backoff.WithContext(backOff, c.ctx))
 	if err != nil {
+		// Once the client context is cancelled backoff.WithContext surfaces the
+		// bare context error, and any attempt torn down mid-flight reports the
+		// same. That cancellation is the caller asking us to stop (Stop, Down or
+		// an engine restart), so exit cleanly instead of handing back a failure
+		// the caller would have to distinguish from a real one.
+		if c.ctx.Err() != nil && errors.Is(err, context.Canceled) {
+			log.Info("exiting client retry loop, context cancelled")
+			return nil
+		}
+
 		log.Debugf("exiting client retry loop due to unrecoverable error: %s", err)
 		if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.PermissionDenied) {
 			state.Set(StatusNeedsLogin)
@@ -673,7 +723,7 @@ func selectMTU(localMTU uint16, peerMTU int32) uint16 {
 }
 
 // connectToSignal creates Signal Service client and established a connection
-func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key) (*signal.GrpcClient, error) {
+func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourPrivateKey wgtypes.Key, netState *netstate.State, sweeper *netsweep.Sweeper) (*signal.GrpcClient, error) {
 	var sigTLSEnabled bool
 	if wtConfig.Signal.Protocol == mgmProto.HostConfig_HTTPS {
 		sigTLSEnabled = true
@@ -681,7 +731,8 @@ func connectToSignal(ctx context.Context, wtConfig *mgmProto.NetbirdConfig, ourP
 		sigTLSEnabled = false
 	}
 
-	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled)
+	signalClient, err := signal.NewClient(ctx, wtConfig.Signal.Uri, ourPrivateKey, sigTLSEnabled,
+		signal.WithNetworkState(netState), signal.WithSweeper(sweeper))
 	if err != nil {
 		log.Errorf("error while connecting to the Signal Exchange Service %s: %s", wtConfig.Signal.Uri, err)
 		return nil, gstatus.Errorf(codes.FailedPrecondition, "failed connecting to Signal Service : %s", err)

client/internal/debug/debug_linux.go

@@ -844,10 +844,6 @@ func collectSysctls() string {
 		[]string{"net.ipv4.conf.all.src_valid_mark", "net.ipv4.conf.default.src_valid_mark"},
 		listInterfaceSysctls("ipv4", "src_valid_mark")...,
 	))
-	writeSysctlGroup(&builder, "accept_ra", append(
-		[]string{"net.ipv6.conf.all.accept_ra", "net.ipv6.conf.default.accept_ra"},
-		listInterfaceSysctls("ipv6", "accept_ra")...,
-	))
 	writeSysctlGroup(&builder, "conntrack", []string{
 		"net.netfilter.nf_conntrack_acct",
 		"net.netfilter.nf_conntrack_tcp_loose",

client/internal/dns/host_darwin.go

@@ -267,38 +267,18 @@ func (s *systemConfigurator) getSystemDNSSettings() (SystemDNSSettings, error) {
 		return SystemDNSSettings{}, fmt.Errorf("sending the command: %w", err)
 	}
 
-	dnsSettings, serverAddresses, err := parseSystemDNSSettings(b)
-	if err != nil {
-		return dnsSettings, err
-	}
-
-	s.mu.Lock()
-	s.origNameservers = serverAddresses
-	s.mu.Unlock()
-
-	return dnsSettings, nil
-}
-
-// parseSystemDNSSettings parses the output of `scutil show State:/Network/Service/<id>/DNS`.
-// Lines that don't match the expected "index : value" shape are skipped: hosts with unusual
-// network services (e.g. orphaned hardware ports) can produce entries without a value.
-func parseSystemDNSSettings(out []byte) (SystemDNSSettings, []netip.Addr, error) {
-	// port is not exposed by scutil, default to 53
-	dnsSettings := SystemDNSSettings{ServerPort: DefaultPort}
+	var dnsSettings SystemDNSSettings
 	var serverAddresses []netip.Addr
 	inSearchDomainsArray := false
 	inServerAddressesArray := false
 
-	scanner := bufio.NewScanner(bytes.NewReader(out))
+	scanner := bufio.NewScanner(bytes.NewReader(b))
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())
 		switch {
 		case strings.HasPrefix(line, "DomainName :"):
-			domainName := strings.TrimSpace(strings.TrimPrefix(line, "DomainName :"))
-			if domainName != "" {
-				dnsSettings.Domains = append(dnsSettings.Domains, domainName)
-			}
-			continue
+			domainName := strings.TrimSpace(strings.Split(line, ":")[1])
+			dnsSettings.Domains = append(dnsSettings.Domains, domainName)
 		case line == "SearchDomains : <array> {":
 			inSearchDomainsArray = true
 			continue
@@ -308,45 +288,36 @@ func parseSystemDNSSettings(out []byte) (SystemDNSSettings, []netip.Addr, error)
 		case line == "}":
 			inSearchDomainsArray = false
 			inServerAddressesArray = false
-			continue
-		}
-
-		if !inSearchDomainsArray && !inServerAddressesArray {
-			continue
-		}
-
-		parts := strings.SplitN(line, " : ", 2)
-		if len(parts) != 2 {
-			log.Debugf("skipping unexpected scutil DNS line %q", line)
-			continue
-		}
-		value := strings.TrimSpace(parts[1])
-		if value == "" {
-			continue
 		}
 
 		if inSearchDomainsArray {
-			dnsSettings.Domains = append(dnsSettings.Domains, value)
-			continue
-		}
-
-		ip, err := netip.ParseAddr(value)
-		if err != nil || ip.IsUnspecified() {
-			continue
-		}
-		ip = ip.Unmap()
-		serverAddresses = append(serverAddresses, ip)
-		// Prefer the first IPv4 server as ServerIP since our DNS listener is IPv4.
-		if !dnsSettings.ServerIP.IsValid() && ip.Is4() {
-			dnsSettings.ServerIP = ip
+			searchDomain := strings.Split(line, " : ")[1]
+			dnsSettings.Domains = append(dnsSettings.Domains, searchDomain)
+		} else if inServerAddressesArray {
+			address := strings.Split(line, " : ")[1]
+			if ip, err := netip.ParseAddr(address); err == nil && !ip.IsUnspecified() {
+				ip = ip.Unmap()
+				serverAddresses = append(serverAddresses, ip)
+				// Prefer the first IPv4 server as ServerIP since our DNS listener is IPv4.
+				if !dnsSettings.ServerIP.IsValid() && ip.Is4() {
+					dnsSettings.ServerIP = ip
+				}
+			}
 		}
 	}
 
 	if err := scanner.Err(); err != nil {
-		return dnsSettings, serverAddresses, err
+		return dnsSettings, err
 	}
 
-	return dnsSettings, serverAddresses, nil
+	// default to 53 port
+	dnsSettings.ServerPort = DefaultPort
+
+	s.mu.Lock()
+	s.origNameservers = serverAddresses
+	s.mu.Unlock()
+
+	return dnsSettings, nil
 }
 
 func (s *systemConfigurator) getOriginalNameservers() []netip.Addr {
@@ -464,15 +435,11 @@ func (s *systemConfigurator) getPrimaryService() (string, string, error) {
 	router := ""
 	for scanner.Scan() {
 		text := scanner.Text()
-		parts := strings.SplitN(text, ":", 2)
-		if len(parts) != 2 {
-			continue
-		}
 		if strings.Contains(text, "PrimaryService") {
-			primaryService = strings.TrimSpace(parts[1])
+			primaryService = strings.TrimSpace(strings.Split(text, ":")[1])
 		}
 		if strings.Contains(text, "Router") {
-			router = strings.TrimSpace(parts[1])
+			router = strings.TrimSpace(strings.Split(text, ":")[1])
 		}
 	}
 	if err := scanner.Err(); err != nil && err != io.EOF {

client/internal/dns/host_darwin_test.go

@@ -328,120 +328,6 @@ func removeTestDNSKey(key string) error {
 	return err
 }
 
-func TestParseSystemDNSSettings(t *testing.T) {
-	tests := []struct {
-		name            string
-		output          string
-		expectedDomains []string
-		expectedServers []netip.Addr
-		expectedIP      netip.Addr
-	}{
-		{
-			name: "well_formed",
-			output: `<dictionary> {
-  DomainName : example.com
-  SearchDomains : <array> {
-    0 : example.com
-    1 : corp.example.com
-  }
-  ServerAddresses : <array> {
-    0 : 192.168.1.1
-    1 : fd00::53
-  }
-}
-`,
-			expectedDomains: []string{"example.com", "example.com", "corp.example.com"},
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1"), netip.MustParseAddr("fd00::53")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			// entries without a value after the separator used to panic with
-			// "index out of range [1] with length 1"
-			name: "malformed_array_entries_skipped",
-			output: `<dictionary> {
-  SearchDomains : <array> {
-    0 :
-    (null)
-
-    1 : corp.example.com
-  }
-  ServerAddresses : <array> {
-    0 :
-    1 : 192.168.1.1
-  }
-}
-`,
-			expectedDomains: []string{"corp.example.com"},
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "domain_name_without_value_skipped",
-			output: `<dictionary> {
-  DomainName :
-  ServerAddresses : <array> {
-    0 : 192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "ipv6_first_prefers_ipv4_server_ip",
-			output: `<dictionary> {
-  ServerAddresses : <array> {
-    0 : fd00::53
-    1 : 192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("fd00::53"), netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "invalid_and_unspecified_addresses_skipped",
-			output: `<dictionary> {
-  ServerAddresses : <array> {
-    0 : (null)
-    1 : 0.0.0.0
-    2 : 192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name: "v4_mapped_address_unmapped",
-			output: `<dictionary> {
-  ServerAddresses : <array> {
-    0 : ::ffff:192.168.1.1
-  }
-}
-`,
-			expectedServers: []netip.Addr{netip.MustParseAddr("192.168.1.1")},
-			expectedIP:      netip.MustParseAddr("192.168.1.1"),
-		},
-		{
-			name:   "empty_output",
-			output: "",
-		},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			settings, servers, err := parseSystemDNSSettings([]byte(tc.output))
-			require.NoError(t, err, "parsing should not fail")
-
-			assert.Equal(t, tc.expectedDomains, settings.Domains, "domains should match")
-			assert.Equal(t, tc.expectedServers, servers, "server addresses should match")
-			assert.Equal(t, tc.expectedIP, settings.ServerIP, "server IP should match")
-			assert.Equal(t, DefaultPort, settings.ServerPort, "server port should default to 53")
-		})
-	}
-}
-
 func TestGetOriginalNameservers(t *testing.T) {
 	configurator := &systemConfigurator{
 		createdKeys: make(map[string]struct{}),

client/internal/engine.go

@@ -59,6 +59,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/syncstore"
 	"github.com/netbirdio/netbird/client/internal/updater"
 	"github.com/netbirdio/netbird/client/jobexec"
+	"github.com/netbirdio/netbird/client/netstate"
 	cProto "github.com/netbirdio/netbird/client/proto"
 	"github.com/netbirdio/netbird/client/system"
 	nbdns "github.com/netbirdio/netbird/dns"
@@ -181,6 +182,9 @@ type EngineServices struct {
 	UpdateManager  *updater.Manager
 	ClientMetrics  *metrics.ClientMetrics
 	MetricsCtx     context.Context
+	// NetState gates the reconnection loops on OS-reported network
+	// availability; nil disables gating.
+	NetState *netstate.State
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -204,6 +208,10 @@ type Engine struct {
 	config    *EngineConfig
 	mobileDep MobileDependency
 
