fix benchmark

We still have some client tests that can lock other tests within the management code

for now, I am adding back the -p 1 flag

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.23-bullseye
+FROM golang:1.21-bullseye
 
 RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
     && apt-get -y install --no-install-recommends\

.devcontainer/devcontainer.json

@@ -7,7 +7,7 @@
 	"features": {
 		"ghcr.io/devcontainers/features/docker-in-docker:2": {},
 		"ghcr.io/devcontainers/features/go:1": {
-			"version": "1.23"
+			"version": "1.21"
 		}
 	},
 	"workspaceFolder": "/workspaces/${localWorkspaceFolderBasename}",

.github/workflows/golang-test-darwin.yml

@@ -44,5 +44,4 @@ jobs:
         run: git --no-pager diff --exit-code
 
       - name: Test
-        run: NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -tags=devcert -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 5m -p 1 $(go list ./... | grep -v /management)
-
+        run: NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 5m -p 1 $(go list ./... | grep -v /management)

.github/workflows/golang-test-freebsd.yml

@@ -24,7 +24,7 @@ jobs:
           copyback: false
           release: "14.1"
           prepare: |
-            pkg install -y go pkgconf xorg
+            pkg install -y go
 
           # -x - to print all executed commands
           # -e - to faile on first error
@@ -33,7 +33,7 @@ jobs:
             time go build -o netbird client/main.go
             # check all component except management, since we do not support management server on freebsd
             time go test -timeout 1m -failfast ./base62/...
-            # NOTE: without -p1 `client/internal/dns` will fail because of `listen udp4 :33100: bind: address already in use`
+            # NOTE: without -p1 `client/internal/dns` will fail becasue of `listen udp4 :33100: bind: address already in use`
             time go test -timeout 8m -failfast -p 1 ./client/...
             time go test -timeout 1m -failfast ./dns/...
             time go test -timeout 1m -failfast ./encryption/...

.github/workflows/golang-test-linux.yml

@@ -13,7 +13,7 @@ concurrency:
 jobs:
   build-cache:
     runs-on: ubuntu-22.04
-    steps:        
+    steps:
       - name: Checkout code
         uses: actions/checkout@v4
 
@@ -134,189 +134,9 @@ jobs:
         run: git --no-pager diff --exit-code
 
       - name: Test
-        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -tags devcert -exec 'sudo' -timeout 10m -p 1 $(go list ./... | grep -v /management)
+        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} CI=true go test -exec 'sudo' -timeout 10m -p 1 $(go list ./... | grep -v /management)
 
   test_management:
-    needs: [ build-cache ]
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [ '386','amd64' ]
-        store: [ 'sqlite', 'postgres', 'mysql' ]
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.23.x"
-          cache: false
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Get Go environment
-        run: |
-          echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
-          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV     
-
-      - name: Cache Go modules
-        uses: actions/cache/restore@v4
-        with:
-          path: |
-            ${{ env.cache }}
-            ${{ env.modcache }}
-          key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-gotest-cache-
-
-      - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
-
-      - name: Install 32-bit libpcap
-        if: matrix.arch == '386'
-        run: sudo dpkg --add-architecture i386 && sudo apt update && sudo apt-get install -y libpcap0.8-dev:i386
-
-      - name: Install modules
-        run: go mod tidy
-
-      - name: check git status
-        run: git --no-pager diff --exit-code
-
-      - name: Login to Docker hub
-        if: matrix.store == 'mysql' && (github.repository == github.head.repo.full_name || !github.head_ref)
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_TOKEN }}
-
-      - name: download mysql image
-        if: matrix.store == 'mysql'
-        run: docker pull mlsmaycon/warmed-mysql:8
-
-      - name: Test
-        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -tags=devcert -p 1 -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 10m $(go list ./... | grep /management)
-
-  benchmark:
-    needs: [ build-cache ]
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [ '386','amd64' ]
-        store: [ 'sqlite', 'postgres', 'mysql' ]
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.23.x"
-          cache: false
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Get Go environment
-        run: |
-          echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
-          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV     
-
-      - name: Cache Go modules
-        uses: actions/cache/restore@v4
-        with:
-          path: |
-            ${{ env.cache }}
-            ${{ env.modcache }}
-          key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-gotest-cache-
-
-      - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
-
-      - name: Install 32-bit libpcap
-        if: matrix.arch == '386'
-        run: sudo dpkg --add-architecture i386 && sudo apt update && sudo apt-get install -y libpcap0.8-dev:i386
-
-      - name: Install modules
-        run: go mod tidy
-
-      - name: check git status
-        run: git --no-pager diff --exit-code
-
-      - name: Login to Docker hub
-        if: matrix.store == 'mysql' && (github.repository == github.head.repo.full_name || !github.head_ref)
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_TOKEN }}
-
-      - name: download mysql image
-        if: matrix.store == 'mysql'
-        run: docker pull mlsmaycon/warmed-mysql:8
-
-      - name: Test
-        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -tags devcert -run=^$ -bench=. -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 20m ./...
-
-  api_benchmark:
-    needs: [ build-cache ]
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [ '386','amd64' ]
-        store: [ 'sqlite', 'postgres' ]
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.23.x"
-          cache: false
-
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Get Go environment
-        run: |
-          echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
-          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV     
-
-      - name: Cache Go modules
-        uses: actions/cache/restore@v4
-        with:
-          path: |
-            ${{ env.cache }}
-            ${{ env.modcache }}
-          key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-gotest-cache-
-
-      - name: Install dependencies
-        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
-
-      - name: Install 32-bit libpcap
-        if: matrix.arch == '386'
-        run: sudo dpkg --add-architecture i386 && sudo apt update && sudo apt-get install -y libpcap0.8-dev:i386
-
-      - name: Install modules
-        run: go mod tidy
-
-      - name: check git status
-        run: git --no-pager diff --exit-code
-
-      - name: Login to Docker hub
-        if: matrix.store == 'mysql' && (github.repository == github.head.repo.full_name || !github.head_ref)
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USER }}
-          password: ${{ secrets.DOCKER_TOKEN }}
-
-      - name: download mysql image
-        if: matrix.store == 'mysql'
-        run: docker pull mlsmaycon/warmed-mysql:8
-        
-      - name: Test
-        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -run=^$ -tags=benchmark -bench=. -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 30m $(go list -tags=benchmark ./... | grep /management)
-
-  api_integration_test:
     needs: [ build-cache ]
     strategy:
       fail-fast: false
@@ -363,7 +183,56 @@ jobs:
         run: git --no-pager diff --exit-code
 
       - name: Test
-        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -tags=integration -p 1 -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 30m $(go list -tags=integration ./... | grep /management)
+        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 10m -p 1 $(go list ./... | grep /management)
+
+  benchmark:
+    needs: [ build-cache ]
+    strategy:
+      fail-fast: false
+      matrix:
+        arch: [ '386','amd64' ]
+        store: [ 'sqlite', 'postgres' ]
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.23.x"
+          cache: false
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Get Go environment
+        run: |
+          echo "cache=$(go env GOCACHE)" >> $GITHUB_ENV
+          echo "modcache=$(go env GOMODCACHE)" >> $GITHUB_ENV     
+
+      - name: Cache Go modules
+        uses: actions/cache/restore@v4
+        with:
+          path: |
+            ${{ env.cache }}
+            ${{ env.modcache }}
+          key: ${{ runner.os }}-gotest-cache-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-gotest-cache-
+
+      - name: Install dependencies
+        run: sudo apt update && sudo apt install -y -q libgtk-3-dev libayatana-appindicator3-dev libgl1-mesa-dev xorg-dev gcc-multilib libpcap-dev
+
+      - name: Install 32-bit libpcap
+        if: matrix.arch == '386'
+        run: sudo dpkg --add-architecture i386 && sudo apt update && sudo apt-get install -y libpcap0.8-dev:i386
+
+      - name: Install modules
+        run: go mod tidy
+
+      - name: check git status
+        run: git --no-pager diff --exit-code
+
+      - name: Test
+        run: CGO_ENABLED=1 GOARCH=${{ matrix.arch }} NETBIRD_STORE_ENGINE=${{ matrix.store }} CI=true go test -run=^$ -bench=. -exec 'sudo --preserve-env=CI,NETBIRD_STORE_ENGINE' -timeout 10m ./...
 
   test_client_on_docker:
     needs: [ build-cache ]

.github/workflows/golang-test-windows.yml

@@ -65,7 +65,7 @@ jobs:
       - run: echo "files=$(go list ./... | ForEach-Object { $_ } | Where-Object { $_ -notmatch '/management' })" >> $env:GITHUB_ENV
 
       - name: test
-        run: PsExec64 -s -w ${{ github.workspace }} cmd.exe /c "C:\hostedtoolcache\windows\go\${{ steps.go.outputs.go-version }}\x64\bin\go.exe test -tags=devcert -timeout 10m -p 1 ${{ env.files }} > test-out.txt 2>&1"
+        run: PsExec64 -s -w ${{ github.workspace }} cmd.exe /c "C:\hostedtoolcache\windows\go\${{ steps.go.outputs.go-version }}\x64\bin\go.exe test -timeout 10m -p 1 ${{ env.files }} > test-out.txt 2>&1"
       - name: test output
         if: ${{ always() }}
         run: Get-Content test-out.txt

.github/workflows/golangci-lint.yml

@@ -19,7 +19,7 @@ jobs:
       - name: codespell
         uses: codespell-project/actions-codespell@v2
         with:
-          ignore_words_list: erro,clienta,hastable,iif,groupd,testin
+          ignore_words_list: erro,clienta,hastable,iif,groupd
           skip: go.mod,go.sum
           only_warn: 1
   golangci:

.github/workflows/test-infrastructure-files.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        store: [ 'sqlite', 'postgres', 'mysql' ]
+        store: [ 'sqlite', 'postgres' ]
     services:
       postgres:
         image: ${{ (matrix.store == 'postgres') && 'postgres' || '' }}
@@ -34,19 +34,6 @@ jobs:
           --health-timeout 5s
         ports:
           - 5432:5432
-      mysql:
-        image: ${{ (matrix.store == 'mysql') && 'mysql' || '' }}
-        env:
-          MYSQL_USER: netbird
-          MYSQL_PASSWORD: mysql
-          MYSQL_ROOT_PASSWORD: mysqlroot
-          MYSQL_DATABASE: netbird
-        options: >-
-          --health-cmd "mysqladmin ping --silent"
-          --health-interval 10s
-          --health-timeout 5s
-        ports:
-          - 3306:3306
     steps:
       - name: Set Database Connection String
         run: |
@@ -55,11 +42,6 @@ jobs:
           else
             echo "NETBIRD_STORE_ENGINE_POSTGRES_DSN==" >> $GITHUB_ENV
           fi
-          if [ "${{ matrix.store }}" == "mysql" ]; then
-            echo "NETBIRD_STORE_ENGINE_MYSQL_DSN=netbird:mysql@tcp($(hostname -I | awk '{print $1}'):3306)/netbird" >> $GITHUB_ENV
-          else
-            echo "NETBIRD_STORE_ENGINE_MYSQL_DSN==" >> $GITHUB_ENV
-          fi
 
       - name: Install jq
         run: sudo apt-get install -y jq
@@ -102,7 +84,6 @@ jobs:
           CI_NETBIRD_AUTH_SUPPORTED_SCOPES: "openid profile email offline_access api email_verified"
           CI_NETBIRD_STORE_CONFIG_ENGINE: ${{ matrix.store }}
           NETBIRD_STORE_ENGINE_POSTGRES_DSN: ${{ env.NETBIRD_STORE_ENGINE_POSTGRES_DSN }}
-          NETBIRD_STORE_ENGINE_MYSQL_DSN: ${{ env.NETBIRD_STORE_ENGINE_MYSQL_DSN }}
           CI_NETBIRD_MGMT_IDP_SIGNKEY_REFRESH: false
 
       - name: check values
@@ -131,7 +112,6 @@ jobs:
           CI_NETBIRD_SIGNAL_PORT: 12345
           CI_NETBIRD_STORE_CONFIG_ENGINE: ${{ matrix.store }}
           NETBIRD_STORE_ENGINE_POSTGRES_DSN: '${{ env.NETBIRD_STORE_ENGINE_POSTGRES_DSN }}$'
-          NETBIRD_STORE_ENGINE_MYSQL_DSN: '${{ env.NETBIRD_STORE_ENGINE_MYSQL_DSN }}$'
           CI_NETBIRD_MGMT_IDP_SIGNKEY_REFRESH: false
           CI_NETBIRD_TURN_EXTERNAL_IP: "1.2.3.4"
 
@@ -169,7 +149,6 @@ jobs:
           grep -A 10 PKCEAuthorizationFlow management.json | grep -A 10 ProviderConfig | grep Scope | grep "$CI_NETBIRD_AUTH_SUPPORTED_SCOPES"
           grep -A 10 PKCEAuthorizationFlow management.json | grep -A 10 ProviderConfig | grep -A 3 RedirectURLs | grep "http://localhost:53000"
           grep "external-ip" turnserver.conf | grep $CI_NETBIRD_TURN_EXTERNAL_IP
-          grep "NETBIRD_STORE_ENGINE_MYSQL_DSN=$NETBIRD_STORE_ENGINE_MYSQL_DSN" docker-compose.yml
           grep NETBIRD_STORE_ENGINE_POSTGRES_DSN docker-compose.yml | egrep "$NETBIRD_STORE_ENGINE_POSTGRES_DSN"
           # check relay values
           grep "NB_EXPOSED_ADDRESS=$CI_NETBIRD_DOMAIN:33445" docker-compose.yml

.goreleaser.yaml

@@ -179,51 +179,6 @@ dockers:
       - "--label=org.opencontainers.image.revision={{.FullCommit}}"
       - "--label=org.opencontainers.image.version={{.Version}}"
       - "--label=maintainer=dev@netbird.io"
-
-  - image_templates:
-      - netbirdio/netbird:{{ .Version }}-rootless-amd64
-    ids:
-      - netbird
-    goarch: amd64
-    use: buildx
-    dockerfile: client/Dockerfile-rootless
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.title={{.ProjectName}}"
-      - "--label=org.opencontainers.image.version={{.Version}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=maintainer=dev@netbird.io"
-  - image_templates:
-      - netbirdio/netbird:{{ .Version }}-rootless-arm64v8
-    ids:
-      - netbird
-    goarch: arm64
-    use: buildx
-    dockerfile: client/Dockerfile-rootless
-    build_flag_templates:
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.title={{.ProjectName}}"
-      - "--label=org.opencontainers.image.version={{.Version}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=maintainer=dev@netbird.io"
-  - image_templates:
-      - netbirdio/netbird:{{ .Version }}-rootless-arm
-    ids:
-      - netbird
-    goarch: arm
-    goarm: 6
-    use: buildx
-    dockerfile: client/Dockerfile-rootless
-    build_flag_templates:
-      - "--platform=linux/arm"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.title={{.ProjectName}}"
-      - "--label=org.opencontainers.image.version={{.Version}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=maintainer=dev@netbird.io"
-
   - image_templates:
       - netbirdio/relay:{{ .Version }}-amd64
     ids:
@@ -422,18 +377,6 @@ docker_manifests:
       - netbirdio/netbird:{{ .Version }}-arm
       - netbirdio/netbird:{{ .Version }}-amd64
 
-  - name_template: netbirdio/netbird:{{ .Version }}-rootless
-    image_templates:
-      - netbirdio/netbird:{{ .Version }}-rootless-arm64v8
-      - netbirdio/netbird:{{ .Version }}-rootless-arm
-      - netbirdio/netbird:{{ .Version }}-rootless-amd64
-
-  - name_template: netbirdio/netbird:rootless-latest
-    image_templates:
-      - netbirdio/netbird:{{ .Version }}-rootless-arm64v8
-      - netbirdio/netbird:{{ .Version }}-rootless-arm
-      - netbirdio/netbird:{{ .Version }}-rootless-amd64
-
   - name_template: netbirdio/relay:{{ .Version }}
     image_templates:
       - netbirdio/relay:{{ .Version }}-arm64v8

README.md

@@ -1,3 +1,10 @@
+<p align="center">
+ <strong>:hatching_chick: New Release! Device Posture Checks.</strong>
+  <a href="https://docs.netbird.io/how-to/manage-posture-checks">
+       Learn more
+     </a>   
+</p>
+<br/>
 <div align="center">
 <p align="center">
   <img width="234" src="docs/media/logo-full.png"/>

client/Dockerfile-rootless

@@ -1,16 +0,0 @@
-FROM alpine:3.21.0
-
-COPY netbird /usr/local/bin/netbird
-
-RUN apk add --no-cache ca-certificates \
-    && adduser -D -h /var/lib/netbird netbird
-WORKDIR /var/lib/netbird
-USER netbird:netbird
-
-ENV NB_FOREGROUND_MODE=true
-ENV NB_USE_NETSTACK_MODE=true
-ENV NB_CONFIG=config.json
-ENV NB_DAEMON_ADDR=unix://netbird.sock
-ENV NB_DISABLE_DNS=true
-
-ENTRYPOINT [ "/usr/local/bin/netbird", "up" ]

client/android/login.go

@@ -162,7 +162,7 @@ func (a *Auth) login(urlOpener URLOpener) error {
 
 	// check if we need to generate JWT token
 	err := a.withBackOff(a.ctx, func() (err error) {
-		needsLogin, err = internal.IsLoginRequired(a.ctx, a.config)
+		needsLogin, err = internal.IsLoginRequired(a.ctx, a.config.PrivateKey, a.config.ManagementURL, a.config.SSHKey)
 		return
 	})
 	if err != nil {

client/cmd/root.go

@@ -38,7 +38,6 @@ const (
 	extraIFaceBlackListFlag = "extra-iface-blacklist"
 	dnsRouteIntervalFlag    = "dns-router-interval"
 	systemInfoFlag          = "system-info"
-	blockLANAccessFlag      = "block-lan-access"
 )
 
 var (
@@ -74,7 +73,6 @@ var (
 	anonymizeFlag           bool
 	debugSystemInfoFlag     bool
 	dnsRouteInterval        time.Duration
-	blockLANAccess          bool
 
 	rootCmd = &cobra.Command{
 		Use:          "netbird",

client/cmd/ssh.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 	"syscall"
 
+	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 
 	"github.com/netbirdio/netbird/client/internal"
@@ -72,7 +73,7 @@ var sshCmd = &cobra.Command{
 		go func() {
 			// blocking
 			if err := runSSH(sshctx, host, []byte(config.SSHKey), cmd); err != nil {
-				cmd.Printf("Error: %v\n", err)
+				log.Debug(err)
 				os.Exit(1)
 			}
 			cancel()

client/cmd/system.go

@@ -1,31 +0,0 @@
-package cmd
-
-// Flag constants for system configuration
-const (
-	disableClientRoutesFlag = "disable-client-routes"
-	disableServerRoutesFlag = "disable-server-routes"
-	disableDNSFlag          = "disable-dns"
-	disableFirewallFlag     = "disable-firewall"
-)
-
-var (
-	disableClientRoutes bool
-	disableServerRoutes bool
-	disableDNS          bool
-	disableFirewall     bool
-)
-
-func init() {
-	// Add system flags to upCmd
-	upCmd.PersistentFlags().BoolVar(&disableClientRoutes, disableClientRoutesFlag, false,
-		"Disable client routes. If enabled, the client won't process client routes received from the management service.")
-
-	upCmd.PersistentFlags().BoolVar(&disableServerRoutes, disableServerRoutesFlag, false,
-		"Disable server routes. If enabled, the client won't act as a router for server routes received from the management service.")
-
-	upCmd.PersistentFlags().BoolVar(&disableDNS, disableDNSFlag, false,
-		"Disable DNS. If enabled, the client won't configure DNS settings.")
-
-	upCmd.PersistentFlags().BoolVar(&disableFirewall, disableFirewallFlag, false,
-		"Disable firewall configuration. If enabled, the client won't modify firewall rules.")
-}

client/cmd/up.go

@@ -48,7 +48,6 @@ func init() {
 	)
 	upCmd.PersistentFlags().StringSliceVar(&extraIFaceBlackList, extraIFaceBlackListFlag, nil, "Extra list of default interfaces to ignore for listening")
 	upCmd.PersistentFlags().DurationVar(&dnsRouteInterval, dnsRouteIntervalFlag, time.Minute, "DNS route update interval")
-	upCmd.PersistentFlags().BoolVar(&blockLANAccess, blockLANAccessFlag, false, "Block access to local networks (LAN) when using this peer as a router or exit node")
 }
 
 func upFunc(cmd *cobra.Command, args []string) error {
@@ -148,23 +147,6 @@ func runInForegroundMode(ctx context.Context, cmd *cobra.Command) error {
 		ic.DNSRouteInterval = &dnsRouteInterval
 	}
 
-	if cmd.Flag(disableClientRoutesFlag).Changed {
-		ic.DisableClientRoutes = &disableClientRoutes
-	}
-	if cmd.Flag(disableServerRoutesFlag).Changed {
-		ic.DisableServerRoutes = &disableServerRoutes
-	}
-	if cmd.Flag(disableDNSFlag).Changed {
-		ic.DisableDNS = &disableDNS
-	}
-	if cmd.Flag(disableFirewallFlag).Changed {
-		ic.DisableFirewall = &disableFirewall
-	}
-
-	if cmd.Flag(blockLANAccessFlag).Changed {
-		ic.BlockLANAccess = &blockLANAccess
-	}
-
 	providedSetupKey, err := getSetupKey()
 	if err != nil {
 		return err
@@ -282,23 +264,6 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command) error {
 		loginRequest.DnsRouteInterval = durationpb.New(dnsRouteInterval)
 	}
 
-	if cmd.Flag(disableClientRoutesFlag).Changed {
-		loginRequest.DisableClientRoutes = &disableClientRoutes
-	}
-	if cmd.Flag(disableServerRoutesFlag).Changed {
-		loginRequest.DisableServerRoutes = &disableServerRoutes
-	}
-	if cmd.Flag(disableDNSFlag).Changed {
-		loginRequest.DisableDns = &disableDNS
-	}
-	if cmd.Flag(disableFirewallFlag).Changed {
-		loginRequest.DisableFirewall = &disableFirewall
-	}
-
-	if cmd.Flag(blockLANAccessFlag).Changed {
-		loginRequest.BlockLanAccess = &blockLANAccess
-	}
-
 	var loginErr error
 
 	var loginResp *proto.LoginResponse

client/configs/configs.go

@@ -1,24 +0,0 @@
-package configs
-
-import (
-	"os"
-	"path/filepath"
-	"runtime"
-)
-
-var StateDir string
-
-func init() {
-	StateDir = os.Getenv("NB_STATE_DIR")
-	if StateDir != "" {
-		return
-	}
-	switch runtime.GOOS {
-	case "windows":
-		StateDir = filepath.Join(os.Getenv("PROGRAMDATA"), "Netbird")
-	case "darwin", "linux":
-		StateDir = "/var/lib/netbird"
-	case "freebsd", "openbsd", "netbsd", "dragonfly":
-		StateDir = "/var/db/netbird"
-	}
-}

client/firewall/iptables/acl_linux.go

@@ -3,7 +3,7 @@ package iptables
 import (
 	"fmt"
 	"net"
-	"slices"
+	"strconv"
 
 	"github.com/coreos/go-iptables/iptables"
 	"github.com/google/uuid"
@@ -19,7 +19,8 @@ const (
 	tableName = "filter"
 
 	// rules chains contains the effective ACL rules
-	chainNameInputRules = "NETBIRD-ACL-INPUT"
+	chainNameInputRules  = "NETBIRD-ACL-INPUT"
+	chainNameOutputRules = "NETBIRD-ACL-OUTPUT"
 )
 
 type aclEntries map[string][][]string
@@ -83,22 +84,28 @@ func (m *aclManager) AddPeerFiltering(
 	protocol firewall.Protocol,
 	sPort *firewall.Port,
 	dPort *firewall.Port,
+	direction firewall.RuleDirection,
 	action firewall.Action,
 	ipsetName string,
 ) ([]firewall.Rule, error) {
-	chain := chainNameInputRules
+	var dPortVal, sPortVal string
+	if dPort != nil && dPort.Values != nil {
+		// TODO: we support only one port per rule in current implementation of ACLs
+		dPortVal = strconv.Itoa(dPort.Values[0])
+	}
+	if sPort != nil && sPort.Values != nil {
+		sPortVal = strconv.Itoa(sPort.Values[0])
+	}
 
-	ipsetName = transformIPsetName(ipsetName, sPort, dPort)
-	specs := filterRuleSpecs(ip, string(protocol), sPort, dPort, action, ipsetName)
+	var chain string
+	if direction == firewall.RuleDirectionOUT {
+		chain = chainNameOutputRules
+	} else {
+		chain = chainNameInputRules
+	}
 
-	mangleSpecs := slices.Clone(specs)
-	mangleSpecs = append(mangleSpecs,
-		"-i", m.wgIface.Name(),
-		"-m", "addrtype", "--dst-type", "LOCAL",
-		"-j", "MARK", "--set-xmark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected),
-	)
-
-	specs = append(specs, "-j", actionToStr(action))
+	ipsetName = transformIPsetName(ipsetName, sPortVal, dPortVal)
+	specs := filterRuleSpecs(ip, string(protocol), sPortVal, dPortVal, direction, action, ipsetName)
 	if ipsetName != "" {
 		if ipList, ipsetExists := m.ipsetStore.ipset(ipsetName); ipsetExists {
 			if err := ipset.Add(ipsetName, ip.String()); err != nil {
@@ -130,7 +137,7 @@ func (m *aclManager) AddPeerFiltering(
 		m.ipsetStore.addIpList(ipsetName, ipList)
 	}
 
-	ok, err := m.iptablesClient.Exists(tableFilter, chain, specs...)
+	ok, err := m.iptablesClient.Exists("filter", chain, specs...)
 	if err != nil {
 		return nil, fmt.Errorf("failed to check rule: %w", err)
 	}
@@ -138,22 +145,16 @@ func (m *aclManager) AddPeerFiltering(
 		return nil, fmt.Errorf("rule already exists")
 	}
 
-	if err := m.iptablesClient.Append(tableFilter, chain, specs...); err != nil {
+	if err := m.iptablesClient.Append("filter", chain, specs...); err != nil {
 		return nil, err
 	}
 
-	if err := m.iptablesClient.Append(tableMangle, chainRTPRE, mangleSpecs...); err != nil {
-		log.Errorf("failed to add mangle rule: %v", err)
-		mangleSpecs = nil
-	}
-
 	rule := &Rule{
-		ruleID:      uuid.New().String(),
-		specs:       specs,
-		mangleSpecs: mangleSpecs,
-		ipsetName:   ipsetName,
-		ip:          ip.String(),
-		chain:       chain,
+		ruleID:    uuid.New().String(),
+		specs:     specs,
+		ipsetName: ipsetName,
+		ip:        ip.String(),
+		chain:     chain,
 	}
 
 	m.updateState()
@@ -196,12 +197,6 @@ func (m *aclManager) DeletePeerRule(rule firewall.Rule) error {
 		return fmt.Errorf("failed to delete rule: %s, %v: %w", r.chain, r.specs, err)
 	}
 
-	if r.mangleSpecs != nil {
-		if err := m.iptablesClient.Delete(tableMangle, chainRTPRE, r.mangleSpecs...); err != nil {
-			log.Errorf("failed to delete mangle rule: %v", err)
-		}
-	}
-
 	m.updateState()
 
 	return nil
@@ -219,7 +214,28 @@ func (m *aclManager) Reset() error {
 
 // todo write less destructive cleanup mechanism
 func (m *aclManager) cleanChains() error {
-	ok, err := m.iptablesClient.ChainExists(tableName, chainNameInputRules)
+	ok, err := m.iptablesClient.ChainExists(tableName, chainNameOutputRules)
+	if err != nil {
+		log.Debugf("failed to list chains: %s", err)
+		return err
+	}
+	if ok {
+		rules := m.entries["OUTPUT"]
+		for _, rule := range rules {
+			err := m.iptablesClient.DeleteIfExists(tableName, "OUTPUT", rule...)
+			if err != nil {
+				log.Errorf("failed to delete rule: %v, %s", rule, err)
+			}
+		}
+
+		err = m.iptablesClient.ClearAndDeleteChain(tableName, chainNameOutputRules)
+		if err != nil {
+			log.Debugf("failed to clear and delete %s chain: %s", chainNameOutputRules, err)
+			return err
+		}
+	}
+
+	ok, err = m.iptablesClient.ChainExists(tableName, chainNameInputRules)
 	if err != nil {
 		log.Debugf("failed to list chains: %s", err)
 		return err
@@ -279,6 +295,12 @@ func (m *aclManager) createDefaultChains() error {
 		return err
 	}
 
+	// chain netbird-acl-output-rules
+	if err := m.iptablesClient.NewChain(tableName, chainNameOutputRules); err != nil {
+		log.Debugf("failed to create '%s' chain: %s", chainNameOutputRules, err)
+		return err
+	}
+
 	for chainName, rules := range m.entries {
 		for _, rule := range rules {
 			if err := m.iptablesClient.InsertUnique(tableName, chainName, 1, rule...); err != nil {
@@ -307,13 +329,21 @@ func (m *aclManager) createDefaultChains() error {
 
 // The existing FORWARD rules/policies decide outbound traffic towards our interface.
 // In case the FORWARD policy is set to "drop", we add an established/related rule to allow return traffic for the inbound rule.
+
+// The OUTPUT chain gets an extra rule to allow traffic to any set up routes, the return traffic is handled by the INPUT related/established rule.
 func (m *aclManager) seedInitialEntries() {
+
 	established := getConntrackEstablished()
 
 	m.appendToEntries("INPUT", []string{"-i", m.wgIface.Name(), "-j", "DROP"})
 	m.appendToEntries("INPUT", []string{"-i", m.wgIface.Name(), "-j", chainNameInputRules})
 	m.appendToEntries("INPUT", append([]string{"-i", m.wgIface.Name()}, established...))
 
+	m.appendToEntries("OUTPUT", []string{"-o", m.wgIface.Name(), "-j", "DROP"})
+	m.appendToEntries("OUTPUT", []string{"-o", m.wgIface.Name(), "-j", chainNameOutputRules})
+	m.appendToEntries("OUTPUT", []string{"-o", m.wgIface.Name(), "!", "-d", m.wgIface.Address().String(), "-j", "ACCEPT"})
+	m.appendToEntries("OUTPUT", append([]string{"-o", m.wgIface.Name()}, established...))
+
 	m.appendToEntries("FORWARD", []string{"-i", m.wgIface.Name(), "-j", "DROP"})
 	m.appendToEntries("FORWARD", []string{"-i", m.wgIface.Name(), "-j", m.routingFwChainName})
 	m.appendToEntries("FORWARD", append([]string{"-o", m.wgIface.Name()}, established...))
@@ -322,10 +352,17 @@ func (m *aclManager) seedInitialEntries() {
 func (m *aclManager) seedInitialOptionalEntries() {
 	m.optionalEntries["FORWARD"] = []entry{
 		{
-			spec:     []string{"-m", "mark", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected), "-j", "ACCEPT"},
+			spec:     []string{"-m", "mark", "--mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected), "-j", chainNameInputRules},
 			position: 2,
 		},
 	}
+
+	m.optionalEntries["PREROUTING"] = []entry{
+		{
+			spec:     []string{"-t", "mangle", "-i", m.wgIface.Name(), "-m", "addrtype", "--dst-type", "LOCAL", "-j", "MARK", "--set-mark", fmt.Sprintf("%#x", nbnet.PreroutingFwmarkRedirected)},
+			position: 1,
+		},
+	}
 }
 
 func (m *aclManager) appendToEntries(chainName string, spec []string) {
@@ -359,26 +396,42 @@ func (m *aclManager) updateState() {
 }
 
 // filterRuleSpecs returns the specs of a filtering rule
-func filterRuleSpecs(ip net.IP, protocol string, sPort, dPort *firewall.Port, action firewall.Action, ipsetName string) (specs []string) {
+func filterRuleSpecs(
+	ip net.IP, protocol string, sPort, dPort string, direction firewall.RuleDirection, action firewall.Action, ipsetName string,
+) (specs []string) {
 	matchByIP := true
 	// don't use IP matching if IP is ip 0.0.0.0
 	if ip.String() == "0.0.0.0" {
 		matchByIP = false
 	}
-
-	if matchByIP {
-		if ipsetName != "" {
-			specs = append(specs, "-m", "set", "--set", ipsetName, "src")
-		} else {
-			specs = append(specs, "-s", ip.String())
+	switch direction {
+	case firewall.RuleDirectionIN:
+		if matchByIP {
+			if ipsetName != "" {
+				specs = append(specs, "-m", "set", "--set", ipsetName, "src")
+			} else {
+				specs = append(specs, "-s", ip.String())
+			}
+		}
+	case firewall.RuleDirectionOUT:
+		if matchByIP {
+			if ipsetName != "" {
+				specs = append(specs, "-m", "set", "--set", ipsetName, "dst")
+			} else {
+				specs = append(specs, "-d", ip.String())
+			}
 		}
 	}
 	if protocol != "all" {
 		specs = append(specs, "-p", protocol)
 	}
-	specs = append(specs, applyPort("--sport", sPort)...)
-	specs = append(specs, applyPort("--dport", dPort)...)
-	return specs
+	if sPort != "" {
+		specs = append(specs, "--sport", sPort)
+	}
+	if dPort != "" {
+		specs = append(specs, "--dport", dPort)
+	}
+	return append(specs, "-j", actionToStr(action))
 }
 
 func actionToStr(action firewall.Action) string {
@@ -388,15 +441,15 @@ func actionToStr(action firewall.Action) string {
 	return "DROP"
 }
 
-func transformIPsetName(ipsetName string, sPort, dPort *firewall.Port) string {
+func transformIPsetName(ipsetName string, sPort, dPort string) string {
 	switch {
 	case ipsetName == "":
 		return ""
-	case sPort != nil && dPort != nil:
+	case sPort != "" && dPort != "":
 		return ipsetName + "-sport-dport"
-	case sPort != nil:
+	case sPort != "":
 		return ipsetName + "-sport"
-	case dPort != nil:
+	case dPort != "":
 		return ipsetName + "-dport"
 	default:
 		return ipsetName

client/firewall/iptables/manager_linux.go

@@ -100,14 +100,15 @@ func (m *Manager) AddPeerFiltering(
 	protocol firewall.Protocol,
 	sPort *firewall.Port,
 	dPort *firewall.Port,
+	direction firewall.RuleDirection,
 	action firewall.Action,
 	ipsetName string,
-	_ string,
+	comment string,
 ) ([]firewall.Rule, error) {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 
-	return m.aclMgr.AddPeerFiltering(ip, protocol, sPort, dPort, action, ipsetName)
+	return m.aclMgr.AddPeerFiltering(ip, protocol, sPort, dPort, direction, action, ipsetName)
 }
 
 func (m *Manager) AddRouteFiltering(
@@ -196,18 +197,29 @@ func (m *Manager) AllowNetbird() error {
 	}
 
 	_, err := m.AddPeerFiltering(
-		net.IP{0, 0, 0, 0},
+		net.ParseIP("0.0.0.0"),
 		"all",
 		nil,
 		nil,
+		firewall.RuleDirectionIN,
 		firewall.ActionAccept,
 		"",
 		"",
 	)
 	if err != nil {
-		return fmt.Errorf("allow netbird interface traffic: %w", err)
+		return fmt.Errorf("failed to allow netbird interface traffic: %w", err)
 	}
-	return nil
+	_, err = m.AddPeerFiltering(
+		net.ParseIP("0.0.0.0"),
+		"all",
+		nil,
+		nil,
+		firewall.RuleDirectionOUT,
+		firewall.ActionAccept,
+		"",
+		"",
+	)
+	return err
 }
 
 // Flush doesn't need to be implemented for this manager

client/firewall/iptables/manager_linux_test.go

@@ -68,14 +68,27 @@ func TestIptablesManager(t *testing.T) {
 		time.Sleep(time.Second)
 	}()
 
+	var rule1 []fw.Rule
+	t.Run("add first rule", func(t *testing.T) {
+		ip := net.ParseIP("10.20.0.2")
+		port := &fw.Port{Values: []int{8080}}
+		rule1, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.RuleDirectionOUT, fw.ActionAccept, "", "accept HTTP traffic")
+		require.NoError(t, err, "failed to add rule")
+
+		for _, r := range rule1 {
+			checkRuleSpecs(t, ipv4Client, chainNameOutputRules, true, r.(*Rule).specs...)
+		}
+
+	})
+
 	var rule2 []fw.Rule
 	t.Run("add second rule", func(t *testing.T) {
 		ip := net.ParseIP("10.20.0.3")
 		port := &fw.Port{
-			IsRange: true,
-			Values:  []uint16{8043, 8046},
+			Values: []int{8043: 8046},
 		}
-		rule2, err = manager.AddPeerFiltering(ip, "tcp", port, nil, fw.ActionAccept, "", "accept HTTPS traffic from ports range")
+		rule2, err = manager.AddPeerFiltering(
+			ip, "tcp", port, nil, fw.RuleDirectionIN, fw.ActionAccept, "", "accept HTTPS traffic from ports range")
 		require.NoError(t, err, "failed to add rule")
 
 		for _, r := range rule2 {
@@ -84,6 +97,15 @@ func TestIptablesManager(t *testing.T) {
 		}
 	})
 
+	t.Run("delete first rule", func(t *testing.T) {
+		for _, r := range rule1 {
+			err := manager.DeletePeerRule(r)
+			require.NoError(t, err, "failed to delete rule")
+
+			checkRuleSpecs(t, ipv4Client, chainNameOutputRules, false, r.(*Rule).specs...)
+		}
+	})
+
 	t.Run("delete second rule", func(t *testing.T) {
 		for _, r := range rule2 {
 			err := manager.DeletePeerRule(r)
@@ -96,8 +118,8 @@ func TestIptablesManager(t *testing.T) {
 	t.Run("reset check", func(t *testing.T) {
 		// add second rule
 		ip := net.ParseIP("10.20.0.3")
-		port := &fw.Port{Values: []uint16{5353}}
-		_, err = manager.AddPeerFiltering(ip, "udp", nil, port, fw.ActionAccept, "", "accept Fake DNS traffic")
+		port := &fw.Port{Values: []int{5353}}
+		_, err = manager.AddPeerFiltering(ip, "udp", nil, port, fw.RuleDirectionOUT, fw.ActionAccept, "", "accept Fake DNS traffic")
 		require.NoError(t, err, "failed to add rule")
 
 		err = manager.Reset(nil)
@@ -113,6 +135,9 @@ func TestIptablesManager(t *testing.T) {
 }
 
 func TestIptablesManagerIPSet(t *testing.T) {
+	ipv4Client, err := iptables.NewWithProtocol(iptables.ProtocolIPv4)
+	require.NoError(t, err)
+
 	mock := &iFaceMock{
 		NameFunc: func() string {
 			return "lo"
@@ -142,13 +167,33 @@ func TestIptablesManagerIPSet(t *testing.T) {
 		time.Sleep(time.Second)
 	}()
 
+	var rule1 []fw.Rule
+	t.Run("add first rule with set", func(t *testing.T) {
+		ip := net.ParseIP("10.20.0.2")
+		port := &fw.Port{Values: []int{8080}}
+		rule1, err = manager.AddPeerFiltering(
+			ip, "tcp", nil, port, fw.RuleDirectionOUT,
+			fw.ActionAccept, "default", "accept HTTP traffic",
+		)
+		require.NoError(t, err, "failed to add rule")
+
+		for _, r := range rule1 {
+			checkRuleSpecs(t, ipv4Client, chainNameOutputRules, true, r.(*Rule).specs...)
+			require.Equal(t, r.(*Rule).ipsetName, "default-dport", "ipset name must be set")
+			require.Equal(t, r.(*Rule).ip, "10.20.0.2", "ipset IP must be set")
+		}
+	})
+
 	var rule2 []fw.Rule
 	t.Run("add second rule", func(t *testing.T) {
 		ip := net.ParseIP("10.20.0.3")
 		port := &fw.Port{
-			Values: []uint16{443},
+			Values: []int{443},
 		}
-		rule2, err = manager.AddPeerFiltering(ip, "tcp", port, nil, fw.ActionAccept, "default", "accept HTTPS traffic from ports range")
+		rule2, err = manager.AddPeerFiltering(
+			ip, "tcp", port, nil, fw.RuleDirectionIN, fw.ActionAccept,
+			"default", "accept HTTPS traffic from ports range",
+		)
 		for _, r := range rule2 {
 			require.NoError(t, err, "failed to add rule")
 			require.Equal(t, r.(*Rule).ipsetName, "default-sport", "ipset name must be set")
@@ -156,6 +201,15 @@ func TestIptablesManagerIPSet(t *testing.T) {
 		}
 	})
 
+	t.Run("delete first rule", func(t *testing.T) {
+		for _, r := range rule1 {
+			err := manager.DeletePeerRule(r)
+			require.NoError(t, err, "failed to delete rule")
+
+			require.NotContains(t, manager.aclMgr.ipsetStore.ipsets, r.(*Rule).ruleID, "rule must be removed form the ruleset index")
+		}
+	})
+
 	t.Run("delete second rule", func(t *testing.T) {
 		for _, r := range rule2 {
 			err := manager.DeletePeerRule(r)
@@ -215,8 +269,12 @@ func TestIptablesCreatePerformance(t *testing.T) {
 			ip := net.ParseIP("10.20.0.100")
 			start := time.Now()
 			for i := 0; i < testMax; i++ {
-				port := &fw.Port{Values: []uint16{uint16(1000 + i)}}
-				_, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.ActionAccept, "", "accept HTTP traffic")
+				port := &fw.Port{Values: []int{1000 + i}}
+				if i%2 == 0 {
+					_, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.RuleDirectionOUT, fw.ActionAccept, "", "accept HTTP traffic")
+				} else {
+					_, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.RuleDirectionIN, fw.ActionAccept, "", "accept HTTP traffic")
+				}
 
 				require.NoError(t, err, "failed to add rule")
 			}

client/firewall/iptables/router_linux.go

@@ -590,10 +590,10 @@ func applyPort(flag string, port *firewall.Port) []string {
 	if len(port.Values) > 1 {
 		portList := make([]string, len(port.Values))
 		for i, p := range port.Values {
-			portList[i] = strconv.Itoa(int(p))
+			portList[i] = strconv.Itoa(p)
 		}
 		return []string{"-m", "multiport", flag, strings.Join(portList, ",")}
 	}
 
-	return []string{flag, strconv.Itoa(int(port.Values[0]))}
+	return []string{flag, strconv.Itoa(port.Values[0])}
 }

client/firewall/iptables/router_linux_test.go

@@ -239,7 +239,7 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			destination: netip.MustParsePrefix("10.0.0.0/24"),
 			proto:       firewall.ProtocolTCP,
 			sPort:       nil,
-			dPort:       &firewall.Port{Values: []uint16{80}},
+			dPort:       &firewall.Port{Values: []int{80}},
 			direction:   firewall.RuleDirectionIN,
 			action:      firewall.ActionAccept,
 			expectSet:   false,
@@ -252,7 +252,7 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			},
 			destination: netip.MustParsePrefix("10.0.0.0/8"),
 			proto:       firewall.ProtocolUDP,
-			sPort:       &firewall.Port{Values: []uint16{1024, 2048}, IsRange: true},
+			sPort:       &firewall.Port{Values: []int{1024, 2048}, IsRange: true},
 			dPort:       nil,
 			direction:   firewall.RuleDirectionOUT,
 			action:      firewall.ActionDrop,
@@ -285,7 +285,7 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			sources:     []netip.Prefix{netip.MustParsePrefix("172.16.0.0/12")},
 			destination: netip.MustParsePrefix("192.168.0.0/16"),
 			proto:       firewall.ProtocolTCP,
-			sPort:       &firewall.Port{Values: []uint16{80, 443, 8080}},
+			sPort:       &firewall.Port{Values: []int{80, 443, 8080}},
 			dPort:       nil,
 			direction:   firewall.RuleDirectionOUT,
 			action:      firewall.ActionAccept,
@@ -297,7 +297,7 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			destination: netip.MustParsePrefix("10.0.0.0/24"),
 			proto:       firewall.ProtocolUDP,
 			sPort:       nil,
-			dPort:       &firewall.Port{Values: []uint16{5000, 5100}, IsRange: true},
+			dPort:       &firewall.Port{Values: []int{5000, 5100}, IsRange: true},
 			direction:   firewall.RuleDirectionIN,
 			action:      firewall.ActionDrop,
 			expectSet:   false,
@@ -307,8 +307,8 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			sources:     []netip.Prefix{netip.MustParsePrefix("10.0.0.0/24")},
 			destination: netip.MustParsePrefix("172.16.0.0/16"),
 			proto:       firewall.ProtocolTCP,
-			sPort:       &firewall.Port{Values: []uint16{1024, 65535}, IsRange: true},
-			dPort:       &firewall.Port{Values: []uint16{22}},
+			sPort:       &firewall.Port{Values: []int{1024, 65535}, IsRange: true},
+			dPort:       &firewall.Port{Values: []int{22}},
 			direction:   firewall.RuleDirectionOUT,
 			action:      firewall.ActionAccept,
 			expectSet:   false,

client/firewall/iptables/rule.go

@@ -5,10 +5,9 @@ type Rule struct {
 	ruleID    string
 	ipsetName string
 
-	specs       []string
-	mangleSpecs []string
-	ip          string
-	chain       string
+	specs []string
+	ip    string
+	chain string
 }
 
 // GetRuleID returns the rule id

client/firewall/manager/firewall.go

@@ -69,6 +69,7 @@ type Manager interface {
 		proto Protocol,
 		sPort *Port,
 		dPort *Port,
+		direction RuleDirection,
 		action Action,
 		ipsetName string,
 		comment string,

client/firewall/manager/port.go

@@ -30,7 +30,7 @@ type Port struct {
 	IsRange bool
 
 	// Values contains one value for single port, multiple values for the list of ports, or two values for the range of ports
-	Values []uint16
+	Values []int
 }
 
 // String interface implementation
@@ -40,11 +40,7 @@ func (p *Port) String() string {
 		if ports != "" {
 			ports += ","
 		}
-		ports += strconv.Itoa(int(port))
+		ports += strconv.Itoa(port)
 	}
-	if p.IsRange {
-		ports = "range:" + ports
-	}
-
 	return ports
 }

client/firewall/nftables/acl_linux.go

@@ -2,9 +2,10 @@ package nftables
 
 import (
 	"bytes"
+	"encoding/binary"
 	"fmt"
 	"net"
-	"slices"
+	"net/netip"
 	"strconv"
 	"strings"
 	"time"
@@ -22,10 +23,12 @@ import (
 const (
 
 	// rules chains contains the effective ACL rules
-	chainNameInputRules = "netbird-acl-input-rules"
+	chainNameInputRules  = "netbird-acl-input-rules"
+	chainNameOutputRules = "netbird-acl-output-rules"
 
 	// filter chains contains the rules that jump to the rules chains
 	chainNameInputFilter   = "netbird-acl-input-filter"
+	chainNameOutputFilter  = "netbird-acl-output-filter"
 	chainNameForwardFilter = "netbird-acl-forward-filter"
 	chainNamePrerouting    = "netbird-rt-prerouting"
 
@@ -44,9 +47,9 @@ type AclManager struct {
 	wgIface            iFaceMapper
 	routingFwChainName string
 
-	workTable       *nftables.Table
-	chainInputRules *nftables.Chain
-	chainPrerouting *nftables.Chain
+	workTable        *nftables.Table
+	chainInputRules  *nftables.Chain
+	chainOutputRules *nftables.Chain
 
 	ipsetStore *ipsetStore
 	rules      map[string]*Rule
@@ -88,6 +91,7 @@ func (m *AclManager) AddPeerFiltering(
 	proto firewall.Protocol,
 	sPort *firewall.Port,
 	dPort *firewall.Port,
+	direction firewall.RuleDirection,
 	action firewall.Action,
 	ipsetName string,
 	comment string,
@@ -102,7 +106,7 @@ func (m *AclManager) AddPeerFiltering(
 	}
 
 	newRules := make([]firewall.Rule, 0, 2)
-	ioRule, err := m.addIOFiltering(ip, proto, sPort, dPort, action, ipset, comment)
+	ioRule, err := m.addIOFiltering(ip, proto, sPort, dPort, direction, action, ipset, comment)
 	if err != nil {
 		return nil, err
 	}
@@ -119,32 +123,23 @@ func (m *AclManager) DeletePeerRule(rule firewall.Rule) error {
 	}
 
 	if r.nftSet == nil {
-		if err := m.rConn.DelRule(r.nftRule); err != nil {
+		err := m.rConn.DelRule(r.nftRule)
+		if err != nil {
 			log.Errorf("failed to delete rule: %v", err)
 		}
-		if r.mangleRule != nil {
-			if err := m.rConn.DelRule(r.mangleRule); err != nil {
-				log.Errorf("failed to delete mangle rule: %v", err)
-			}
-		}
 		delete(m.rules, r.GetRuleID())
 		return m.rConn.Flush()
 	}
 
 	ips, ok := m.ipsetStore.ips(r.nftSet.Name)
 	if !ok {
-		if err := m.rConn.DelRule(r.nftRule); err != nil {
+		err := m.rConn.DelRule(r.nftRule)
+		if err != nil {
 			log.Errorf("failed to delete rule: %v", err)
 		}
-		if r.mangleRule != nil {
-			if err := m.rConn.DelRule(r.mangleRule); err != nil {
-				log.Errorf("failed to delete mangle rule: %v", err)
-			}
-		}
 		delete(m.rules, r.GetRuleID())
 		return m.rConn.Flush()
 	}
-
 	if _, ok := ips[r.ip.String()]; ok {
 		err := m.sConn.SetDeleteElements(r.nftSet, []nftables.SetElement{{Key: r.ip.To4()}})
 		if err != nil {
@@ -163,16 +158,12 @@ func (m *AclManager) DeletePeerRule(rule firewall.Rule) error {
 		return nil
 	}
 
-	if err := m.rConn.DelRule(r.nftRule); err != nil {
+	err := m.rConn.DelRule(r.nftRule)
+	if err != nil {
 		log.Errorf("failed to delete rule: %v", err)
 	}
-	if r.mangleRule != nil {
-		if err := m.rConn.DelRule(r.mangleRule); err != nil {
-			log.Errorf("failed to delete mangle rule: %v", err)
-		}
-	}
-
-	if err := m.rConn.Flush(); err != nil {
+	err = m.rConn.Flush()
+	if err != nil {
 		return err
 	}
 
@@ -225,6 +216,38 @@ func (m *AclManager) createDefaultAllowRules() error {
 		Exprs:    expIn,
 	})
 
+	expOut := []expr.Any{
+		&expr.Payload{
+			DestRegister: 1,
+			Base:         expr.PayloadBaseNetworkHeader,
+			Offset:       16,
+			Len:          4,
+		},
+		// mask
+		&expr.Bitwise{
+			SourceRegister: 1,
+			DestRegister:   1,
+			Len:            4,
+			Mask:           []byte{0, 0, 0, 0},
+			Xor:            []byte{0, 0, 0, 0},
+		},
+		// net address
+		&expr.Cmp{
+			Register: 1,
+			Data:     []byte{0, 0, 0, 0},
+		},
+		&expr.Verdict{
+			Kind: expr.VerdictAccept,
+		},
+	}
+
+	_ = m.rConn.InsertRule(&nftables.Rule{
+		Table:    m.workTable,
+		Chain:    m.chainOutputRules,
+		Position: 0,
+		Exprs:    expOut,
+	})
+
 	if err := m.rConn.Flush(); err != nil {
 		return fmt.Errorf(flushError, err)
 	}
@@ -239,33 +262,25 @@ func (m *AclManager) Flush() error {
 		return err
 	}
 
-	if err := m.refreshRuleHandles(m.chainInputRules, false); err != nil {
+	if err := m.refreshRuleHandles(m.chainInputRules); err != nil {
 		log.Errorf("failed to refresh rule handles ipv4 input chain: %v", err)
 	}
-	if err := m.refreshRuleHandles(m.chainPrerouting, true); err != nil {
-		log.Errorf("failed to refresh rule handles prerouting chain: %v", err)
+
+	if err := m.refreshRuleHandles(m.chainOutputRules); err != nil {
+		log.Errorf("failed to refresh rule handles IPv4 output chain: %v", err)
 	}
 
 	return nil
 }
 
-func (m *AclManager) addIOFiltering(
-	ip net.IP,
-	proto firewall.Protocol,
-	sPort *firewall.Port,
-	dPort *firewall.Port,
-	action firewall.Action,
-	ipset *nftables.Set,
-	comment string,
-) (*Rule, error) {
-	ruleId := generatePeerRuleId(ip, sPort, dPort, action, ipset)
+func (m *AclManager) addIOFiltering(ip net.IP, proto firewall.Protocol, sPort *firewall.Port, dPort *firewall.Port, direction firewall.RuleDirection, action firewall.Action, ipset *nftables.Set, comment string) (*Rule, error) {
+	ruleId := generatePeerRuleId(ip, sPort, dPort, direction, action, ipset)
 	if r, ok := m.rules[ruleId]; ok {
 		return &Rule{
-			nftRule:    r.nftRule,
-			mangleRule: r.mangleRule,
-			nftSet:     r.nftSet,
-			ruleID:     r.ruleID,
-			ip:         ip,
+			r.nftRule,
+			r.nftSet,
+			r.ruleID,
+			ip,
 		}, nil
 	}
 
@@ -297,6 +312,9 @@ func (m *AclManager) addIOFiltering(
 	if !bytes.HasPrefix(anyIP, rawIP) {
 		// source address position
 		addrOffset := uint32(12)
+		if direction == firewall.RuleDirectionOUT {
+			addrOffset += 4 // is ipv4 address length
+		}
 
 		expressions = append(expressions,
 			&expr.Payload{
@@ -326,34 +344,65 @@ func (m *AclManager) addIOFiltering(
 		}
 	}
 
-	expressions = append(expressions, applyPort(sPort, true)...)
-	expressions = append(expressions, applyPort(dPort, false)...)
+	if sPort != nil && len(sPort.Values) != 0 {
+		expressions = append(expressions,
+			&expr.Payload{
+				DestRegister: 1,
+				Base:         expr.PayloadBaseTransportHeader,
+				Offset:       0,
+				Len:          2,
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     encodePort(*sPort),
+			},
+		)
+	}
 
-	mainExpressions := slices.Clone(expressions)
+	if dPort != nil && len(dPort.Values) != 0 {
+		expressions = append(expressions,
+			&expr.Payload{
+				DestRegister: 1,
+				Base:         expr.PayloadBaseTransportHeader,
+				Offset:       2,
+				Len:          2,
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     encodePort(*dPort),
+			},
+		)
+	}
 
 	switch action {
 	case firewall.ActionAccept:
-		mainExpressions = append(mainExpressions, &expr.Verdict{Kind: expr.VerdictAccept})
+		expressions = append(expressions, &expr.Verdict{Kind: expr.VerdictAccept})
 	case firewall.ActionDrop:
-		mainExpressions = append(mainExpressions, &expr.Verdict{Kind: expr.VerdictDrop})
+		expressions = append(expressions, &expr.Verdict{Kind: expr.VerdictDrop})
 	}
 
 	userData := []byte(strings.Join([]string{ruleId, comment}, " "))
 
-	chain := m.chainInputRules
+	var chain *nftables.Chain
+	if direction == firewall.RuleDirectionIN {
+		chain = m.chainInputRules
+	} else {
+		chain = m.chainOutputRules
+	}
 	nftRule := m.rConn.AddRule(&nftables.Rule{
 		Table:    m.workTable,
 		Chain:    chain,
-		Exprs:    mainExpressions,
+		Exprs:    expressions,
 		UserData: userData,
 	})
 
 	rule := &Rule{
-		nftRule:    nftRule,
-		mangleRule: m.createPreroutingRule(expressions, userData),
-		nftSet:     ipset,
-		ruleID:     ruleId,
-		ip:         ip,
+		nftRule: nftRule,
+		nftSet:  ipset,
+		ruleID:  ruleId,
+		ip:      ip,
 	}
 	m.rules[ruleId] = rule
 	if ipset != nil {
@@ -362,59 +411,6 @@ func (m *AclManager) addIOFiltering(
 	return rule, nil
 }
 
-func (m *AclManager) createPreroutingRule(expressions []expr.Any, userData []byte) *nftables.Rule {
-	if m.chainPrerouting == nil {
-		log.Warn("prerouting chain is not created")
-		return nil
-	}
-
-	preroutingExprs := slices.Clone(expressions)
-
-	// interface
-	preroutingExprs = append([]expr.Any{
-		&expr.Meta{
-			Key:      expr.MetaKeyIIFNAME,
-			Register: 1,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     ifname(m.wgIface.Name()),
-		},
-	}, preroutingExprs...)
-
-	// local destination and mark
-	preroutingExprs = append(preroutingExprs,
-		&expr.Fib{
-			Register:       1,
-			ResultADDRTYPE: true,
-			FlagDADDR:      true,
-		},
-		&expr.Cmp{
-			Op:       expr.CmpOpEq,
-			Register: 1,
-			Data:     binaryutil.NativeEndian.PutUint32(unix.RTN_LOCAL),
-		},
-
-		&expr.Immediate{
-			Register: 1,
-			Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkRedirected),
-		},
-		&expr.Meta{
-			Key:            expr.MetaKeyMARK,
-			Register:       1,
-			SourceRegister: true,
-		},
-	)
-
-	return m.rConn.AddRule(&nftables.Rule{
-		Table:    m.workTable,
-		Chain:    m.chainPrerouting,
-		Exprs:    preroutingExprs,
-		UserData: userData,
-	})
-}
-
 func (m *AclManager) createDefaultChains() (err error) {
 	// chainNameInputRules
 	chain := m.createChain(chainNameInputRules)
@@ -425,6 +421,15 @@ func (m *AclManager) createDefaultChains() (err error) {
 	}
 	m.chainInputRules = chain
 
+	// chainNameOutputRules
+	chain = m.createChain(chainNameOutputRules)
+	err = m.rConn.Flush()
+	if err != nil {
+		log.Debugf("failed to create chain (%s): %s", chainNameOutputRules, err)
+		return err
+	}
+	m.chainOutputRules = chain
+
 	// netbird-acl-input-filter
 	// type filter hook input priority filter; policy accept;
 	chain = m.createFilterChainWithHook(chainNameInputFilter, nftables.ChainHookInput)
@@ -436,6 +441,18 @@ func (m *AclManager) createDefaultChains() (err error) {
 		return err
 	}
 
+	// netbird-acl-output-filter
+	// type filter hook output priority filter; policy accept;
+	chain = m.createFilterChainWithHook(chainNameOutputFilter, nftables.ChainHookOutput)
+	m.addFwdAllow(chain, expr.MetaKeyOIFNAME)
+	m.addJumpRule(chain, m.chainOutputRules.Name, expr.MetaKeyOIFNAME) // to netbird-acl-output-rules
+	m.addDropExpressions(chain, expr.MetaKeyOIFNAME)
+	err = m.rConn.Flush()
+	if err != nil {
+		log.Debugf("failed to create chain (%s): %s", chainNameOutputFilter, err)
+		return err
+	}
+
 	// netbird-acl-forward-filter
 	chainFwFilter := m.createFilterChainWithHook(chainNameForwardFilter, nftables.ChainHookForward)
 	m.addJumpRulesToRtForward(chainFwFilter) // to netbird-rt-fwd
@@ -458,7 +475,7 @@ func (m *AclManager) createDefaultChains() (err error) {
 // go through the input filter as well. This will enable e.g. Docker services to keep working by accessing the
 // netbird peer IP.
 func (m *AclManager) allowRedirectedTraffic(chainFwFilter *nftables.Chain) error {
-	m.chainPrerouting = m.rConn.AddChain(&nftables.Chain{
+	preroutingChain := m.rConn.AddChain(&nftables.Chain{
 		Name:     chainNamePrerouting,
 		Table:    m.workTable,
 		Type:     nftables.ChainTypeFilter,
@@ -466,6 +483,8 @@ func (m *AclManager) allowRedirectedTraffic(chainFwFilter *nftables.Chain) error
 		Priority: nftables.ChainPriorityMangle,
 	})
 
+	m.addPreroutingRule(preroutingChain)
+
 	m.addFwmarkToForward(chainFwFilter)
 
 	if err := m.rConn.Flush(); err != nil {
@@ -475,6 +494,43 @@ func (m *AclManager) allowRedirectedTraffic(chainFwFilter *nftables.Chain) error
 	return nil
 }
 
+func (m *AclManager) addPreroutingRule(preroutingChain *nftables.Chain) {
+	m.rConn.AddRule(&nftables.Rule{
+		Table: m.workTable,
+		Chain: preroutingChain,
+		Exprs: []expr.Any{
+			&expr.Meta{
+				Key:      expr.MetaKeyIIFNAME,
+				Register: 1,
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     ifname(m.wgIface.Name()),
+			},
+			&expr.Fib{
+				Register:       1,
+				ResultADDRTYPE: true,
+				FlagDADDR:      true,
+			},
+			&expr.Cmp{
+				Op:       expr.CmpOpEq,
+				Register: 1,
+				Data:     binaryutil.NativeEndian.PutUint32(unix.RTN_LOCAL),
+			},
+			&expr.Immediate{
+				Register: 1,
+				Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkRedirected),
+			},
+			&expr.Meta{
+				Key:            expr.MetaKeyMARK,
+				Register:       1,
+				SourceRegister: true,
+			},
+		},
+	})
+}
+
 func (m *AclManager) addFwmarkToForward(chainFwFilter *nftables.Chain) {
 	m.rConn.InsertRule(&nftables.Rule{
 		Table: m.workTable,
@@ -490,7 +546,8 @@ func (m *AclManager) addFwmarkToForward(chainFwFilter *nftables.Chain) {
 				Data:     binaryutil.NativeEndian.PutUint32(nbnet.PreroutingFwmarkRedirected),
 			},
 			&expr.Verdict{
-				Kind: expr.VerdictAccept,
+				Kind:  expr.VerdictJump,
+				Chain: m.chainInputRules.Name,
 			},
 		},
 	})
@@ -562,6 +619,45 @@ func (m *AclManager) addDropExpressions(chain *nftables.Chain, ifaceKey expr.Met
 	return nil
 }
 
+func (m *AclManager) addFwdAllow(chain *nftables.Chain, iifname expr.MetaKey) {
+	ip, _ := netip.AddrFromSlice(m.wgIface.Address().Network.IP.To4())
+	dstOp := expr.CmpOpNeq
+	expressions := []expr.Any{
+		&expr.Meta{Key: iifname, Register: 1},
+		&expr.Cmp{
+			Op:       expr.CmpOpEq,
+			Register: 1,
+			Data:     ifname(m.wgIface.Name()),
+		},
+		&expr.Payload{
+			DestRegister: 2,
+			Base:         expr.PayloadBaseNetworkHeader,
+			Offset:       16,
+			Len:          4,
+		},
+		&expr.Bitwise{
+			SourceRegister: 2,
+			DestRegister:   2,
+			Len:            4,
+			Xor:            []byte{0x0, 0x0, 0x0, 0x0},
+			Mask:           m.wgIface.Address().Network.Mask,
+		},
+		&expr.Cmp{
+			Op:       dstOp,
+			Register: 2,
+			Data:     ip.Unmap().AsSlice(),
+		},
+		&expr.Verdict{
+			Kind: expr.VerdictAccept,
+		},
+	}
+	_ = m.rConn.AddRule(&nftables.Rule{
+		Table: chain.Table,
+		Chain: chain,
+		Exprs: expressions,
+	})
+}
+
 func (m *AclManager) addJumpRule(chain *nftables.Chain, to string, ifaceKey expr.MetaKey) {
 	expressions := []expr.Any{
 		&expr.Meta{Key: ifaceKey, Register: 1},
@@ -637,7 +733,6 @@ func (m *AclManager) flushWithBackoff() (err error) {
 	for i := 0; ; i++ {
 		err = m.rConn.Flush()
 		if err != nil {
-			log.Debugf("failed to flush nftables: %v", err)
 			if !strings.Contains(err.Error(), "busy") {
 				return
 			}
@@ -654,7 +749,7 @@ func (m *AclManager) flushWithBackoff() (err error) {
 	return
 }
 
-func (m *AclManager) refreshRuleHandles(chain *nftables.Chain, mangle bool) error {
+func (m *AclManager) refreshRuleHandles(chain *nftables.Chain) error {
 	if m.workTable == nil || chain == nil {
 		return nil
 	}
@@ -671,19 +766,22 @@ func (m *AclManager) refreshRuleHandles(chain *nftables.Chain, mangle bool) erro
 		split := bytes.Split(rule.UserData, []byte(" "))
 		r, ok := m.rules[string(split[0])]
 		if ok {
-			if mangle {
-				*r.mangleRule = *rule
-			} else {
-				*r.nftRule = *rule
-			}
+			*r.nftRule = *rule
 		}
 	}
 
 	return nil
 }
 
-func generatePeerRuleId(ip net.IP, sPort *firewall.Port, dPort *firewall.Port, action firewall.Action, ipset *nftables.Set) string {
-	rulesetID := ":"
+func generatePeerRuleId(
+	ip net.IP,
+	sPort *firewall.Port,
+	dPort *firewall.Port,
+	direction firewall.RuleDirection,
+	action firewall.Action,
+	ipset *nftables.Set,
+) string {
+	rulesetID := ":" + strconv.Itoa(int(direction)) + ":"
 	if sPort != nil {
 		rulesetID += sPort.String()
 	}
@@ -699,6 +797,12 @@ func generatePeerRuleId(ip net.IP, sPort *firewall.Port, dPort *firewall.Port, a
 	return "set:" + ipset.Name + rulesetID
 }
 
+func encodePort(port firewall.Port) []byte {
+	bs := make([]byte, 2)
+	binary.BigEndian.PutUint16(bs, uint16(port.Values[0]))
+	return bs
+}
+
 func ifname(n string) []byte {
 	b := make([]byte, 16)
 	copy(b, n+"\x00")

client/firewall/nftables/manager_linux.go

@@ -117,6 +117,7 @@ func (m *Manager) AddPeerFiltering(
 	proto firewall.Protocol,
 	sPort *firewall.Port,
 	dPort *firewall.Port,
+	direction firewall.RuleDirection,
 	action firewall.Action,
 	ipsetName string,
 	comment string,
@@ -129,17 +130,10 @@ func (m *Manager) AddPeerFiltering(
 		return nil, fmt.Errorf("unsupported IP version: %s", ip.String())
 	}
 
-	return m.aclManager.AddPeerFiltering(ip, proto, sPort, dPort, action, ipsetName, comment)
+	return m.aclManager.AddPeerFiltering(ip, proto, sPort, dPort, direction, action, ipsetName, comment)
 }
 