+	// netState gates the peer reconnection guards on OS-reported network
+	// availability; nil disables gating.
+	netState *netstate.State
+
 	// STUNs is a list of STUN servers used by ICE
 	STUNs []*stun.URI
 	// TURNs is a list of STUN servers used by ICE
@@ -337,6 +345,7 @@ func NewEngine(
 		syncMsgMux:         &sync.Mutex{},
 		config:             config,
 		mobileDep:          mobileDep,
+		netState:           services.NetState,
 		STUNs:              []*stun.URI{},
 		TURNs:              []*stun.URI{},
 		networkSerial:      0,
@@ -1893,7 +1902,8 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 			Addr:           e.getRosenpassAddr(),
 			PermissiveMode: e.config.RosenpassPermissive,
 		},
-		ICEConfig: e.createICEConfig(),
+		ICEConfig:    e.createICEConfig(),
+		NetworkState: e.netState,
 	}
 
 	serviceDependencies := peer.ServiceDependencies{

client/internal/peer/conn.go

@@ -26,6 +26,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/portforward"
 	"github.com/netbirdio/netbird/client/internal/rosenpass"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
+	"github.com/netbirdio/netbird/client/netstate"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 )
@@ -93,6 +94,10 @@ type ConnConfig struct {
 
 	// ICEConfig ICE protocol configuration
 	ICEConfig icemaker.Config
+
+	// NetworkState gates the reconnection guard on OS-reported network
+	// availability; nil disables gating.
+	NetworkState *netstate.State
 }
 
 type Conn struct {
@@ -254,7 +259,7 @@ func (conn *Conn) open(engineCtx context.Context, firstPacket []byte) error {
 		conn.handshaker.AddICEListener(conn.workerICE.OnNewOffer)
 	}
 
-	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher)
+	conn.guard = guard.NewGuard(conn.Log, conn.isConnectedOnAllWay, conn.config.Timeout, conn.srWatcher, conn.config.NetworkState)
 
 	conn.wg.Add(1)
 	go func() {

client/internal/peer/guard/guard.go

@@ -6,6 +6,8 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/netstate"
 )
 
 // ConnStatus represents the connection state as seen by the guard.
@@ -31,20 +33,26 @@ type connStatusFunc func() ConnStatus
 // - Relayed connection disconnected
 // - ICE candidate changes
 type Guard struct {
-	log                     *log.Entry
-	isConnectedOnAllWay     connStatusFunc
-	timeout                 time.Duration
-	srWatcher               *SRWatcher
+	log                 *log.Entry
+	isConnectedOnAllWay connStatusFunc
+	timeout             time.Duration
+	srWatcher           *SRWatcher
+	// netState gates reconnect attempts on OS-reported network availability;
+	// nil disables gating.
+	netState                *netstate.State
 	relayedConnDisconnected chan struct{}
 	iCEConnDisconnected     chan struct{}
 }
 
-func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher) *Guard {
+// NewGuard creates a reconnection guard for a peer connection. A nil netState
+// disables network availability gating.
+func NewGuard(log *log.Entry, isConnectedFn connStatusFunc, timeout time.Duration, srWatcher *SRWatcher, netState *netstate.State) *Guard {
 	return &Guard{
 		log:                     log,
 		isConnectedOnAllWay:     isConnectedFn,
 		timeout:                 timeout,
 		srWatcher:               srWatcher,
+		netState:                netState,
 		relayedConnDisconnected: make(chan struct{}, 1),
 		iCEConnDisconnected:     make(chan struct{}, 1),
 	}
@@ -96,9 +104,16 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 	iceState := &iceRetryState{log: g.log}
 	defer iceState.reset()
 
+	netChanged := g.netState.Changed()
+
 	for {
 		select {
 		case <-tickerChannel:
+			// skip attempts while the OS reports no usable network; the
+			// netChanged case below resumes the loop once it returns
+			if !g.netState.IsOnline() {
+				continue
+			}
 			switch g.isConnectedOnAllWay() {
 			case ConnStatusConnected:
 				// all good, nothing to do
@@ -135,6 +150,23 @@ func (g *Guard) reconnectLoopWithRetry(ctx context.Context, callback func()) {
 			tickerChannel = ticker.C
 			iceState.reset()
 
+		case <-netChanged:
+			// Re-arm for the next transition before acting on this one.
+			netChanged = g.netState.Changed()
+			if !g.netState.IsOnline() {
+				continue
+			}
+			// Ticks skipped while offline drove the backoff towards its
+			// maximum without ever attempting, and left the ICE budget
+			// frozen — possibly in hourly mode. Recover on our own so the
+			// peer does not depend on a signal or relay event that never
+			// comes when both stayed up across the outage.
+			g.log.Debugf("network is back, reset reconnection ticker")
+			ticker.Stop()
+			ticker = g.newReconnectTicker(ctx)
+			tickerChannel = ticker.C
+			iceState.reset()
+
 		case <-ctx.Done():
 			g.log.Debugf("context is done, stop reconnect loop")
 			return

client/internal/peer/guard/guard_leak_test.go

@@ -15,7 +15,7 @@ import (
 
 func newTestGuard(status connStatusFunc) *Guard {
 	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
-	return NewGuard(log.WithField("test", "guard"), status, 50*time.Millisecond, srw)
+	return NewGuard(log.WithField("test", "guard"), status, 50*time.Millisecond, srw, nil)
 }
 
 // countBackoffTickerGoroutines returns how many goroutines are currently sitting

client/internal/peer/guard/guard_netstate_test.go

@@ -0,0 +1,107 @@
+package guard
+
+import (
+	"context"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/internal/peer/ice"
+	"github.com/netbirdio/netbird/client/netstate"
+)
+
+// newTestGuardWithNetState builds a guard with a realistic MaxInterval: the
+// backoff must be able to grow well past the outage, as it does in production
+// where the timeout is seconds to minutes.
+func newTestGuardWithNetState(status connStatusFunc, netState *netstate.State) *Guard {
+	srw := NewSRWatcher(nil, nil, nil, ice.Config{})
+	return NewGuard(log.WithField("test", "guard"), status, 30*time.Second, srw, netState)
+}
+
+// TestGuard_RecoversAfterOfflineToOnline covers a peer that stays disconnected
+// across a network outage while neither signal nor relay reports an event —
+// both stayed up, as on a short airplane mode toggle over Wi-Fi.
+//
+// Every tick taken while offline is skipped, but it still advances the
+// exponential backoff, so by the time the network returns the next tick can be
+// tens of seconds away. Without an explicit reaction to the transition the
+// peer waits out that interval for a recovery that could start immediately.
+func TestGuard_RecoversAfterOfflineToOnline(t *testing.T) {
+	netState := netstate.New()
+
+	var attempts atomic.Int32
+	g := newTestGuardWithNetState(func() ConnStatus { return ConnStatusDisconnected }, netState)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	// Start from the reconnect ticker (800ms initial interval), the state a
+	// peer is in after it loses its connection.
+	go g.Start(ctx, func() { attempts.Add(1) })
+	g.SetRelayedConnDisconnected()
+
+	// Let the backoff climb: 0.8s, 1.6s, 3.2s, 6.4s ... every tick is skipped
+	// while offline, but each one doubles the wait for the next.
+	netState.Set(false)
+	time.Sleep(8 * time.Second)
+
+	offlineAttempts := attempts.Load()
+	if offlineAttempts != 0 {
+		t.Fatalf("callback ran %d times while offline, want 0", offlineAttempts)
+	}
+
+	netState.Set(true)
+
+	// The next organic tick is now several seconds out, so anything within
+	// this window can only come from reacting to the transition itself.
+	pollCtx, stopPolling := context.WithTimeout(ctx, 2*time.Second)
+	defer stopPolling()
+
+	select {
+	case <-pollCtx.Done():
+		t.Fatal("peer was not retried within 2s of the network coming back, " +
+			"with neither a signal nor a relay event to fall back on")
+	case <-pollUntil(pollCtx, func() bool { return attempts.Load() > 0 }):
+	}
+}
+
+// TestGuard_OfflineTransitionDoesNotRetry checks the other direction: going
+// offline must not itself trigger an attempt.
+func TestGuard_OfflineTransitionDoesNotRetry(t *testing.T) {
+	netState := netstate.New()
+
+	var attempts atomic.Int32
+	g := newTestGuardWithNetState(func() ConnStatus { return ConnStatusDisconnected }, netState)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go g.Start(ctx, func() { attempts.Add(1) })
+
+	netState.Set(false)
+	time.Sleep(5 * time.Second)
+
+	if got := attempts.Load(); got != 0 {
+		t.Fatalf("callback ran %d times after going offline, want 0", got)
+	}
+}
+
+// pollUntil closes the returned channel once cond holds. It gives up when ctx
+// is done, so the polling goroutine never outlives the test that started it.
+func pollUntil(ctx context.Context, cond func() bool) <-chan struct{} {
+	done := make(chan struct{})
+	go func() {
+		for {
+			if cond() {
+				close(done)
+				return
+			}
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(10 * time.Millisecond):
+			}
+		}
+	}()
+	return done
+}

client/internal/peer/listener.go

@@ -1,11 +1,40 @@
 package peer
 
+// ClientState identifies the client connection state delivered via
+// Listener.OnStateChanged.
+type ClientState int
+
+// Client states. The numeric values cross the gomobile boundary (the mobile
+// bindings re-export them as integer constants), so they are a wire format:
+// append new states at the end, never reorder or insert.
+const (
+	ClientStateDisconnected ClientState = iota
+	ClientStateConnected
+	ClientStateConnecting
+	ClientStateDisconnecting
+	// ClientStateNoNetwork is an overlay state: it is never stored as the
+	// last notification, only derived from ClientStateConnecting while the
+	// OS reports no usable network (see notifier.effectiveState).
+	ClientStateNoNetwork
+)
+
 // Listener is a callback type about the NetBird network connection state
 type Listener interface {
+	// OnStateChanged reports every client state transition. New states are
+	// delivered only through this callback; the per-state callbacks below
+	// are kept for compatibility and will be removed once all consumers
+	// have migrated.
+	OnStateChanged(state ClientState)
+
+	// Deprecated: consume OnStateChanged instead.
 	OnConnected()
+	// Deprecated: consume OnStateChanged instead.
 	OnDisconnected()
+	// Deprecated: consume OnStateChanged instead.
 	OnConnecting()
+	// Deprecated: consume OnStateChanged instead.
 	OnDisconnecting()
+
 	OnAddressChanged(string, string)
 	OnPeersListChanged(int)
 }

client/internal/peer/notifier.go

@@ -4,31 +4,64 @@ import (
 	"sync"
 )
 