-func (m *Manager) AddRouteFiltering(
-	sources []netip.Prefix,
-	destination netip.Prefix,
-	proto firewall.Protocol,
-	sPort *firewall.Port,
-	dPort *firewall.Port,
-	action firewall.Action,
-) (firewall.Rule, error) {
+func (m *Manager) AddRouteFiltering(sources []netip.Prefix, destination netip.Prefix, proto firewall.Protocol, sPort *firewall.Port, dPort *firewall.Port, action firewall.Action) (firewall.Rule, error) {
 	m.mutex.Lock()
 	defer m.mutex.Unlock()
 

client/firewall/nftables/manager_linux_test.go

@@ -74,7 +74,16 @@ func TestNftablesManager(t *testing.T) {
 
 	testClient := &nftables.Conn{}
 
-	rule, err := manager.AddPeerFiltering(ip, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{53}}, fw.ActionDrop, "", "")
+	rule, err := manager.AddPeerFiltering(
+		ip,
+		fw.ProtocolTCP,
+		nil,
+		&fw.Port{Values: []int{53}},
+		fw.RuleDirectionIN,
+		fw.ActionDrop,
+		"",
+		"",
+	)
 	require.NoError(t, err, "failed to add rule")
 
 	err = manager.Flush()
@@ -200,8 +209,12 @@ func TestNFtablesCreatePerformance(t *testing.T) {
 			ip := net.ParseIP("10.20.0.100")
 			start := time.Now()
 			for i := 0; i < testMax; i++ {
-				port := &fw.Port{Values: []uint16{uint16(1000 + i)}}
-				_, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.ActionAccept, "", "accept HTTP traffic")
+				port := &fw.Port{Values: []int{1000 + i}}
+				if i%2 == 0 {
+					_, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.RuleDirectionOUT, fw.ActionAccept, "", "accept HTTP traffic")
+				} else {
+					_, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.RuleDirectionIN, fw.ActionAccept, "", "accept HTTP traffic")
+				}
 				require.NoError(t, err, "failed to add rule")
 
 				if i%100 == 0 {
@@ -283,7 +296,16 @@ func TestNftablesManagerCompatibilityWithIptables(t *testing.T) {
 	})
 
 	ip := net.ParseIP("100.96.0.1")
-	_, err = manager.AddPeerFiltering(ip, fw.ProtocolTCP, nil, &fw.Port{Values: []uint16{80}}, fw.ActionAccept, "", "test rule")
+	_, err = manager.AddPeerFiltering(
+		ip,
+		fw.ProtocolTCP,
+		nil,
+		&fw.Port{Values: []int{80}},
+		fw.RuleDirectionIN,
+		fw.ActionAccept,
+		"",
+		"test rule",
+	)
 	require.NoError(t, err, "failed to add peer filtering rule")
 
 	_, err = manager.AddRouteFiltering(
@@ -291,7 +313,7 @@ func TestNftablesManagerCompatibilityWithIptables(t *testing.T) {
 		netip.MustParsePrefix("10.1.0.0/24"),
 		fw.ProtocolTCP,
 		nil,
-		&fw.Port{Values: []uint16{443}},
+		&fw.Port{Values: []int{443}},
 		fw.ActionAccept,
 	)
 	require.NoError(t, err, "failed to add route filtering rule")

client/firewall/nftables/router_linux.go

@@ -956,12 +956,12 @@ func applyPort(port *firewall.Port, isSource bool) []expr.Any {
 			&expr.Cmp{
 				Op:       expr.CmpOpGte,
 				Register: 1,
-				Data:     binaryutil.BigEndian.PutUint16(port.Values[0]),
+				Data:     binaryutil.BigEndian.PutUint16(uint16(port.Values[0])),
 			},
 			&expr.Cmp{
 				Op:       expr.CmpOpLte,
 				Register: 1,
-				Data:     binaryutil.BigEndian.PutUint16(port.Values[1]),
+				Data:     binaryutil.BigEndian.PutUint16(uint16(port.Values[1])),
 			},
 		)
 	} else {
@@ -980,7 +980,7 @@ func applyPort(port *firewall.Port, isSource bool) []expr.Any {
 			exprs = append(exprs, &expr.Cmp{
 				Op:       expr.CmpOpEq,
 				Register: 1,
-				Data:     binaryutil.BigEndian.PutUint16(p),
+				Data:     binaryutil.BigEndian.PutUint16(uint16(p)),
 			})
 		}
 	}

client/firewall/nftables/router_linux_test.go

@@ -222,7 +222,7 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			destination: netip.MustParsePrefix("10.0.0.0/24"),
 			proto:       firewall.ProtocolTCP,
 			sPort:       nil,
-			dPort:       &firewall.Port{Values: []uint16{80}},
+			dPort:       &firewall.Port{Values: []int{80}},
 			direction:   firewall.RuleDirectionIN,
 			action:      firewall.ActionAccept,
 			expectSet:   false,
@@ -235,7 +235,7 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			},
 			destination: netip.MustParsePrefix("10.0.0.0/8"),
 			proto:       firewall.ProtocolUDP,
-			sPort:       &firewall.Port{Values: []uint16{1024, 2048}, IsRange: true},
+			sPort:       &firewall.Port{Values: []int{1024, 2048}, IsRange: true},
 			dPort:       nil,
 			direction:   firewall.RuleDirectionOUT,
 			action:      firewall.ActionDrop,
@@ -268,7 +268,7 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			sources:     []netip.Prefix{netip.MustParsePrefix("172.16.0.0/12")},
 			destination: netip.MustParsePrefix("192.168.0.0/16"),
 			proto:       firewall.ProtocolTCP,
-			sPort:       &firewall.Port{Values: []uint16{80, 443, 8080}},
+			sPort:       &firewall.Port{Values: []int{80, 443, 8080}},
 			dPort:       nil,
 			direction:   firewall.RuleDirectionOUT,
 			action:      firewall.ActionAccept,
@@ -280,7 +280,7 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			destination: netip.MustParsePrefix("10.0.0.0/24"),
 			proto:       firewall.ProtocolUDP,
 			sPort:       nil,
-			dPort:       &firewall.Port{Values: []uint16{5000, 5100}, IsRange: true},
+			dPort:       &firewall.Port{Values: []int{5000, 5100}, IsRange: true},
 			direction:   firewall.RuleDirectionIN,
 			action:      firewall.ActionDrop,
 			expectSet:   false,
@@ -290,8 +290,8 @@ func TestRouter_AddRouteFiltering(t *testing.T) {
 			sources:     []netip.Prefix{netip.MustParsePrefix("10.0.0.0/24")},
 			destination: netip.MustParsePrefix("172.16.0.0/16"),
 			proto:       firewall.ProtocolTCP,
-			sPort:       &firewall.Port{Values: []uint16{1024, 65535}, IsRange: true},
-			dPort:       &firewall.Port{Values: []uint16{22}},
+			sPort:       &firewall.Port{Values: []int{1024, 65535}, IsRange: true},
+			dPort:       &firewall.Port{Values: []int{22}},
 			direction:   firewall.RuleDirectionOUT,
 			action:      firewall.ActionAccept,
 			expectSet:   false,

client/firewall/nftables/rule_linux.go

@@ -8,11 +8,10 @@ import (
 
 // Rule to handle management of rules
 type Rule struct {
-	nftRule    *nftables.Rule
-	mangleRule *nftables.Rule
-	nftSet     *nftables.Set
-	ruleID     string
-	ip         net.IP
+	nftRule *nftables.Rule
+	nftSet  *nftables.Set
+	ruleID  string
+	ip      net.IP
 }
 
 // GetRuleID returns the rule id

client/firewall/uspfilter/allow_netbird.go

@@ -2,10 +2,7 @@
 
 package uspfilter
 
-import (
-	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
-	"github.com/netbirdio/netbird/client/internal/statemanager"
-)
+import "github.com/netbirdio/netbird/client/internal/statemanager"
 
 // Reset firewall to the default state
 func (m *Manager) Reset(stateManager *statemanager.Manager) error {
@@ -15,21 +12,6 @@ func (m *Manager) Reset(stateManager *statemanager.Manager) error {
 	m.outgoingRules = make(map[string]RuleSet)
 	m.incomingRules = make(map[string]RuleSet)
 
-	if m.udpTracker != nil {
-		m.udpTracker.Close()
-		m.udpTracker = conntrack.NewUDPTracker(conntrack.DefaultUDPTimeout)
-	}
-
-	if m.icmpTracker != nil {
-		m.icmpTracker.Close()
-		m.icmpTracker = conntrack.NewICMPTracker(conntrack.DefaultICMPTimeout)
-	}
-
-	if m.tcpTracker != nil {
-		m.tcpTracker.Close()
-		m.tcpTracker = conntrack.NewTCPTracker(conntrack.DefaultTCPTimeout)
-	}
-
 	if m.nativeFirewall != nil {
 		return m.nativeFirewall.Reset(stateManager)
 	}

client/firewall/uspfilter/allow_netbird_windows.go

@@ -7,7 +7,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
 
@@ -27,21 +26,6 @@ func (m *Manager) Reset(*statemanager.Manager) error {
 	m.outgoingRules = make(map[string]RuleSet)
 	m.incomingRules = make(map[string]RuleSet)
 
-	if m.udpTracker != nil {
-		m.udpTracker.Close()
-		m.udpTracker = conntrack.NewUDPTracker(conntrack.DefaultUDPTimeout)
-	}
-
-	if m.icmpTracker != nil {
-		m.icmpTracker.Close()
-		m.icmpTracker = conntrack.NewICMPTracker(conntrack.DefaultICMPTimeout)
-	}
-
-	if m.tcpTracker != nil {
-		m.tcpTracker.Close()
-		m.tcpTracker = conntrack.NewTCPTracker(conntrack.DefaultTCPTimeout)
-	}
-
 	if !isWindowsFirewallReachable() {
 		return nil
 	}

client/firewall/uspfilter/conntrack/common.go

@@ -1,137 +0,0 @@
-// common.go
-package conntrack
-
-import (
-	"net"
-	"sync"
-	"sync/atomic"
-	"time"
-)
-
-// BaseConnTrack provides common fields and locking for all connection types
-type BaseConnTrack struct {
-	SourceIP    net.IP
-	DestIP      net.IP
-	SourcePort  uint16
-	DestPort    uint16
-	lastSeen    atomic.Int64 // Unix nano for atomic access
-	established atomic.Bool
-}
-
-// these small methods will be inlined by the compiler
-
-// UpdateLastSeen safely updates the last seen timestamp
-func (b *BaseConnTrack) UpdateLastSeen() {
-	b.lastSeen.Store(time.Now().UnixNano())
-}
-
-// IsEstablished safely checks if connection is established
-func (b *BaseConnTrack) IsEstablished() bool {
-	return b.established.Load()
-}
-
-// SetEstablished safely sets the established state
-func (b *BaseConnTrack) SetEstablished(state bool) {
-	b.established.Store(state)
-}
-
-// GetLastSeen safely gets the last seen timestamp
-func (b *BaseConnTrack) GetLastSeen() time.Time {
-	return time.Unix(0, b.lastSeen.Load())
-}
-
-// timeoutExceeded checks if the connection has exceeded the given timeout
-func (b *BaseConnTrack) timeoutExceeded(timeout time.Duration) bool {
-	lastSeen := time.Unix(0, b.lastSeen.Load())
-	return time.Since(lastSeen) > timeout
-}
-
-// IPAddr is a fixed-size IP address to avoid allocations
-type IPAddr [16]byte
-
-// MakeIPAddr creates an IPAddr from net.IP
-func MakeIPAddr(ip net.IP) (addr IPAddr) {
-	// Optimization: check for v4 first as it's more common
-	if ip4 := ip.To4(); ip4 != nil {
-		copy(addr[12:], ip4)
-	} else {
-		copy(addr[:], ip.To16())
-	}
-	return addr
-}
-
-// ConnKey uniquely identifies a connection
-type ConnKey struct {
-	SrcIP   IPAddr
-	DstIP   IPAddr
-	SrcPort uint16
-	DstPort uint16
-}
-
-// makeConnKey creates a connection key
-func makeConnKey(srcIP net.IP, dstIP net.IP, srcPort uint16, dstPort uint16) ConnKey {
-	return ConnKey{
-		SrcIP:   MakeIPAddr(srcIP),
-		DstIP:   MakeIPAddr(dstIP),
-		SrcPort: srcPort,
-		DstPort: dstPort,
-	}
-}
-
-// ValidateIPs checks if IPs match without allocation
-func ValidateIPs(connIP IPAddr, pktIP net.IP) bool {
-	if ip4 := pktIP.To4(); ip4 != nil {
-		// Compare IPv4 addresses (last 4 bytes)
-		for i := 0; i < 4; i++ {
-			if connIP[12+i] != ip4[i] {
-				return false
-			}
-		}
-		return true
-	}
-	// Compare full IPv6 addresses
-	ip6 := pktIP.To16()
-	for i := 0; i < 16; i++ {
-		if connIP[i] != ip6[i] {
-			return false
-		}
-	}
-	return true
-}
-
-// PreallocatedIPs is a pool of IP byte slices to reduce allocations
-type PreallocatedIPs struct {
-	sync.Pool
-}
-
-// NewPreallocatedIPs creates a new IP pool
-func NewPreallocatedIPs() *PreallocatedIPs {
-	return &PreallocatedIPs{
-		Pool: sync.Pool{
-			New: func() interface{} {
-				ip := make(net.IP, 16)
-				return &ip
-			},
-		},
-	}
-}
-
-// Get retrieves an IP from the pool
-func (p *PreallocatedIPs) Get() net.IP {
-	return *p.Pool.Get().(*net.IP)
-}
-
-// Put returns an IP to the pool
-func (p *PreallocatedIPs) Put(ip net.IP) {
-	p.Pool.Put(&ip)
-}
-
-// copyIP copies an IP address efficiently
-func copyIP(dst, src net.IP) {
-	if len(src) == 16 {
-		copy(dst, src)
-	} else {
-		// Handle IPv4
-		copy(dst[12:], src.To4())
-	}
-}

client/firewall/uspfilter/conntrack/common_test.go

@@ -1,115 +0,0 @@
-package conntrack
-
-import (
-	"net"
-	"testing"
-)
-
-func BenchmarkIPOperations(b *testing.B) {
-	b.Run("MakeIPAddr", func(b *testing.B) {
-		ip := net.ParseIP("192.168.1.1")
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			_ = MakeIPAddr(ip)
-		}
-	})
-
-	b.Run("ValidateIPs", func(b *testing.B) {
-		ip1 := net.ParseIP("192.168.1.1")
-		ip2 := net.ParseIP("192.168.1.1")
-		addr := MakeIPAddr(ip1)
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			_ = ValidateIPs(addr, ip2)
-		}
-	})
-
-	b.Run("IPPool", func(b *testing.B) {
-		pool := NewPreallocatedIPs()
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			ip := pool.Get()
-			pool.Put(ip)
-		}
-	})
-
-}
-func BenchmarkAtomicOperations(b *testing.B) {
-	conn := &BaseConnTrack{}
-	b.Run("UpdateLastSeen", func(b *testing.B) {
-		for i := 0; i < b.N; i++ {
-			conn.UpdateLastSeen()
-		}
-	})
-
-	b.Run("IsEstablished", func(b *testing.B) {
-		for i := 0; i < b.N; i++ {
-			_ = conn.IsEstablished()
-		}
-	})
-
-	b.Run("SetEstablished", func(b *testing.B) {
-		for i := 0; i < b.N; i++ {
-			conn.SetEstablished(i%2 == 0)
-		}
-	})
-
-	b.Run("GetLastSeen", func(b *testing.B) {
-		for i := 0; i < b.N; i++ {
-			_ = conn.GetLastSeen()
-		}
-	})
-}
-
-// Memory pressure tests
-func BenchmarkMemoryPressure(b *testing.B) {
-	b.Run("TCPHighLoad", func(b *testing.B) {
-		tracker := NewTCPTracker(DefaultTCPTimeout)
-		defer tracker.Close()
-
-		// Generate different IPs
-		srcIPs := make([]net.IP, 100)
-		dstIPs := make([]net.IP, 100)
-		for i := 0; i < 100; i++ {
-			srcIPs[i] = net.IPv4(192, 168, byte(i/256), byte(i%256))
-			dstIPs[i] = net.IPv4(10, 0, byte(i/256), byte(i%256))
-		}
-
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			srcIdx := i % len(srcIPs)
-			dstIdx := (i + 1) % len(dstIPs)
-			tracker.TrackOutbound(srcIPs[srcIdx], dstIPs[dstIdx], uint16(i%65535), 80, TCPSyn)
-
-			// Simulate some valid inbound packets
-			if i%3 == 0 {
-				tracker.IsValidInbound(dstIPs[dstIdx], srcIPs[srcIdx], 80, uint16(i%65535), TCPAck)
-			}
-		}
-	})
-
-	b.Run("UDPHighLoad", func(b *testing.B) {
-		tracker := NewUDPTracker(DefaultUDPTimeout)
-		defer tracker.Close()
-
-		// Generate different IPs
-		srcIPs := make([]net.IP, 100)
-		dstIPs := make([]net.IP, 100)
-		for i := 0; i < 100; i++ {
-			srcIPs[i] = net.IPv4(192, 168, byte(i/256), byte(i%256))
-			dstIPs[i] = net.IPv4(10, 0, byte(i/256), byte(i%256))
-		}
-
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			srcIdx := i % len(srcIPs)
-			dstIdx := (i + 1) % len(dstIPs)
-			tracker.TrackOutbound(srcIPs[srcIdx], dstIPs[dstIdx], uint16(i%65535), 80)
-
-			// Simulate some valid inbound packets
-			if i%3 == 0 {
-				tracker.IsValidInbound(dstIPs[dstIdx], srcIPs[srcIdx], 80, uint16(i%65535))
-			}
-		}
-	})
-}

client/firewall/uspfilter/conntrack/icmp.go

@@ -1,170 +0,0 @@
-package conntrack
-
-import (
-	"net"
-	"sync"
-	"time"
-
-	"github.com/google/gopacket/layers"
-)
-
-const (
-	// DefaultICMPTimeout is the default timeout for ICMP connections
-	DefaultICMPTimeout = 30 * time.Second
-	// ICMPCleanupInterval is how often we check for stale ICMP connections
-	ICMPCleanupInterval = 15 * time.Second
-)
-
-// ICMPConnKey uniquely identifies an ICMP connection
-type ICMPConnKey struct {
-	// Supports both IPv4 and IPv6
-	SrcIP    [16]byte
-	DstIP    [16]byte
-	Sequence uint16 // ICMP sequence number
-	ID       uint16 // ICMP identifier
-}
-
-// ICMPConnTrack represents an ICMP connection state
-type ICMPConnTrack struct {
-	BaseConnTrack
-	Sequence uint16
-	ID       uint16
-}
-
-// ICMPTracker manages ICMP connection states
-type ICMPTracker struct {
-	connections   map[ICMPConnKey]*ICMPConnTrack
-	timeout       time.Duration
-	cleanupTicker *time.Ticker
-	mutex         sync.RWMutex
-	done          chan struct{}
-	ipPool        *PreallocatedIPs
-}
-
-// NewICMPTracker creates a new ICMP connection tracker
-func NewICMPTracker(timeout time.Duration) *ICMPTracker {
-	if timeout == 0 {
-		timeout = DefaultICMPTimeout
-	}
-
-	tracker := &ICMPTracker{
-		connections:   make(map[ICMPConnKey]*ICMPConnTrack),
-		timeout:       timeout,
-		cleanupTicker: time.NewTicker(ICMPCleanupInterval),
-		done:          make(chan struct{}),
-		ipPool:        NewPreallocatedIPs(),
-	}
-
-	go tracker.cleanupRoutine()
-	return tracker
-}
-
-// TrackOutbound records an outbound ICMP Echo Request
-func (t *ICMPTracker) TrackOutbound(srcIP net.IP, dstIP net.IP, id uint16, seq uint16) {
-	key := makeICMPKey(srcIP, dstIP, id, seq)
-	now := time.Now().UnixNano()
-
-	t.mutex.Lock()
-	conn, exists := t.connections[key]
-	if !exists {
-		srcIPCopy := t.ipPool.Get()
-		dstIPCopy := t.ipPool.Get()
-		copyIP(srcIPCopy, srcIP)
-		copyIP(dstIPCopy, dstIP)
-
-		conn = &ICMPConnTrack{
-			BaseConnTrack: BaseConnTrack{
-				SourceIP: srcIPCopy,
-				DestIP:   dstIPCopy,
-			},
-			ID:       id,
-			Sequence: seq,
-		}
-		conn.lastSeen.Store(now)
-		conn.established.Store(true)
-		t.connections[key] = conn
-	}
-	t.mutex.Unlock()
-
-	conn.lastSeen.Store(now)
-}
-
-// IsValidInbound checks if an inbound ICMP Echo Reply matches a tracked request
-func (t *ICMPTracker) IsValidInbound(srcIP net.IP, dstIP net.IP, id uint16, seq uint16, icmpType uint8) bool {
-	switch icmpType {
-	case uint8(layers.ICMPv4TypeDestinationUnreachable),
-		uint8(layers.ICMPv4TypeTimeExceeded):
-		return true
-	case uint8(layers.ICMPv4TypeEchoReply):
-		// continue processing
-	default:
-		return false
-	}
-
-	key := makeICMPKey(dstIP, srcIP, id, seq)
-
-	t.mutex.RLock()
-	conn, exists := t.connections[key]
-	t.mutex.RUnlock()
-
-	if !exists {
-		return false
-	}
-
-	if conn.timeoutExceeded(t.timeout) {
-		return false
-	}
-
-	return conn.IsEstablished() &&
-		ValidateIPs(MakeIPAddr(srcIP), conn.DestIP) &&
-		ValidateIPs(MakeIPAddr(dstIP), conn.SourceIP) &&
-		conn.ID == id &&
-		conn.Sequence == seq
-}
-
-func (t *ICMPTracker) cleanupRoutine() {
-	for {
-		select {
-		case <-t.cleanupTicker.C:
-			t.cleanup()
-		case <-t.done:
-			return
-		}
-	}
-}
-func (t *ICMPTracker) cleanup() {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-
-	for key, conn := range t.connections {
-		if conn.timeoutExceeded(t.timeout) {
-			t.ipPool.Put(conn.SourceIP)
-			t.ipPool.Put(conn.DestIP)
-			delete(t.connections, key)
-		}
-	}
-}
-
-// Close stops the cleanup routine and releases resources
-func (t *ICMPTracker) Close() {
-	t.cleanupTicker.Stop()
-	close(t.done)
-
-	t.mutex.Lock()
-	for _, conn := range t.connections {
-		t.ipPool.Put(conn.SourceIP)
-		t.ipPool.Put(conn.DestIP)
-	}
-	t.connections = nil
-	t.mutex.Unlock()
-}
-
-// makeICMPKey creates an ICMP connection key
-func makeICMPKey(srcIP net.IP, dstIP net.IP, id uint16, seq uint16) ICMPConnKey {
-	return ICMPConnKey{
-		SrcIP:    MakeIPAddr(srcIP),
-		DstIP:    MakeIPAddr(dstIP),
-		ID:       id,
-		Sequence: seq,
-	}
-}

client/firewall/uspfilter/conntrack/icmp_test.go

@@ -1,39 +0,0 @@
-package conntrack
-
-import (
-	"net"
-	"testing"
-)
-
-func BenchmarkICMPTracker(b *testing.B) {
-	b.Run("TrackOutbound", func(b *testing.B) {
-		tracker := NewICMPTracker(DefaultICMPTimeout)
-		defer tracker.Close()
-
-		srcIP := net.ParseIP("192.168.1.1")
-		dstIP := net.ParseIP("192.168.1.2")
-
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			tracker.TrackOutbound(srcIP, dstIP, uint16(i%65535), uint16(i%65535))
-		}
-	})
-
-	b.Run("IsValidInbound", func(b *testing.B) {
-		tracker := NewICMPTracker(DefaultICMPTimeout)
-		defer tracker.Close()
-
-		srcIP := net.ParseIP("192.168.1.1")
-		dstIP := net.ParseIP("192.168.1.2")
-
-		// Pre-populate some connections
-		for i := 0; i < 1000; i++ {
-			tracker.TrackOutbound(srcIP, dstIP, uint16(i), uint16(i))
-		}
-
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			tracker.IsValidInbound(dstIP, srcIP, uint16(i%1000), uint16(i%1000), 0)
-		}
-	})
-}

client/firewall/uspfilter/conntrack/tcp.go

@@ -1,352 +0,0 @@
-package conntrack
-
-// TODO: Send RST packets for invalid/timed-out connections
-
-import (
-	"net"
-	"sync"
-	"time"
-)
-
-const (
-	// MSL (Maximum Segment Lifetime) is typically 2 minutes
-	MSL = 2 * time.Minute
-	// TimeWaitTimeout (TIME-WAIT) should last 2*MSL
-	TimeWaitTimeout = 2 * MSL
-)
-
-const (
-	TCPSyn  uint8 = 0x02
-	TCPAck  uint8 = 0x10
-	TCPFin  uint8 = 0x01
-	TCPRst  uint8 = 0x04
-	TCPPush uint8 = 0x08
-	TCPUrg  uint8 = 0x20
-)
-
-const (
-	// DefaultTCPTimeout is the default timeout for established TCP connections
-	DefaultTCPTimeout = 3 * time.Hour
-	// TCPHandshakeTimeout is timeout for TCP handshake completion
-	TCPHandshakeTimeout = 60 * time.Second
-	// TCPCleanupInterval is how often we check for stale connections
-	TCPCleanupInterval = 5 * time.Minute
-)
-
-// TCPState represents the state of a TCP connection
-type TCPState int
-
-const (
-	TCPStateNew TCPState = iota
-	TCPStateSynSent
-	TCPStateSynReceived
-	TCPStateEstablished
-	TCPStateFinWait1
-	TCPStateFinWait2
-	TCPStateClosing
-	TCPStateTimeWait
-	TCPStateCloseWait
-	TCPStateLastAck
-	TCPStateClosed
-)
-
-// TCPConnKey uniquely identifies a TCP connection
-type TCPConnKey struct {
-	SrcIP   [16]byte
-	DstIP   [16]byte
-	SrcPort uint16
-	DstPort uint16
-}
-
-// TCPConnTrack represents a TCP connection state
-type TCPConnTrack struct {
-	BaseConnTrack
-	State TCPState
-	sync.RWMutex
-}
-
-// TCPTracker manages TCP connection states
-type TCPTracker struct {
-	connections   map[ConnKey]*TCPConnTrack
-	mutex         sync.RWMutex
-	cleanupTicker *time.Ticker
-	done          chan struct{}
-	timeout       time.Duration
-	ipPool        *PreallocatedIPs
-}
-
-// NewTCPTracker creates a new TCP connection tracker
-func NewTCPTracker(timeout time.Duration) *TCPTracker {
-	tracker := &TCPTracker{
-		connections:   make(map[ConnKey]*TCPConnTrack),
-		cleanupTicker: time.NewTicker(TCPCleanupInterval),
-		done:          make(chan struct{}),
-		timeout:       timeout,
-		ipPool:        NewPreallocatedIPs(),
-	}
-
-	go tracker.cleanupRoutine()
-	return tracker
-}
-
-// TrackOutbound processes an outbound TCP packet and updates connection state
-func (t *TCPTracker) TrackOutbound(srcIP net.IP, dstIP net.IP, srcPort uint16, dstPort uint16, flags uint8) {
-	// Create key before lock
-	key := makeConnKey(srcIP, dstIP, srcPort, dstPort)
-	now := time.Now().UnixNano()
-
-	t.mutex.Lock()
-	conn, exists := t.connections[key]
-	if !exists {
-		// Use preallocated IPs
-		srcIPCopy := t.ipPool.Get()
-		dstIPCopy := t.ipPool.Get()
-		copyIP(srcIPCopy, srcIP)
-		copyIP(dstIPCopy, dstIP)
-
-		conn = &TCPConnTrack{
-			BaseConnTrack: BaseConnTrack{
-				SourceIP:   srcIPCopy,
-				DestIP:     dstIPCopy,
-				SourcePort: srcPort,
-				DestPort:   dstPort,
-			},
-			State: TCPStateNew,
-		}
-		conn.lastSeen.Store(now)
-		conn.established.Store(false)
-		t.connections[key] = conn
-	}
-	t.mutex.Unlock()
-
-	// Lock individual connection for state update
-	conn.Lock()
-	t.updateState(conn, flags, true)
-	conn.Unlock()
-	conn.lastSeen.Store(now)
-}
-
-// IsValidInbound checks if an inbound TCP packet matches a tracked connection
-func (t *TCPTracker) IsValidInbound(srcIP net.IP, dstIP net.IP, srcPort uint16, dstPort uint16, flags uint8) bool {
-	if !isValidFlagCombination(flags) {
-		return false
-	}
-
-	key := makeConnKey(dstIP, srcIP, dstPort, srcPort)
-
-	t.mutex.RLock()
-	conn, exists := t.connections[key]
-	t.mutex.RUnlock()
-
-	if !exists {
-		return false
-	}
-
-	// Handle RST packets
-	if flags&TCPRst != 0 {
-		conn.Lock()
-		if conn.IsEstablished() || conn.State == TCPStateSynSent || conn.State == TCPStateSynReceived {
-			conn.State = TCPStateClosed
-			conn.SetEstablished(false)
-			conn.Unlock()
-			return true
-		}
-		conn.Unlock()
-		return false
-	}
-
-	conn.Lock()
-	t.updateState(conn, flags, false)
-	conn.UpdateLastSeen()
-	isEstablished := conn.IsEstablished()
-	isValidState := t.isValidStateForFlags(conn.State, flags)
-	conn.Unlock()
-
-	return isEstablished || isValidState
-}
-
-// updateState updates the TCP connection state based on flags
-func (t *TCPTracker) updateState(conn *TCPConnTrack, flags uint8, isOutbound bool) {
-	// Handle RST flag specially - it always causes transition to closed
-	if flags&TCPRst != 0 {
-		conn.State = TCPStateClosed
-		conn.SetEstablished(false)
-		return
-	}
-
-	switch conn.State {
-	case TCPStateNew:
-		if flags&TCPSyn != 0 && flags&TCPAck == 0 {
-			conn.State = TCPStateSynSent
-		}
-
-	case TCPStateSynSent:
-		if flags&TCPSyn != 0 && flags&TCPAck != 0 {
-			if isOutbound {
-				conn.State = TCPStateSynReceived
-			} else {
-				// Simultaneous open
-				conn.State = TCPStateEstablished
-				conn.SetEstablished(true)
-			}
-		}
-
-	case TCPStateSynReceived:
-		if flags&TCPAck != 0 && flags&TCPSyn == 0 {
-			conn.State = TCPStateEstablished
-			conn.SetEstablished(true)
-		}
-
-	case TCPStateEstablished:
-		if flags&TCPFin != 0 {
-			if isOutbound {
-				conn.State = TCPStateFinWait1
-			} else {
-				conn.State = TCPStateCloseWait
-			}
-			conn.SetEstablished(false)
-		}
-
-	case TCPStateFinWait1:
-		switch {
-		case flags&TCPFin != 0 && flags&TCPAck != 0:
-			// Simultaneous close - both sides sent FIN
-			conn.State = TCPStateClosing
-		case flags&TCPFin != 0:
-			conn.State = TCPStateFinWait2
-		case flags&TCPAck != 0:
-			conn.State = TCPStateFinWait2
-		}
-
-	case TCPStateFinWait2:
-		if flags&TCPFin != 0 {
-			conn.State = TCPStateTimeWait
-		}
-
-	case TCPStateClosing:
-		if flags&TCPAck != 0 {
-			conn.State = TCPStateTimeWait
-			// Keep established = false from previous state
-		}
-
-	case TCPStateCloseWait:
-		if flags&TCPFin != 0 {
-			conn.State = TCPStateLastAck
-		}
-
-	case TCPStateLastAck:
-		if flags&TCPAck != 0 {
-			conn.State = TCPStateClosed
-		}
-
-	case TCPStateTimeWait:
-		// Stay in TIME-WAIT for 2MSL before transitioning to closed
-		// This is handled by the cleanup routine
-	}
-}
-
-// isValidStateForFlags checks if the TCP flags are valid for the current connection state
-func (t *TCPTracker) isValidStateForFlags(state TCPState, flags uint8) bool {
-	if !isValidFlagCombination(flags) {
-		return false
-	}
-
-	switch state {
-	case TCPStateNew:
-		return flags&TCPSyn != 0 && flags&TCPAck == 0
-	case TCPStateSynSent:
-		return flags&TCPSyn != 0 && flags&TCPAck != 0
-	case TCPStateSynReceived:
-		return flags&TCPAck != 0
-	case TCPStateEstablished:
-		if flags&TCPRst != 0 {
-			return true
-		}
-		return flags&TCPAck != 0
-	case TCPStateFinWait1:
-		return flags&TCPFin != 0 || flags&TCPAck != 0
-	case TCPStateFinWait2:
-		return flags&TCPFin != 0 || flags&TCPAck != 0
-	case TCPStateClosing:
-		// In CLOSING state, we should accept the final ACK
-		return flags&TCPAck != 0
-	case TCPStateTimeWait:
-		// In TIME_WAIT, we might see retransmissions
-		return flags&TCPAck != 0
-	case TCPStateCloseWait:
-		return flags&TCPFin != 0 || flags&TCPAck != 0
-	case TCPStateLastAck:
-		return flags&TCPAck != 0
-	case TCPStateClosed:
-		// Accept retransmitted ACKs in closed state
-		// This is important because the final ACK might be lost
-		// and the peer will retransmit their FIN-ACK
-		return flags&TCPAck != 0
-	}
-	return false
-}
-
-func (t *TCPTracker) cleanupRoutine() {
-	for {
-		select {
-		case <-t.cleanupTicker.C:
-			t.cleanup()
-		case <-t.done:
-			return
-		}
-	}
-}
-
-func (t *TCPTracker) cleanup() {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-
-	for key, conn := range t.connections {
-		var timeout time.Duration
-		switch {
-		case conn.State == TCPStateTimeWait:
-			timeout = TimeWaitTimeout
-		case conn.IsEstablished():
-			timeout = t.timeout
-		default:
-			timeout = TCPHandshakeTimeout
-		}
-
-		lastSeen := conn.GetLastSeen()
-		if time.Since(lastSeen) > timeout {
-			// Return IPs to pool
-			t.ipPool.Put(conn.SourceIP)
-			t.ipPool.Put(conn.DestIP)
-			delete(t.connections, key)
-		}
-	}
-}
-
-// Close stops the cleanup routine and releases resources
-func (t *TCPTracker) Close() {
-	t.cleanupTicker.Stop()
-	close(t.done)
-
-	// Clean up all remaining IPs
-	t.mutex.Lock()
-	for _, conn := range t.connections {
-		t.ipPool.Put(conn.SourceIP)
-		t.ipPool.Put(conn.DestIP)
-	}
-	t.connections = nil
-	t.mutex.Unlock()
-}
-
-func isValidFlagCombination(flags uint8) bool {
-	// Invalid: SYN+FIN
-	if flags&TCPSyn != 0 && flags&TCPFin != 0 {
-		return false
-	}
-
-	// Invalid: RST with SYN or FIN
-	if flags&TCPRst != 0 && (flags&TCPSyn != 0 || flags&TCPFin != 0) {
-		return false
-	}
-
-	return true
-}

client/firewall/uspfilter/conntrack/tcp_test.go

@@ -1,308 +0,0 @@
-package conntrack
-
-import (
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestTCPStateMachine(t *testing.T) {
-	tracker := NewTCPTracker(DefaultTCPTimeout)
-	defer tracker.Close()
-
-	srcIP := net.ParseIP("100.64.0.1")
-	dstIP := net.ParseIP("100.64.0.2")
-	srcPort := uint16(12345)
-	dstPort := uint16(80)
-
-	t.Run("Security Tests", func(t *testing.T) {
-		tests := []struct {
-			name     string
-			flags    uint8
-			wantDrop bool
-			desc     string
-		}{
-			{
-				name:     "Block unsolicited SYN-ACK",
-				flags:    TCPSyn | TCPAck,
-				wantDrop: true,
-				desc:     "Should block SYN-ACK without prior SYN",
-			},
-			{
-				name:     "Block invalid SYN-FIN",
-				flags:    TCPSyn | TCPFin,
-				wantDrop: true,
-				desc:     "Should block invalid SYN-FIN combination",
-			},
-			{
-				name:     "Block unsolicited RST",
-				flags:    TCPRst,
-				wantDrop: true,
-				desc:     "Should block RST without connection",
-			},
-			{
-				name:     "Block unsolicited ACK",
-				flags:    TCPAck,
-				wantDrop: true,
-				desc:     "Should block ACK without connection",
-			},
-			{
-				name:     "Block data without connection",
-				flags:    TCPAck | TCPPush,
-				wantDrop: true,
-				desc:     "Should block data without established connection",
-			},
-		}
-
-		for _, tt := range tests {
-			t.Run(tt.name, func(t *testing.T) {
-				isValid := tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, tt.flags)
-				require.Equal(t, !tt.wantDrop, isValid, tt.desc)
-			})
-		}
-	})
-
-	t.Run("Connection Flow Tests", func(t *testing.T) {
-		tests := []struct {
-			name string
-			test func(*testing.T)
-			desc string
-		}{
-			{
-				name: "Normal Handshake",
-				test: func(t *testing.T) {
-					t.Helper()
-
-					// Send initial SYN
-					tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPSyn)
-
-					// Receive SYN-ACK
-					valid := tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPSyn|TCPAck)
-					require.True(t, valid, "SYN-ACK should be allowed")
-
-					// Send ACK
-					tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPAck)
-
-					// Test data transfer
-					valid = tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPPush|TCPAck)
-					require.True(t, valid, "Data should be allowed after handshake")
-				},
-			},
-			{
-				name: "Normal Close",
-				test: func(t *testing.T) {
-					t.Helper()
-
-					// First establish connection
-					establishConnection(t, tracker, srcIP, dstIP, srcPort, dstPort)
-
-					// Send FIN
-					tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPFin|TCPAck)
-
-					// Receive ACK for FIN
-					valid := tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPAck)
-					require.True(t, valid, "ACK for FIN should be allowed")
-
-					// Receive FIN from other side
-					valid = tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPFin|TCPAck)
-					require.True(t, valid, "FIN should be allowed")
-
-					// Send final ACK
-					tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPAck)
-				},
-			},
-			{
-				name: "RST During Connection",
-				test: func(t *testing.T) {
-					t.Helper()
-
-					// First establish connection
-					establishConnection(t, tracker, srcIP, dstIP, srcPort, dstPort)
-
-					// Receive RST
-					valid := tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPRst)
-					require.True(t, valid, "RST should be allowed for established connection")
-
-					// Connection is logically dead but we don't enforce blocking subsequent packets
-					// The connection will be cleaned up by timeout
-				},
-			},
-			{
-				name: "Simultaneous Close",
-				test: func(t *testing.T) {
-					t.Helper()
-
-					// First establish connection
-					establishConnection(t, tracker, srcIP, dstIP, srcPort, dstPort)
-
-					// Both sides send FIN+ACK
-					tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPFin|TCPAck)
-					valid := tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPFin|TCPAck)
-					require.True(t, valid, "Simultaneous FIN should be allowed")
-
-					// Both sides send final ACK
-					tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPAck)
-					valid = tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPAck)
-					require.True(t, valid, "Final ACKs should be allowed")
-				},
-			},
-		}
-
-		for _, tt := range tests {
-			t.Run(tt.name, func(t *testing.T) {
-				t.Helper()
-
-				tracker = NewTCPTracker(DefaultTCPTimeout)
-				tt.test(t)
-			})
-		}
-	})
-}
-
-func TestRSTHandling(t *testing.T) {
-	tracker := NewTCPTracker(DefaultTCPTimeout)
-	defer tracker.Close()
-
-	srcIP := net.ParseIP("100.64.0.1")
-	dstIP := net.ParseIP("100.64.0.2")
-	srcPort := uint16(12345)
-	dstPort := uint16(80)
-
-	tests := []struct {
-		name       string
-		setupState func()
-		sendRST    func()
-		wantValid  bool
-		desc       string
-	}{
-		{
-			name: "RST in established",
-			setupState: func() {
-				// Establish connection first
-				tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPSyn)
-				tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPSyn|TCPAck)
-				tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPAck)
-			},
-			sendRST: func() {
-				tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPRst)
-			},
-			wantValid: true,
-			desc:      "Should accept RST for established connection",
-		},
-		{
-			name:       "RST without connection",
-			setupState: func() {},
-			sendRST: func() {
-				tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPRst)
-			},
-			wantValid: false,
-			desc:      "Should reject RST without connection",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			tt.setupState()
-			tt.sendRST()
-
-			// Verify connection state is as expected
-			key := makeConnKey(srcIP, dstIP, srcPort, dstPort)
-			conn := tracker.connections[key]
-			if tt.wantValid {
-				require.NotNil(t, conn)
-				require.Equal(t, TCPStateClosed, conn.State)
-				require.False(t, conn.IsEstablished())
-			}
-		})
-	}
-}
-
-// Helper to establish a TCP connection
-func establishConnection(t *testing.T, tracker *TCPTracker, srcIP, dstIP net.IP, srcPort, dstPort uint16) {
-	t.Helper()
-
-	tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPSyn)
-
-	valid := tracker.IsValidInbound(dstIP, srcIP, dstPort, srcPort, TCPSyn|TCPAck)
-	require.True(t, valid, "SYN-ACK should be allowed")
-
-	tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort, TCPAck)
-}
-
-func BenchmarkTCPTracker(b *testing.B) {
-	b.Run("TrackOutbound", func(b *testing.B) {
-		tracker := NewTCPTracker(DefaultTCPTimeout)
-		defer tracker.Close()
-
-		srcIP := net.ParseIP("192.168.1.1")
-		dstIP := net.ParseIP("192.168.1.2")
-
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			tracker.TrackOutbound(srcIP, dstIP, uint16(i%65535), 80, TCPSyn)
-		}
-	})
-
-	b.Run("IsValidInbound", func(b *testing.B) {
-		tracker := NewTCPTracker(DefaultTCPTimeout)
-		defer tracker.Close()
-
-		srcIP := net.ParseIP("192.168.1.1")
-		dstIP := net.ParseIP("192.168.1.2")
-
-		// Pre-populate some connections
-		for i := 0; i < 1000; i++ {
-			tracker.TrackOutbound(srcIP, dstIP, uint16(i), 80, TCPSyn)
-		}
-
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			tracker.IsValidInbound(dstIP, srcIP, 80, uint16(i%1000), TCPAck)
-		}
-	})
-
-	b.Run("ConcurrentAccess", func(b *testing.B) {
-		tracker := NewTCPTracker(DefaultTCPTimeout)
-		defer tracker.Close()
-
-		srcIP := net.ParseIP("192.168.1.1")
-		dstIP := net.ParseIP("192.168.1.2")
-
-		b.RunParallel(func(pb *testing.PB) {
-			i := 0
-			for pb.Next() {
-				if i%2 == 0 {
-					tracker.TrackOutbound(srcIP, dstIP, uint16(i%65535), 80, TCPSyn)
-				} else {
-					tracker.IsValidInbound(dstIP, srcIP, 80, uint16(i%65535), TCPAck)
-				}
-				i++
-			}
-		})
-	})
-}
-
-// Benchmark connection cleanup
-func BenchmarkCleanup(b *testing.B) {
-	b.Run("TCPCleanup", func(b *testing.B) {
-		tracker := NewTCPTracker(100 * time.Millisecond) // Short timeout for testing
-		defer tracker.Close()
-
-		// Pre-populate with expired connections
-		srcIP := net.ParseIP("192.168.1.1")
-		dstIP := net.ParseIP("192.168.1.2")
-		for i := 0; i < 10000; i++ {
-			tracker.TrackOutbound(srcIP, dstIP, uint16(i), 80, TCPSyn)
-		}
-
-		// Wait for connections to expire
-		time.Sleep(200 * time.Millisecond)
-
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			tracker.cleanup()
-		}
-	})
-}

client/firewall/uspfilter/conntrack/udp.go

@@ -1,158 +0,0 @@
-package conntrack
-
-import (
-	"net"
-	"sync"
-	"time"
-)
-
-const (
-	// DefaultUDPTimeout is the default timeout for UDP connections
-	DefaultUDPTimeout = 30 * time.Second
-	// UDPCleanupInterval is how often we check for stale connections
-	UDPCleanupInterval = 15 * time.Second
-)
-
-// UDPConnTrack represents a UDP connection state
-type UDPConnTrack struct {
-	BaseConnTrack
-}
-
-// UDPTracker manages UDP connection states
-type UDPTracker struct {
-	connections   map[ConnKey]*UDPConnTrack
-	timeout       time.Duration
-	cleanupTicker *time.Ticker
-	mutex         sync.RWMutex
-	done          chan struct{}
-	ipPool        *PreallocatedIPs
-}
-
-// NewUDPTracker creates a new UDP connection tracker
-func NewUDPTracker(timeout time.Duration) *UDPTracker {
-	if timeout == 0 {
-		timeout = DefaultUDPTimeout
-	}
-
-	tracker := &UDPTracker{
-		connections:   make(map[ConnKey]*UDPConnTrack),
-		timeout:       timeout,
-		cleanupTicker: time.NewTicker(UDPCleanupInterval),
-		done:          make(chan struct{}),
-		ipPool:        NewPreallocatedIPs(),
-	}
-
-	go tracker.cleanupRoutine()
-	return tracker
-}
-
-// TrackOutbound records an outbound UDP connection
-func (t *UDPTracker) TrackOutbound(srcIP net.IP, dstIP net.IP, srcPort uint16, dstPort uint16) {
-	key := makeConnKey(srcIP, dstIP, srcPort, dstPort)
-	now := time.Now().UnixNano()
-
-	t.mutex.Lock()
-	conn, exists := t.connections[key]
-	if !exists {
-		srcIPCopy := t.ipPool.Get()
-		dstIPCopy := t.ipPool.Get()
-		copyIP(srcIPCopy, srcIP)
-		copyIP(dstIPCopy, dstIP)
-
-		conn = &UDPConnTrack{
-			BaseConnTrack: BaseConnTrack{
-				SourceIP:   srcIPCopy,
-				DestIP:     dstIPCopy,
-				SourcePort: srcPort,
-				DestPort:   dstPort,
-			},
-		}
-		conn.lastSeen.Store(now)
-		conn.established.Store(true)
-		t.connections[key] = conn
-	}
-	t.mutex.Unlock()
-
-	conn.lastSeen.Store(now)
-}
-
-// IsValidInbound checks if an inbound packet matches a tracked connection
-func (t *UDPTracker) IsValidInbound(srcIP net.IP, dstIP net.IP, srcPort uint16, dstPort uint16) bool {
-	key := makeConnKey(dstIP, srcIP, dstPort, srcPort)
-
-	t.mutex.RLock()
-	conn, exists := t.connections[key]
-	t.mutex.RUnlock()
-
-	if !exists {
-		return false
-	}
-
-	if conn.timeoutExceeded(t.timeout) {
-		return false
-	}
-
-	return conn.IsEstablished() &&
-		ValidateIPs(MakeIPAddr(srcIP), conn.DestIP) &&
-		ValidateIPs(MakeIPAddr(dstIP), conn.SourceIP) &&
-		conn.DestPort == srcPort &&
-		conn.SourcePort == dstPort
-}
-
-// cleanupRoutine periodically removes stale connections
-func (t *UDPTracker) cleanupRoutine() {
-	for {
-		select {
-		case <-t.cleanupTicker.C:
-			t.cleanup()
-		case <-t.done:
-			return
-		}
-	}
-}
-
-func (t *UDPTracker) cleanup() {
-	t.mutex.Lock()
-	defer t.mutex.Unlock()
-
-	for key, conn := range t.connections {
-		if conn.timeoutExceeded(t.timeout) {
-			t.ipPool.Put(conn.SourceIP)
-			t.ipPool.Put(conn.DestIP)
-			delete(t.connections, key)
-		}
-	}
-}
-
-// Close stops the cleanup routine and releases resources
-func (t *UDPTracker) Close() {
-	t.cleanupTicker.Stop()
-	close(t.done)
-
-	t.mutex.Lock()
-	for _, conn := range t.connections {
-		t.ipPool.Put(conn.SourceIP)
-		t.ipPool.Put(conn.DestIP)
-	}
-	t.connections = nil
-	t.mutex.Unlock()
-}
-
-// GetConnection safely retrieves a connection state
-func (t *UDPTracker) GetConnection(srcIP net.IP, srcPort uint16, dstIP net.IP, dstPort uint16) (*UDPConnTrack, bool) {
-	t.mutex.RLock()
-	defer t.mutex.RUnlock()
-
-	key := makeConnKey(srcIP, dstIP, srcPort, dstPort)
-	conn, exists := t.connections[key]
-	if !exists {
-		return nil, false
-	}
-
-	return conn, true
-}
-
-// Timeout returns the configured timeout duration for the tracker
-func (t *UDPTracker) Timeout() time.Duration {
-	return t.timeout
-}

client/firewall/uspfilter/conntrack/udp_test.go

@@ -1,243 +0,0 @@
-package conntrack
-
-import (
-	"net"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewUDPTracker(t *testing.T) {
-	tests := []struct {
-		name        string
-		timeout     time.Duration
-		wantTimeout time.Duration
-	}{
-		{
-			name:        "with custom timeout",
-			timeout:     1 * time.Minute,
-			wantTimeout: 1 * time.Minute,
-		},
-		{
-			name:        "with zero timeout uses default",
-			timeout:     0,
-			wantTimeout: DefaultUDPTimeout,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			tracker := NewUDPTracker(tt.timeout)
-			assert.NotNil(t, tracker)
-			assert.Equal(t, tt.wantTimeout, tracker.timeout)
-			assert.NotNil(t, tracker.connections)
-			assert.NotNil(t, tracker.cleanupTicker)
-			assert.NotNil(t, tracker.done)
-		})
-	}
-}
-
-func TestUDPTracker_TrackOutbound(t *testing.T) {
-	tracker := NewUDPTracker(DefaultUDPTimeout)
-	defer tracker.Close()
-
-	srcIP := net.ParseIP("192.168.1.2")
-	dstIP := net.ParseIP("192.168.1.3")
-	srcPort := uint16(12345)
-	dstPort := uint16(53)
-
-	tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort)
-
-	// Verify connection was tracked
-	key := makeConnKey(srcIP, dstIP, srcPort, dstPort)
-	conn, exists := tracker.connections[key]
-	require.True(t, exists)
-	assert.True(t, conn.SourceIP.Equal(srcIP))
-	assert.True(t, conn.DestIP.Equal(dstIP))
-	assert.Equal(t, srcPort, conn.SourcePort)
-	assert.Equal(t, dstPort, conn.DestPort)
-	assert.True(t, conn.IsEstablished())
-	assert.WithinDuration(t, time.Now(), conn.GetLastSeen(), 1*time.Second)
-}
-
-func TestUDPTracker_IsValidInbound(t *testing.T) {
-	tracker := NewUDPTracker(1 * time.Second)
-	defer tracker.Close()
-
-	srcIP := net.ParseIP("192.168.1.2")
-	dstIP := net.ParseIP("192.168.1.3")
-	srcPort := uint16(12345)
-	dstPort := uint16(53)
-
-	// Track outbound connection
-	tracker.TrackOutbound(srcIP, dstIP, srcPort, dstPort)
-
-	tests := []struct {
-		name    string
-		srcIP   net.IP
-		dstIP   net.IP
-		srcPort uint16
-		dstPort uint16
-		sleep   time.Duration
-		want    bool
-	}{
-		{
-			name:    "valid inbound response",
-			srcIP:   dstIP,   // Original destination is now source
-			dstIP:   srcIP,   // Original source is now destination
-			srcPort: dstPort, // Original destination port is now source
-			dstPort: srcPort, // Original source port is now destination
-			sleep:   0,
-			want:    true,
-		},
-		{
-			name:    "invalid source IP",
-			srcIP:   net.ParseIP("192.168.1.4"),
-			dstIP:   srcIP,
-			srcPort: dstPort,
-			dstPort: srcPort,
-			sleep:   0,
-			want:    false,
-		},
-		{
-			name:    "invalid destination IP",
-			srcIP:   dstIP,
-			dstIP:   net.ParseIP("192.168.1.4"),
-			srcPort: dstPort,
-			dstPort: srcPort,
-			sleep:   0,
-			want:    false,
-		},
-		{
-			name:    "invalid source port",
-			srcIP:   dstIP,
-			dstIP:   srcIP,
-			srcPort: 54321,
-			dstPort: srcPort,
-			sleep:   0,
-			want:    false,
-		},
-		{
-			name:    "invalid destination port",
-			srcIP:   dstIP,
-			dstIP:   srcIP,
-			srcPort: dstPort,
-			dstPort: 54321,
-			sleep:   0,
-			want:    false,
-		},
-		{
-			name:    "expired connection",
-			srcIP:   dstIP,
-			dstIP:   srcIP,
-			srcPort: dstPort,
-			dstPort: srcPort,
-			sleep:   2 * time.Second, // Longer than tracker timeout
-			want:    false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.sleep > 0 {
-				time.Sleep(tt.sleep)
-			}
-			got := tracker.IsValidInbound(tt.srcIP, tt.dstIP, tt.srcPort, tt.dstPort)
-			assert.Equal(t, tt.want, got)
-		})
-	}
-}
-
-func TestUDPTracker_Cleanup(t *testing.T) {
-	// Use shorter intervals for testing
-	timeout := 50 * time.Millisecond
-	cleanupInterval := 25 * time.Millisecond
-
-	// Create tracker with custom cleanup interval
-	tracker := &UDPTracker{
-		connections:   make(map[ConnKey]*UDPConnTrack),
-		timeout:       timeout,
-		cleanupTicker: time.NewTicker(cleanupInterval),
-		done:          make(chan struct{}),
-		ipPool:        NewPreallocatedIPs(),
-	}
-
-	// Start cleanup routine
-	go tracker.cleanupRoutine()
-
-	// Add some connections
-	connections := []struct {
-		srcIP   net.IP
-		dstIP   net.IP
-		srcPort uint16
-		dstPort uint16
-	}{
-		{
-			srcIP:   net.ParseIP("192.168.1.2"),
-			dstIP:   net.ParseIP("192.168.1.3"),
-			srcPort: 12345,
-			dstPort: 53,
-		},
-		{
-			srcIP:   net.ParseIP("192.168.1.4"),
-			dstIP:   net.ParseIP("192.168.1.5"),
-			srcPort: 12346,
-			dstPort: 53,
-		},
-	}
-
-	for _, conn := range connections {
-		tracker.TrackOutbound(conn.srcIP, conn.dstIP, conn.srcPort, conn.dstPort)
-	}
-
-	// Verify initial connections
-	assert.Len(t, tracker.connections, 2)
-
-	// Wait for connection timeout and cleanup interval
-	time.Sleep(timeout + 2*cleanupInterval)
-
-	tracker.mutex.RLock()
-	connCount := len(tracker.connections)
-	tracker.mutex.RUnlock()
-
-	// Verify connections were cleaned up
-	assert.Equal(t, 0, connCount, "Expected all connections to be cleaned up")
-
-	// Properly close the tracker
-	tracker.Close()
-}
-
-func BenchmarkUDPTracker(b *testing.B) {
-	b.Run("TrackOutbound", func(b *testing.B) {
-		tracker := NewUDPTracker(DefaultUDPTimeout)
-		defer tracker.Close()
-
-		srcIP := net.ParseIP("192.168.1.1")
-		dstIP := net.ParseIP("192.168.1.2")
-
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			tracker.TrackOutbound(srcIP, dstIP, uint16(i%65535), 80)
-		}
-	})
-
-	b.Run("IsValidInbound", func(b *testing.B) {
-		tracker := NewUDPTracker(DefaultUDPTimeout)
-		defer tracker.Close()
-
-		srcIP := net.ParseIP("192.168.1.1")
-		dstIP := net.ParseIP("192.168.1.2")
-
-		// Pre-populate some connections
-		for i := 0; i < 1000; i++ {
-			tracker.TrackOutbound(srcIP, dstIP, uint16(i), 80)
-		}
-
-		b.ResetTimer()
-		for i := 0; i < b.N; i++ {
-			tracker.IsValidInbound(dstIP, srcIP, 80, uint16(i%1000))
-		}
-	})
-}

client/firewall/uspfilter/rule.go

@@ -15,8 +15,9 @@ type Rule struct {
 	ipLayer    gopacket.LayerType
 	matchByIP  bool
 	protoLayer gopacket.LayerType
-	sPort      *firewall.Port
-	dPort      *firewall.Port
+	direction  firewall.RuleDirection
+	sPort      uint16
+	dPort      uint16
 	drop       bool
 	comment    string
 

client/firewall/uspfilter/uspfilter.go

@@ -4,8 +4,6 @@ import (
 	"fmt"
 	"net"
 	"net/netip"
-	"os"
-	"strconv"
 	"sync"
 
 	"github.com/google/gopacket"
@@ -14,7 +12,6 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
@@ -22,8 +19,6 @@ import (
 
 const layerTypeAll = 0
 
-const EnvDisableConntrack = "NB_DISABLE_CONNTRACK"
-
 var (
 	errRouteNotSupported = fmt.Errorf("route not supported with userspace firewall")
 )
@@ -39,9 +34,7 @@ type RuleSet map[string]Rule
 
 // Manager userspace firewall manager
 type Manager struct {
-	// outgoingRules is used for hooks only
-	outgoingRules map[string]RuleSet
-	// incomingRules is used for filtering and hooks
+	outgoingRules  map[string]RuleSet
 	incomingRules  map[string]RuleSet
 	wgNetwork      *net.IPNet
 	decoders       sync.Pool
@@ -49,11 +42,6 @@ type Manager struct {
 	nativeFirewall firewall.Manager
 
 	mutex sync.RWMutex
-
-	stateful    bool
-	udpTracker  *conntrack.UDPTracker
-	icmpTracker *conntrack.ICMPTracker
-	tcpTracker  *conntrack.TCPTracker
 }
 
 // decoder for packages
@@ -85,8 +73,6 @@ func CreateWithNativeFirewall(iface IFaceMapper, nativeFirewall firewall.Manager
 }
 
 func create(iface IFaceMapper) (*Manager, error) {
-	disableConntrack, _ := strconv.ParseBool(os.Getenv(EnvDisableConntrack))
-
 	m := &Manager{
 		decoders: sync.Pool{
 			New: func() any {
@@ -104,16 +90,6 @@ func create(iface IFaceMapper) (*Manager, error) {
 		outgoingRules: make(map[string]RuleSet),
 		incomingRules: make(map[string]RuleSet),
 		wgIface:       iface,
-		stateful:      !disableConntrack,
-	}
-
-	// Only initialize trackers if stateful mode is enabled
-	if disableConntrack {
-		log.Info("conntrack is disabled")
-	} else {
-		m.udpTracker = conntrack.NewUDPTracker(conntrack.DefaultUDPTimeout)
-		m.icmpTracker = conntrack.NewICMPTracker(conntrack.DefaultICMPTimeout)
-		m.tcpTracker = conntrack.NewTCPTracker(conntrack.DefaultTCPTimeout)
 	}
 
 	if err := iface.SetFilter(m); err != nil {
@@ -158,8 +134,9 @@ func (m *Manager) AddPeerFiltering(
 	proto firewall.Protocol,
 	sPort *firewall.Port,
 	dPort *firewall.Port,
+	direction firewall.RuleDirection,
 	action firewall.Action,
-	_ string,
+	ipsetName string,
 	comment string,
 ) ([]firewall.Rule, error) {
 	r := Rule{
@@ -167,6 +144,7 @@ func (m *Manager) AddPeerFiltering(
 		ip:        ip,
 		ipLayer:   layers.LayerTypeIPv6,
 		matchByIP: true,
+		direction: direction,
 		drop:      action == firewall.ActionDrop,
 		comment:   comment,
 	}
@@ -179,8 +157,13 @@ func (m *Manager) AddPeerFiltering(
 		r.matchByIP = false
 	}
 
-	r.sPort = sPort
-	r.dPort = dPort
+	if sPort != nil && len(sPort.Values) == 1 {
+		r.sPort = uint16(sPort.Values[0])
+	}
+
+	if dPort != nil && len(dPort.Values) == 1 {
+		r.dPort = uint16(dPort.Values[0])
+	}
 
 	switch proto {
 	case firewall.ProtocolTCP:
@@ -197,10 +180,17 @@ func (m *Manager) AddPeerFiltering(
 	}
 
 	m.mutex.Lock()
-	if _, ok := m.incomingRules[r.ip.String()]; !ok {
-		m.incomingRules[r.ip.String()] = make(RuleSet)
+	if direction == firewall.RuleDirectionIN {
+		if _, ok := m.incomingRules[r.ip.String()]; !ok {
+			m.incomingRules[r.ip.String()] = make(RuleSet)
+		}
+		m.incomingRules[r.ip.String()][r.id] = r
+	} else {
+		if _, ok := m.outgoingRules[r.ip.String()]; !ok {
+			m.outgoingRules[r.ip.String()] = make(RuleSet)
+		}
+		m.outgoingRules[r.ip.String()][r.id] = r
 	}
-	m.incomingRules[r.ip.String()][r.id] = r
 	m.mutex.Unlock()
 	return []firewall.Rule{&r}, nil
 }
@@ -229,10 +219,19 @@ func (m *Manager) DeletePeerRule(rule firewall.Rule) error {
 		return fmt.Errorf("delete rule: invalid rule type: %T", rule)
 	}
 
-	if _, ok := m.incomingRules[r.ip.String()][r.id]; !ok {
-		return fmt.Errorf("delete rule: no rule with such id: %v", r.id)
+	if r.direction == firewall.RuleDirectionIN {
+		_, ok := m.incomingRules[r.ip.String()][r.id]
+		if !ok {
+			return fmt.Errorf("delete rule: no rule with such id: %v", r.id)
+		}
+		delete(m.incomingRules[r.ip.String()], r.id)
+	} else {
+		_, ok := m.outgoingRules[r.ip.String()][r.id]
+		if !ok {
+			return fmt.Errorf("delete rule: no rule with such id: %v", r.id)
+		}
+		delete(m.outgoingRules[r.ip.String()], r.id)
 	}
-	delete(m.incomingRules[r.ip.String()], r.id)
 
 	return nil
 }
@@ -250,250 +249,79 @@ func (m *Manager) Flush() error { return nil }
 
 // DropOutgoing filter outgoing packets
 func (m *Manager) DropOutgoing(packetData []byte) bool {
-	return m.processOutgoingHooks(packetData)
+	return m.dropFilter(packetData, m.outgoingRules, false)
 }
 
 // DropIncoming filter incoming packets
 func (m *Manager) DropIncoming(packetData []byte) bool {
-	return m.dropFilter(packetData, m.incomingRules)
+	return m.dropFilter(packetData, m.incomingRules, true)
 }
 
-// processOutgoingHooks processes UDP hooks for outgoing packets and tracks TCP/UDP/ICMP
-func (m *Manager) processOutgoingHooks(packetData []byte) bool {
+// dropFilter implements same logic for booth direction of the traffic
+func (m *Manager) dropFilter(packetData []byte, rules map[string]RuleSet, isIncomingPacket bool) bool {
 	m.mutex.RLock()
 	defer m.mutex.RUnlock()
 
 	d := m.decoders.Get().(*decoder)
 	defer m.decoders.Put(d)
 
-	if err := d.parser.DecodeLayers(packetData, &d.decoded); err != nil {
-		return false
-	}
-
-	if len(d.decoded) < 2 {
-		return false
-	}
-
-	srcIP, dstIP := m.extractIPs(d)
-	if srcIP == nil {
-		return false
-	}
-
-	// Always process UDP hooks
-	if d.decoded[1] == layers.LayerTypeUDP {
-		// Track UDP state only if enabled
-		if m.stateful {
-			m.trackUDPOutbound(d, srcIP, dstIP)
-		}
-		return m.checkUDPHooks(d, dstIP, packetData)
-	}
-
-	// Track other protocols only if stateful mode is enabled
-	if m.stateful {
-		switch d.decoded[1] {
-		case layers.LayerTypeTCP:
-			m.trackTCPOutbound(d, srcIP, dstIP)
-		case layers.LayerTypeICMPv4:
-			m.trackICMPOutbound(d, srcIP, dstIP)
-		}
-	}
-
-	return false
-}
-
-func (m *Manager) extractIPs(d *decoder) (srcIP, dstIP net.IP) {
-	switch d.decoded[0] {
-	case layers.LayerTypeIPv4:
-		return d.ip4.SrcIP, d.ip4.DstIP
-	case layers.LayerTypeIPv6:
-		return d.ip6.SrcIP, d.ip6.DstIP
-	default:
-		return nil, nil
-	}
-}
-
-func (m *Manager) trackTCPOutbound(d *decoder, srcIP, dstIP net.IP) {
-	flags := getTCPFlags(&d.tcp)
-	m.tcpTracker.TrackOutbound(
-		srcIP,
-		dstIP,
-		uint16(d.tcp.SrcPort),
-		uint16(d.tcp.DstPort),
-		flags,
-	)
-}
-
-func getTCPFlags(tcp *layers.TCP) uint8 {
-	var flags uint8
-	if tcp.SYN {
-		flags |= conntrack.TCPSyn
-	}
-	if tcp.ACK {
-		flags |= conntrack.TCPAck
-	}
-	if tcp.FIN {
-		flags |= conntrack.TCPFin
-	}
-	if tcp.RST {
-		flags |= conntrack.TCPRst
-	}
-	if tcp.PSH {
-		flags |= conntrack.TCPPush
-	}
-	if tcp.URG {
-		flags |= conntrack.TCPUrg
-	}
-	return flags
-}
-
-func (m *Manager) trackUDPOutbound(d *decoder, srcIP, dstIP net.IP) {
-	m.udpTracker.TrackOutbound(
-		srcIP,
-		dstIP,
-		uint16(d.udp.SrcPort),
-		uint16(d.udp.DstPort),
-	)
-}
-
-func (m *Manager) checkUDPHooks(d *decoder, dstIP net.IP, packetData []byte) bool {
-	for _, ipKey := range []string{dstIP.String(), "0.0.0.0", "::"} {
-		if rules, exists := m.outgoingRules[ipKey]; exists {
-			for _, rule := range rules {
-				if rule.udpHook != nil && portsMatch(rule.dPort, uint16(d.udp.DstPort)) {
-					return rule.udpHook(packetData)
-				}
-			}
-		}
-	}
-	return false
-}
-
-func (m *Manager) trackICMPOutbound(d *decoder, srcIP, dstIP net.IP) {
-	if d.icmp4.TypeCode.Type() == layers.ICMPv4TypeEchoRequest {
-		m.icmpTracker.TrackOutbound(
-			srcIP,
-			dstIP,
-			d.icmp4.Id,
-			d.icmp4.Seq,
-		)
-	}
-}
-
-// dropFilter implements filtering logic for incoming packets
-func (m *Manager) dropFilter(packetData []byte, rules map[string]RuleSet) bool {
-	// TODO: Disable router if --disable-server-router is set
-
-	m.mutex.RLock()
-	defer m.mutex.RUnlock()
-
-	d := m.decoders.Get().(*decoder)
-	defer m.decoders.Put(d)
-
-	if !m.isValidPacket(d, packetData) {
-		return true
-	}
-
-	srcIP, dstIP := m.extractIPs(d)
-	if srcIP == nil {
-		log.Errorf("unknown layer: %v", d.decoded[0])
-		return true
-	}
-
-	if !m.isWireguardTraffic(srcIP, dstIP) {
-		return false
-	}
-
-	// Check connection state only if enabled
-	if m.stateful && m.isValidTrackedConnection(d, srcIP, dstIP) {
-		return false
-	}
-
-	return m.applyRules(srcIP, packetData, rules, d)
-}
-
-func (m *Manager) isValidPacket(d *decoder, packetData []byte) bool {
 	if err := d.parser.DecodeLayers(packetData, &d.decoded); err != nil {
 		log.Tracef("couldn't decode layer, err: %s", err)
-		return false
+		return true
 	}
 
 	if len(d.decoded) < 2 {
 		log.Tracef("not enough levels in network packet")
-		return false
-	}
-	return true
-}
-
-func (m *Manager) isWireguardTraffic(srcIP, dstIP net.IP) bool {
-	return m.wgNetwork.Contains(srcIP) && m.wgNetwork.Contains(dstIP)
-}
-
-func (m *Manager) isValidTrackedConnection(d *decoder, srcIP, dstIP net.IP) bool {
-	switch d.decoded[1] {
-	case layers.LayerTypeTCP:
-		return m.tcpTracker.IsValidInbound(
-			srcIP,
-			dstIP,
-			uint16(d.tcp.SrcPort),
-			uint16(d.tcp.DstPort),
-			getTCPFlags(&d.tcp),
-		)
-
-	case layers.LayerTypeUDP:
-		return m.udpTracker.IsValidInbound(
-			srcIP,
-			dstIP,
-			uint16(d.udp.SrcPort),
-			uint16(d.udp.DstPort),
-		)
-
-	case layers.LayerTypeICMPv4:
-		return m.icmpTracker.IsValidInbound(
-			srcIP,
-			dstIP,
-			d.icmp4.Id,
-			d.icmp4.Seq,
-			d.icmp4.TypeCode.Type(),
-		)
-
-		// TODO: ICMPv6
-	}
-
-	return false
-}
-
-func (m *Manager) applyRules(srcIP net.IP, packetData []byte, rules map[string]RuleSet, d *decoder) bool {
-	if filter, ok := validateRule(srcIP, packetData, rules[srcIP.String()], d); ok {
-		return filter
-	}
-
-	if filter, ok := validateRule(srcIP, packetData, rules["0.0.0.0"], d); ok {
-		return filter
-	}
-
-	if filter, ok := validateRule(srcIP, packetData, rules["::"], d); ok {
-		return filter
-	}
-
-	// Default policy: DROP ALL
-	return true
-}
-
-func portsMatch(rulePort *firewall.Port, packetPort uint16) bool {
-	if rulePort == nil {
 		return true
 	}
 