-const (
-	stateDisconnected = iota
-	stateConnected
-	stateConnecting
-	stateDisconnecting
-)
-
 type notifier struct {
+	// publishLock orders state publication: it is held across computing the
+	// effective state and handing it to the listener, so a transition cannot
+	// overtake a newer one and leave the listener on a stale state.
+	publishLock        sync.Mutex
 	serverStateLock    sync.Mutex
 	listenersLock      sync.Mutex
 	listener           Listener
 	currentClientState bool
-	lastNotification   int
+	lastNotification   ClientState
 	lastNumberOfPeers  int
 	lastFqdnAddress    string
 	lastIPAddress      string
+	networkAvailable   bool
 }
 
 func newNotifier() *notifier {
-	return &notifier{}
+	return &notifier{
+		networkAvailable: true,
+	}
+}
+
+// effectiveState maps the computed state to what listeners should see:
+// while the OS reports no usable network, "Connecting" would be a lie —
+// connection attempts are suspended — so it is reported as NoNetwork.
+// Caller must hold serverStateLock.
+func (n *notifier) effectiveState(state ClientState) ClientState {
+	if !n.networkAvailable && state == ClientStateConnecting {
+		return ClientStateNoNetwork
+	}
+	return state
+}
+
+// setNetworkAvailable records the OS network availability and re-notifies
+// the listener when the flag flips the effective state (Connecting <->
+// NoNetwork).
+func (n *notifier) setNetworkAvailable(available bool) {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
+	n.serverStateLock.Lock()
+	if n.networkAvailable == available {
+		n.serverStateLock.Unlock()
+		return
+	}
+	previous := n.effectiveState(n.lastNotification)
+	n.networkAvailable = available
+	current := n.effectiveState(n.lastNotification)
+	n.serverStateLock.Unlock()
+
+	if previous != current {
+		n.notify(current)
+	}
 }
 
 func (n *notifier) setListener(listener Listener) {
 	n.serverStateLock.Lock()
-	lastNotification := n.lastNotification
+	lastNotification := n.effectiveState(n.lastNotification)
 	numOfPeers := n.lastNumberOfPeers
 	fqdnAddress := n.lastFqdnAddress
 	address := n.lastIPAddress
@@ -52,6 +85,9 @@ func (n *notifier) removeListener() {
 }
 
 func (n *notifier) updateServerStates(mgmState bool, signalState bool) {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
 	n.serverStateLock.Lock()
 	calculatedState := n.calculateState(mgmState, signalState)
 
@@ -61,43 +97,54 @@ func (n *notifier) updateServerStates(mgmState bool, signalState bool) {
 	}
 
 	n.lastNotification = calculatedState
+	effective := n.effectiveState(calculatedState)
 	n.serverStateLock.Unlock()
 
-	n.notify(calculatedState)
+	n.notify(effective)
 }
 
 func (n *notifier) clientStart() {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
 	n.serverStateLock.Lock()
 	n.currentClientState = true
-	n.lastNotification = stateConnecting
+	n.lastNotification = ClientStateConnecting
+	effective := n.effectiveState(ClientStateConnecting)
 	n.serverStateLock.Unlock()
 
-	n.notify(stateConnecting)
+	n.notify(effective)
 }
 
 func (n *notifier) clientStop() {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
 	n.serverStateLock.Lock()
 	n.currentClientState = false
-	n.lastNotification = stateDisconnected
+	n.lastNotification = ClientStateDisconnected
 	n.serverStateLock.Unlock()
 
-	n.notify(stateDisconnected)
+	n.notify(ClientStateDisconnected)
 }
 
 func (n *notifier) clientTearDown() {
+	n.publishLock.Lock()
+	defer n.publishLock.Unlock()
+
 	n.serverStateLock.Lock()
 	n.currentClientState = false
-	n.lastNotification = stateDisconnecting
+	n.lastNotification = ClientStateDisconnecting
 	n.serverStateLock.Unlock()
 
-	n.notify(stateDisconnecting)
+	n.notify(ClientStateDisconnecting)
 }
 
-func (n *notifier) isServerStateChanged(newState int) bool {
+func (n *notifier) isServerStateChanged(newState ClientState) bool {
 	return n.lastNotification != newState
 }
 
-func (n *notifier) notify(state int) {
+func (n *notifier) notify(state ClientState) {
 	n.listenersLock.Lock()
 	listener := n.listener
 	n.listenersLock.Unlock()
@@ -109,20 +156,20 @@ func (n *notifier) notify(state int) {
 	notifyListener(listener, state)
 }
 
-func (n *notifier) calculateState(managementConn, signalConn bool) int {
+func (n *notifier) calculateState(managementConn, signalConn bool) ClientState {
 	if managementConn && signalConn {
-		return stateConnected
+		return ClientStateConnected
 	}
 
 	if !managementConn && !signalConn && !n.currentClientState {
-		return stateDisconnected
+		return ClientStateDisconnected
 	}
 
-	if n.lastNotification == stateDisconnecting {
-		return stateDisconnecting
+	if n.lastNotification == ClientStateDisconnecting {
+		return ClientStateDisconnecting
 	}
 
-	return stateConnecting
+	return ClientStateConnecting
 }
 
 func (n *notifier) peerListChanged(numOfPeers int) {
@@ -159,15 +206,19 @@ func (n *notifier) localAddressChanged(fqdn, address string) {
 	listener.OnAddressChanged(fqdn, address)
 }
 
-func notifyListener(l Listener, state int) {
+func notifyListener(l Listener, state ClientState) {
+	// legacy per-state callbacks; NoNetwork is delivered only via
+	// OnStateChanged below
 	switch state {
-	case stateDisconnected:
+	case ClientStateDisconnected:
 		l.OnDisconnected()
-	case stateConnected:
+	case ClientStateConnected:
 		l.OnConnected()
-	case stateConnecting:
+	case ClientStateConnecting:
 		l.OnConnecting()
-	case stateDisconnecting:
+	case ClientStateDisconnecting:
 		l.OnDisconnecting()
 	}
+
+	l.OnStateChanged(state)
 }

client/internal/peer/notifier_concurrent_test.go

@@ -0,0 +1,108 @@
+package peer
+
+import (
+	"sync"
+	"testing"
+	"time"
+)
+
+type recordingListener struct {
+	mu      sync.Mutex
+	states  []ClientState
+	onState func(ClientState)
+}
+
+func (l *recordingListener) OnStateChanged(state ClientState) {
+	l.mu.Lock()
+	l.states = append(l.states, state)
+	hook := l.onState
+	l.mu.Unlock()
+
+	if hook != nil {
+		hook(state)
+	}
+}
+
+func (l *recordingListener) last() (ClientState, bool) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if len(l.states) == 0 {
+		return 0, false
+	}
+	return l.states[len(l.states)-1], true
+}
+
+func (l *recordingListener) snapshot() []ClientState {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return append([]ClientState(nil), l.states...)
+}
+
+func (l *recordingListener) OnConnected()                    {}
+func (l *recordingListener) OnDisconnected()                 {}
+func (l *recordingListener) OnConnecting()                   {}
+func (l *recordingListener) OnDisconnecting()                {}
+func (l *recordingListener) OnAddressChanged(string, string) {}
+func (l *recordingListener) OnPeersListChanged(int)          {}
+
+// TestNotifier_ConcurrentAvailabilityFlipOrdersPublication holds the first
+// transition inside the listener callback and flips availability again from
+// another goroutine while it is parked. The second flip must not publish
+// ahead of the one in flight, otherwise the listener ends up on a state the
+// notifier already superseded.
+func TestNotifier_ConcurrentAvailabilityFlipOrdersPublication(t *testing.T) {
+	n := newNotifier()
+	n.currentClientState = true
+	n.lastNotification = ClientStateConnecting
+
+	entered := make(chan struct{})
+	release := make(chan struct{})
+
+	l := &recordingListener{}
+	l.onState = func(state ClientState) {
+		if state != ClientStateNoNetwork {
+			return
+		}
+		l.mu.Lock()
+		l.onState = nil
+		l.mu.Unlock()
+		close(entered)
+		<-release
+	}
+	n.listener = l
+
+	var wg sync.WaitGroup
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		n.setNetworkAvailable(false)
+	}()
+
+	<-entered
+
+	flipped := make(chan struct{})
+	go func() {
+		defer close(flipped)
+		n.setNetworkAvailable(true)
+	}()
+
+	select {
+	case <-flipped:
+		t.Fatal("the online transition published while the offline one was " +
+			"still in flight; publication is not serialized")
+	case <-time.After(200 * time.Millisecond):
+	}
+
+	close(release)
+	<-flipped
+	wg.Wait()
+
+	got, ok := l.last()
+	if !ok {
+		t.Fatal("listener never observed a state")
+	}
+	if got != ClientStateConnecting {
+		t.Fatalf("listener holds %v after the network came back, want Connecting; sequence: %v",
+			got, l.snapshot())
+	}
+}

client/internal/peer/notifier_test.go

@@ -6,29 +6,32 @@ import (
 )
 
 type mocListener struct {
-	lastState int
+	lastState ClientState
 	wg        sync.WaitGroup
 	peersWg   sync.WaitGroup
 	peers     int
 }
 
 func (l *mocListener) OnConnected() {
-	l.lastState = stateConnected
+	l.lastState = ClientStateConnected
 	l.wg.Done()
 }
 func (l *mocListener) OnDisconnected() {
-	l.lastState = stateDisconnected
+	l.lastState = ClientStateDisconnected
 	l.wg.Done()
 }
 func (l *mocListener) OnConnecting() {
-	l.lastState = stateConnecting
+	l.lastState = ClientStateConnecting
 	l.wg.Done()
 }
 func (l *mocListener) OnDisconnecting() {
-	l.lastState = stateDisconnecting
+	l.lastState = ClientStateDisconnecting
 	l.wg.Done()
 }
 
+func (l *mocListener) OnStateChanged(state ClientState) {
+
+}
 func (l *mocListener) OnAddressChanged(host, addr string) {
 
 }
@@ -57,15 +60,15 @@ func Test_notifier_serverState(t *testing.T) {
 
 	type scenario struct {
 		name        string
-		expected    int
+		expected    ClientState
 		mgmState    bool
 		signalState bool
 	}
 	scenarios := []scenario{
-		{"connected", stateConnected, true, true},
-		{"mgm down", stateConnecting, false, true},
-		{"signal down", stateConnecting, true, false},
-		{"disconnected", stateDisconnected, false, false},
+		{"connected", ClientStateConnected, true, true},
+		{"mgm down", ClientStateConnecting, false, true},
+		{"signal down", ClientStateConnecting, true, false},
+		{"disconnected", ClientStateDisconnected, false, false},
 	}
 
 	for _, tt := range scenarios {
@@ -85,7 +88,7 @@ func Test_notifier_SetListener(t *testing.T) {
 	listener.setPeersWaiter()
 
 	n := newNotifier()
-	n.lastNotification = stateConnecting
+	n.lastNotification = ClientStateConnecting
 	n.setListener(listener)
 	listener.wait()
 	listener.waitPeers()
@@ -99,7 +102,7 @@ func Test_notifier_RemoveListener(t *testing.T) {
 	listener.setWaiter()
 	listener.setPeersWaiter()
 	n := newNotifier()
-	n.lastNotification = stateConnecting
+	n.lastNotification = ClientStateConnecting
 	n.setListener(listener)
 	// setListener replays cached state on a goroutine; wait for both the state
 	// and peers callbacks to finish so we don't race on listener.peers.