-	if rulePort.IsRange {
-		return packetPort >= rulePort.Values[0] && packetPort <= rulePort.Values[1]
+	ipLayer := d.decoded[0]
+
+	switch ipLayer {
+	case layers.LayerTypeIPv4:
+		if !m.wgNetwork.Contains(d.ip4.SrcIP) || !m.wgNetwork.Contains(d.ip4.DstIP) {
+			return false
+		}
+	case layers.LayerTypeIPv6:
+		if !m.wgNetwork.Contains(d.ip6.SrcIP) || !m.wgNetwork.Contains(d.ip6.DstIP) {
+			return false
+		}
+	default:
+		log.Errorf("unknown layer: %v", d.decoded[0])
+		return true
 	}
 
-	for _, p := range rulePort.Values {
-		if p == packetPort {
-			return true
+	var ip net.IP
+	switch ipLayer {
+	case layers.LayerTypeIPv4:
+		if isIncomingPacket {
+			ip = d.ip4.SrcIP
+		} else {
+			ip = d.ip4.DstIP
+		}
+	case layers.LayerTypeIPv6:
+		if isIncomingPacket {
+			ip = d.ip6.SrcIP
+		} else {
+			ip = d.ip6.DstIP
 		}
 	}
-	return false
+
+	filter, ok := validateRule(ip, packetData, rules[ip.String()], d)
+	if ok {
+		return filter
+	}
+	filter, ok = validateRule(ip, packetData, rules["0.0.0.0"], d)
+	if ok {
+		return filter
+	}
+	filter, ok = validateRule(ip, packetData, rules["::"], d)
+	if ok {
+		return filter
+	}
+
+	// default policy is DROP ALL
+	return true
 }
 
 func validateRule(ip net.IP, packetData []byte, rules map[string]Rule, d *decoder) (bool, bool) {
@@ -513,7 +341,13 @@ func validateRule(ip net.IP, packetData []byte, rules map[string]Rule, d *decode
 
 		switch payloadLayer {
 		case layers.LayerTypeTCP:
-			if portsMatch(rule.sPort, uint16(d.tcp.SrcPort)) && portsMatch(rule.dPort, uint16(d.tcp.DstPort)) {
+			if rule.sPort == 0 && rule.dPort == 0 {
+				return rule.drop, true
+			}
+			if rule.sPort != 0 && rule.sPort == uint16(d.tcp.SrcPort) {
+				return rule.drop, true
+			}
+			if rule.dPort != 0 && rule.dPort == uint16(d.tcp.DstPort) {
 				return rule.drop, true
 			}
 		case layers.LayerTypeUDP:
@@ -523,7 +357,13 @@ func validateRule(ip net.IP, packetData []byte, rules map[string]Rule, d *decode
 				return rule.udpHook(packetData), true
 			}
 
-			if portsMatch(rule.sPort, uint16(d.udp.SrcPort)) && portsMatch(rule.dPort, uint16(d.udp.DstPort)) {
+			if rule.sPort == 0 && rule.dPort == 0 {
+				return rule.drop, true
+			}
+			if rule.sPort != 0 && rule.sPort == uint16(d.udp.SrcPort) {
+				return rule.drop, true
+			}
+			if rule.dPort != 0 && rule.dPort == uint16(d.udp.DstPort) {
 				return rule.drop, true
 			}
 		case layers.LayerTypeICMPv4, layers.LayerTypeICMPv6:
@@ -548,8 +388,9 @@ func (m *Manager) AddUDPPacketHook(
 		id:         uuid.New().String(),
 		ip:         ip,
 		protoLayer: layers.LayerTypeUDP,
-		dPort:      &firewall.Port{Values: []uint16{dPort}},
+		dPort:      dPort,
 		ipLayer:    layers.LayerTypeIPv6,
+		direction:  firewall.RuleDirectionOUT,
 		comment:    fmt.Sprintf("UDP Hook direction: %v, ip:%v, dport:%d", in, ip, dPort),
 		udpHook:    hook,
 	}
@@ -560,6 +401,7 @@ func (m *Manager) AddUDPPacketHook(
 
 	m.mutex.Lock()
 	if in {
+		r.direction = firewall.RuleDirectionIN
 		if _, ok := m.incomingRules[r.ip.String()]; !ok {
 			m.incomingRules[r.ip.String()] = make(map[string]Rule)
 		}
@@ -578,22 +420,19 @@ func (m *Manager) AddUDPPacketHook(
 
 // RemovePacketHook removes packet hook by given ID
 func (m *Manager) RemovePacketHook(hookID string) error {
-	m.mutex.Lock()
-	defer m.mutex.Unlock()
-
 	for _, arr := range m.incomingRules {
 		for _, r := range arr {
 			if r.id == hookID {
-				delete(arr, r.id)
-				return nil
+				rule := r
+				return m.DeletePeerRule(&rule)
 			}
 		}
 	}
 	for _, arr := range m.outgoingRules {
 		for _, r := range arr {
 			if r.id == hookID {
-				delete(arr, r.id)
-				return nil
+				rule := r
+				return m.DeletePeerRule(&rule)
 			}
 		}
 	}

client/firewall/uspfilter/uspfilter_bench_test.go

@@ -1,998 +0,0 @@
-package uspfilter
-
-import (
-	"fmt"
-	"math/rand"
-	"net"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/google/gopacket"
-	"github.com/google/gopacket/layers"
-	"github.com/stretchr/testify/require"
-
-	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
-	"github.com/netbirdio/netbird/client/iface/device"
-)
-
-// generateRandomIPs generates n different random IPs in the 100.64.0.0/10 range
-func generateRandomIPs(n int) []net.IP {
-	ips := make([]net.IP, n)
-	seen := make(map[string]bool)
-
-	for i := 0; i < n; {
-		ip := make(net.IP, 4)
-		ip[0] = 100
-		ip[1] = byte(64 + rand.Intn(63)) // 64-126
-		ip[2] = byte(rand.Intn(256))
-		ip[3] = byte(1 + rand.Intn(254)) // avoid .0 and .255
-
-		key := ip.String()
-		if !seen[key] {
-			ips[i] = ip
-			seen[key] = true
-			i++
-		}
-	}
-	return ips
-}
-
-func generatePacket(b *testing.B, srcIP, dstIP net.IP, srcPort, dstPort uint16, protocol layers.IPProtocol) []byte {
-	b.Helper()
-
-	ipv4 := &layers.IPv4{
-		TTL:      64,
-		Version:  4,
-		SrcIP:    srcIP,
-		DstIP:    dstIP,
-		Protocol: protocol,
-	}
-
-	var transportLayer gopacket.SerializableLayer
-	switch protocol {
-	case layers.IPProtocolTCP:
-		tcp := &layers.TCP{
-			SrcPort: layers.TCPPort(srcPort),
-			DstPort: layers.TCPPort(dstPort),
-			SYN:     true,
-		}
-		require.NoError(b, tcp.SetNetworkLayerForChecksum(ipv4))
-		transportLayer = tcp
-	case layers.IPProtocolUDP:
-		udp := &layers.UDP{
-			SrcPort: layers.UDPPort(srcPort),
-			DstPort: layers.UDPPort(dstPort),
-		}
-		require.NoError(b, udp.SetNetworkLayerForChecksum(ipv4))
-		transportLayer = udp
-	}
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	err := gopacket.SerializeLayers(buf, opts, ipv4, transportLayer, gopacket.Payload("test"))
-	require.NoError(b, err)
-	return buf.Bytes()
-}
-
-// BenchmarkCoreFiltering focuses on the essential performance comparisons between
-// stateful and stateless filtering approaches
-func BenchmarkCoreFiltering(b *testing.B) {
-	scenarios := []struct {
-		name      string
-		stateful  bool
-		setupFunc func(*Manager)
-		desc      string
-	}{
-		{
-			name:     "stateless_single_allow_all",
-			stateful: false,
-			setupFunc: func(m *Manager) {
-				// Single rule allowing all traffic
-				_, err := m.AddPeerFiltering(net.ParseIP("0.0.0.0"), fw.ProtocolALL, nil, nil,
-					fw.ActionAccept, "", "allow all")
-				require.NoError(b, err)
-			},
-			desc: "Baseline: Single 'allow all' rule without connection tracking",
-		},
-		{
-			name:     "stateful_no_rules",
-			stateful: true,
-			setupFunc: func(m *Manager) {
-				// No explicit rules - rely purely on connection tracking
-			},
-			desc: "Pure connection tracking without any rules",
-		},
-		{
-			name:     "stateless_explicit_return",
-			stateful: false,
-			setupFunc: func(m *Manager) {
-				// Add explicit rules matching return traffic pattern
-				for i := 0; i < 1000; i++ { // Simulate realistic ruleset size
-					ip := generateRandomIPs(1)[0]
-					_, err := m.AddPeerFiltering(ip, fw.ProtocolTCP,
-						&fw.Port{Values: []uint16{uint16(1024 + i)}},
-						&fw.Port{Values: []uint16{80}},
-						fw.ActionAccept, "", "explicit return")
-					require.NoError(b, err)
-				}
-			},
-			desc: "Explicit rules matching return traffic patterns without state",
-		},
-		{
-			name:     "stateful_with_established",
-			stateful: true,
-			setupFunc: func(m *Manager) {
-				// Add some basic rules but rely on state for established connections
-				_, err := m.AddPeerFiltering(net.ParseIP("0.0.0.0"), fw.ProtocolTCP, nil, nil,
-					fw.ActionDrop, "", "default drop")
-				require.NoError(b, err)
-			},
-			desc: "Connection tracking with established connections",
-		},
-	}
-
-	// Test both TCP and UDP
-	protocols := []struct {
-		name  string
-		proto layers.IPProtocol
-	}{
-		{"TCP", layers.IPProtocolTCP},
-		{"UDP", layers.IPProtocolUDP},
-	}
-
-	for _, sc := range scenarios {
-		for _, proto := range protocols {
-			b.Run(fmt.Sprintf("%s_%s", sc.name, proto.name), func(b *testing.B) {
-				// Configure stateful/stateless mode
-				if !sc.stateful {
-					require.NoError(b, os.Setenv("NB_DISABLE_CONNTRACK", "1"))
-				} else {
-					require.NoError(b, os.Setenv("NB_CONNTRACK_TIMEOUT", "1m"))
-				}
-
-				// Create manager and basic setup
-				manager, _ := Create(&IFaceMock{
-					SetFilterFunc: func(device.PacketFilter) error { return nil },
-				})
-				defer b.Cleanup(func() {
-					require.NoError(b, manager.Reset(nil))
-				})
-
-				manager.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("100.64.0.0"),
-					Mask: net.CIDRMask(10, 32),
-				}
-
-				// Apply scenario-specific setup
-				sc.setupFunc(manager)
-
-				// Generate test packets
-				srcIP := generateRandomIPs(1)[0]
-				dstIP := generateRandomIPs(1)[0]
-				srcPort := uint16(1024 + b.N%60000)
-				dstPort := uint16(80)
-
-				outbound := generatePacket(b, srcIP, dstIP, srcPort, dstPort, proto.proto)
-				inbound := generatePacket(b, dstIP, srcIP, dstPort, srcPort, proto.proto)
-
-				// For stateful scenarios, establish the connection
-				if sc.stateful {
-					manager.processOutgoingHooks(outbound)
-				}
-
-				// Measure inbound packet processing
-				b.ResetTimer()
-				for i := 0; i < b.N; i++ {
-					manager.dropFilter(inbound, manager.incomingRules)
-				}
-			})
-		}
-	}
-}
-
-// BenchmarkStateScaling measures how performance scales with connection table size
-func BenchmarkStateScaling(b *testing.B) {
-	connCounts := []int{100, 1000, 10000, 100000}
-
-	for _, count := range connCounts {
-		b.Run(fmt.Sprintf("conns_%d", count), func(b *testing.B) {
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			})
-			b.Cleanup(func() {
-				require.NoError(b, manager.Reset(nil))
-			})
-
-			manager.wgNetwork = &net.IPNet{
-				IP:   net.ParseIP("100.64.0.0"),
-				Mask: net.CIDRMask(10, 32),
-			}
-
-			// Pre-populate connection table
-			srcIPs := generateRandomIPs(count)
-			dstIPs := generateRandomIPs(count)
-			for i := 0; i < count; i++ {
-				outbound := generatePacket(b, srcIPs[i], dstIPs[i],
-					uint16(1024+i), 80, layers.IPProtocolTCP)
-				manager.processOutgoingHooks(outbound)
-			}
-
-			// Test packet
-			testOut := generatePacket(b, srcIPs[0], dstIPs[0], 1024, 80, layers.IPProtocolTCP)
-			testIn := generatePacket(b, dstIPs[0], srcIPs[0], 80, 1024, layers.IPProtocolTCP)
-
-			// First establish our test connection
-			manager.processOutgoingHooks(testOut)
-
-			b.ResetTimer()
-			for i := 0; i < b.N; i++ {
-				manager.dropFilter(testIn, manager.incomingRules)
-			}
-		})
-	}
-}
-
-// BenchmarkEstablishmentOverhead measures the overhead of connection establishment
-func BenchmarkEstablishmentOverhead(b *testing.B) {
-	scenarios := []struct {
-		name        string
-		established bool
-	}{
-		{"established", true},
-		{"new", false},
-	}
-
-	for _, sc := range scenarios {
-		b.Run(sc.name, func(b *testing.B) {
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			})
-			b.Cleanup(func() {
-				require.NoError(b, manager.Reset(nil))
-			})
-
-			manager.wgNetwork = &net.IPNet{
-				IP:   net.ParseIP("100.64.0.0"),
-				Mask: net.CIDRMask(10, 32),
-			}
-
-			srcIP := generateRandomIPs(1)[0]
-			dstIP := generateRandomIPs(1)[0]
-			outbound := generatePacket(b, srcIP, dstIP, 1024, 80, layers.IPProtocolTCP)
-			inbound := generatePacket(b, dstIP, srcIP, 80, 1024, layers.IPProtocolTCP)
-
-			if sc.established {
-				manager.processOutgoingHooks(outbound)
-			}
-
-			b.ResetTimer()
-			for i := 0; i < b.N; i++ {
-				manager.dropFilter(inbound, manager.incomingRules)
-			}
-		})
-	}
-}
-
-// BenchmarkRoutedNetworkReturn compares approaches for handling routed network return traffic
-func BenchmarkRoutedNetworkReturn(b *testing.B) {
-	scenarios := []struct {
-		name       string
-		proto      layers.IPProtocol
-		state      string // "new", "established", "post_handshake" (TCP only)
-		setupFunc  func(*Manager)
-		genPackets func(net.IP, net.IP) ([]byte, []byte) // generates appropriate packets for the scenario
-		desc       string
-	}{
-		{
-			name:  "allow_non_wg_tcp_new",
-			proto: layers.IPProtocolTCP,
-			state: "new",
-			setupFunc: func(m *Manager) {
-				m.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("100.64.0.0"),
-					Mask: net.CIDRMask(10, 32),
-				}
-				b.Setenv("NB_DISABLE_CONNTRACK", "1")
-			},
-			genPackets: func(srcIP, dstIP net.IP) ([]byte, []byte) {
-				return generatePacket(b, srcIP, dstIP, 1024, 80, layers.IPProtocolTCP),
-					generatePacket(b, dstIP, srcIP, 80, 1024, layers.IPProtocolTCP)
-			},
-			desc: "Allow non-WG: TCP new connection",
-		},
-		{
-			name:  "allow_non_wg_tcp_established",
-			proto: layers.IPProtocolTCP,
-			state: "established",
-			setupFunc: func(m *Manager) {
-				m.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("100.64.0.0"),
-					Mask: net.CIDRMask(10, 32),
-				}
-				b.Setenv("NB_DISABLE_CONNTRACK", "1")
-			},
-			genPackets: func(srcIP, dstIP net.IP) ([]byte, []byte) {
-				// Generate packets with ACK flag for established connection
-				return generateTCPPacketWithFlags(b, srcIP, dstIP, 1024, 80, uint16(conntrack.TCPAck)),
-					generateTCPPacketWithFlags(b, dstIP, srcIP, 80, 1024, uint16(conntrack.TCPAck))
-			},
-			desc: "Allow non-WG: TCP established connection",
-		},
-		{
-			name:  "allow_non_wg_udp_new",
-			proto: layers.IPProtocolUDP,
-			state: "new",
-			setupFunc: func(m *Manager) {
-				m.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("100.64.0.0"),
-					Mask: net.CIDRMask(10, 32),
-				}
-				b.Setenv("NB_DISABLE_CONNTRACK", "1")
-			},
-			genPackets: func(srcIP, dstIP net.IP) ([]byte, []byte) {
-				return generatePacket(b, srcIP, dstIP, 1024, 80, layers.IPProtocolUDP),
-					generatePacket(b, dstIP, srcIP, 80, 1024, layers.IPProtocolUDP)
-			},
-			desc: "Allow non-WG: UDP new connection",
-		},
-		{
-			name:  "allow_non_wg_udp_established",
-			proto: layers.IPProtocolUDP,
-			state: "established",
-			setupFunc: func(m *Manager) {
-				m.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("100.64.0.0"),
-					Mask: net.CIDRMask(10, 32),
-				}
-				b.Setenv("NB_DISABLE_CONNTRACK", "1")
-			},
-			genPackets: func(srcIP, dstIP net.IP) ([]byte, []byte) {
-				return generatePacket(b, srcIP, dstIP, 1024, 80, layers.IPProtocolUDP),
-					generatePacket(b, dstIP, srcIP, 80, 1024, layers.IPProtocolUDP)
-			},
-			desc: "Allow non-WG: UDP established connection",
-		},
-		{
-			name:  "stateful_tcp_new",
-			proto: layers.IPProtocolTCP,
-			state: "new",
-			setupFunc: func(m *Manager) {
-				m.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("0.0.0.0"),
-					Mask: net.CIDRMask(0, 32),
-				}
-				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
-			},
-			genPackets: func(srcIP, dstIP net.IP) ([]byte, []byte) {
-				return generatePacket(b, srcIP, dstIP, 1024, 80, layers.IPProtocolTCP),
-					generatePacket(b, dstIP, srcIP, 80, 1024, layers.IPProtocolTCP)
-			},
-			desc: "Stateful: TCP new connection",
-		},
-		{
-			name:  "stateful_tcp_established",
-			proto: layers.IPProtocolTCP,
-			state: "established",
-			setupFunc: func(m *Manager) {
-				m.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("0.0.0.0"),
-					Mask: net.CIDRMask(0, 32),
-				}
-				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
-			},
-			genPackets: func(srcIP, dstIP net.IP) ([]byte, []byte) {
-				// Generate established TCP packets (ACK flag)
-				return generateTCPPacketWithFlags(b, srcIP, dstIP, 1024, 80, uint16(conntrack.TCPAck)),
-					generateTCPPacketWithFlags(b, dstIP, srcIP, 80, 1024, uint16(conntrack.TCPAck))
-			},
-			desc: "Stateful: TCP established connection",
-		},
-		{
-			name:  "stateful_tcp_post_handshake",
-			proto: layers.IPProtocolTCP,
-			state: "post_handshake",
-			setupFunc: func(m *Manager) {
-				m.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("0.0.0.0"),
-					Mask: net.CIDRMask(0, 32),
-				}
-				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
-			},
-			genPackets: func(srcIP, dstIP net.IP) ([]byte, []byte) {
-				// Generate packets with PSH+ACK flags for data transfer
-				return generateTCPPacketWithFlags(b, srcIP, dstIP, 1024, 80, uint16(conntrack.TCPPush|conntrack.TCPAck)),
-					generateTCPPacketWithFlags(b, dstIP, srcIP, 80, 1024, uint16(conntrack.TCPPush|conntrack.TCPAck))
-			},
-			desc: "Stateful: TCP post-handshake data transfer",
-		},
-		{
-			name:  "stateful_udp_new",
-			proto: layers.IPProtocolUDP,
-			state: "new",
-			setupFunc: func(m *Manager) {
-				m.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("0.0.0.0"),
-					Mask: net.CIDRMask(0, 32),
-				}
-				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
-			},
-			genPackets: func(srcIP, dstIP net.IP) ([]byte, []byte) {
-				return generatePacket(b, srcIP, dstIP, 1024, 80, layers.IPProtocolUDP),
-					generatePacket(b, dstIP, srcIP, 80, 1024, layers.IPProtocolUDP)
-			},
-			desc: "Stateful: UDP new connection",
-		},
-		{
-			name:  "stateful_udp_established",
-			proto: layers.IPProtocolUDP,
-			state: "established",
-			setupFunc: func(m *Manager) {
-				m.wgNetwork = &net.IPNet{
-					IP:   net.ParseIP("0.0.0.0"),
-					Mask: net.CIDRMask(0, 32),
-				}
-				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
-			},
-			genPackets: func(srcIP, dstIP net.IP) ([]byte, []byte) {
-				return generatePacket(b, srcIP, dstIP, 1024, 80, layers.IPProtocolUDP),
-					generatePacket(b, dstIP, srcIP, 80, 1024, layers.IPProtocolUDP)
-			},
-			desc: "Stateful: UDP established connection",
-		},
-	}
-
-	for _, sc := range scenarios {
-		b.Run(sc.name, func(b *testing.B) {
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			})
-			b.Cleanup(func() {
-				require.NoError(b, manager.Reset(nil))
-			})
-
-			// Setup scenario
-			sc.setupFunc(manager)
-
-			// Use IPs outside WG range for routed network simulation
-			srcIP := net.ParseIP("192.168.1.2")
-			dstIP := net.ParseIP("8.8.8.8")
-			outbound, inbound := sc.genPackets(srcIP, dstIP)
-
-			// For stateful cases and established connections
-			if !strings.Contains(sc.name, "allow_non_wg") ||
-				(strings.Contains(sc.state, "established") || sc.state == "post_handshake") {
-				manager.processOutgoingHooks(outbound)
-
-				// For TCP post-handshake, simulate full handshake
-				if sc.state == "post_handshake" {
-					// SYN
-					syn := generateTCPPacketWithFlags(b, srcIP, dstIP, 1024, 80, uint16(conntrack.TCPSyn))
-					manager.processOutgoingHooks(syn)
-					// SYN-ACK
-					synack := generateTCPPacketWithFlags(b, dstIP, srcIP, 80, 1024, uint16(conntrack.TCPSyn|conntrack.TCPAck))
-					manager.dropFilter(synack, manager.incomingRules)
-					// ACK
-					ack := generateTCPPacketWithFlags(b, srcIP, dstIP, 1024, 80, uint16(conntrack.TCPAck))
-					manager.processOutgoingHooks(ack)
-				}
-			}
-
-			b.ResetTimer()
-			for i := 0; i < b.N; i++ {
-				manager.dropFilter(inbound, manager.incomingRules)
-			}
-		})
-	}
-}
-
-var scenarios = []struct {
-	name      string
-	stateful  bool // Whether conntrack is enabled
-	rules     bool // Whether to add return traffic rules
-	routed    bool // Whether to test routed network traffic
-	connCount int  // Number of concurrent connections
-	desc      string
-}{
-	{
-		name:      "stateless_with_rules_100conns",
-		stateful:  false,
-		rules:     true,
-		routed:    false,
-		connCount: 100,
-		desc:      "Pure stateless with return traffic rules, 100 conns",
-	},
-	{
-		name:      "stateless_with_rules_1000conns",
-		stateful:  false,
-		rules:     true,
-		routed:    false,
-		connCount: 1000,
-		desc:      "Pure stateless with return traffic rules, 1000 conns",
-	},
-	{
-		name:      "stateful_no_rules_100conns",
-		stateful:  true,
-		rules:     false,
-		routed:    false,
-		connCount: 100,
-		desc:      "Pure stateful tracking without rules, 100 conns",
-	},
-	{
-		name:      "stateful_no_rules_1000conns",
-		stateful:  true,
-		rules:     false,
-		routed:    false,
-		connCount: 1000,
-		desc:      "Pure stateful tracking without rules, 1000 conns",
-	},
-	{
-		name:      "stateful_with_rules_100conns",
-		stateful:  true,
-		rules:     true,
-		routed:    false,
-		connCount: 100,
-		desc:      "Combined stateful + rules (current implementation), 100 conns",
-	},
-	{
-		name:      "stateful_with_rules_1000conns",
-		stateful:  true,
-		rules:     true,
-		routed:    false,
-		connCount: 1000,
-		desc:      "Combined stateful + rules (current implementation), 1000 conns",
-	},
-	{
-		name:      "routed_network_100conns",
-		stateful:  true,
-		rules:     false,
-		routed:    true,
-		connCount: 100,
-		desc:      "Routed network traffic (non-WG), 100 conns",
-	},
-	{
-		name:      "routed_network_1000conns",
-		stateful:  true,
-		rules:     false,
-		routed:    true,
-		connCount: 1000,
-		desc:      "Routed network traffic (non-WG), 1000 conns",
-	},
-}
-
-// BenchmarkLongLivedConnections tests performance with realistic TCP traffic patterns
-func BenchmarkLongLivedConnections(b *testing.B) {
-	for _, sc := range scenarios {
-		b.Run(sc.name, func(b *testing.B) {
-			// Configure stateful/stateless mode
-			if !sc.stateful {
-				b.Setenv("NB_DISABLE_CONNTRACK", "1")
-			} else {
-				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
-			}
-
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			})
-			defer b.Cleanup(func() {
-				require.NoError(b, manager.Reset(nil))
-			})
-
-			manager.SetNetwork(&net.IPNet{
-				IP:   net.ParseIP("100.64.0.0"),
-				Mask: net.CIDRMask(10, 32),
-			})
-
-			// Setup initial state based on scenario
-			if sc.rules {
-				// Single rule to allow all return traffic from port 80
-				_, err := manager.AddPeerFiltering(net.ParseIP("0.0.0.0"), fw.ProtocolTCP,
-					&fw.Port{Values: []uint16{80}},
-					nil,
-					fw.ActionAccept, "", "return traffic")
-				require.NoError(b, err)
-			}
-
-			// Generate IPs for connections
-			srcIPs := make([]net.IP, sc.connCount)
-			dstIPs := make([]net.IP, sc.connCount)
-
-			for i := 0; i < sc.connCount; i++ {
-				if sc.routed {
-					srcIPs[i] = net.IPv4(192, 168, 1, byte(2+(i%250))).To4()
-					dstIPs[i] = net.IPv4(8, 8, byte((i/250)%255), byte(2+(i%250))).To4()
-				} else {
-					srcIPs[i] = generateRandomIPs(1)[0]
-					dstIPs[i] = generateRandomIPs(1)[0]
-				}
-			}
-
-			// Create established connections
-			for i := 0; i < sc.connCount; i++ {
-				// Initial SYN
-				syn := generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-					uint16(1024+i), 80, uint16(conntrack.TCPSyn))
-				manager.processOutgoingHooks(syn)
-
-				// SYN-ACK
-				synack := generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-					80, uint16(1024+i), uint16(conntrack.TCPSyn|conntrack.TCPAck))
-				manager.dropFilter(synack, manager.incomingRules)
-
-				// ACK
-				ack := generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-					uint16(1024+i), 80, uint16(conntrack.TCPAck))
-				manager.processOutgoingHooks(ack)
-			}
-
-			// Prepare test packets simulating bidirectional traffic
-			inPackets := make([][]byte, sc.connCount)
-			outPackets := make([][]byte, sc.connCount)
-			for i := 0; i < sc.connCount; i++ {
-				// Server -> Client (inbound)
-				inPackets[i] = generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-					80, uint16(1024+i), uint16(conntrack.TCPPush|conntrack.TCPAck))
-				// Client -> Server (outbound)
-				outPackets[i] = generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-					uint16(1024+i), 80, uint16(conntrack.TCPPush|conntrack.TCPAck))
-			}
-
-			b.ResetTimer()
-			for i := 0; i < b.N; i++ {
-				connIdx := i % sc.connCount
-
-				// Simulate bidirectional traffic
-				// First outbound data
-				manager.processOutgoingHooks(outPackets[connIdx])
-				// Then inbound response - this is what we're actually measuring
-				manager.dropFilter(inPackets[connIdx], manager.incomingRules)
-			}
-		})
-	}
-}
-
-// BenchmarkShortLivedConnections tests performance with many short-lived connections
-func BenchmarkShortLivedConnections(b *testing.B) {
-	for _, sc := range scenarios {
-		b.Run(sc.name, func(b *testing.B) {
-			// Configure stateful/stateless mode
-			if !sc.stateful {
-				b.Setenv("NB_DISABLE_CONNTRACK", "1")
-			} else {
-				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
-			}
-
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			})
-			defer b.Cleanup(func() {
-				require.NoError(b, manager.Reset(nil))
-			})
-
-			manager.SetNetwork(&net.IPNet{
-				IP:   net.ParseIP("100.64.0.0"),
-				Mask: net.CIDRMask(10, 32),
-			})
-
-			// Setup initial state based on scenario
-			if sc.rules {
-				// Single rule to allow all return traffic from port 80
-				_, err := manager.AddPeerFiltering(net.ParseIP("0.0.0.0"), fw.ProtocolTCP,
-					&fw.Port{Values: []uint16{80}},
-					nil,
-					fw.ActionAccept, "", "return traffic")
-				require.NoError(b, err)
-			}
-
-			// Generate IPs for connections
-			srcIPs := make([]net.IP, sc.connCount)
-			dstIPs := make([]net.IP, sc.connCount)
-
-			for i := 0; i < sc.connCount; i++ {
-				if sc.routed {
-					srcIPs[i] = net.IPv4(192, 168, 1, byte(2+(i%250))).To4()
-					dstIPs[i] = net.IPv4(8, 8, byte((i/250)%255), byte(2+(i%250))).To4()
-				} else {
-					srcIPs[i] = generateRandomIPs(1)[0]
-					dstIPs[i] = generateRandomIPs(1)[0]
-				}
-			}
-
-			// Create packet patterns for a complete HTTP-like short connection:
-			// 1. Initial handshake (SYN, SYN-ACK, ACK)
-			// 2. HTTP Request (PSH+ACK from client)
-			// 3. HTTP Response (PSH+ACK from server)
-			// 4. Connection teardown (FIN+ACK, ACK, FIN+ACK, ACK)
-			type connPackets struct {
-				syn       []byte
-				synAck    []byte
-				ack       []byte
-				request   []byte
-				response  []byte
-				finClient []byte
-				ackServer []byte
-				finServer []byte
-				ackClient []byte
-			}
-
-			// Generate all possible connection patterns
-			patterns := make([]connPackets, sc.connCount)
-			for i := 0; i < sc.connCount; i++ {
-				patterns[i] = connPackets{
-					// Handshake
-					syn: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPSyn)),
-					synAck: generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-						80, uint16(1024+i), uint16(conntrack.TCPSyn|conntrack.TCPAck)),
-					ack: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPAck)),
-
-					// Data transfer
-					request: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPPush|conntrack.TCPAck)),
-					response: generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-						80, uint16(1024+i), uint16(conntrack.TCPPush|conntrack.TCPAck)),
-
-					// Connection teardown
-					finClient: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPFin|conntrack.TCPAck)),
-					ackServer: generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-						80, uint16(1024+i), uint16(conntrack.TCPAck)),
-					finServer: generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-						80, uint16(1024+i), uint16(conntrack.TCPFin|conntrack.TCPAck)),
-					ackClient: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPAck)),
-				}
-			}
-
-			b.ResetTimer()
-			for i := 0; i < b.N; i++ {
-				// Each iteration creates a new short-lived connection
-				connIdx := i % sc.connCount
-				p := patterns[connIdx]
-
-				// Connection establishment
-				manager.processOutgoingHooks(p.syn)
-				manager.dropFilter(p.synAck, manager.incomingRules)
-				manager.processOutgoingHooks(p.ack)
-
-				// Data transfer
-				manager.processOutgoingHooks(p.request)
-				manager.dropFilter(p.response, manager.incomingRules)
-
-				// Connection teardown
-				manager.processOutgoingHooks(p.finClient)
-				manager.dropFilter(p.ackServer, manager.incomingRules)
-				manager.dropFilter(p.finServer, manager.incomingRules)
-				manager.processOutgoingHooks(p.ackClient)
-			}
-		})
-	}
-}
-
-// BenchmarkParallelLongLivedConnections tests performance with realistic TCP traffic patterns in parallel
-func BenchmarkParallelLongLivedConnections(b *testing.B) {
-	for _, sc := range scenarios {
-		b.Run(sc.name, func(b *testing.B) {
-			// Configure stateful/stateless mode
-			if !sc.stateful {
-				b.Setenv("NB_DISABLE_CONNTRACK", "1")
-			} else {
-				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
-			}
-
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			})
-			defer b.Cleanup(func() {
-				require.NoError(b, manager.Reset(nil))
-			})
-
-			manager.SetNetwork(&net.IPNet{
-				IP:   net.ParseIP("100.64.0.0"),
-				Mask: net.CIDRMask(10, 32),
-			})
-
-			// Setup initial state based on scenario
-			if sc.rules {
-				_, err := manager.AddPeerFiltering(net.ParseIP("0.0.0.0"), fw.ProtocolTCP,
-					&fw.Port{Values: []uint16{80}},
-					nil,
-					fw.ActionAccept, "", "return traffic")
-				require.NoError(b, err)
-			}
-
-			// Generate IPs for connections
-			srcIPs := make([]net.IP, sc.connCount)
-			dstIPs := make([]net.IP, sc.connCount)
-
-			for i := 0; i < sc.connCount; i++ {
-				if sc.routed {
-					srcIPs[i] = net.IPv4(192, 168, 1, byte(2+(i%250))).To4()
-					dstIPs[i] = net.IPv4(8, 8, byte((i/250)%255), byte(2+(i%250))).To4()
-				} else {
-					srcIPs[i] = generateRandomIPs(1)[0]
-					dstIPs[i] = generateRandomIPs(1)[0]
-				}
-			}
-
-			// Create established connections
-			for i := 0; i < sc.connCount; i++ {
-				syn := generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-					uint16(1024+i), 80, uint16(conntrack.TCPSyn))
-				manager.processOutgoingHooks(syn)
-
-				synack := generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-					80, uint16(1024+i), uint16(conntrack.TCPSyn|conntrack.TCPAck))
-				manager.dropFilter(synack, manager.incomingRules)
-
-				ack := generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-					uint16(1024+i), 80, uint16(conntrack.TCPAck))
-				manager.processOutgoingHooks(ack)
-			}
-
-			// Pre-generate test packets
-			inPackets := make([][]byte, sc.connCount)
-			outPackets := make([][]byte, sc.connCount)
-			for i := 0; i < sc.connCount; i++ {
-				inPackets[i] = generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-					80, uint16(1024+i), uint16(conntrack.TCPPush|conntrack.TCPAck))
-				outPackets[i] = generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-					uint16(1024+i), 80, uint16(conntrack.TCPPush|conntrack.TCPAck))
-			}
-
-			b.ResetTimer()
-			b.RunParallel(func(pb *testing.PB) {
-				// Each goroutine gets its own counter to distribute load
-				counter := 0
-				for pb.Next() {
-					connIdx := counter % sc.connCount
-					counter++
-
-					// Simulate bidirectional traffic
-					manager.processOutgoingHooks(outPackets[connIdx])
-					manager.dropFilter(inPackets[connIdx], manager.incomingRules)
-				}
-			})
-		})
-	}
-}
-
-// BenchmarkParallelShortLivedConnections tests performance with many short-lived connections in parallel
-func BenchmarkParallelShortLivedConnections(b *testing.B) {
-	for _, sc := range scenarios {
-		b.Run(sc.name, func(b *testing.B) {
-			// Configure stateful/stateless mode
-			if !sc.stateful {
-				b.Setenv("NB_DISABLE_CONNTRACK", "1")
-			} else {
-				require.NoError(b, os.Unsetenv("NB_DISABLE_CONNTRACK"))
-			}
-
-			manager, _ := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			})
-			defer b.Cleanup(func() {
-				require.NoError(b, manager.Reset(nil))
-			})
-
-			manager.SetNetwork(&net.IPNet{
-				IP:   net.ParseIP("100.64.0.0"),
-				Mask: net.CIDRMask(10, 32),
-			})
-
-			if sc.rules {
-				_, err := manager.AddPeerFiltering(net.ParseIP("0.0.0.0"), fw.ProtocolTCP,
-					&fw.Port{Values: []uint16{80}},
-					nil,
-					fw.ActionAccept, "", "return traffic")
-				require.NoError(b, err)
-			}
-
-			// Generate IPs and pre-generate all packet patterns
-			srcIPs := make([]net.IP, sc.connCount)
-			dstIPs := make([]net.IP, sc.connCount)
-			for i := 0; i < sc.connCount; i++ {
-				if sc.routed {
-					srcIPs[i] = net.IPv4(192, 168, 1, byte(2+(i%250))).To4()
-					dstIPs[i] = net.IPv4(8, 8, byte((i/250)%255), byte(2+(i%250))).To4()
-				} else {
-					srcIPs[i] = generateRandomIPs(1)[0]
-					dstIPs[i] = generateRandomIPs(1)[0]
-				}
-			}
-
-			type connPackets struct {
-				syn       []byte
-				synAck    []byte
-				ack       []byte
-				request   []byte
-				response  []byte
-				finClient []byte
-				ackServer []byte
-				finServer []byte
-				ackClient []byte
-			}
-
-			patterns := make([]connPackets, sc.connCount)
-			for i := 0; i < sc.connCount; i++ {
-				patterns[i] = connPackets{
-					syn: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPSyn)),
-					synAck: generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-						80, uint16(1024+i), uint16(conntrack.TCPSyn|conntrack.TCPAck)),
-					ack: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPAck)),
-					request: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPPush|conntrack.TCPAck)),
-					response: generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-						80, uint16(1024+i), uint16(conntrack.TCPPush|conntrack.TCPAck)),
-					finClient: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPFin|conntrack.TCPAck)),
-					ackServer: generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-						80, uint16(1024+i), uint16(conntrack.TCPAck)),
-					finServer: generateTCPPacketWithFlags(b, dstIPs[i], srcIPs[i],
-						80, uint16(1024+i), uint16(conntrack.TCPFin|conntrack.TCPAck)),
-					ackClient: generateTCPPacketWithFlags(b, srcIPs[i], dstIPs[i],
-						uint16(1024+i), 80, uint16(conntrack.TCPAck)),
-				}
-			}
-
-			b.ResetTimer()
-			b.RunParallel(func(pb *testing.PB) {
-				counter := 0
-				for pb.Next() {
-					connIdx := counter % sc.connCount
-					counter++
-					p := patterns[connIdx]
-
-					// Full connection lifecycle
-					manager.processOutgoingHooks(p.syn)
-					manager.dropFilter(p.synAck, manager.incomingRules)
-					manager.processOutgoingHooks(p.ack)
-
-					manager.processOutgoingHooks(p.request)
-					manager.dropFilter(p.response, manager.incomingRules)
-
-					manager.processOutgoingHooks(p.finClient)
-					manager.dropFilter(p.ackServer, manager.incomingRules)
-					manager.dropFilter(p.finServer, manager.incomingRules)
-					manager.processOutgoingHooks(p.ackClient)
-				}
-			})
-		})
-	}
-}
-
-// generateTCPPacketWithFlags creates a TCP packet with specific flags
-func generateTCPPacketWithFlags(b *testing.B, srcIP, dstIP net.IP, srcPort, dstPort, flags uint16) []byte {
-	b.Helper()
-
-	ipv4 := &layers.IPv4{
-		TTL:      64,
-		Version:  4,
-		SrcIP:    srcIP,
-		DstIP:    dstIP,
-		Protocol: layers.IPProtocolTCP,
-	}
-
-	tcp := &layers.TCP{
-		SrcPort: layers.TCPPort(srcPort),
-		DstPort: layers.TCPPort(dstPort),
-	}
-
-	// Set TCP flags
-	tcp.SYN = (flags & uint16(conntrack.TCPSyn)) != 0
-	tcp.ACK = (flags & uint16(conntrack.TCPAck)) != 0
-	tcp.PSH = (flags & uint16(conntrack.TCPPush)) != 0
-	tcp.RST = (flags & uint16(conntrack.TCPRst)) != 0
-	tcp.FIN = (flags & uint16(conntrack.TCPFin)) != 0
-
-	require.NoError(b, tcp.SetNetworkLayerForChecksum(ipv4))
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{ComputeChecksums: true, FixLengths: true}
-	require.NoError(b, gopacket.SerializeLayers(buf, opts, ipv4, tcp, gopacket.Payload("test")))
-	return buf.Bytes()
-}