client/internal/peer/status.go

@@ -1211,6 +1211,12 @@ func (d *Status) ClientTeardown() {
 	d.notifyStateChange()
 }
 
+// SetNetworkAvailable records the OS-reported network availability; while
+// unavailable, listeners see NoNetwork instead of Connecting.
+func (d *Status) SetNetworkAvailable(available bool) {
+	d.notifier.setNetworkAvailable(available)
+}
+
 // SetConnectionListener set a listener to the notifier
 func (d *Status) SetConnectionListener(listener Listener) {
 	d.notifier.setListener(listener)

client/internal/routemanager/ipfwdstate/ipfwdstate.go

@@ -2,183 +2,54 @@ package ipfwdstate
 
 import (
 	"fmt"
-	"sync"
 
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/internal/routemanager/systemops"
 )
 
-// IPForwardingState tracks v4 and v6 IP-forwarding sysctl enables with
-// independent refcounts so a v4-only routing setup doesn't flip v6 sysctls.
+// IPForwardingState is a struct that keeps track of the IP forwarding state.
+// todo: read initial state of the IP forwarding from the system and reset the state based on it.
+// todo: separate v4/v6 forwarding state, since the sysctls are independent
+// (net.ipv4.ip_forward vs net.ipv6.conf.all.forwarding). Currently the nftables
+// manager shares one instance between both routers, which works only because
+// EnableIPForwarding enables both sysctls in a single call.
 type IPForwardingState struct {
-	mu sync.Mutex
-
-	v4Count int
-	v6Count int
-
-	// routingV4/routingV6 track whether the routing path currently holds a
-	// reference, so repeated EnableRouting calls (one per network-map update)
-	// hold at most one reference per family and an unpaired DisableRouting
-	// can't release references held by DNAT rules.
-	routingV4 bool
-	routingV6 bool
-
-	wgIfaceName string
-	v6Saved     map[string]int
+	enabledCounter int
 }
 
-// NewIPForwardingState returns a state tracker for the IP-forwarding sysctls.
-// wgIfaceName is excluded from the per-interface accept_ra handling.
-func NewIPForwardingState(wgIfaceName string) *IPForwardingState {
-	return &IPForwardingState{wgIfaceName: wgIfaceName}
+func NewIPForwardingState() *IPForwardingState {
+	return &IPForwardingState{}
 }
 
-// Counts returns the current v4 and v6 refcounts. Intended for diagnostics
-// and tests.
-func (f *IPForwardingState) Counts() (v4, v6 int) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return f.v4Count, f.v6Count
-}
-
-// RequestRouting takes the forwarding references for the routing path. It is
-// idempotent: while routing already holds a reference, further calls don't
-// increment the refcounts, and a v4-only request releases a previously held v6
-// reference. A v6 sysctl failure is logged and not returned so it can't take
-// down v4 routing (the sysctl may be unwritable, e.g. read-only /proc/sys or
-// IPv6 disabled on the kernel command line); v6 is retried on the next call.
-func (f *IPForwardingState) RequestRouting(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if !f.routingV4 {
-		if err := f.requestV4(); err != nil {
-			return err
-		}
-		f.routingV4 = true
-	}
-
-	if !v6 {
-		if !f.routingV6 {
-			return nil
-		}
-		f.routingV6 = false
-		return f.releaseV6()
-	}
-
-	if f.routingV6 {
-		return nil
-	}
-	if err := f.requestV6(); err != nil {
-		log.Warnf("enable IPv6 forwarding for routing: %v", err)
-		return nil
-	}
-	f.routingV6 = true
-	return nil
-}
-
-// ReleaseRouting releases the references RequestRouting holds. Calls without a
-// held reference are no-ops.
-func (f *IPForwardingState) ReleaseRouting() error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if f.routingV4 {
-		f.routingV4 = false
-		f.releaseV4()
-	}
-	if f.routingV6 {
-		f.routingV6 = false
-		return f.releaseV6()
-	}
-	return nil
-}
-
-// RequestForwarding enables the family's forwarding sysctl on first request.
-func (f *IPForwardingState) RequestForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.requestV6()
-	}
-	return f.requestV4()
-}
-
-// ReleaseForwarding decrements the family counter. The last v6 release restores
-// what enable captured. v4 stays on: net.ipv4.ip_forward is co-owned by other
-// tooling (docker, k8s, libvirt).
-func (f *IPForwardingState) ReleaseForwarding(v6 bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-
-	if v6 {
-		return f.releaseV6()
-	}
-	f.releaseV4()
-	return nil
-}
-
-func (f *IPForwardingState) requestV4() error {
-	if f.v4Count == 0 {
-		if err := systemops.EnableV4IPForwarding(); err != nil {
-			return fmt.Errorf("enable IPv4 forwarding: %w", err)
-		}
-		log.Info("IPv4 forwarding enabled")
-	}
-	f.v4Count++
-	return nil
-}
-
-func (f *IPForwardingState) releaseV4() {
-	if f.v4Count > 0 {
-		f.v4Count--
-	}
-}
-
-func (f *IPForwardingState) requestV6() error {
-	if f.v6Count == 0 {
-		saved, err := systemops.EnableV6IPForwarding(f.wgIfaceName)
-		if err != nil {
-			if rerr := systemops.DisableV6IPForwarding(saved); rerr != nil {
-				log.Warnf("rollback partial v6 sysctls: %v", rerr)
-			}
-			return fmt.Errorf("enable IPv6 forwarding: %w", err)
-		}
-		// A failed restore on a previous release keeps its saved values; those
-		// are the true originals, so keep them over what this enable captured.
-		if f.v6Saved == nil {
-			f.v6Saved = saved
-		} else {
-			for k, v := range saved {
-				if _, ok := f.v6Saved[k]; !ok {
-					f.v6Saved[k] = v
-				}
-			}
-		}
-		log.Info("IPv6 forwarding enabled")
-	}
-	f.v6Count++
-	return nil
-}
-
-func (f *IPForwardingState) releaseV6() error {
-	if f.v6Count == 0 {
-		return nil
-	}
-	f.v6Count--
-	if f.v6Count > 0 {
+func (f *IPForwardingState) RequestForwarding() error {
+	if f.enabledCounter != 0 {
+		f.enabledCounter++
 		return nil
 	}
 
-	// Keep the saved values on failure so a later release or enable/release
-	// cycle can still restore them; re-restoring an already-restored key is a
-	// no-op since the sysctl already holds the desired value.
-	if err := systemops.DisableV6IPForwarding(f.v6Saved); err != nil {
-		return fmt.Errorf("disable IPv6 forwarding: %w", err)
+	if err := systemops.EnableIPForwarding(); err != nil {
+		return fmt.Errorf("failed to enable IP forwarding with sysctl: %w", err)
 	}
-	f.v6Saved = nil
-	log.Info("IPv6 forwarding disabled")
+	f.enabledCounter = 1
+	log.Info("IP forwarding enabled")
+
+	return nil
+}
+
+func (f *IPForwardingState) ReleaseForwarding() error {
+	if f.enabledCounter == 0 {
+		return nil
+	}
+
+	if f.enabledCounter > 1 {
+		f.enabledCounter--
+		return nil
+	}
+
+	// if failed to disable IP forwarding we anyway decrement the counter
+	f.enabledCounter = 0
+
+	// todo call systemops.DisableIPForwarding()
 	return nil
 }

client/internal/routemanager/ipfwdstate/ipfwdstate_privileged_linux_test.go

@@ -1,39 +0,0 @@
-//go:build privileged
-
-package ipfwdstate
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// TestRequestRoutingV6ToV4Transition verifies that a v4-only routing request
-// releases a previously held routing-owned v6 reference without touching
-// references held by DNAT rules.
-func TestRequestRoutingV6ToV4Transition(t *testing.T) {
-	f := NewIPForwardingState("wt-fwd-test")
-
-	require.NoError(t, f.RequestRouting(true), "request routing with v6")
-	v4, v6 := f.Counts()
-	assert.Equal(t, 1, v4, "v4 reference held")
-	assert.Equal(t, 1, v6, "v6 reference held")
-
-	require.NoError(t, f.RequestRouting(false), "request routing v4-only")
-	v4, v6 = f.Counts()
-	assert.Equal(t, 1, v4, "v4 reference kept")
-	assert.Equal(t, 0, v6, "routing-owned v6 reference released")
-
-	// A DNAT-held reference survives a v4-only routing request.
-	require.NoError(t, f.RequestForwarding(true), "dnat v6 reference")
-	require.NoError(t, f.RequestRouting(false), "repeat v4-only request")
-	_, v6 = f.Counts()
-	assert.Equal(t, 1, v6, "dnat-held v6 reference survives")
-	require.NoError(t, f.ReleaseForwarding(true), "release dnat v6 reference")
-
-	require.NoError(t, f.ReleaseRouting(), "release routing")
-	v4, v6 = f.Counts()
-	assert.Equal(t, 0, v4, "all v4 references released")
-	assert.Equal(t, 0, v6, "all v6 references released")
-}

client/internal/routemanager/sysctl/sysctl_linux.go

@@ -58,7 +58,11 @@ func Setup(wgIface iface) (map[string]int, error) {
 			continue
 		}
 
-		i := fmt.Sprintf(rpFilterInterfacePath, EscapeInterfaceName(intf.Name))
+		// Escape '%' and '.' so they survive the dot-to-slash conversion in Set()
+		safeName := strings.ReplaceAll(intf.Name, "%", percentEscape)
+		safeName = strings.ReplaceAll(safeName, ".", dotEscape)
+
+		i := fmt.Sprintf(rpFilterInterfacePath, safeName)
 		oldVal, err := Set(i, 2, true)
 		if err != nil {
 			result = multierror.Append(result, err)
@@ -70,13 +74,6 @@ func Setup(wgIface iface) (map[string]int, error) {
 	return keys, nberrors.FormatErrorOrNil(result)
 }
 
-// EscapeInterfaceName escapes '%' and '.' in an interface name (e.g. VLANs
-// like eth0.100) so the name survives the dot-to-slash conversion in Set.
-func EscapeInterfaceName(name string) string {
-	safe := strings.ReplaceAll(name, "%", percentEscape)
-	return strings.ReplaceAll(safe, ".", dotEscape)
-}
-
 // Set sets a sysctl configuration, if onlyIfOne is true it will only set the new value if it's set to 1
 func Set(key string, desiredValue int, onlyIfOne bool) (int, error) {
 	path := strings.ReplaceAll(key, ".", "/")

client/internal/routemanager/systemops/systemops_android.go

@@ -32,17 +32,8 @@ func (r *SysOps) removeFromRouteTable(netip.Prefix, Nexthop) error {
 	return nil
 }
 