client/firewall/uspfilter/uspfilter_test.go

@@ -3,7 +3,6 @@ package uspfilter
 import (
 	"fmt"
 	"net"
-	"sync"
 	"testing"
 	"time"
 
@@ -12,7 +11,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	fw "github.com/netbirdio/netbird/client/firewall/manager"
-	"github.com/netbirdio/netbird/client/firewall/uspfilter/conntrack"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 )
@@ -69,11 +67,12 @@ func TestManagerAddPeerFiltering(t *testing.T) {
 
 	ip := net.ParseIP("192.168.1.1")
 	proto := fw.ProtocolTCP
-	port := &fw.Port{Values: []uint16{80}}
+	port := &fw.Port{Values: []int{80}}
+	direction := fw.RuleDirectionOUT
 	action := fw.ActionDrop
 	comment := "Test rule"
 
-	rule, err := m.AddPeerFiltering(ip, proto, nil, port, action, "", comment)
+	rule, err := m.AddPeerFiltering(ip, proto, nil, port, direction, action, "", comment)
 	if err != nil {
 		t.Errorf("failed to add filtering: %v", err)
 		return
@@ -103,16 +102,38 @@ func TestManagerDeleteRule(t *testing.T) {
 
 	ip := net.ParseIP("192.168.1.1")
 	proto := fw.ProtocolTCP
-	port := &fw.Port{Values: []uint16{80}}
+	port := &fw.Port{Values: []int{80}}
+	direction := fw.RuleDirectionOUT
 	action := fw.ActionDrop
-	comment := "Test rule 2"
+	comment := "Test rule"
 
-	rule2, err := m.AddPeerFiltering(ip, proto, nil, port, action, "", comment)
+	rule, err := m.AddPeerFiltering(ip, proto, nil, port, direction, action, "", comment)
 	if err != nil {
 		t.Errorf("failed to add filtering: %v", err)
 		return
 	}
 
+	ip = net.ParseIP("192.168.1.1")
+	proto = fw.ProtocolTCP
+	port = &fw.Port{Values: []int{80}}
+	direction = fw.RuleDirectionIN
+	action = fw.ActionDrop
+	comment = "Test rule 2"
+
+	rule2, err := m.AddPeerFiltering(ip, proto, nil, port, direction, action, "", comment)
+	if err != nil {
+		t.Errorf("failed to add filtering: %v", err)
+		return
+	}
+
+	for _, r := range rule {
+		err = m.DeletePeerRule(r)
+		if err != nil {
+			t.Errorf("failed to delete rule: %v", err)
+			return
+		}
+	}
+
 	for _, r := range rule2 {
 		if _, ok := m.incomingRules[ip.String()][r.GetRuleID()]; !ok {
 			t.Errorf("rule2 is not in the incomingRules")
@@ -164,10 +185,10 @@ func TestAddUDPPacketHook(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			manager, err := Create(&IFaceMock{
-				SetFilterFunc: func(device.PacketFilter) error { return nil },
-			})
-			require.NoError(t, err)
+			manager := &Manager{
+				incomingRules: map[string]RuleSet{},
+				outgoingRules: map[string]RuleSet{},
+			}
 
 			manager.AddUDPPacketHook(tt.in, tt.ip, tt.dPort, tt.hook)
 
@@ -194,14 +215,18 @@ func TestAddUDPPacketHook(t *testing.T) {
 				t.Errorf("expected ip %s, got %s", tt.ip, addedRule.ip)
 				return
 			}
-			if tt.dPort != addedRule.dPort.Values[0] {
-				t.Errorf("expected dPort %d, got %d", tt.dPort, addedRule.dPort.Values[0])
+			if tt.dPort != addedRule.dPort {
+				t.Errorf("expected dPort %d, got %d", tt.dPort, addedRule.dPort)
 				return
 			}
 			if layers.LayerTypeUDP != addedRule.protoLayer {
 				t.Errorf("expected protoLayer %s, got %s", layers.LayerTypeUDP, addedRule.protoLayer)
 				return
 			}
+			if tt.expDir != addedRule.direction {
+				t.Errorf("expected direction %d, got %d", tt.expDir, addedRule.direction)
+				return
+			}
 			if addedRule.udpHook == nil {
 				t.Errorf("expected udpHook to be set")
 				return
@@ -223,11 +248,12 @@ func TestManagerReset(t *testing.T) {
 
 	ip := net.ParseIP("192.168.1.1")
 	proto := fw.ProtocolTCP
-	port := &fw.Port{Values: []uint16{80}}
+	port := &fw.Port{Values: []int{80}}
+	direction := fw.RuleDirectionOUT
 	action := fw.ActionDrop
 	comment := "Test rule"
 
-	_, err = m.AddPeerFiltering(ip, proto, nil, port, action, "", comment)
+	_, err = m.AddPeerFiltering(ip, proto, nil, port, direction, action, "", comment)
 	if err != nil {
 		t.Errorf("failed to add filtering: %v", err)
 		return
@@ -261,10 +287,11 @@ func TestNotMatchByIP(t *testing.T) {
 
 	ip := net.ParseIP("0.0.0.0")
 	proto := fw.ProtocolUDP
+	direction := fw.RuleDirectionOUT
 	action := fw.ActionAccept
 	comment := "Test rule"
 
-	_, err = m.AddPeerFiltering(ip, proto, nil, nil, action, "", comment)
+	_, err = m.AddPeerFiltering(ip, proto, nil, nil, direction, action, "", comment)
 	if err != nil {
 		t.Errorf("failed to add filtering: %v", err)
 		return
@@ -286,7 +313,7 @@ func TestNotMatchByIP(t *testing.T) {
 		t.Errorf("failed to set network layer for checksum: %v", err)
 		return
 	}
-	payload := gopacket.Payload("test")
+	payload := gopacket.Payload([]byte("test"))
 
 	buf := gopacket.NewSerializeBuffer()
 	opts := gopacket.SerializeOptions{
@@ -298,7 +325,7 @@ func TestNotMatchByIP(t *testing.T) {
 		return
 	}
 
-	if m.dropFilter(buf.Bytes(), m.incomingRules) {
+	if m.dropFilter(buf.Bytes(), m.outgoingRules, false) {
 		t.Errorf("expected packet to be accepted")
 		return
 	}
@@ -321,9 +348,6 @@ func TestRemovePacketHook(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Failed to create Manager: %s", err)
 	}
-	defer func() {
-		require.NoError(t, manager.Reset(nil))
-	}()
 
 	// Add a UDP packet hook
 	hookFunc := func(data []byte) bool { return true }
@@ -360,88 +384,6 @@ func TestRemovePacketHook(t *testing.T) {
 	}
 }
 
-func TestProcessOutgoingHooks(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	})
-	require.NoError(t, err)
-
-	manager.wgNetwork = &net.IPNet{
-		IP:   net.ParseIP("100.10.0.0"),
-		Mask: net.CIDRMask(16, 32),
-	}
-	manager.udpTracker.Close()
-	manager.udpTracker = conntrack.NewUDPTracker(100 * time.Millisecond)
-	defer func() {
-		require.NoError(t, manager.Reset(nil))
-	}()
-
-	manager.decoders = sync.Pool{
-		New: func() any {
-			d := &decoder{
-				decoded: []gopacket.LayerType{},
-			}
-			d.parser = gopacket.NewDecodingLayerParser(
-				layers.LayerTypeIPv4,
-				&d.eth, &d.ip4, &d.ip6, &d.icmp4, &d.icmp6, &d.tcp, &d.udp,
-			)
-			d.parser.IgnoreUnsupported = true
-			return d
-		},
-	}
-
-	hookCalled := false
-	hookID := manager.AddUDPPacketHook(
-		false,
-		net.ParseIP("100.10.0.100"),
-		53,
-		func([]byte) bool {
-			hookCalled = true
-			return true
-		},
-	)
-	require.NotEmpty(t, hookID)
-
-	// Create test UDP packet
-	ipv4 := &layers.IPv4{
-		TTL:      64,
-		Version:  4,
-		SrcIP:    net.ParseIP("100.10.0.1"),
-		DstIP:    net.ParseIP("100.10.0.100"),
-		Protocol: layers.IPProtocolUDP,
-	}
-	udp := &layers.UDP{
-		SrcPort: 51334,
-		DstPort: 53,
-	}
-
-	err = udp.SetNetworkLayerForChecksum(ipv4)
-	require.NoError(t, err)
-	payload := gopacket.Payload("test")
-
-	buf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{
-		ComputeChecksums: true,
-		FixLengths:       true,
-	}
-	err = gopacket.SerializeLayers(buf, opts, ipv4, udp, payload)
-	require.NoError(t, err)
-
-	// Test hook gets called
-	result := manager.processOutgoingHooks(buf.Bytes())
-	require.True(t, result)
-	require.True(t, hookCalled)
-
-	// Test non-UDP packet is ignored
-	ipv4.Protocol = layers.IPProtocolTCP
-	buf = gopacket.NewSerializeBuffer()
-	err = gopacket.SerializeLayers(buf, opts, ipv4)
-	require.NoError(t, err)
-
-	result = manager.processOutgoingHooks(buf.Bytes())
-	require.False(t, result)
-}
-
 func TestUSPFilterCreatePerformance(t *testing.T) {
 	for _, testMax := range []int{10, 20, 30, 40, 50, 60, 70, 80, 90, 100, 200, 300, 400, 500, 600, 700, 800, 900, 1000} {
 		t.Run(fmt.Sprintf("Testing %d rules", testMax), func(t *testing.T) {
@@ -463,8 +405,12 @@ func TestUSPFilterCreatePerformance(t *testing.T) {
 			ip := net.ParseIP("10.20.0.100")
 			start := time.Now()
 			for i := 0; i < testMax; i++ {
-				port := &fw.Port{Values: []uint16{uint16(1000 + i)}}
-				_, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.ActionAccept, "", "accept HTTP traffic")
+				port := &fw.Port{Values: []int{1000 + i}}
+				if i%2 == 0 {
+					_, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.RuleDirectionOUT, fw.ActionAccept, "", "accept HTTP traffic")
+				} else {
+					_, err = manager.AddPeerFiltering(ip, "tcp", nil, port, fw.RuleDirectionIN, fw.ActionAccept, "", "accept HTTP traffic")
+				}
 
 				require.NoError(t, err, "failed to add rule")
 			}
@@ -472,213 +418,3 @@ func TestUSPFilterCreatePerformance(t *testing.T) {
 		})
 	}
 }
-
-func TestStatefulFirewall_UDPTracking(t *testing.T) {
-	manager, err := Create(&IFaceMock{
-		SetFilterFunc: func(device.PacketFilter) error { return nil },
-	})
-	require.NoError(t, err)
-
-	manager.wgNetwork = &net.IPNet{
-		IP:   net.ParseIP("100.10.0.0"),
-		Mask: net.CIDRMask(16, 32),
-	}
-
-	manager.udpTracker.Close() // Close the existing tracker
-	manager.udpTracker = conntrack.NewUDPTracker(200 * time.Millisecond)
-	manager.decoders = sync.Pool{
-		New: func() any {
-			d := &decoder{
-				decoded: []gopacket.LayerType{},
-			}
-			d.parser = gopacket.NewDecodingLayerParser(
-				layers.LayerTypeIPv4,
-				&d.eth, &d.ip4, &d.ip6, &d.icmp4, &d.icmp6, &d.tcp, &d.udp,
-			)
-			d.parser.IgnoreUnsupported = true
-			return d
-		},
-	}
-	defer func() {
-		require.NoError(t, manager.Reset(nil))
-	}()
-
-	// Set up packet parameters
-	srcIP := net.ParseIP("100.10.0.1")
-	dstIP := net.ParseIP("100.10.0.100")
-	srcPort := uint16(51334)
-	dstPort := uint16(53)
-
-	// Create outbound packet
-	outboundIPv4 := &layers.IPv4{
-		TTL:      64,
-		Version:  4,
-		SrcIP:    srcIP,
-		DstIP:    dstIP,
-		Protocol: layers.IPProtocolUDP,
-	}
-	outboundUDP := &layers.UDP{
-		SrcPort: layers.UDPPort(srcPort),
-		DstPort: layers.UDPPort(dstPort),
-	}
-
-	err = outboundUDP.SetNetworkLayerForChecksum(outboundIPv4)
-	require.NoError(t, err)
-
-	outboundBuf := gopacket.NewSerializeBuffer()
-	opts := gopacket.SerializeOptions{
-		ComputeChecksums: true,
-		FixLengths:       true,
-	}
-
-	err = gopacket.SerializeLayers(outboundBuf, opts,
-		outboundIPv4,
-		outboundUDP,
-		gopacket.Payload("test"),
-	)
-	require.NoError(t, err)
-
-	// Process outbound packet and verify connection tracking
-	drop := manager.DropOutgoing(outboundBuf.Bytes())
-	require.False(t, drop, "Initial outbound packet should not be dropped")
-
-	// Verify connection was tracked
-	conn, exists := manager.udpTracker.GetConnection(srcIP, srcPort, dstIP, dstPort)
-
-	require.True(t, exists, "Connection should be tracked after outbound packet")
-	require.True(t, conntrack.ValidateIPs(conntrack.MakeIPAddr(srcIP), conn.SourceIP), "Source IP should match")
-	require.True(t, conntrack.ValidateIPs(conntrack.MakeIPAddr(dstIP), conn.DestIP), "Destination IP should match")
-	require.Equal(t, srcPort, conn.SourcePort, "Source port should match")
-	require.Equal(t, dstPort, conn.DestPort, "Destination port should match")
-
-	// Create valid inbound response packet
-	inboundIPv4 := &layers.IPv4{
-		TTL:      64,
-		Version:  4,
-		SrcIP:    dstIP, // Original destination is now source
-		DstIP:    srcIP, // Original source is now destination
-		Protocol: layers.IPProtocolUDP,
-	}
-	inboundUDP := &layers.UDP{
-		SrcPort: layers.UDPPort(dstPort), // Original destination port is now source
-		DstPort: layers.UDPPort(srcPort), // Original source port is now destination
-	}
-
-	err = inboundUDP.SetNetworkLayerForChecksum(inboundIPv4)
-	require.NoError(t, err)
-
-	inboundBuf := gopacket.NewSerializeBuffer()
-	err = gopacket.SerializeLayers(inboundBuf, opts,
-		inboundIPv4,
-		inboundUDP,
-		gopacket.Payload("response"),
-	)
-	require.NoError(t, err)
-	// Test roundtrip response handling over time
-	checkPoints := []struct {
-		sleep       time.Duration
-		shouldAllow bool
-		description string
-	}{
-		{
-			sleep:       0,
-			shouldAllow: true,
-			description: "Immediate response should be allowed",
-		},
-		{
-			sleep:       50 * time.Millisecond,
-			shouldAllow: true,
-			description: "Response within timeout should be allowed",
-		},
-		{
-			sleep:       100 * time.Millisecond,
-			shouldAllow: true,
-			description: "Response at half timeout should be allowed",
-		},
-		{
-			// tracker hasn't updated conn for 250ms -> greater than 200ms timeout
-			sleep:       250 * time.Millisecond,
-			shouldAllow: false,
-			description: "Response after timeout should be dropped",
-		},
-	}
-
-	for _, cp := range checkPoints {
-		time.Sleep(cp.sleep)
-
-		drop = manager.dropFilter(inboundBuf.Bytes(), manager.incomingRules)
-		require.Equal(t, cp.shouldAllow, !drop, cp.description)
-
-		// If the connection should still be valid, verify it exists
-		if cp.shouldAllow {
-			conn, exists := manager.udpTracker.GetConnection(srcIP, srcPort, dstIP, dstPort)
-			require.True(t, exists, "Connection should still exist during valid window")
-			require.True(t, time.Since(conn.GetLastSeen()) < manager.udpTracker.Timeout(),
-				"LastSeen should be updated for valid responses")
-		}
-	}
-
-	// Test invalid response packets (while connection is expired)
-	invalidCases := []struct {
-		name        string
-		modifyFunc  func(*layers.IPv4, *layers.UDP)
-		description string
-	}{
-		{
-			name: "wrong source IP",
-			modifyFunc: func(ip *layers.IPv4, udp *layers.UDP) {
-				ip.SrcIP = net.ParseIP("100.10.0.101")
-			},
-			description: "Response from wrong IP should be dropped",
-		},
-		{
-			name: "wrong destination IP",
-			modifyFunc: func(ip *layers.IPv4, udp *layers.UDP) {
-				ip.DstIP = net.ParseIP("100.10.0.2")
-			},
-			description: "Response to wrong IP should be dropped",
-		},
-		{
-			name: "wrong source port",
-			modifyFunc: func(ip *layers.IPv4, udp *layers.UDP) {
-				udp.SrcPort = 54
-			},
-			description: "Response from wrong port should be dropped",
-		},
-		{
-			name: "wrong destination port",
-			modifyFunc: func(ip *layers.IPv4, udp *layers.UDP) {
-				udp.DstPort = 51335
-			},
-			description: "Response to wrong port should be dropped",
-		},
-	}
-
-	// Create a new outbound connection for invalid tests
-	drop = manager.processOutgoingHooks(outboundBuf.Bytes())
-	require.False(t, drop, "Second outbound packet should not be dropped")
-
-	for _, tc := range invalidCases {
-		t.Run(tc.name, func(t *testing.T) {
-			testIPv4 := *inboundIPv4
-			testUDP := *inboundUDP
-
-			tc.modifyFunc(&testIPv4, &testUDP)
-
-			err = testUDP.SetNetworkLayerForChecksum(&testIPv4)
-			require.NoError(t, err)
-
-			testBuf := gopacket.NewSerializeBuffer()
-			err = gopacket.SerializeLayers(testBuf, opts,
-				&testIPv4,
-				&testUDP,
-				gopacket.Payload("response"),
-			)
-			require.NoError(t, err)
-
-			// Verify the invalid packet is dropped
-			drop = manager.dropFilter(testBuf.Bytes(), manager.incomingRules)
-			require.True(t, drop, tc.description)
-		})
-	}
-}

client/iface/device/device_kernel_unix.go

@@ -33,6 +33,8 @@ type TunKernelDevice struct {
 }
 
 func NewKernelDevice(name string, address WGAddress, wgPort int, key string, mtu int, transportNet transport.Net) *TunKernelDevice {
+	checkUser()
+
 	ctx, cancel := context.WithCancel(context.Background())
 	return &TunKernelDevice{
 		ctx:          ctx,

client/iface/device/device_usp_unix.go

@@ -4,6 +4,8 @@ package device
 
 import (
 	"fmt"
+	"os"
+	"runtime"
 
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/device"
@@ -30,6 +32,8 @@ type USPDevice struct {
 func NewUSPDevice(name string, address WGAddress, port int, key string, mtu int, iceBind *bind.ICEBind) *USPDevice {
 	log.Infof("using userspace bind mode")
 
+	checkUser()
+
 	return &USPDevice{
 		name:    name,
 		address: address,
@@ -130,3 +134,12 @@ func (t *USPDevice) assignAddr() error {
 
 	return link.assignAddr(t.address)
 }
+
+func checkUser() {
+	if runtime.GOOS == "freebsd" {
+		euid := os.Geteuid()
+		if euid != 0 {
+			log.Warn("newTunUSPDevice: on netbird must run as root to be able to assign address to the tun interface with ifconfig")
+		}
+	}
+}

client/iface/freebsd/link.go

@@ -203,11 +203,6 @@ func (l *Link) setAddr(ip, netmask string) error {
 		return fmt.Errorf("set interface addr: %w", err)
 	}
 
-	cmd = exec.Command("ifconfig", l.name, "inet6", "fe80::/64")
-	if out, err := cmd.CombinedOutput(); err != nil {
-		log.Debugf("adding address command '%v' failed with output: %s", cmd.String(), out)
-	}
-
 	return nil
 }
 

client/iface/netstack/env.go

@@ -15,10 +15,6 @@ func IsEnabled() bool {
 
 func ListenAddr() string {
 	sPort := os.Getenv("NB_SOCKS5_LISTENER_PORT")
-	if sPort == "" {
-		return listenAddr(DefaultSocks5Port)
-	}
-
 	port, err := strconv.Atoi(sPort)
 	if err != nil {
 		log.Warnf("invalid socks5 listener port, unable to convert it to int, falling back to default: %d", DefaultSocks5Port)

client/internal/acl/manager.go

@@ -151,7 +151,7 @@ func (d *DefaultManager) applyPeerACLs(networkMap *mgmProto.NetworkMap) {
 			d.rollBack(newRulePairs)
 			break
 		}
-		if len(rulePair) > 0 {
+		if len(rules) > 0 {
 			d.peerRulesPairs[pairID] = rulePair
 			newRulePairs[pairID] = rulePair
 		}
@@ -268,16 +268,13 @@ func (d *DefaultManager) protoRuleToFirewallRule(
 	}
 
 	var port *firewall.Port
-	if r.PortInfo != nil {
-		port = convertPortInfo(r.PortInfo)
-	} else if r.Port != "" {
-		// old version of management, single port
+	if r.Port != "" {
 		value, err := strconv.Atoi(r.Port)
 		if err != nil {
-			return "", nil, fmt.Errorf("invalid port: %w", err)
+			return "", nil, fmt.Errorf("invalid port, skipping firewall rule")
 		}
 		port = &firewall.Port{
-			Values: []uint16{uint16(value)},
+			Values: []int{value},
 		}
 	}
 
@@ -291,8 +288,6 @@ func (d *DefaultManager) protoRuleToFirewallRule(
 	case mgmProto.RuleDirection_IN:
 		rules, err = d.addInRules(ip, protocol, port, action, ipsetName, "")
 	case mgmProto.RuleDirection_OUT:
-		// TODO: Remove this soon. Outbound rules are obsolete.
-		// We only maintain this for return traffic (inbound dir) which is now handled by the stateful firewall already
 		rules, err = d.addOutRules(ip, protocol, port, action, ipsetName, "")
 	default:
 		return "", nil, fmt.Errorf("invalid direction, skipping firewall rule")
@@ -313,12 +308,25 @@ func (d *DefaultManager) addInRules(
 	ipsetName string,
 	comment string,
 ) ([]firewall.Rule, error) {
-	rule, err := d.firewall.AddPeerFiltering(ip, protocol, nil, port, action, ipsetName, comment)
+	var rules []firewall.Rule
+	rule, err := d.firewall.AddPeerFiltering(
+		ip, protocol, nil, port, firewall.RuleDirectionIN, action, ipsetName, comment)
 	if err != nil {
-		return nil, fmt.Errorf("add firewall rule: %w", err)
+		return nil, fmt.Errorf("failed to add firewall rule: %v", err)
+	}
+	rules = append(rules, rule...)
+
+	if shouldSkipInvertedRule(protocol, port) {
+		return rules, nil
 	}
 
-	return rule, nil
+	rule, err = d.firewall.AddPeerFiltering(
+		ip, protocol, port, nil, firewall.RuleDirectionOUT, action, ipsetName, comment)
+	if err != nil {
+		return nil, fmt.Errorf("failed to add firewall rule: %v", err)
+	}
+
+	return append(rules, rule...), nil
 }
 
 func (d *DefaultManager) addOutRules(
@@ -329,16 +337,25 @@ func (d *DefaultManager) addOutRules(
 	ipsetName string,
 	comment string,
 ) ([]firewall.Rule, error) {
-	if shouldSkipInvertedRule(protocol, port) {
-		return nil, nil
-	}
-
-	rule, err := d.firewall.AddPeerFiltering(ip, protocol, port, nil, action, ipsetName, comment)
+	var rules []firewall.Rule
+	rule, err := d.firewall.AddPeerFiltering(
+		ip, protocol, nil, port, firewall.RuleDirectionOUT, action, ipsetName, comment)
 	if err != nil {
-		return nil, fmt.Errorf("add firewall rule: %w", err)
+		return nil, fmt.Errorf("failed to add firewall rule: %v", err)
+	}
+	rules = append(rules, rule...)
+
+	if shouldSkipInvertedRule(protocol, port) {
+		return rules, nil
 	}
 
-	return rule, nil
+	rule, err = d.firewall.AddPeerFiltering(
+		ip, protocol, port, nil, firewall.RuleDirectionIN, action, ipsetName, comment)
+	if err != nil {
+		return nil, fmt.Errorf("failed to add firewall rule: %v", err)
+	}
+
+	return append(rules, rule...), nil
 }
 
 // getPeerRuleID() returns unique ID for the rule based on its parameters.
@@ -542,14 +559,14 @@ func convertPortInfo(portInfo *mgmProto.PortInfo) *firewall.Port {
 
 	if portInfo.GetPort() != 0 {
 		return &firewall.Port{
-			Values: []uint16{uint16(int(portInfo.GetPort()))},
+			Values: []int{int(portInfo.GetPort())},
 		}
 	}
 
 	if portInfo.GetRange() != nil {
 		return &firewall.Port{
 			IsRange: true,
-			Values:  []uint16{uint16(portInfo.GetRange().Start), uint16(portInfo.GetRange().End)},
+			Values:  []int{int(portInfo.GetRange().Start), int(portInfo.GetRange().End)},
 		}
 	}
 

client/internal/acl/manager_test.go

@@ -119,8 +119,8 @@ func TestDefaultManager(t *testing.T) {
 
 		networkMap.FirewallRulesIsEmpty = false
 		acl.ApplyFiltering(networkMap)
-		if len(acl.peerRulesPairs) != 1 {
-			t.Errorf("rules should contain 1 rules if FirewallRulesIsEmpty is not set, got: %v", len(acl.peerRulesPairs))
+		if len(acl.peerRulesPairs) != 2 {
+			t.Errorf("rules should contain 2 rules if FirewallRulesIsEmpty is not set, got: %v", len(acl.peerRulesPairs))
 			return
 		}
 	})
@@ -356,8 +356,8 @@ func TestDefaultManagerEnableSSHRules(t *testing.T) {
 
 	acl.ApplyFiltering(networkMap)
 
-	if len(acl.peerRulesPairs) != 3 {
-		t.Errorf("expect 3 rules (last must be SSH), got: %d", len(acl.peerRulesPairs))
+	if len(acl.peerRulesPairs) != 4 {
+		t.Errorf("expect 4 rules (last must be SSH), got: %d", len(acl.peerRulesPairs))
 		return
 	}
 }

client/internal/config.go

@@ -61,13 +61,6 @@ type ConfigInput struct {
 	DNSRouteInterval    *time.Duration
 	ClientCertPath      string
 	ClientCertKeyPath   string
-
-	DisableClientRoutes *bool
-	DisableServerRoutes *bool
-	DisableDNS          *bool
-	DisableFirewall     *bool
-
-	BlockLANAccess *bool
 }
 
 // Config Configuration type
@@ -85,14 +78,6 @@ type Config struct {
 	RosenpassEnabled     bool
 	RosenpassPermissive  bool
 	ServerSSHAllowed     *bool
-
-	DisableClientRoutes bool
-	DisableServerRoutes bool
-	DisableDNS          bool
-	DisableFirewall     bool
-
-	BlockLANAccess bool
-
 	// SSHKey is a private SSH key in a PEM format
 	SSHKey string
 
@@ -417,56 +402,7 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		config.DNSRouteInterval = dynamic.DefaultInterval
 		log.Infof("using default DNS route interval %s", config.DNSRouteInterval)
 		updated = true
-	}
 
-	if input.DisableClientRoutes != nil && *input.DisableClientRoutes != config.DisableClientRoutes {
-		if *input.DisableClientRoutes {
-			log.Infof("disabling client routes")
-		} else {
-			log.Infof("enabling client routes")
-		}
-		config.DisableClientRoutes = *input.DisableClientRoutes
-		updated = true
-	}
-
-	if input.DisableServerRoutes != nil && *input.DisableServerRoutes != config.DisableServerRoutes {
-		if *input.DisableServerRoutes {
-			log.Infof("disabling server routes")
-		} else {
-			log.Infof("enabling server routes")
-		}
-		config.DisableServerRoutes = *input.DisableServerRoutes
-		updated = true
-	}
-
-	if input.DisableDNS != nil && *input.DisableDNS != config.DisableDNS {
-		if *input.DisableDNS {
-			log.Infof("disabling DNS configuration")
-		} else {
-			log.Infof("enabling DNS configuration")
-		}
-		config.DisableDNS = *input.DisableDNS
-		updated = true
-	}
-
-	if input.DisableFirewall != nil && *input.DisableFirewall != config.DisableFirewall {
-		if *input.DisableFirewall {
-			log.Infof("disabling firewall configuration")
-		} else {
-			log.Infof("enabling firewall configuration")
-		}
-		config.DisableFirewall = *input.DisableFirewall
-		updated = true
-	}
-
-	if input.BlockLANAccess != nil && *input.BlockLANAccess != config.BlockLANAccess {
-		if *input.BlockLANAccess {
-			log.Infof("blocking LAN access")
-		} else {
-			log.Infof("allowing LAN access")
-		}
-		config.BlockLANAccess = *input.BlockLANAccess
-		updated = true
 	}
 
 	if input.ClientCertKeyPath != "" {

client/internal/connect.go

@@ -183,7 +183,7 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, probes *ProbeHold
 		}()
 
 		// connect (just a connection, no stream yet) and login to Management Service to get an initial global Wiretrustee config
-		loginResp, err := loginToManagement(engineCtx, mgmClient, publicSSHKey, c.config)
+		loginResp, err := loginToManagement(engineCtx, mgmClient, publicSSHKey)
 		if err != nil {
 			log.Debug(err)
 			if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.PermissionDenied) {
@@ -382,7 +382,8 @@ func (c *ConnectClient) isContextCancelled() bool {
 // SetNetworkMapPersistence enables or disables network map persistence.
 // When enabled, the last received network map will be stored and can be retrieved
 // through the Engine's getLatestNetworkMap method. When disabled, any stored
-// network map will be cleared.
+// network map will be cleared. This functionality is primarily used for debugging
+// and should not be enabled during normal operation.
 func (c *ConnectClient) SetNetworkMapPersistence(enabled bool) {
 	c.engineMutex.Lock()
 	c.persistNetworkMap = enabled
@@ -415,13 +416,6 @@ func createEngineConfig(key wgtypes.Key, config *Config, peerConfig *mgmProto.Pe
 		RosenpassPermissive:  config.RosenpassPermissive,
 		ServerSSHAllowed:     util.ReturnBoolWithDefaultTrue(config.ServerSSHAllowed),
 		DNSRouteInterval:     config.DNSRouteInterval,
-
-		DisableClientRoutes: config.DisableClientRoutes,
-		DisableServerRoutes: config.DisableServerRoutes,
-		DisableDNS:          config.DisableDNS,
-		DisableFirewall:     config.DisableFirewall,
-
-		BlockLANAccess: config.BlockLANAccess,
 	}
 
 	if config.PreSharedKey != "" {
@@ -463,7 +457,7 @@ func connectToSignal(ctx context.Context, wtConfig *mgmProto.WiretrusteeConfig,
 }
 
 // loginToManagement creates Management Services client, establishes a connection, logs-in and gets a global Wiretrustee config (signal, turn, stun hosts, etc)
-func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte, config *Config) (*mgmProto.LoginResponse, error) {
+func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte) (*mgmProto.LoginResponse, error) {
 
 	serverPublicKey, err := client.GetServerPublicKey()
 	if err != nil {
@@ -471,15 +465,6 @@ func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte,
 	}
 
 	sysInfo := system.GetInfo(ctx)
-	sysInfo.SetFlags(
-		config.RosenpassEnabled,
-		config.RosenpassPermissive,
-		config.ServerSSHAllowed,
-		config.DisableClientRoutes,
-		config.DisableServerRoutes,
-		config.DisableDNS,
-		config.DisableFirewall,
-	)
 	loginResp, err := client.Login(*serverPublicKey, sysInfo, pubSSHKey)
 	if err != nil {
 		return nil, err

client/internal/dns/consts.go

@@ -1,18 +0,0 @@
-//go:build !android
-
-package dns
-
-import (
-	"github.com/netbirdio/netbird/client/configs"
-	"os"
-	"path/filepath"
-)
-
-var fileUncleanShutdownResolvConfLocation string
-
-func init() {
-	fileUncleanShutdownResolvConfLocation = os.Getenv("NB_UNCLEAN_SHUTDOWN_RESOLV_FILE")
-	if fileUncleanShutdownResolvConfLocation == "" {
-		fileUncleanShutdownResolvConfLocation = filepath.Join(configs.StateDir, "resolv.conf")
-	}
-}

client/internal/dns/consts_freebsd.go

@@ -0,0 +1,5 @@
+package dns
+
+const (
+	fileUncleanShutdownResolvConfLocation = "/var/db/netbird/resolv.conf"
+)

client/internal/dns/consts_linux.go

@@ -0,0 +1,7 @@
+//go:build !android
+
+package dns
+
+const (
+	fileUncleanShutdownResolvConfLocation = "/var/lib/netbird/resolv.conf"
+)

client/internal/dns/handler_chain.go

@@ -1,7 +1,6 @@
 package dns
 
 import (
-	"slices"
 	"strings"
 	"sync"
 
@@ -68,16 +67,17 @@ func (c *HandlerChain) AddHandler(pattern string, handler dns.Handler, priority
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
-	pattern = strings.ToLower(dns.Fqdn(pattern))
 	origPattern := pattern
 	isWildcard := strings.HasPrefix(pattern, "*.")
 	if isWildcard {
 		pattern = pattern[2:]
 	}
+	pattern = dns.Fqdn(pattern)
+	origPattern = dns.Fqdn(origPattern)
 
-	// First remove any existing handler with same pattern (case-insensitive) and priority
+	// First remove any existing handler with same original pattern and priority
 	for i := len(c.handlers) - 1; i >= 0; i-- {
-		if strings.EqualFold(c.handlers[i].OrigPattern, origPattern) && c.handlers[i].Priority == priority {
+		if c.handlers[i].OrigPattern == origPattern && c.handlers[i].Priority == priority {
 			if c.handlers[i].StopHandler != nil {
 				c.handlers[i].StopHandler.stop()
 			}
@@ -105,30 +105,17 @@ func (c *HandlerChain) AddHandler(pattern string, handler dns.Handler, priority
 		MatchSubdomains: matchSubdomains,
 	}
 
-	pos := c.findHandlerPosition(entry)
-	c.handlers = append(c.handlers[:pos], append([]HandlerEntry{entry}, c.handlers[pos:]...)...)
-}
-
-// findHandlerPosition determines where to insert a new handler based on priority and specificity
-func (c *HandlerChain) findHandlerPosition(newEntry HandlerEntry) int {
+	// Insert handler in priority order
+	pos := 0
 	for i, h := range c.handlers {
-		// prio first
-		if h.Priority < newEntry.Priority {
-			return i
-		}
-
-		// domain specificity next
-		if h.Priority == newEntry.Priority {
-			newDots := strings.Count(newEntry.Pattern, ".")
-			existingDots := strings.Count(h.Pattern, ".")
-			if newDots > existingDots {
-				return i
-			}
+		if h.Priority < priority {
+			pos = i
+			break
 		}
+		pos = i + 1
 	}
 
-	// add at end
-	return len(c.handlers)
+	c.handlers = append(c.handlers[:pos], append([]HandlerEntry{entry}, c.handlers[pos:]...)...)
 }
 
 // RemoveHandler removes a handler for the given pattern and priority
@@ -138,10 +125,10 @@ func (c *HandlerChain) RemoveHandler(pattern string, priority int) {
 
 	pattern = dns.Fqdn(pattern)
 
-	// Find and remove handlers matching both original pattern (case-insensitive) and priority
+	// Find and remove handlers matching both original pattern and priority
 	for i := len(c.handlers) - 1; i >= 0; i-- {
 		entry := c.handlers[i]
-		if strings.EqualFold(entry.OrigPattern, pattern) && entry.Priority == priority {
+		if entry.OrigPattern == pattern && entry.Priority == priority {
 			if entry.StopHandler != nil {
 				entry.StopHandler.stop()
 			}
@@ -156,9 +143,9 @@ func (c *HandlerChain) HasHandlers(pattern string) bool {
 	c.mu.RLock()
 	defer c.mu.RUnlock()
 
-	pattern = strings.ToLower(dns.Fqdn(pattern))
+	pattern = dns.Fqdn(pattern)
 	for _, entry := range c.handlers {
-		if strings.EqualFold(entry.Pattern, pattern) {
+		if entry.Pattern == pattern {
 			return true
 		}
 	}
@@ -170,23 +157,20 @@ func (c *HandlerChain) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 		return
 	}
 
-	qname := strings.ToLower(r.Question[0].Name)
+	qname := r.Question[0].Name
 	log.Tracef("handling DNS request for domain=%s", qname)
 
 	c.mu.RLock()
-	handlers := slices.Clone(c.handlers)
-	c.mu.RUnlock()
+	defer c.mu.RUnlock()
 
-	if log.IsLevelEnabled(log.TraceLevel) {
-		log.Tracef("current handlers (%d):", len(handlers))
-		for _, h := range handlers {
-			log.Tracef("  - pattern: domain=%s original: domain=%s wildcard=%v priority=%d",
-				h.Pattern, h.OrigPattern, h.IsWildcard, h.Priority)
-		}
+	log.Tracef("current handlers (%d):", len(c.handlers))
+	for _, h := range c.handlers {
+		log.Tracef("  - pattern: domain=%s original: domain=%s wildcard=%v priority=%d",
+			h.Pattern, h.OrigPattern, h.IsWildcard, h.Priority)
 	}
 
 	// Try handlers in priority order
-	for _, entry := range handlers {
+	for _, entry := range c.handlers {
 		var matched bool
 		switch {
 		case entry.Pattern == ".":
@@ -199,9 +183,9 @@ func (c *HandlerChain) ServeDNS(w dns.ResponseWriter, r *dns.Msg) {
 			// If handler wants subdomain matching, allow suffix match
 			// Otherwise require exact match
 			if entry.MatchSubdomains {
-				matched = strings.EqualFold(qname, entry.Pattern) || strings.HasSuffix(qname, "."+entry.Pattern)
+				matched = qname == entry.Pattern || strings.HasSuffix(qname, "."+entry.Pattern)
 			} else {
-				matched = strings.EqualFold(qname, entry.Pattern)
+				matched = qname == entry.Pattern
 			}
 		}
 

client/internal/dns/handler_chain_test.go

@@ -507,326 +507,5 @@ func TestHandlerChain_MultiPriorityHandling(t *testing.T) {
 
 	// Test 4: Remove last handler
 	chain.RemoveHandler(testDomain, nbdns.PriorityDefault)
-
 	assert.False(t, chain.HasHandlers(testDomain))
 }
-
-func TestHandlerChain_CaseSensitivity(t *testing.T) {
-	tests := []struct {
-		name        string
-		scenario    string
-		addHandlers []struct {
-			pattern     string
-			priority    int
-			subdomains  bool
-			shouldMatch bool
-		}
-		query         string
-		expectedCalls int
-	}{
-		{
-			name:     "case insensitive exact match",
-			scenario: "handler registered lowercase, query uppercase",
-			addHandlers: []struct {
-				pattern     string
-				priority    int
-				subdomains  bool
-				shouldMatch bool
-			}{
-				{"example.com.", nbdns.PriorityDefault, false, true},
-			},
-			query:         "EXAMPLE.COM.",
-			expectedCalls: 1,
-		},
-		{
-			name:     "case insensitive wildcard match",
-			scenario: "handler registered mixed case wildcard, query different case",
-			addHandlers: []struct {
-				pattern     string
-				priority    int
-				subdomains  bool
-				shouldMatch bool
-			}{
-				{"*.Example.Com.", nbdns.PriorityDefault, false, true},
-			},
-			query:         "sub.EXAMPLE.COM.",
-			expectedCalls: 1,
-		},
-		{
-			name:     "multiple handlers different case same domain",
-			scenario: "second handler should replace first despite case difference",
-			addHandlers: []struct {
-				pattern     string
-				priority    int
-				subdomains  bool
-				shouldMatch bool
-			}{
-				{"EXAMPLE.COM.", nbdns.PriorityDefault, false, false},
-				{"example.com.", nbdns.PriorityDefault, false, true},
-			},
-			query:         "ExAmPlE.cOm.",
-			expectedCalls: 1,
-		},
-		{
-			name:     "subdomain matching case insensitive",
-			scenario: "handler with MatchSubdomains true should match regardless of case",
-			addHandlers: []struct {
-				pattern     string
-				priority    int
-				subdomains  bool
-				shouldMatch bool
-			}{
-				{"example.com.", nbdns.PriorityDefault, true, true},
-			},
-			query:         "SUB.EXAMPLE.COM.",
-			expectedCalls: 1,
-		},
-		{
-			name:     "root zone case insensitive",
-			scenario: "root zone handler should match regardless of case",
-			addHandlers: []struct {
-				pattern     string
-				priority    int
-				subdomains  bool
-				shouldMatch bool
-			}{
-				{".", nbdns.PriorityDefault, false, true},
-			},
-			query:         "EXAMPLE.COM.",
-			expectedCalls: 1,
-		},
-		{
-			name:     "multiple handlers different priority",
-			scenario: "should call higher priority handler despite case differences",
-			addHandlers: []struct {
-				pattern     string
-				priority    int
-				subdomains  bool
-				shouldMatch bool
-			}{
-				{"EXAMPLE.COM.", nbdns.PriorityDefault, false, false},
-				{"example.com.", nbdns.PriorityMatchDomain, false, false},
-				{"Example.Com.", nbdns.PriorityDNSRoute, false, true},
-			},
-			query:         "example.com.",
-			expectedCalls: 1,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			chain := nbdns.NewHandlerChain()
-			handlerCalls := make(map[string]bool) // track which patterns were called
-
-			// Add handlers according to test case
-			for _, h := range tt.addHandlers {
-				var handler dns.Handler
-				pattern := h.pattern // capture pattern for closure
-
-				if h.subdomains {
-					subHandler := &nbdns.MockSubdomainHandler{
-						Subdomains: true,
-					}
-					if h.shouldMatch {
-						subHandler.On("ServeDNS", mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
-							handlerCalls[pattern] = true
-							w := args.Get(0).(dns.ResponseWriter)
-							r := args.Get(1).(*dns.Msg)
-							resp := new(dns.Msg)
-							resp.SetRcode(r, dns.RcodeSuccess)
-							assert.NoError(t, w.WriteMsg(resp))
-						}).Once()
-					}
-					handler = subHandler
-				} else {
-					mockHandler := &nbdns.MockHandler{}
-					if h.shouldMatch {
-						mockHandler.On("ServeDNS", mock.Anything, mock.Anything).Run(func(args mock.Arguments) {
-							handlerCalls[pattern] = true
-							w := args.Get(0).(dns.ResponseWriter)
-							r := args.Get(1).(*dns.Msg)
-							resp := new(dns.Msg)
-							resp.SetRcode(r, dns.RcodeSuccess)
-							assert.NoError(t, w.WriteMsg(resp))
-						}).Once()
-					}
-					handler = mockHandler
-				}
-
-				chain.AddHandler(pattern, handler, h.priority, nil)
-			}
-
-			// Execute request
-			r := new(dns.Msg)
-			r.SetQuestion(tt.query, dns.TypeA)
-			chain.ServeDNS(&mockResponseWriter{}, r)
-
-			// Verify each handler was called exactly as expected
-			for _, h := range tt.addHandlers {
-				wasCalled := handlerCalls[h.pattern]
-				assert.Equal(t, h.shouldMatch, wasCalled,
-					"Handler for pattern %q was %s when it should%s have been",
-					h.pattern,
-					map[bool]string{true: "called", false: "not called"}[wasCalled],
-					map[bool]string{true: "", false: " not"}[wasCalled == h.shouldMatch])
-			}
-
-			// Verify total number of calls
-			assert.Equal(t, tt.expectedCalls, len(handlerCalls),
-				"Wrong number of total handler calls")
-		})
-	}
-}
-
-func TestHandlerChain_DomainSpecificityOrdering(t *testing.T) {
-	tests := []struct {
-		name     string
-		scenario string
-		ops      []struct {
-			action    string
-			pattern   string
-			priority  int
-			subdomain bool
-		}
-		query         string
-		expectedMatch string
-	}{
-		{
-			name:     "more specific domain matches first",
-			scenario: "sub.example.com should match before example.com",
-			ops: []struct {
-				action    string
-				pattern   string
-				priority  int
-				subdomain bool
-			}{
-				{"add", "example.com.", nbdns.PriorityMatchDomain, true},
-				{"add", "sub.example.com.", nbdns.PriorityMatchDomain, false},
-			},
-			query:         "sub.example.com.",
-			expectedMatch: "sub.example.com.",
-		},
-		{
-			name:     "more specific domain matches first, both match subdomains",
-			scenario: "sub.example.com should match before example.com",
-			ops: []struct {
-				action    string
-				pattern   string
-				priority  int
-				subdomain bool
-			}{
-				{"add", "example.com.", nbdns.PriorityMatchDomain, true},
-				{"add", "sub.example.com.", nbdns.PriorityMatchDomain, true},
-			},
-			query:         "sub.example.com.",
-			expectedMatch: "sub.example.com.",
-		},
-		{
-			name:     "maintain specificity order after removal",
-			scenario: "after removing most specific, should fall back to less specific",
-			ops: []struct {
-				action    string
-				pattern   string
-				priority  int
-				subdomain bool
-			}{
-				{"add", "example.com.", nbdns.PriorityMatchDomain, true},
-				{"add", "sub.example.com.", nbdns.PriorityMatchDomain, true},
-				{"add", "test.sub.example.com.", nbdns.PriorityMatchDomain, false},
-				{"remove", "test.sub.example.com.", nbdns.PriorityMatchDomain, false},
-			},
-			query:         "test.sub.example.com.",
-			expectedMatch: "sub.example.com.",
-		},
-		{
-			name:     "priority overrides specificity",
-			scenario: "less specific domain with higher priority should match first",
-			ops: []struct {
-				action    string
-				pattern   string
-				priority  int
-				subdomain bool
-			}{
-				{"add", "sub.example.com.", nbdns.PriorityMatchDomain, false},
-				{"add", "example.com.", nbdns.PriorityDNSRoute, true},
-			},
-			query:         "sub.example.com.",
-			expectedMatch: "example.com.",
-		},
-		{
-			name:     "equal priority respects specificity",
-			scenario: "with equal priority, more specific domain should match",
-			ops: []struct {
-				action    string
-				pattern   string
-				priority  int
-				subdomain bool
-			}{
-				{"add", "example.com.", nbdns.PriorityMatchDomain, true},
-				{"add", "other.example.com.", nbdns.PriorityMatchDomain, true},
-				{"add", "sub.example.com.", nbdns.PriorityMatchDomain, false},
-			},
-			query:         "sub.example.com.",
-			expectedMatch: "sub.example.com.",
-		},
-		{
-			name:     "specific matches before wildcard",
-			scenario: "specific domain should match before wildcard at same priority",
-			ops: []struct {
-				action    string
-				pattern   string
-				priority  int
-				subdomain bool
-			}{
-				{"add", "*.example.com.", nbdns.PriorityDNSRoute, false},
-				{"add", "sub.example.com.", nbdns.PriorityDNSRoute, false},
-			},
-			query:         "sub.example.com.",
-			expectedMatch: "sub.example.com.",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			chain := nbdns.NewHandlerChain()
-			handlers := make(map[string]*nbdns.MockSubdomainHandler)
-
-			for _, op := range tt.ops {
-				if op.action == "add" {
-					handler := &nbdns.MockSubdomainHandler{Subdomains: op.subdomain}
-					handlers[op.pattern] = handler
-					chain.AddHandler(op.pattern, handler, op.priority, nil)
-				} else {
-					chain.RemoveHandler(op.pattern, op.priority)
-				}
-			}
-
-			r := new(dns.Msg)
-			r.SetQuestion(tt.query, dns.TypeA)
-			w := &nbdns.ResponseWriterChain{ResponseWriter: &mockResponseWriter{}}
-
-			// Setup handler expectations
-			for pattern, handler := range handlers {
-				if pattern == tt.expectedMatch {
-					handler.On("ServeDNS", mock.Anything, r).Run(func(args mock.Arguments) {
-						w := args.Get(0).(dns.ResponseWriter)
-						r := args.Get(1).(*dns.Msg)
-						resp := new(dns.Msg)
-						resp.SetReply(r)
-						assert.NoError(t, w.WriteMsg(resp))
-					}).Once()
-				}
-			}
-
-			chain.ServeDNS(w, r)
-
-			for pattern, handler := range handlers {
-				if pattern == tt.expectedMatch {
-					handler.AssertNumberOfCalls(t, "ServeDNS", 1)
-				} else {
-					handler.AssertNumberOfCalls(t, "ServeDNS", 0)
-				}
-			}
-		})
-	}
-}

client/internal/dns/host.go

@@ -102,17 +102,3 @@ func dnsConfigToHostDNSConfig(dnsConfig nbdns.Config, ip string, port int) HostD
 
 	return config
 }
-
-type noopHostConfigurator struct{}
-
-func (n noopHostConfigurator) applyDNSConfig(HostDNSConfig, *statemanager.Manager) error {
-	return nil
-}
-
-func (n noopHostConfigurator) restoreHostDNS() error {
-	return nil
-}
-
-func (n noopHostConfigurator) supportCustomPort() bool {
-	return true
-}

client/internal/dns/host_darwin.go

@@ -28,7 +28,6 @@ const (
 	arraySymbol                         = "* "
 	digitSymbol                         = "# "
 	scutilPath                          = "/usr/sbin/scutil"
-	dscacheutilPath                     = "/usr/bin/dscacheutil"
 	searchSuffix                        = "Search"
 	matchSuffix                         = "Match"
 	localSuffix                         = "Local"
@@ -107,10 +106,6 @@ func (s *systemConfigurator) applyDNSConfig(config HostDNSConfig, stateManager *
 		return fmt.Errorf("add search domains: %w", err)
 	}
 
-	if err := s.flushDNSCache(); err != nil {
-		log.Errorf("failed to flush DNS cache: %v", err)
-	}
-
 	return nil
 }
 
@@ -128,10 +123,6 @@ func (s *systemConfigurator) restoreHostDNS() error {
 		}
 	}
 
-	if err := s.flushDNSCache(); err != nil {
-		log.Errorf("failed to flush DNS cache: %v", err)
-	}
-
 	return nil
 }
 
@@ -325,21 +316,6 @@ func (s *systemConfigurator) getPrimaryService() (string, string, error) {
 	return primaryService, router, nil
 }
 
-func (s *systemConfigurator) flushDNSCache() error {
-	cmd := exec.Command(dscacheutilPath, "-flushcache")
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("flush DNS cache: %w, output: %s", err, out)
-	}
-
-	cmd = exec.Command("killall", "-HUP", "mDNSResponder")
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("restart mDNSResponder: %w, output: %s", err, out)
-	}
-
-	log.Info("flushed DNS cache")
-	return nil
-}
-
 func (s *systemConfigurator) restoreUncleanShutdownDNS() error {
 	if err := s.restoreHostDNS(); err != nil {
 		return fmt.Errorf("restoring dns via scutil: %w", err)

client/internal/dns/host_unix.go

@@ -48,17 +48,11 @@ type restoreHostManager interface {
 func newHostManager(wgInterface string) (hostManager, error) {
 	osManager, err := getOSDNSManagerType()
 	if err != nil {
-		return nil, fmt.Errorf("get os dns manager type: %w", err)
+		return nil, err
 	}
 
 	log.Infof("System DNS manager discovered: %s", osManager)
-	mgr, err := newHostManagerFromType(wgInterface, osManager)
-	// need to explicitly return nil mgr on error to avoid returning a non-nil interface containing a nil value
-	if err != nil {
-		return nil, fmt.Errorf("create host manager: %w", err)
-	}
-
-	return mgr, nil
+	return newHostManagerFromType(wgInterface, osManager)
 }
 
 func newHostManagerFromType(wgInterface string, osManager osManagerType) (restoreHostManager, error) {

client/internal/dns/resolvconf_unix.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"net/netip"
 	"os/exec"
-	"strings"
 
 	log "github.com/sirupsen/logrus"
 
@@ -16,64 +15,23 @@ import (
 
 const resolvconfCommand = "resolvconf"
 
-// resolvconfType represents the type of resolvconf implementation
-type resolvconfType int
-
-func (r resolvconfType) String() string {
-	switch r {
-	case typeOpenresolv:
-		return "openresolv"
-	case typeResolvconf:
-		return "resolvconf"
-	default:
-		return "unknown"
-	}
-}
-
-const (
-	typeOpenresolv resolvconfType = iota
-	typeResolvconf
-)
-
 type resolvconf struct {
 	ifaceName string
-	implType  resolvconfType
 
 	originalSearchDomains []string
 	originalNameServers   []string
 	othersConfigs         []string
 }
 
-func detectResolvconfType() (resolvconfType, error) {
-	cmd := exec.Command(resolvconfCommand, "--version")
-	out, err := cmd.Output()
-	if err != nil {
-		return typeOpenresolv, fmt.Errorf("failed to determine resolvconf type: %w", err)
-	}
-
-	if strings.Contains(string(out), "openresolv") {
-		return typeOpenresolv, nil
-	}
-	return typeResolvconf, nil
-}
-
+// supported "openresolv" only
 func newResolvConfConfigurator(wgInterface string) (*resolvconf, error) {
 	resolvConfEntries, err := parseDefaultResolvConf()
 	if err != nil {
 		log.Errorf("could not read original search domains from %s: %s", defaultResolvConfPath, err)
 	}
 
-	implType, err := detectResolvconfType()
-	if err != nil {
-		log.Warnf("failed to detect resolvconf type, defaulting to openresolv: %v", err)
-		implType = typeOpenresolv
-	} else {
-		log.Infof("detected resolvconf type: %v", implType)
-	}
-
 	return &resolvconf{
 		ifaceName:             wgInterface,
-		implType:              implType,
 		originalSearchDomains: resolvConfEntries.searchDomains,
 		originalNameServers:   resolvConfEntries.nameServers,
 		othersConfigs:         resolvConfEntries.others,
@@ -122,15 +80,8 @@ func (r *resolvconf) applyDNSConfig(config HostDNSConfig, stateManager *stateman
 }
 
 func (r *resolvconf) restoreHostDNS() error {
-	var cmd *exec.Cmd
-
-	switch r.implType {
-	case typeOpenresolv:
-		cmd = exec.Command(resolvconfCommand, "-f", "-d", r.ifaceName)
-	case typeResolvconf:
-		cmd = exec.Command(resolvconfCommand, "-d", r.ifaceName)
-	}
-
+	// openresolv only, debian resolvconf doesn't support "-f"
+	cmd := exec.Command(resolvconfCommand, "-f", "-d", r.ifaceName)
 	_, err := cmd.Output()
 	if err != nil {
 		return fmt.Errorf("removing resolvconf configuration for %s interface: %w", r.ifaceName, err)
@@ -140,21 +91,10 @@ func (r *resolvconf) restoreHostDNS() error {
 }
 
 func (r *resolvconf) applyConfig(content bytes.Buffer) error {
-	var cmd *exec.Cmd
-
-	switch r.implType {
-	case typeOpenresolv:
-		// OpenResolv supports exclusive mode with -x
-		cmd = exec.Command(resolvconfCommand, "-x", "-a", r.ifaceName)
-	case typeResolvconf:
-		cmd = exec.Command(resolvconfCommand, "-a", r.ifaceName)
-	default:
-		return fmt.Errorf("unsupported resolvconf type: %v", r.implType)
-	}
-
+	// openresolv only, debian resolvconf doesn't support "-x"
+	cmd := exec.Command(resolvconfCommand, "-x", "-a", r.ifaceName)
 	cmd.Stdin = &content
-	out, err := cmd.Output()
-	log.Tracef("resolvconf output: %s", out)
+	_, err := cmd.Output()
 	if err != nil {
 		return fmt.Errorf("applying resolvconf configuration for %s interface: %w", r.ifaceName, err)
 	}

client/internal/dns/server.go

@@ -12,7 +12,6 @@ import (
 	"github.com/mitchellh/hashstructure/v2"
 	log "github.com/sirupsen/logrus"
 
-	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
@@ -48,7 +47,6 @@ type registeredHandlerMap map[string]handlerWithStop
 type DefaultServer struct {
 	ctx                context.Context
 	ctxCancel          context.CancelFunc
-	disableSys         bool
 	mux                sync.Mutex
 	service            service
 	dnsMuxMap          registeredHandlerMap
@@ -86,14 +84,7 @@ type muxUpdate struct {
 }
 
 // NewDefaultServer returns a new dns server
-func NewDefaultServer(
-	ctx context.Context,
-	wgInterface WGIface,
-	customAddress string,
-	statusRecorder *peer.Status,
-	stateManager *statemanager.Manager,
-	disableSys bool,
-) (*DefaultServer, error) {
+func NewDefaultServer(ctx context.Context, wgInterface WGIface, customAddress string, statusRecorder *peer.Status, stateManager *statemanager.Manager) (*DefaultServer, error) {
 	var addrPort *netip.AddrPort
 	if customAddress != "" {
 		parsedAddrPort, err := netip.ParseAddrPort(customAddress)
@@ -110,7 +101,7 @@ func NewDefaultServer(
 		dnsService = newServiceViaListener(wgInterface, addrPort)
 	}
 
-	return newDefaultServer(ctx, wgInterface, dnsService, statusRecorder, stateManager, disableSys), nil
+	return newDefaultServer(ctx, wgInterface, dnsService, statusRecorder, stateManager), nil
 }
 
 // NewDefaultServerPermanentUpstream returns a new dns server. It optimized for mobile systems
@@ -121,10 +112,9 @@ func NewDefaultServerPermanentUpstream(
 	config nbdns.Config,
 	listener listener.NetworkChangeListener,
 	statusRecorder *peer.Status,
-	disableSys bool,
 ) *DefaultServer {
 	log.Debugf("host dns address list is: %v", hostsDnsList)
-	ds := newDefaultServer(ctx, wgInterface, NewServiceViaMemory(wgInterface), statusRecorder, nil, disableSys)
+	ds := newDefaultServer(ctx, wgInterface, NewServiceViaMemory(wgInterface), statusRecorder, nil)
 	ds.hostsDNSHolder.set(hostsDnsList)
 	ds.permanent = true
 	ds.addHostRootZone()
@@ -141,26 +131,17 @@ func NewDefaultServerIos(
 	wgInterface WGIface,
 	iosDnsManager IosDnsManager,
 	statusRecorder *peer.Status,
-	disableSys bool,
 ) *DefaultServer {
-	ds := newDefaultServer(ctx, wgInterface, NewServiceViaMemory(wgInterface), statusRecorder, nil, disableSys)
+	ds := newDefaultServer(ctx, wgInterface, NewServiceViaMemory(wgInterface), statusRecorder, nil)
 	ds.iosDnsManager = iosDnsManager
 	return ds
 }
 