-func EnableV4IPForwarding() error {
-	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
-	return nil
-}
-
-func EnableV6IPForwarding(string) (map[string]int, error) {
-	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
-	return map[string]int{}, nil
-}
-
-func DisableV6IPForwarding(map[string]int) error {
+func EnableIPForwarding() error {
+	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_ios.go

@@ -58,17 +58,8 @@ func (r *SysOps) removeFromRouteTable(netip.Prefix, Nexthop) error {
 	return nil
 }
 
-func EnableV4IPForwarding() error {
-	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
-	return nil
-}
-
-func EnableV6IPForwarding(string) (map[string]int, error) {
-	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
-	return map[string]int{}, nil
-}
-
-func DisableV6IPForwarding(map[string]int) error {
+func EnableIPForwarding() error {
+	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_linux.go

@@ -763,10 +763,13 @@ func flushRoutes(tableID, family int) error {
 	return nberrors.FormatErrorOrNil(result)
 }
 
-func EnableV4IPForwarding() error {
+func EnableIPForwarding() error {
 	if _, err := sysctl.Set(ipv4ForwardingPath, 1, false); err != nil {
 		return err
 	}
+	if _, err := sysctl.Set(ipv6ForwardingPath, 1, false); err != nil {
+		log.Warnf("failed to enable IPv6 forwarding: %v", err)
+	}
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_nonlinux.go

@@ -43,17 +43,8 @@ func (r *SysOps) RemoveVPNRoute(prefix netip.Prefix, intf *net.Interface) error
 	return r.genericRemoveVPNRoute(prefix, intf)
 }
 
-func EnableV4IPForwarding() error {
-	log.Infof("Enable IPv4 forwarding is not implemented on %s", runtime.GOOS)
-	return nil
-}
-
-func EnableV6IPForwarding(string) (map[string]int, error) {
-	log.Infof("Enable IPv6 forwarding is not implemented on %s", runtime.GOOS)
-	return map[string]int{}, nil
-}
-
-func DisableV6IPForwarding(map[string]int) error {
+func EnableIPForwarding() error {
+	log.Infof("Enable IP forwarding is not implemented on %s", runtime.GOOS)
 	return nil
 }
 

client/internal/routemanager/systemops/v6forwarding_linux.go

@@ -1,92 +0,0 @@
-//go:build !android
-
-package systemops
-
-import (
-	"fmt"
-	"net"
-	"os"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/client/internal/routemanager/sysctl"
-)
-
-const (
-	// 1 (default) accepts RAs only while forwarding is off; 2 keeps RA
-	// acceptance on regardless, so RA-installed host defaults survive our
-	// v6 forwarding flip.
-	acceptRAInterfacePath  = "net.ipv6.conf.%s.accept_ra"
-	acceptRADefaultPath    = "net.ipv6.conf.default.accept_ra"
-	acceptRAProcPathFormat = "/proc/sys/net/ipv6/conf/%s/accept_ra"
-)
-
-// EnableV6IPForwarding bumps accept_ra=2 on host v6 interfaces before flipping
-// forwarding=1, so RA-installed host defaults survive. Returns the prior values
-// of sysctls we actually changed; entries already at the target are omitted.
-func EnableV6IPForwarding(wgIfaceName string) (map[string]int, error) {
-	saved := map[string]int{}
-	bumpAcceptRA(saved, wgIfaceName)
-
-	oldVal, err := sysctl.Set(ipv6ForwardingPath, 1, false)
-	if err != nil {
-		return saved, err
-	}
-	if oldVal != 1 {
-		saved[ipv6ForwardingPath] = oldVal
-	}
-	return saved, nil
-}
-
-// DisableV6IPForwarding restores what EnableV6IPForwarding captured.
-func DisableV6IPForwarding(saved map[string]int) error {
-	var result *multierror.Error
-	for key, value := range saved {
-		if _, err := sysctl.Set(key, value, false); err != nil {
-			result = multierror.Append(result, fmt.Errorf("restore %s: %w", key, err))
-		}
-	}
-	return nberrors.FormatErrorOrNil(result)
-}
-
-func bumpAcceptRA(saved map[string]int, wgIfaceName string) {
-	// Also bump conf.default so interfaces created while forwarding is on
-	// (hotplug, new Wi-Fi/dock) inherit accept_ra=2 and keep accepting RAs.
-	bumpAcceptRAKey(saved, acceptRADefaultPath)
-
-	interfaces, err := net.Interfaces()
-	if err != nil {
-		log.Warnf("list interfaces for accept_ra: %v", err)
-		return
-	}
-	for _, intf := range interfaces {
-		if intf.Name == "lo" || intf.Name == wgIfaceName {
-			continue
-		}
-		bumpAcceptRAForInterface(saved, intf.Name)
-	}
-}
-
-func bumpAcceptRAForInterface(saved map[string]int, name string) {
-	// Build procfs path from name, not the dotted key: VLAN names like eth0.100.
-	if _, err := os.Stat(fmt.Sprintf(acceptRAProcPathFormat, name)); err != nil {
-		return
-	}
-	bumpAcceptRAKey(saved, fmt.Sprintf(acceptRAInterfacePath, sysctl.EscapeInterfaceName(name)))
-}
-
-func bumpAcceptRAKey(saved map[string]int, key string) {
-	// onlyIfOne=true: leave admin overrides (0, 2) alone.
-	oldVal, err := sysctl.Set(key, 2, true)
-	if err != nil {
-		log.Warnf("bump %s: %v", key, err)
-		return
-	}
-	// With onlyIfOne, a write only happened when the old value was 1; values
-	// left untouched (0, 2) must not be recorded for restore.
-	if oldVal == 1 {
-		saved[key] = oldVal
-	}
-}

client/ios/NetBirdSDK/client.go

@@ -22,6 +22,8 @@ import (
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
 	"github.com/netbirdio/netbird/route"
@@ -36,11 +38,6 @@ const (
 	AnonymizeLevelStrict  = nbAnonymize.LevelStrictString
 )
 
-// ConnectionListener export internal Listener for mobile
-type ConnectionListener interface {
-	peer.Listener
-}
-
 // RouteListener export internal RouteListener for mobile
 type NetworkChangeListener interface {
 	listener.NetworkChangeListener
@@ -87,6 +84,12 @@ type Client struct {
 	onHostDnsFn           func([]string)
 	dnsManager            dns.IosDnsManager
 	loginComplete         bool
+	// netState outlives engine restarts: it mirrors the OS connectivity, not
+	// the engine lifecycle. Run injects it into each new ConnectClient, which
+	// distributes it to every reconnection loop.
+	netState *netstate.State
+	// sweeper also outlives engine restarts; NotifyNetworkChange sweeps it.
+	sweeper *netsweep.Sweeper
 	// preloadedConfig holds config loaded from JSON (used on tvOS where file writes are blocked)
 	preloadedConfig *profilemanager.Config
 
@@ -109,6 +112,8 @@ func NewClient(cfgFile, stateFile, cacheDir, logFilePath, deviceName string, osV
 		ctxCancelLock:         &sync.Mutex{},
 		networkChangeListener: networkChangeListener,
 		dnsManager:            dnsManager,
+		netState:              netstate.New(),
+		sweeper:               netsweep.New(),
 	}
 }
 
@@ -184,7 +189,8 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	c.onHostDnsFn = func([]string) {}
 	cfg.WgIface = interfaceName
 
-	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder)
+	connectClient := internal.NewConnectClient(ctx, cfg, c.recorder,
+		internal.WithNetworkState(c.netState), internal.WithSweeper(c.sweeper))
 	c.setState(cfg, connectClient)
 	// Persist the latest sync response so DebugBundle can include the network
 	// map. On iOS this is backed by disk to keep it out of the constrained
@@ -193,6 +199,24 @@ func (c *Client) Run(fd int32, interfaceName string, envList *EnvList) error {
 	return connectClient.RunOniOS(fd, c.networkChangeListener, c.dnsManager, c.stateFile, c.cacheDir, c.logFilePath)
 }
 
+// SetNetworkAvailable feeds OS-reported network availability into the client
+// (e.g. from NWPathMonitor). While unavailable, the internal reconnect loops
+// suspend their attempts and the connection listener reports NoNetwork
+// instead of Connecting; when availability returns, the loops resume
+// immediately with a fresh backoff.
+func (c *Client) SetNetworkAvailable(available bool) {
+	c.netState.Set(available)
+	c.recorder.SetNetworkAvailable(available)
+}
+
+// NotifyNetworkChange cuts the management, signal and relay connections
+// after the OS switched networks, so the reconnect loops redial immediately
+// on the new one. The engine and the TUN device stay untouched.
+func (c *Client) NotifyNetworkChange() {
+	n := c.sweeper.Sweep()
+	log.Infof("network change: swept %d connections", n)
+}
+
 // Stop the internal client and free the resources
 func (c *Client) Stop() {
 	c.ctxCancelLock.Lock()
@@ -331,7 +355,11 @@ func (c *Client) GetStatusDetails() *StatusDetails {
 
 // SetConnectionListener set the network connection listener
 func (c *Client) SetConnectionListener(listener ConnectionListener) {
-	c.recorder.SetConnectionListener(listener)
+	if listener == nil {
+		c.recorder.RemoveConnectionListener()
+		return
+	}
+	c.recorder.SetConnectionListener(connectionListenerAdapter{listener})
 }
 
 // RemoveConnectionListener remove connection listener

client/ios/NetBirdSDK/connection_listener.go

@@ -0,0 +1,43 @@
+//go:build ios
+
+package NetBirdSDK
+
+import (
+	"github.com/netbirdio/netbird/client/internal/peer"
+)
+
+// Client state values, re-exported as basic constants so gomobile emits them
+// into the generated bindings. They mirror peer.ClientState*: append-only,
+// never reorder.
+const (
+	ClientStateDisconnected  = int(peer.ClientStateDisconnected)
+	ClientStateConnected     = int(peer.ClientStateConnected)
+	ClientStateConnecting    = int(peer.ClientStateConnecting)
+	ClientStateDisconnecting = int(peer.ClientStateDisconnecting)
+	ClientStateNoNetwork     = int(peer.ClientStateNoNetwork)
+)
+
+// ConnectionListener export internal Listener for mobile.
+//
+// It intentionally lacks OnStateChanged for now: adding a method to a gomobile
+// interface breaks every Swift implementation, so the iOS app keeps building
+// against the legacy per-state callbacks. A follow-up will extend it together
+// with the app.
+type ConnectionListener interface {
+	OnConnected()
+	OnDisconnected()
+	OnConnecting()
+	OnDisconnecting()
+	OnAddressChanged(string, string)
+	OnPeersListChanged(int)
+}
+
+// connectionListenerAdapter adapts the gomobile-facing ConnectionListener to
+// peer.Listener.
+type connectionListenerAdapter struct {
+	ConnectionListener
+}
+
+// OnStateChanged is dropped on iOS until the app adopts the state callback;
+// the legacy per-state callbacks continue to fire.
+func (a connectionListenerAdapter) OnStateChanged(peer.ClientState) {}

client/netstate/netstate.go

@@ -0,0 +1,107 @@
+// Package netstate tracks OS-reported network availability for the client.
+//
+// A State instance is owned by the platform integration (e.g. the Android or
+// iOS bindings, fed from ConnectivityManager callbacks or NWPathMonitor) and
+// is injected into the connection retry loops (management, signal, relay,
+// peer guards and the top-level connect loop), which consult it to avoid
+// burning CPU and battery on reconnect attempts while the device has no
+// network at all (e.g. airplane mode), and to reset their backoff as soon as
+// the network returns.
+//
+// Consumers hold a *State that may be nil — every non-mobile platform leaves
+// it unset. The read methods are safe on a nil receiver: they report online
+// and never block, so consumers behave as if this package did not exist.
+package netstate
+
+import (
+	"context"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// State holds the OS-reported network availability. The zero value is not
+// usable; create instances with New.
+type State struct {
+	mu      sync.Mutex
+	online  bool
+	changed chan struct{}
+}
+
+// New creates a State that starts online.
+func New() *State {
+	return &State{
+		online:  true,
+		changed: make(chan struct{}),
+	}
+}
+
+// Set records whether the OS reports any usable network. Transitions wake up
+// all Wait callers immediately.
+func (s *State) Set(online bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.online == online {
+		return
+	}
+	s.online = online
+	close(s.changed)
+	s.changed = make(chan struct{})
+	log.Infof("OS network availability changed: online=%t", online)
+}
+
+// IsOnline reports whether the OS reports at least one usable network. On a
+// nil receiver — no State injected — it reports online.
+func (s *State) IsOnline() bool {
+	if s == nil {
+		return true
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.online
+}
+
+// Changed returns a channel closed on the next availability transition, for
+// callers that already own a select loop and cannot block in Wait. Re-read it
+// after every fire: each transition installs a fresh channel. On a nil
+// receiver — no State injected — it returns nil, which blocks forever in a
+// select, so the caller simply never observes a transition.
+func (s *State) Changed() <-chan struct{} {
+	if s == nil {
+		return nil
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.changed
+}
+
+// Wait blocks while the network is offline. It reports whether it had to
+// wait, so callers can reset their backoff after an outage. It returns early
+// with the context error when ctx is done. On a nil receiver — no State
+// injected — it returns immediately.
+func (s *State) Wait(ctx context.Context) (bool, error) {
+	if s == nil {
+		return false, nil
+	}
+	waited := false
+	for {
+		s.mu.Lock()
+		if s.online {
+			s.mu.Unlock()
+			return waited, nil
+		}
+		ch := s.changed
+		s.mu.Unlock()
+
+		if !waited {
+			waited = true
+			log.Debugf("network is offline, pausing connection attempts")
+		}
+
+		select {
+		case <-ctx.Done():
+			return waited, ctx.Err()
+		case <-ch:
+		}
+	}
+}

client/netstate/netstate_test.go

@@ -0,0 +1,170 @@
+package netstate
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewStateIsOnline(t *testing.T) {
+	assert.True(t, New().IsOnline(), "a fresh State should start online")
+}
+
+func TestSetTogglesOnlineState(t *testing.T) {
+	s := New()
+
+	s.Set(false)
+	assert.False(t, s.IsOnline(), "state should be offline after Set(false)")
+
+	s.Set(true)
+	assert.True(t, s.IsOnline(), "state should be online after Set(true)")
+}
+
+func TestWaitReturnsImmediatelyWhenOnline(t *testing.T) {
+	s := New()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+
+	waited, err := s.Wait(ctx)
+	require.NoError(t, err)
+	assert.False(t, waited, "Wait should not block when the network is online")
+}
+
+func TestWaitBlocksUntilOnline(t *testing.T) {
+	s := New()
+	s.Set(false)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	result := make(chan bool, 1)
+	go func() {
+		waited, err := s.Wait(ctx)
+		if err != nil {
+			result <- false
+			return
+		}
+		result <- waited
+	}()
+
+	// Verify Wait is actually blocking while offline
+	select {
+	case <-result:
+		t.Fatal("Wait should block while the network is offline")
+	case <-time.After(100 * time.Millisecond):
+	}
+
+	s.Set(true)
+
+	select {
+	case waited := <-result:
+		assert.True(t, waited, "Wait should report that it had to wait for the network")
+	case <-time.After(2 * time.Second):
+		t.Fatal("Wait should return promptly after the network becomes available")
+	}
+}
+
+func TestWaitReturnsOnContextCancel(t *testing.T) {
+	s := New()
+	s.Set(false)
+
+	ctx, cancel := context.WithCancel(context.Background())
+
+	result := make(chan error, 1)
+	go func() {
+		_, err := s.Wait(ctx)
+		result <- err
+	}()
+
+	cancel()
+
+	select {
+	case err := <-result:
+		assert.ErrorIs(t, err, context.Canceled)
+	case <-time.After(2 * time.Second):
+		t.Fatal("Wait should return promptly after context cancellation")
+	}
+}
+
+func TestWaitWakesAllWaiters(t *testing.T) {
+	s := New()
+	s.Set(false)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	const waiters = 10
+	var wg sync.WaitGroup
+	results := make(chan bool, waiters)
+	for i := 0; i < waiters; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			waited, err := s.Wait(ctx)
+			if err != nil {
+				results <- false
+				return
+			}
+			results <- waited
+		}()
+	}
+
+	time.Sleep(100 * time.Millisecond)
+	s.Set(true)
+	wg.Wait()
+
+	close(results)
+	count := 0
+	for waited := range results {
+		assert.True(t, waited, "every waiter should report that it waited")
+		count++
+	}
+	assert.Equal(t, waiters, count, "all waiters should have returned")
+}
+
+func TestNilStateReadsAreNoops(t *testing.T) {
+	var s *State
+
+	assert.True(t, s.IsOnline(), "nil State should report online")
+
+	waited, err := s.Wait(context.Background())
+	require.NoError(t, err)
+	assert.False(t, waited, "nil State's Wait should not block")
+}
+
+func TestConcurrentSetAndWait(t *testing.T) {
+	s := New()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	var wg sync.WaitGroup
+	for i := 0; i < 4; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 100; j++ {
+				s.Set(j%2 == 0)
+				s.IsOnline()
+			}
+		}()
+	}
+	for i := 0; i < 4; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 100; j++ {
+				if _, err := s.Wait(ctx); err != nil {
+					return
+				}
+			}
+		}()
+	}
+
+	wg.Wait()
+}

client/netsweep/netsweep.go

@@ -0,0 +1,175 @@
+// Package netsweep cuts network-bound activity when the OS switches networks:
+// a sweep closes the registered connections and aborts the in-flight dials, so
+// their owners redial immediately instead of waiting for the old sockets to
+// time out.
+//
+// A nil *Sweeper disables everything: all methods are nil-safe no-ops.
+package netsweep
+
+import (
+	"context"
+	"errors"
+	"net"
+	"sync"
+
+	log "github.com/sirupsen/logrus"
+)
+
+// ErrSwept reports that a dial finished after a network change swept its
+// registration. The connection is already closed; the caller must treat it
+// as a failed dial and redial on the new network.
+var ErrSwept = errors.New("netsweep: connection swept by network change")
+
+// sweepID identifies one registration in a sweeper. Connections and dials
+// draw from the same counter, so an id is unique across both registries.
+type sweepID uint64
+
+// Dial tracks one dial from start to connection registration. It hands the
+// dialed connection to the sweeper atomically, so a sweep can never fall
+// between the dial finishing and the connection being registered.
+type Dial struct {
+	sweeper *Sweeper
+	ctx     context.Context
+	cancel  context.CancelFunc
+	id      sweepID
+	done    bool // set by Sweep, WrapConn or Release; guarded by sweeper.mu
+}
+
+// Ctx returns the dial's context. Sweep cancels it, so a dial started on the
+// old network aborts instead of waiting out its handshake timeout.
+func (d *Dial) Ctx() context.Context {
+	return d.ctx
+}
+
+// Release ends the dial's registration and cancels its context. It is
+// idempotent and safe after WrapConn, so callers can defer it.
+func (d *Dial) Release() {
+	s := d.sweeper
+	if s == nil {
+		return
+	}
+
+	s.mu.Lock()
+	d.done = true
+	delete(s.dials, d.id)
+	s.mu.Unlock()
+
+	d.cancel()
+}
+
+// sweptConn deregisters itself from the sweeper when closed.
+type sweptConn struct {
+	net.Conn
+	sweeper *Sweeper
+	id      sweepID
+}
+
+func (c *sweptConn) Close() error {
+	c.sweeper.deregister(c.id)
+	return c.Conn.Close()
+}
+
+// Sweeper registers live connections and in-flight dials so Sweep can cut
+// everything that started before the network changed.
+type Sweeper struct {
+	mu     sync.Mutex
+	conns  map[sweepID]net.Conn
+	dials  map[sweepID]*Dial
+	nextID sweepID
+}
+
+// New creates an empty sweeper.
+func New() *Sweeper {
+	return &Sweeper{
+		conns: make(map[sweepID]net.Conn),
+		dials: make(map[sweepID]*Dial),
+	}
+}
+
+// StartDial registers an in-flight dial. Dial with Ctx, hand the result to
+// WrapConn, and Release the dial when the attempt is over, typically deferred.
+func (s *Sweeper) StartDial(ctx context.Context) *Dial {
+	if s == nil {
+		return &Dial{ctx: ctx}
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	d := &Dial{sweeper: s, ctx: ctx, cancel: cancel}
+
+	s.mu.Lock()
+	d.id = s.nextID
+	s.nextID++
+	s.dials[d.id] = d
+	s.mu.Unlock()
+
+	return d
+}
+
+// WrapConn hands conn over to the sweeper. If a sweep ran since StartDial,
+// the connection belongs to the old network: it is closed and ErrSwept is
+// returned. Otherwise conn is registered against the next sweep and returned
+// wrapped, deregistering itself on Close. Call it once, before Release.
+func (d *Dial) WrapConn(conn net.Conn) (net.Conn, error) {
+	s := d.sweeper
+	if s == nil {
+		return conn, nil
+	}
+
+	s.mu.Lock()
+	if d.done {
+		s.mu.Unlock()
+		if err := conn.Close(); err != nil {
+			log.Debugf("swept dial close error: %v", err)
+		}
+		return nil, ErrSwept
+	}
+	d.done = true
+	delete(s.dials, d.id)
+	id := s.nextID
+	s.nextID++
+	s.conns[id] = conn
+	s.mu.Unlock()
+
+	return &sweptConn{Conn: conn, sweeper: s, id: id}, nil
+}
+
+// Sweep closes every registered connection, aborts every in-flight dial, and
+// returns how many connections it closed. A dial whose connection was not
+// yet handed to WrapConn is marked, so the late WrapConn closes it instead
+// of registering it.
+func (s *Sweeper) Sweep() int {
+	if s == nil {
+		return 0
+	}
+
+	s.mu.Lock()
+	conns := s.conns
+	dials := s.dials
+	s.conns = make(map[sweepID]net.Conn)
+	s.dials = make(map[sweepID]*Dial)
+	for _, d := range dials {
+		d.done = true
+	}
+	s.mu.Unlock()
+
+	if len(dials) > 0 {
+		log.Debugf("aborting %d in-flight dials", len(dials))
+		for _, d := range dials {
+			d.cancel()
+		}
+	}
+
+	for _, conn := range conns {
+		log.Debugf("sweeping connection %s -> %s", conn.LocalAddr(), conn.RemoteAddr())
+		if err := conn.Close(); err != nil {
+			log.Debugf("swept connection close error: %v", err)
+		}
+	}
+	return len(conns)
+}
+
+func (s *Sweeper) deregister(id sweepID) {
+	s.mu.Lock()
+	delete(s.conns, id)
+	s.mu.Unlock()
+}

client/netsweep/netsweep_test.go

@@ -0,0 +1,168 @@
+package netsweep
+
+import (
+	"context"
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSweepClosesRegisteredConns(t *testing.T) {
+	sweeper := New()
+
+	c1 := wrap(t, sweeper, connPair(t))
+	c2 := wrap(t, sweeper, connPair(t))
+
+	assert.Equal(t, 2, sweeper.Sweep(), "both live connections should be closed")
+
+	// The wrappers must report closed now.
+	buf := make([]byte, 1)
+	_, err := c1.Read(buf)
+	assert.Error(t, err, "first connection should be unusable after the sweep")
+	_, err = c2.Read(buf)
+	assert.Error(t, err, "second connection should be unusable after the sweep")
+
+	assert.Equal(t, 0, sweeper.Sweep(), "second sweep should find nothing")
+}
+
+func TestCloseDeregisters(t *testing.T) {
+	sweeper := New()
+
+	conn := wrap(t, sweeper, connPair(t))
+	require.NoError(t, conn.Close())
+
+	assert.Equal(t, 0, sweeper.Sweep(), "closed connection must leave the registry")
+}
+
+func TestCloseIsIdempotent(t *testing.T) {
+	sweeper := New()
+
+	conn := wrap(t, sweeper, connPair(t))
+	require.NoError(t, conn.Close())
+	assert.Error(t, conn.Close(), "double close surfaces the underlying error but must not panic")
+}
+
+func TestSweepOnlyAffectsOlderConns(t *testing.T) {
+	sweeper := New()
+
+	_ = wrap(t, sweeper, connPair(t))
+	assert.Equal(t, 1, sweeper.Sweep())
+
+	// A connection dialed after the sweep must survive until the next one.
+	_ = wrap(t, sweeper, connPair(t))
+	assert.Equal(t, 1, sweeper.Sweep(), "post-sweep connection belongs to the next sweep")
+}
+
+func TestSweepAbortsInFlightDials(t *testing.T) {
+	sweeper := New()
+
+	dial := sweeper.StartDial(context.Background())
+	defer dial.Release()
+
+	sweeper.Sweep()
+
+	assert.ErrorIs(t, dial.Ctx().Err(), context.Canceled, "sweep must cancel the in-flight dial context")
+}
+
+func TestReleasedDialIsNotAborted(t *testing.T) {
+	sweeper := New()
+
+	// Simulate a dial that finished before the sweep.
+	released := sweeper.StartDial(context.Background())
+	released.Release()
+
+	// A dial still in flight during the sweep.
+	pending := sweeper.StartDial(context.Background())
+	defer pending.Release()
+
+	sweeper.Sweep()
+	assert.ErrorIs(t, pending.Ctx().Err(), context.Canceled, "pending dial must be aborted")
+}
+
+func TestSweepBetweenDialAndHandoffClosesConn(t *testing.T) {
+	sweeper := New()
+
+	dial := sweeper.StartDial(context.Background())
+	defer dial.Release()
+
+	// The dial succeeds on the old network, then the sweep lands before the
+	// connection is handed over.
+	conn := connPair(t)
+	assert.Equal(t, 0, sweeper.Sweep(), "the connection is not registered yet")
+
+	wrapped, err := dial.WrapConn(conn)
+	require.ErrorIs(t, err, ErrSwept)
+	require.Nil(t, wrapped)
+
+	buf := make([]byte, 1)
+	_, err = conn.Read(buf)
+	assert.Error(t, err, "the old-network connection must be closed, not leaked")
+
+	assert.Equal(t, 0, sweeper.Sweep(), "nothing may leak into the next sweep")
+}
+
+func TestNilSweeperIsNoop(t *testing.T) {
+	var sweeper *Sweeper
+
+	conn := connPair(t)
+	dial := sweeper.StartDial(context.Background())
+	defer dial.Release()
+
+	wrapped, err := dial.WrapConn(conn)
+	require.NoError(t, err)
+	assert.Equal(t, conn, wrapped, "nil sweeper must return the conn unchanged")
+	assert.NoError(t, dial.Ctx().Err(), "nil sweeper must not cancel the dial context")
+	assert.Equal(t, 0, sweeper.Sweep(), "nil sweeper closes nothing")
+}
+
+// wrap registers conn with the sweeper through a completed dial.
+func wrap(t *testing.T, sweeper *Sweeper, conn net.Conn) net.Conn {
+	t.Helper()
+
+	dial := sweeper.StartDial(context.Background())
+	defer dial.Release()
+
+	wrapped, err := dial.WrapConn(conn)
+	require.NoError(t, err)
+	return wrapped
+}
+
+// connPair dials a loopback TCP connection and keeps the accepted peer open
+// until the test ends: a peer that closed early would make the connection
+// unreadable on its own, so a read error after the sweep would prove nothing.
+func connPair(t *testing.T) net.Conn {
+	t.Helper()
+
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		if err := l.Close(); err != nil {
+			t.Logf("listener close error: %v", err)
+		}
+	})
+
+	accepted := make(chan net.Conn, 1)
+	go func() {
+		conn, err := l.Accept()
+		if err != nil {
+			close(accepted)
+			return
+		}
+		accepted <- conn
+	}()
+
+	conn, err := net.Dial("tcp", l.Addr().String())
+	require.NoError(t, err)
+
+	peer, ok := <-accepted
+	require.True(t, ok, "listener must accept the dialed connection")
+	t.Cleanup(func() {
+		if err := peer.Close(); err != nil {
+			t.Logf("peer close error: %v", err)
+		}
+	})
+
+	return conn
+}

shared/management/client/grpc.go

@@ -21,6 +21,8 @@ import (
 	"google.golang.org/grpc/connectivity"
 
 	nbgrpc "github.com/netbirdio/netbird/client/grpc"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/shared/management/domain"
@@ -62,6 +64,13 @@ type GrpcClient struct {
 	connStateCallbackLock sync.RWMutex
 	serverURL             string
 
+	// netState gates the stream retry loop on OS-reported network
+	// availability; nil (the default) disables gating.
+	netState *netstate.State
+
+	// sweeper cuts the transport connections on network change; nil disables it.
+	sweeper *netsweep.Sweeper
+
 	// syncStreamErr holds the last Sync stream error, or nil while the stream
 	// is established and healthy. GetServerKey succeeds even when the peer
 	// cannot sync (e.g. the server returns "settings not found"), so the
@@ -111,16 +120,43 @@ func MaxRecvMsgSize() int {
 	return size
 }
 
+// Option configures optional GrpcClient behavior.
+type Option func(*GrpcClient)
+
+// WithNetworkState injects the OS network availability state that gates the
+// stream retry loop; without it gating is disabled.
+func WithNetworkState(netState *netstate.State) Option {
+	return func(c *GrpcClient) { c.netState = netState }
+}
+
+// WithSweeper injects the network change sweeper.
+func WithSweeper(sweeper *netsweep.Sweeper) Option {
+	return func(c *GrpcClient) { c.sweeper = sweeper }
+}
+
 // NewClient creates a new client to Management service
-func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsEnabled bool) (*GrpcClient, error) {
-	var conn *grpc.ClientConn
+func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsEnabled bool, opts ...Option) (*GrpcClient, error) {
+	// Options apply before dialing: the sweeper must wrap the first connection too.
+	c := &GrpcClient{
+		key:                   ourPrivateKey,
+		ctx:                   ctx,
+		connStateCallbackLock: sync.RWMutex{},
+		serverURL:             addr,
+	}
+	for _, opt := range opts {
+		opt(c)
+	}
 
 	var extraOpts []grpc.DialOption
 	if maxSize := MaxRecvMsgSize(); maxSize > 0 {
 		extraOpts = append(extraOpts, grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(maxSize)))
 		log.Infof("management gRPC max receive message size set to %d bytes", maxSize)
 	}
+	if c.sweeper != nil {
+		extraOpts = append(extraOpts, nbgrpc.WithSweeper(c.sweeper))
+	}
 
+	var conn *grpc.ClientConn
 	operation := func() error {
 		var err error
 		conn, err = nbgrpc.CreateConnection(ctx, addr, tlsEnabled, wsproxy.ManagementComponent, extraOpts...)
@@ -136,16 +172,9 @@ func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsE
 		return nil, err
 	}
 
-	realClient := proto.NewManagementServiceClient(conn)
-
-	return &GrpcClient{
-		key:                   ourPrivateKey,
-		realClient:            realClient,
-		ctx:                   ctx,
-		conn:                  conn,
-		connStateCallbackLock: sync.RWMutex{},
-		serverURL:             addr,
-	}, nil
+	c.conn = conn
+	c.realClient = proto.NewManagementServiceClient(conn)
+	return c, nil
 }
 
 // GetServerURL returns the management server URL
@@ -208,6 +237,16 @@ func (c *GrpcClient) withMgmtStream(
 ) error {
 	backOff := defaultBackoff(ctx)
 	operation := func() error {
+		// suspend reconnect attempts while the OS reports no usable network.
+		// Wait only errors on a cancelled context, which means shutdown, so
+		// stop the loop without reporting a failure.
+		if waited, err := c.netState.Wait(ctx); err != nil {
+			log.Debugf("management connection context has been canceled while offline, this usually indicates shutdown")
+			return nil //nolint:nilerr // a cancelled context means shutdown, not a retryable failure
+		} else if waited {
+			backOff.Reset()
+		}
+
 		log.Debugf("management connection state %v", c.conn.GetState())
 		connState := c.conn.GetState()
 

shared/relay/client/client.go

@@ -14,6 +14,7 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/client/netsweep"
 	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	"github.com/netbirdio/netbird/shared/relay/client/dialer"
 	netErr "github.com/netbirdio/netbird/shared/relay/client/dialer/net"
@@ -184,6 +185,10 @@ type Client struct {
 	// datagram-sized transport is avoided on subsequent connects. Shared via
 	// the manager.
 	transportFallback *transportFallback
+
+	// sweeper cuts the relay connection on network change; the read loop
+	// reports the disconnect and the guard reconnects. Shared via the manager.
+	sweeper *netsweep.Sweeper
 	// datagramFallbackTriggered guards a single fallback per connection so a
 	// burst of oversized datagrams triggers one reconnect, not many.
 	datagramFallbackTriggered atomic.Bool
@@ -393,6 +398,12 @@ func (c *Client) Close() error {
 }
 
 func (c *Client) connect(ctx context.Context) (*RelayAddr, error) {
+	// A sweep cancels this context, so a dial started on the old network
+	// aborts instead of waiting out its handshake timeout.
+	dial := c.sweeper.StartDial(ctx)
+	defer dial.Release()
+	ctx = dial.Ctx()
+
 	mode := transportModeFromEnv()
 	dialers := c.getDialers(mode)
 
@@ -417,12 +428,19 @@ func (c *Client) connect(ctx context.Context) (*RelayAddr, error) {
 			return nil, fmt.Errorf("dial via FQDN: %w", err)
 		}
 	}
-	c.relayConn = conn
-	c.datagramFallbackTriggered.Store(false)
+	// Read the transport off the concrete connection: the sweeper's wrapper
+	// embeds net.Conn only, so it does not promote Protocol().
 	if tc, ok := conn.(transportConn); ok {
 		c.transport = tc.Protocol()
 	}
 
+	conn, err := dial.WrapConn(conn)
+	if err != nil {
+		return nil, fmt.Errorf("register connection: %w", err)
+	}
+	c.relayConn = conn
+	c.datagramFallbackTriggered.Store(false)
+
 	instanceURL, err := c.handShake(ctx)
 	if err != nil {
 		cErr := conn.Close()

shared/relay/client/guard.go

@@ -7,6 +7,8 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/client/netstate"
 )
 
 const defaultMaxBackoffInterval = 60 * time.Second
@@ -22,14 +24,19 @@ type Guard struct {
 	// attempts.
 	maxBackoffInterval time.Duration
 
+	// netState gates reconnect attempts on OS-reported network availability;
+	// nil disables gating.
+	netState *netstate.State
+
 	// lastErr is the error from the most recent failed reconnect attempt,
 	// surfaced as the home relay status while disconnected.
 	lastErr atomic.Pointer[error]
 }
 
 // NewGuard creates a new guard for the relay client. A non-positive
-// maxBackoffInterval falls back to defaultMaxBackoffInterval.
-func NewGuard(sp *ServerPicker, maxBackoffInterval time.Duration) *Guard {
+// maxBackoffInterval falls back to defaultMaxBackoffInterval. A nil netState
+// disables network availability gating.
+func NewGuard(sp *ServerPicker, maxBackoffInterval time.Duration, netState *netstate.State) *Guard {
 	if maxBackoffInterval <= 0 {
 		maxBackoffInterval = defaultMaxBackoffInterval
 	}
@@ -38,6 +45,7 @@ func NewGuard(sp *ServerPicker, maxBackoffInterval time.Duration) *Guard {
 		OnReconnected:      make(chan struct{}, 1),
 		serverPicker:       sp,
 		maxBackoffInterval: maxBackoffInterval,
+		netState:           netState,
 	}
 	return g
 }
@@ -70,11 +78,21 @@ func (g *Guard) StartReconnectTrys(ctx context.Context, relayClient *Client) {
 
 	// start a ticker to pick a new server
 	ticker := g.exponentTicker(ctx)
-	defer ticker.Stop()
+	defer func() {
+		ticker.Stop()
+	}()
 
 	for {
 		select {
 		case <-ticker.C:
+			// suspend reconnect attempts while the OS reports no usable network
+			if waited, err := g.netState.Wait(ctx); err != nil {
+				return
+			} else if waited {
+				ticker.Stop()
+				ticker = g.exponentTicker(ctx)
+				continue
+			}
 			if err := g.retry(ctx); err != nil {
 				log.Errorf("failed to pick new Relay server: %s", err)
 				g.setLastError(err)
@@ -104,6 +122,13 @@ func (g *Guard) tryToQuickReconnect(parentCtx context.Context, rc *Client) bool
 		return false
 	}
 
+	// Re-check after the wait: the disconnect that triggered this reconnect
+	// is often the first symptom of the network going away, so the
+	// availability flag typically arrives while we sleep here.
+	if !g.netState.IsOnline() {
+		return false
+	}
+
 	log.Infof("try to reconnect to Relay server: %s", rc.connectionURL)
 
 	if err := rc.Connect(parentCtx); err != nil {

shared/relay/client/manager.go

@@ -12,6 +12,8 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	relayAuth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 )
 
@@ -65,6 +67,17 @@ func WithMaxBackoffInterval(d time.Duration) ManagerOption {
 	return func(m *Manager) { m.maxBackoffInterval = d }
 }
 
+// WithNetworkState injects the OS network availability state that gates the
+// reconnect guard; without it reconnect attempts are not gated.
+func WithNetworkState(netState *netstate.State) ManagerOption {
+	return func(m *Manager) { m.netState = netState }
+}
+
+// WithSweeper injects the network change sweeper.
+func WithSweeper(sweeper *netsweep.Sweeper) ManagerOption {
+	return func(m *Manager) { m.sweeper = sweeper }
+}
+
 // Manager is a manager for the relay client instances. It establishes one persistent connection to the given relay URL
 // and automatically reconnect to them in case disconnection.
 // The manager also manage temporary relay connection. If a client wants to communicate with a client on a
@@ -92,6 +105,8 @@ type Manager struct {
 
 	mtu                uint16
 	maxBackoffInterval time.Duration
+	netState           *netstate.State
+	sweeper            *netsweep.Sweeper
 
 	cleanupInterval      time.Duration
 	keepUnusedServerTime time.Duration
@@ -128,8 +143,9 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 	for _, opt := range opts {
 		opt(m)
 	}
+	m.serverPicker.Sweeper = m.sweeper
 	m.serverPicker.ServerURLs.Store(serverURLs)
-	m.reconnectGuard = NewGuard(m.serverPicker, m.maxBackoffInterval)
+	m.reconnectGuard = NewGuard(m.serverPicker, m.maxBackoffInterval, m.netState)
 	return m
 }
 
@@ -354,6 +370,7 @@ func (m *Manager) openConnVia(ctx context.Context, serverAddress, peerKey string
 
 	relayClient := NewClientWithServerIP(serverAddress, serverIP, m.tokenStore, m.peerID, m.mtu)
 	relayClient.SetTransportFallback(m.transportFallback)
+	relayClient.sweeper = m.sweeper
 	err := relayClient.Connect(m.ctx)
 	if err != nil {
 		rt.Lock()

shared/relay/client/picker.go

@@ -9,6 +9,7 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/client/netsweep"
 	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 )
 
@@ -30,6 +31,7 @@ type ServerPicker struct {
 	MTU               uint16
 	ConnectionTimeout time.Duration
 	TransportFallback *transportFallback
+	Sweeper           *netsweep.Sweeper
 }
 
 func (sp *ServerPicker) PickServer(parentCtx context.Context) (*Client, error) {
@@ -73,6 +75,7 @@ func (sp *ServerPicker) startConnection(ctx context.Context, resultChan chan con
 	log.Infof("try to connecting to relay server: %s", url)
 	relayClient := NewClient(url, sp.TokenStore, sp.PeerID, sp.MTU)
 	relayClient.SetTransportFallback(sp.TransportFallback)
+	relayClient.sweeper = sp.Sweeper
 	err := relayClient.Connect(ctx)
 	resultChan <- connResult{
 		RelayClient: relayClient,

shared/signal/client/grpc.go

@@ -19,6 +19,8 @@ import (
 	"google.golang.org/grpc/status"
 
 	nbgrpc "github.com/netbirdio/netbird/client/grpc"
+	"github.com/netbirdio/netbird/client/netstate"
+	"github.com/netbirdio/netbird/client/netsweep"
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/shared/management/client"
 	"github.com/netbirdio/netbird/shared/signal/proto"
@@ -65,6 +67,13 @@ type GrpcClient struct {
 	connStateCallback     ConnStateNotifier
 	connStateCallbackLock sync.RWMutex
 
+	// netState gates the Receive retry loop on OS-reported network
+	// availability; nil (the default) disables gating.
+	netState *netstate.State
+
+	// sweeper cuts the transport connections on network change; nil disables it.
+	sweeper *netsweep.Sweeper
+
 	onReconnectedListenerFn func()
 
 	decryptionWorker       *Worker
@@ -88,13 +97,43 @@ type GrpcClient struct {
 	watchdogWg            sync.WaitGroup
 }
 
-// NewClient creates a new Signal client
-func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled bool) (*GrpcClient, error) {
-	var conn *grpc.ClientConn
+// Option configures optional GrpcClient behavior.
+type Option func(*GrpcClient)
 
+// WithNetworkState injects the OS network availability state that gates the
+// Receive retry loop; without it gating is disabled.
+func WithNetworkState(netState *netstate.State) Option {
+	return func(c *GrpcClient) { c.netState = netState }
+}
+
+// WithSweeper injects the network change sweeper.
+func WithSweeper(sweeper *netsweep.Sweeper) Option {
+	return func(c *GrpcClient) { c.sweeper = sweeper }
+}
+
+// NewClient creates a new Signal client
+func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled bool, opts ...Option) (*GrpcClient, error) {
+	// Options apply before dialing: the sweeper must wrap the first connection too.
+	c := &GrpcClient{
+		ctx:                   ctx,
+		key:                   key,
+		mux:                   sync.Mutex{},
+		status:                StreamDisconnected,
+		connStateCallbackLock: sync.RWMutex{},
+	}
+	for _, opt := range opts {
+		opt(c)
+	}
+
+	var extraOpts []grpc.DialOption
+	if c.sweeper != nil {
+		extraOpts = append(extraOpts, nbgrpc.WithSweeper(c.sweeper))
+	}
+
+	var conn *grpc.ClientConn
 	operation := func() error {
 		var err error
-		conn, err = nbgrpc.CreateConnection(ctx, addr, tlsEnabled, wsproxy.SignalComponent)
+		conn, err = nbgrpc.CreateConnection(ctx, addr, tlsEnabled, wsproxy.SignalComponent, extraOpts...)
 		if err != nil {
 			return fmt.Errorf("create connection: %w", err)
 		}
@@ -109,15 +148,9 @@ func NewClient(ctx context.Context, addr string, key wgtypes.Key, tlsEnabled boo
 
 	log.Debugf("connected to Signal Service: %v", conn.Target())
 
-	return &GrpcClient{
-		realClient:            proto.NewSignalExchangeClient(conn),
-		ctx:                   ctx,
-		signalConn:            conn,
-		key:                   key,
-		mux:                   sync.Mutex{},
-		status:                StreamDisconnected,
-		connStateCallbackLock: sync.RWMutex{},
-	}, nil
+	c.signalConn = conn
+	c.realClient = proto.NewSignalExchangeClient(conn)
+	return c, nil
 }
 
 func (c *GrpcClient) StreamConnected() bool {
@@ -168,6 +201,15 @@ func (c *GrpcClient) Receive(ctx context.Context, msgHandler func(msg *proto.Mes
 	var backOff = defaultBackoff(ctx)
 
 	operation := func() error {
+		// suspend reconnect attempts while the OS reports no usable network.
+		// Wait only errors on a cancelled context, which means shutdown, so
+		// stop the loop without reporting a failure.
+		if waited, err := c.netState.Wait(ctx); err != nil {
+			log.Debugf("signal connection context has been canceled while offline, this usually indicates shutdown")
+			return nil
+		} else if waited {
+			backOff.Reset()
+		}
 
 		c.notifyStreamDisconnected()