-func newDefaultServer(
-	ctx context.Context,
-	wgInterface WGIface,
-	dnsService service,
-	statusRecorder *peer.Status,
-	stateManager *statemanager.Manager,
-	disableSys bool,
-) *DefaultServer {
+func newDefaultServer(ctx context.Context, wgInterface WGIface, dnsService service, statusRecorder *peer.Status, stateManager *statemanager.Manager) *DefaultServer {
 	ctx, stop := context.WithCancel(ctx)
 	defaultServer := &DefaultServer{
 		ctx:               ctx,
 		ctxCancel:         stop,
-		disableSys:        disableSys,
 		service:           dnsService,
 		handlerChain:      NewHandlerChain(),
 		dnsMuxMap:         make(registeredHandlerMap),
@@ -188,10 +169,6 @@ func (s *DefaultServer) registerHandler(domains []string, handler dns.Handler, p
 	log.Debugf("registering handler %s with priority %d", handler, priority)
 
 	for _, domain := range domains {
-		if domain == "" {
-			log.Warn("skipping empty domain")
-			continue
-		}
 		s.handlerChain.AddHandler(domain, handler, priority, nil)
 		s.handlerPriorities[domain] = priority
 		s.service.RegisterMux(nbdns.NormalizeZone(domain), s.handlerChain)
@@ -206,17 +183,11 @@ func (s *DefaultServer) DeregisterHandler(domains []string, priority int) {
 }
 
 func (s *DefaultServer) deregisterHandler(domains []string, priority int) {
-	log.Debugf("deregistering handler %v with priority %d", domains, priority)
-
 	for _, domain := range domains {
 		s.handlerChain.RemoveHandler(domain, priority)
 
 		// Only deregister from service if no handlers remain
 		if !s.handlerChain.HasHandlers(domain) {
-			if domain == "" {
-				log.Warn("skipping empty domain")
-				continue
-			}
 			s.service.DeregisterMux(nbdns.NormalizeZone(domain))
 		}
 	}
@@ -239,16 +210,6 @@ func (s *DefaultServer) Initialize() (err error) {
 	}
 
 	s.stateManager.RegisterState(&ShutdownState{})
-
-	// use noop host manager if requested or running in netstack mode.
-	// Netstack mode currently doesn't have a way to receive DNS requests.
-	// TODO: Use listener on localhost in netstack mode when running as root.
-	if s.disableSys || netstack.IsEnabled() {
-		log.Info("system DNS is disabled, not setting up host manager")
-		s.hostManager = &noopHostConfigurator{}
-		return nil
-	}
-
 	s.hostManager, err = s.initialize()
 	if err != nil {
 		return fmt.Errorf("initialize: %w", err)
@@ -297,47 +258,47 @@ func (s *DefaultServer) OnUpdatedHostDNSServer(hostsDnsList []string) {
 
 // UpdateDNSServer processes an update received from the management service
 func (s *DefaultServer) UpdateDNSServer(serial uint64, update nbdns.Config) error {
-	if s.ctx.Err() != nil {
+	select {
+	case <-s.ctx.Done():
 		log.Infof("not updating DNS server as context is closed")
 		return s.ctx.Err()
-	}
+	default:
+		if serial < s.updateSerial {
+			return fmt.Errorf("not applying dns update, error: "+
+				"network update is %d behind the last applied update", s.updateSerial-serial)
+		}
+		s.mux.Lock()
+		defer s.mux.Unlock()
 
-	if serial < s.updateSerial {
-		return fmt.Errorf("not applying dns update, error: "+
-			"network update is %d behind the last applied update", s.updateSerial-serial)
-	}
+		if s.hostManager == nil {
+			return fmt.Errorf("dns service is not initialized yet")
+		}
 
-	s.mux.Lock()
-	defer s.mux.Unlock()
+		hash, err := hashstructure.Hash(update, hashstructure.FormatV2, &hashstructure.HashOptions{
+			ZeroNil:         true,
+			IgnoreZeroValue: true,
+			SlicesAsSets:    true,
+			UseStringer:     true,
+		})
+		if err != nil {
+			log.Errorf("unable to hash the dns configuration update, got error: %s", err)
+		}
 
-	if s.hostManager == nil {
-		return fmt.Errorf("dns service is not initialized yet")
-	}
+		if s.previousConfigHash == hash {
+			log.Debugf("not applying the dns configuration update as there is nothing new")
+			s.updateSerial = serial
+			return nil
+		}
 
-	hash, err := hashstructure.Hash(update, hashstructure.FormatV2, &hashstructure.HashOptions{
-		ZeroNil:         true,
-		IgnoreZeroValue: true,
-		SlicesAsSets:    true,
-		UseStringer:     true,
-	})
-	if err != nil {
-		log.Errorf("unable to hash the dns configuration update, got error: %s", err)
-	}
+		if err := s.applyConfiguration(update); err != nil {
+			return fmt.Errorf("apply configuration: %w", err)
+		}
 
-	if s.previousConfigHash == hash {
-		log.Debugf("not applying the dns configuration update as there is nothing new")
 		s.updateSerial = serial
+		s.previousConfigHash = hash
+
 		return nil
 	}
-
-	if err := s.applyConfiguration(update); err != nil {
-		return fmt.Errorf("apply configuration: %w", err)
-	}
-
-	s.updateSerial = serial
-	s.previousConfigHash = hash
-
-	return nil
 }
 
 func (s *DefaultServer) SearchDomains() []string {
@@ -656,11 +617,8 @@ func (s *DefaultServer) upstreamCallbacks(
 			s.currentConfig.RouteAll = true
 			s.registerHandler([]string{nbdns.RootZone}, handler, PriorityDefault)
 		}
-
-		if s.hostManager != nil {
-			if err := s.hostManager.applyDNSConfig(s.currentConfig, s.stateManager); err != nil {
-				l.WithError(err).Error("reactivate temporary disabled nameserver group, DNS update apply")
-			}
+		if err := s.hostManager.applyDNSConfig(s.currentConfig, s.stateManager); err != nil {
+			l.WithError(err).Error("reactivate temporary disabled nameserver group, DNS update apply")
 		}
 
 		s.updateNSState(nsGroup, nil, true)

client/internal/dns/server_test.go

@@ -294,7 +294,7 @@ func TestUpdateDNSServer(t *testing.T) {
 					t.Log(err)
 				}
 			}()
-			dnsServer, err := NewDefaultServer(context.Background(), wgIface, "", &peer.Status{}, nil, false)
+			dnsServer, err := NewDefaultServer(context.Background(), wgIface, "", &peer.Status{}, nil)
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -403,7 +403,7 @@ func TestDNSFakeResolverHandleUpdates(t *testing.T) {
 		return
 	}
 
-	dnsServer, err := NewDefaultServer(context.Background(), wgIface, "", &peer.Status{}, nil, false)
+	dnsServer, err := NewDefaultServer(context.Background(), wgIface, "", &peer.Status{}, nil)
 	if err != nil {
 		t.Errorf("create DNS server: %v", err)
 		return
@@ -498,7 +498,7 @@ func TestDNSServerStartStop(t *testing.T) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
-			dnsServer, err := NewDefaultServer(context.Background(), &mocWGIface{}, testCase.addrPort, &peer.Status{}, nil, false)
+			dnsServer, err := NewDefaultServer(context.Background(), &mocWGIface{}, testCase.addrPort, &peer.Status{}, nil)
 			if err != nil {
 				t.Fatalf("%v", err)
 			}
@@ -633,7 +633,7 @@ func TestDNSPermanent_updateHostDNS_emptyUpstream(t *testing.T) {
 
 	var dnsList []string
 	dnsConfig := nbdns.Config{}
-	dnsServer := NewDefaultServerPermanentUpstream(context.Background(), wgIFace, dnsList, dnsConfig, nil, &peer.Status{}, false)
+	dnsServer := NewDefaultServerPermanentUpstream(context.Background(), wgIFace, dnsList, dnsConfig, nil, &peer.Status{})
 	err = dnsServer.Initialize()
 	if err != nil {
 		t.Errorf("failed to initialize DNS server: %v", err)
@@ -657,7 +657,7 @@ func TestDNSPermanent_updateUpstream(t *testing.T) {
 	}
 	defer wgIFace.Close()
 	dnsConfig := nbdns.Config{}
-	dnsServer := NewDefaultServerPermanentUpstream(context.Background(), wgIFace, []string{"8.8.8.8"}, dnsConfig, nil, &peer.Status{}, false)
+	dnsServer := NewDefaultServerPermanentUpstream(context.Background(), wgIFace, []string{"8.8.8.8"}, dnsConfig, nil, &peer.Status{})
 	err = dnsServer.Initialize()
 	if err != nil {
 		t.Errorf("failed to initialize DNS server: %v", err)
@@ -749,7 +749,7 @@ func TestDNSPermanent_matchOnly(t *testing.T) {
 	}
 	defer wgIFace.Close()
 	dnsConfig := nbdns.Config{}
-	dnsServer := NewDefaultServerPermanentUpstream(context.Background(), wgIFace, []string{"8.8.8.8"}, dnsConfig, nil, &peer.Status{}, false)
+	dnsServer := NewDefaultServerPermanentUpstream(context.Background(), wgIFace, []string{"8.8.8.8"}, dnsConfig, nil, &peer.Status{})
 	err = dnsServer.Initialize()
 	if err != nil {
 		t.Errorf("failed to initialize DNS server: %v", err)

client/internal/dnsfwd/forwarder.go

@@ -22,18 +22,23 @@ type DNSForwarder struct {
 	mux       *dns.ServeMux
 }
 
-func NewDNSForwarder(listenAddress string, ttl uint32) *DNSForwarder {
-	log.Debugf("creating DNS forwarder with listen_address=%s ttl=%d", listenAddress, ttl)
+func NewDNSForwarder(listenAddress string, ttl uint32, domains []string) *DNSForwarder {
+	log.Debugf("creating DNS forwarder with listen_address=%s ttl=%d domains=%v", listenAddress, ttl, domains)
 	return &DNSForwarder{
 		listenAddress: listenAddress,
 		ttl:           ttl,
+		domains:       domains,
 	}
 }
 
-func (f *DNSForwarder) Listen(domains []string) error {
+func (f *DNSForwarder) Listen() error {
 	log.Infof("listen DNS forwarder on address=%s", f.listenAddress)
 	mux := dns.NewServeMux()
 
+	for _, d := range f.domains {
+		mux.HandleFunc(nbdns.NormalizeZone(d), f.handleDNSQuery)
+	}
+
 	dnsServer := &dns.Server{
 		Addr:    f.listenAddress,
 		Net:     "udp",
@@ -41,24 +46,18 @@ func (f *DNSForwarder) Listen(domains []string) error {
 	}
 	f.dnsServer = dnsServer
 	f.mux = mux
-
-	f.UpdateDomains(domains)
-
 	return dnsServer.ListenAndServe()
 }
 
 func (f *DNSForwarder) UpdateDomains(domains []string) {
-	log.Debugf("Updating domains from %v to %v", f.domains, domains)
-
 	for _, d := range f.domains {
 		f.mux.HandleRemove(d)
 	}
 
-	newDomains := filterDomains(domains)
-	for _, d := range newDomains {
-		f.mux.HandleFunc(d, f.handleDNSQuery)
+	for _, d := range f.domains {
+		f.mux.HandleFunc(nbdns.NormalizeZone(d), f.handleDNSQuery)
 	}
-	f.domains = newDomains
+	f.domains = domains
 }
 
 func (f *DNSForwarder) Close(ctx context.Context) error {
@@ -142,16 +141,3 @@ func (f *DNSForwarder) handleDNSQuery(w dns.ResponseWriter, query *dns.Msg) {
 		log.Errorf("failed to write DNS response: %v", err)
 	}
 }
-
-// filterDomains returns a list of normalized domains
-func filterDomains(domains []string) []string {
-	newDomains := make([]string, 0, len(domains))
-	for _, d := range domains {
-		if d == "" {
-			log.Warn("empty domain in DNS forwarder")
-			continue
-		}
-		newDomains = append(newDomains, nbdns.NormalizeZone(d))
-	}
-	return newDomains
-}

client/internal/dnsfwd/manager.go

@@ -41,9 +41,9 @@ func (m *Manager) Start(domains []string) error {
 		return err
 	}
 
-	m.dnsForwarder = NewDNSForwarder(fmt.Sprintf(":%d", ListenPort), dnsTTL)
+	m.dnsForwarder = NewDNSForwarder(fmt.Sprintf(":%d", ListenPort), dnsTTL, domains)
 	go func() {
-		if err := m.dnsForwarder.Listen(domains); err != nil {
+		if err := m.dnsForwarder.Listen(); err != nil {
 			// todo handle close error if it is exists
 			log.Errorf("failed to start DNS forwarder, err: %v", err)
 		}
@@ -81,14 +81,9 @@ func (m *Manager) Stop(ctx context.Context) error {
 func (h *Manager) allowDNSFirewall() error {
 	dport := &firewall.Port{
 		IsRange: false,
-		Values:  []uint16{ListenPort},
+		Values:  []int{ListenPort},
 	}
-
-	if h.firewall == nil {
-		return nil
-	}
-
-	dnsRules, err := h.firewall.AddPeerFiltering(net.IP{0, 0, 0, 0}, firewall.ProtocolUDP, nil, dport, firewall.ActionAccept, "", "")
+	dnsRules, err := h.firewall.AddPeerFiltering(net.ParseIP("0.0.0.0"), firewall.ProtocolUDP, nil, dport, firewall.RuleDirectionIN, firewall.ActionAccept, "", "")
 	if err != nil {
 		log.Errorf("failed to add allow DNS router rules, err: %v", err)
 		return err

client/internal/engine.go

@@ -16,20 +16,17 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/hashicorp/go-multierror"
 	"github.com/pion/ice/v3"
 	"github.com/pion/stun/v2"
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/protobuf/proto"
 
-	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/firewall"
 	"github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/internal/acl"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	"github.com/netbirdio/netbird/client/internal/dnsfwd"
@@ -111,13 +108,6 @@ type EngineConfig struct {
 	ServerSSHAllowed bool
 
 	DNSRouteInterval time.Duration
-
-	DisableClientRoutes bool
-	DisableServerRoutes bool
-	DisableDNS          bool
-	DisableFirewall     bool
-
-	BlockLANAccess bool
 }
 
 // Engine is a mechanism responsible for reacting on Signal and Management stream events and managing connections to the remote peers.
@@ -384,20 +374,18 @@ func (e *Engine) Start() error {
 	}
 	e.dnsServer = dnsServer
 
-	e.routeManager = routemanager.NewManager(routemanager.ManagerConfig{
-		Context:             e.ctx,
-		PublicKey:           e.config.WgPrivateKey.PublicKey().String(),
-		DNSRouteInterval:    e.config.DNSRouteInterval,
-		WGInterface:         e.wgInterface,
-		StatusRecorder:      e.statusRecorder,
-		RelayManager:        e.relayManager,
-		InitialRoutes:       initialRoutes,
-		StateManager:        e.stateManager,
-		DNSServer:           dnsServer,
-		PeerStore:           e.peerStore,
-		DisableClientRoutes: e.config.DisableClientRoutes,
-		DisableServerRoutes: e.config.DisableServerRoutes,
-	})
+	e.routeManager = routemanager.NewManager(
+		e.ctx,
+		e.config.WgPrivateKey.PublicKey().String(),
+		e.config.DNSRouteInterval,
+		e.wgInterface,
+		e.statusRecorder,
+		e.relayManager,
+		initialRoutes,
+		e.stateManager,
+		dnsServer,
+		e.peerStore,
+	)
 	beforePeerHook, afterPeerHook, err := e.routeManager.Init()
 	if err != nil {
 		log.Errorf("Failed to initialize route manager: %s", err)
@@ -415,8 +403,17 @@ func (e *Engine) Start() error {
 		return fmt.Errorf("create wg interface: %w", err)
 	}
 
-	if err := e.createFirewall(); err != nil {
-		return err
+	e.firewall, err = firewall.NewFirewall(e.wgInterface, e.stateManager)
+	if err != nil {
+		log.Errorf("failed creating firewall manager: %s", err)
+	}
+
+	if e.firewall != nil && e.firewall.IsServerRouteSupported() {
+		err = e.routeManager.EnableServerRouter(e.firewall)
+		if err != nil {
+			e.close()
+			return fmt.Errorf("enable server router: %w", err)
+		}
 	}
 
 	e.udpMux, err = e.wgInterface.Up()
@@ -458,93 +455,6 @@ func (e *Engine) Start() error {
 	return nil
 }
 
-func (e *Engine) createFirewall() error {
-	if e.config.DisableFirewall {
-		log.Infof("firewall is disabled")
-		return nil
-	}
-
-	var err error
-	e.firewall, err = firewall.NewFirewall(e.wgInterface, e.stateManager)
-	if err != nil || e.firewall == nil {
-		log.Errorf("failed creating firewall manager: %s", err)
-		return nil
-	}
-
-	if err := e.initFirewall(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (e *Engine) initFirewall() error {
-	if e.firewall.IsServerRouteSupported() {
-		if err := e.routeManager.EnableServerRouter(e.firewall); err != nil {
-			e.close()
-			return fmt.Errorf("enable server router: %w", err)
-		}
-	}
-
-	if e.config.BlockLANAccess {
-		e.blockLanAccess()
-	}
-
-	if e.rpManager == nil || !e.config.RosenpassEnabled {
-		return nil
-	}
-
-	rosenpassPort := e.rpManager.GetAddress().Port
-	port := manager.Port{Values: []uint16{uint16(rosenpassPort)}}
-
-	// this rule is static and will be torn down on engine down by the firewall manager
-	if _, err := e.firewall.AddPeerFiltering(
-		net.IP{0, 0, 0, 0},
-		manager.ProtocolUDP,
-		nil,
-		&port,
-		manager.ActionAccept,
-		"",
-		"",
-	); err != nil {
-		log.Errorf("failed to allow rosenpass interface traffic: %v", err)
-		return nil
-	}
-
-	log.Infof("rosenpass interface traffic allowed on port %d", rosenpassPort)
-
-	return nil
-}
-
-func (e *Engine) blockLanAccess() {
-	var merr *multierror.Error
-
-	// TODO: keep this updated
-	toBlock, err := getInterfacePrefixes()
-	if err != nil {
-		merr = multierror.Append(merr, fmt.Errorf("get local addresses: %w", err))
-	}
-
-	log.Infof("blocking route LAN access for networks: %v", toBlock)
-	v4 := netip.PrefixFrom(netip.IPv4Unspecified(), 0)
-	for _, network := range toBlock {
-		if _, err := e.firewall.AddRouteFiltering(
-			[]netip.Prefix{v4},
-			network,
-			manager.ProtocolALL,
-			nil,
-			nil,
-			manager.ActionDrop,
-		); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("add fw rule for network %s: %w", network, err))
-		}
-	}
-
-	if merr != nil {
-		log.Warnf("encountered errors blocking IPs to block LAN access: %v", nberrors.FormatErrorOrNil(merr))
-	}
-}
-
 // modifyPeers updates peers that have been modified (e.g. IP address has been changed).
 // It closes the existing connection, removes it from the peerConns map, and creates a new one.
 func (e *Engine) modifyPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
@@ -716,15 +626,6 @@ func (e *Engine) updateChecksIfNew(checks []*mgmProto.Checks) error {
 		log.Warnf("failed to get system info with checks: %v", err)
 		info = system.GetInfo(e.ctx)
 	}
-	info.SetFlags(
-		e.config.RosenpassEnabled,
-		e.config.RosenpassPermissive,
-		&e.config.ServerSSHAllowed,
-		e.config.DisableClientRoutes,
-		e.config.DisableServerRoutes,
-		e.config.DisableDNS,
-		e.config.DisableFirewall,
-	)
 
 	if err := e.mgmClient.SyncMeta(info); err != nil {
 		log.Errorf("could not sync meta: error %s", err)
@@ -745,22 +646,18 @@ func (e *Engine) updateSSH(sshConf *mgmProto.SSHConfig) error {
 	} else {
 
 		if sshConf.GetSshEnabled() {
-			if runtime.GOOS == "windows" {
+			if runtime.GOOS == "windows" || runtime.GOOS == "freebsd" {
 				log.Warnf("running SSH server on %s is not supported", runtime.GOOS)
 				return nil
 			}
 			// start SSH server if it wasn't running
 			if isNil(e.sshServer) {
-				listenAddr := fmt.Sprintf("%s:%d", e.wgInterface.Address().IP.String(), nbssh.DefaultSSHPort)
-				if netstack.IsEnabled() {
-					listenAddr = fmt.Sprintf("127.0.0.1:%d", nbssh.DefaultSSHPort)
-				}
 				// nil sshServer means it has not yet been started
 				var err error
-				e.sshServer, err = e.sshServerFunc(e.config.SSHKey, listenAddr)
-
+				e.sshServer, err = e.sshServerFunc(e.config.SSHKey,
+					fmt.Sprintf("%s:%d", e.wgInterface.Address().IP.String(), nbssh.DefaultSSHPort))
 				if err != nil {
-					return fmt.Errorf("create ssh server: %w", err)
+					return err
 				}
 				go func() {
 					// blocking
@@ -809,17 +706,16 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 	if conf.GetSshConfig() != nil {
 		err := e.updateSSH(conf.GetSshConfig())
 		if err != nil {
-			log.Warnf("failed handling SSH server setup: %v", err)
+			log.Warnf("failed handling SSH server setup %v", err)
 		}
 	}
 
-	state := e.statusRecorder.GetLocalPeerState()
-	state.IP = e.config.WgAddr
-	state.PubKey = e.config.WgPrivateKey.PublicKey().String()
-	state.KernelInterface = device.WireGuardModuleIsLoaded()
-	state.FQDN = conf.GetFqdn()
-
-	e.statusRecorder.UpdateLocalPeerState(state)
+	e.statusRecorder.UpdateLocalPeerState(peer.LocalPeerState{
+		IP:              e.config.WgAddr,
+		PubKey:          e.config.WgPrivateKey.PublicKey().String(),
+		KernelInterface: device.WireGuardModuleIsLoaded(),
+		FQDN:            conf.GetFqdn(),
+	})
 
 	return nil
 }
@@ -833,15 +729,6 @@ func (e *Engine) receiveManagementEvents() {
 			log.Warnf("failed to get system info with checks: %v", err)
 			info = system.GetInfo(e.ctx)
 		}
-		info.SetFlags(
-			e.config.RosenpassEnabled,
-			e.config.RosenpassPermissive,
-			&e.config.ServerSSHAllowed,
-			e.config.DisableClientRoutes,
-			e.config.DisableServerRoutes,
-			e.config.DisableDNS,
-			e.config.DisableFirewall,
-		)
 
 		// err = e.mgmClient.Sync(info, e.handleSync)
 		err = e.mgmClient.Sync(e.ctx, info, e.handleSync)
@@ -915,16 +802,18 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 		e.acl.ApplyFiltering(networkMap)
 	}
 
-	// DNS forwarder
-	dnsRouteFeatureFlag := toDNSFeatureFlag(networkMap)
-	dnsRouteDomains := toRouteDomains(e.config.WgPrivateKey.PublicKey().String(), networkMap.GetRoutes())
-	e.updateDNSForwarder(dnsRouteFeatureFlag, dnsRouteDomains)
+	var dnsRouteFeatureFlag bool
+	if networkMap.PeerConfig != nil {
+		dnsRouteFeatureFlag = networkMap.PeerConfig.RoutingPeerDnsResolutionEnabled
+	}
+	routedDomains, routes := toRoutes(networkMap.GetRoutes())
 
-	routes := toRoutes(networkMap.GetRoutes())
 	if err := e.routeManager.UpdateRoutes(serial, routes, dnsRouteFeatureFlag); err != nil {
 		log.Errorf("failed to update clientRoutes, err: %v", err)
 	}
 
+	e.updateDNSForwarder(dnsRouteFeatureFlag, routedDomains)
+
 	log.Debugf("got peers update from Management Service, total peers to connect to = %d", len(networkMap.GetRemotePeers()))
 
 	e.updateOfflinePeers(networkMap.GetOfflinePeers())
@@ -985,18 +874,12 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 	return nil
 }
 
-func toDNSFeatureFlag(networkMap *mgmProto.NetworkMap) bool {
-	if networkMap.PeerConfig != nil {
-		return networkMap.PeerConfig.RoutingPeerDnsResolutionEnabled
-	}
-	return false
-}
-
-func toRoutes(protoRoutes []*mgmProto.Route) []*route.Route {
+func toRoutes(protoRoutes []*mgmProto.Route) ([]string, []*route.Route) {
 	if protoRoutes == nil {
 		protoRoutes = []*mgmProto.Route{}
 	}
 
+	var dnsRoutes []string
 	routes := make([]*route.Route, 0)
 	for _, protoRoute := range protoRoutes {
 		var prefix netip.Prefix
@@ -1007,6 +890,7 @@ func toRoutes(protoRoutes []*mgmProto.Route) []*route.Route {
 				continue
 			}
 		}
+		dnsRoutes = append(dnsRoutes, protoRoute.Domains...)
 
 		convertedRoute := &route.Route{
 			ID:          route.ID(protoRoute.ID),
@@ -1021,24 +905,7 @@ func toRoutes(protoRoutes []*mgmProto.Route) []*route.Route {
 		}
 		routes = append(routes, convertedRoute)
 	}
-	return routes
-}
-
-func toRouteDomains(myPubKey string, protoRoutes []*mgmProto.Route) []string {
-	if protoRoutes == nil {
-		protoRoutes = []*mgmProto.Route{}
-	}
-
-	var dnsRoutes []string
-	for _, protoRoute := range protoRoutes {
-		if len(protoRoute.Domains) == 0 {
-			continue
-		}
-		if protoRoute.Peer == myPubKey {
-			dnsRoutes = append(dnsRoutes, protoRoute.Domains...)
-		}
-	}
-	return dnsRoutes
+	return dnsRoutes, routes
 }
 
 func toDNSConfig(protoDNSConfig *mgmProto.DNSConfig) nbdns.Config {
@@ -1372,21 +1239,11 @@ func (e *Engine) close() {
 
 func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, error) {
 	info := system.GetInfo(e.ctx)
-	info.SetFlags(
-		e.config.RosenpassEnabled,
-		e.config.RosenpassPermissive,
-		&e.config.ServerSSHAllowed,
-		e.config.DisableClientRoutes,
-		e.config.DisableServerRoutes,
-		e.config.DisableDNS,
-		e.config.DisableFirewall,
-	)
-
 	netMap, err := e.mgmClient.GetNetworkMap(info)
 	if err != nil {
 		return nil, nil, err
 	}
-	routes := toRoutes(netMap.GetRoutes())
+	_, routes := toRoutes(netMap.GetRoutes())
 	dnsCfg := toDNSConfig(netMap.GetDNSConfig())
 	return routes, &dnsCfg, nil
 }
@@ -1440,7 +1297,6 @@ func (e *Engine) newDnsServer() ([]*route.Route, dns.Server, error) {
 	if e.dnsServer != nil {
 		return nil, e.dnsServer, nil
 	}
-
 	switch runtime.GOOS {
 	case "android":
 		routes, dnsConfig, err := e.readInitialSettings()
@@ -1454,17 +1310,14 @@ func (e *Engine) newDnsServer() ([]*route.Route, dns.Server, error) {
 			*dnsConfig,
 			e.mobileDep.NetworkChangeListener,
 			e.statusRecorder,
-			e.config.DisableDNS,
 		)
 		go e.mobileDep.DnsReadyListener.OnReady()
 		return routes, dnsServer, nil
-
 	case "ios":
-		dnsServer := dns.NewDefaultServerIos(e.ctx, e.wgInterface, e.mobileDep.DnsManager, e.statusRecorder, e.config.DisableDNS)
+		dnsServer := dns.NewDefaultServerIos(e.ctx, e.wgInterface, e.mobileDep.DnsManager, e.statusRecorder)
 		return nil, dnsServer, nil
-
 	default:
-		dnsServer, err := dns.NewDefaultServer(e.ctx, e.wgInterface, e.config.CustomDNSAddress, e.statusRecorder, e.stateManager, e.config.DisableDNS)
+		dnsServer, err := dns.NewDefaultServer(e.ctx, e.wgInterface, e.config.CustomDNSAddress, e.statusRecorder, e.stateManager)
 		if err != nil {
 			return nil, nil, err
 		}
@@ -1693,7 +1546,7 @@ func (e *Engine) GetLatestNetworkMap() (*mgmProto.NetworkMap, error) {
 		return nil, nil
 	}
 
-	log.Debugf("Retrieving latest network map with size %d bytes", proto.Size(e.latestNetworkMap))
+	// Create a deep copy to avoid external modifications
 	nm, ok := proto.Clone(e.latestNetworkMap).(*mgmProto.NetworkMap)
 	if !ok {
 
@@ -1754,45 +1607,3 @@ func isChecksEqual(checks []*mgmProto.Checks, oChecks []*mgmProto.Checks) bool {
 		return slices.Equal(checks.Files, oChecks.Files)
 	})
 }
-
-func getInterfacePrefixes() ([]netip.Prefix, error) {
-	ifaces, err := net.Interfaces()
-	if err != nil {
-		return nil, fmt.Errorf("get interfaces: %w", err)
-	}
-
-	var prefixes []netip.Prefix
-	var merr *multierror.Error
-
-	for _, iface := range ifaces {
-		addrs, err := iface.Addrs()
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("get addresses for interface %s: %w", iface.Name, err))
-			continue
-		}
-		for _, addr := range addrs {
-			ipNet, ok := addr.(*net.IPNet)
-			if !ok {
-				merr = multierror.Append(merr, fmt.Errorf("cast address to IPNet: %v", addr))
-				continue
-			}
-			addr, ok := netip.AddrFromSlice(ipNet.IP)
-			if !ok {
-				merr = multierror.Append(merr, fmt.Errorf("cast IPNet to netip.Addr: %v", ipNet.IP))
-				continue
-			}
-			ones, _ := ipNet.Mask.Size()
-			prefix := netip.PrefixFrom(addr.Unmap(), ones).Masked()
-			ip := prefix.Addr()
-
-			// TODO: add IPv6
-			if !ip.Is4() || ip.IsLoopback() || ip.IsMulticast() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {
-				continue
-			}
-
-			prefixes = append(prefixes, prefix)
-		}
-	}
-
-	return prefixes, nberrors.FormatErrorOrNil(merr)
-}

client/internal/engine_test.go

@@ -71,7 +71,8 @@ func TestMain(m *testing.M) {
 }
 
 func TestEngine_SSH(t *testing.T) {
-	if runtime.GOOS == "windows" {
+	// todo resolve test execution on freebsd
+	if runtime.GOOS == "windows" || runtime.GOOS == "freebsd" {
 		t.Skip("skipping TestEngine_SSH")
 	}
 
@@ -252,14 +253,7 @@ func TestEngine_UpdateNetworkMap(t *testing.T) {
 		},
 	}
 	engine.wgInterface = wgIface
-	engine.routeManager = routemanager.NewManager(routemanager.ManagerConfig{
-		Context:          ctx,
-		PublicKey:        key.PublicKey().String(),
-		DNSRouteInterval: time.Minute,
-		WGInterface:      engine.wgInterface,
-		StatusRecorder:   engine.statusRecorder,
-		RelayManager:     relayMgr,
-	})
+	engine.routeManager = routemanager.NewManager(ctx, key.PublicKey().String(), time.Minute, engine.wgInterface, engine.statusRecorder, relayMgr, nil, nil, nil, nil)
 	_, _, err = engine.routeManager.Init()
 	require.NoError(t, err)
 	engine.dnsServer = &dns.MockServer{

client/internal/login.go

@@ -17,9 +17,8 @@ import (
 )
 
 // IsLoginRequired check that the server is support SSO or not
-func IsLoginRequired(ctx context.Context, config *Config) (bool, error) {
-	mgmURL := config.ManagementURL
-	mgmClient, err := getMgmClient(ctx, config.PrivateKey, mgmURL)
+func IsLoginRequired(ctx context.Context, privateKey string, mgmURL *url.URL, sshKey string) (bool, error) {
+	mgmClient, err := getMgmClient(ctx, privateKey, mgmURL)
 	if err != nil {
 		return false, err
 	}
@@ -34,12 +33,12 @@ func IsLoginRequired(ctx context.Context, config *Config) (bool, error) {
 	}()
 	log.Debugf("connected to the Management service %s", mgmURL.String())
 
-	pubSSHKey, err := ssh.GeneratePublicKey([]byte(config.SSHKey))
+	pubSSHKey, err := ssh.GeneratePublicKey([]byte(sshKey))
 	if err != nil {
 		return false, err
 	}
 
-	_, err = doMgmLogin(ctx, mgmClient, pubSSHKey, config)
+	_, err = doMgmLogin(ctx, mgmClient, pubSSHKey)
 	if isLoginNeeded(err) {
 		return true, nil
 	}
@@ -68,10 +67,10 @@ func Login(ctx context.Context, config *Config, setupKey string, jwtToken string
 		return err
 	}
 
-	serverKey, err := doMgmLogin(ctx, mgmClient, pubSSHKey, config)
+	serverKey, err := doMgmLogin(ctx, mgmClient, pubSSHKey)
 	if serverKey != nil && isRegistrationNeeded(err) {
 		log.Debugf("peer registration required")
-		_, err = registerPeer(ctx, *serverKey, mgmClient, setupKey, jwtToken, pubSSHKey, config)
+		_, err = registerPeer(ctx, *serverKey, mgmClient, setupKey, jwtToken, pubSSHKey)
 		return err
 	}
 
@@ -100,7 +99,7 @@ func getMgmClient(ctx context.Context, privateKey string, mgmURL *url.URL) (*mgm
 	return mgmClient, err
 }
 
-func doMgmLogin(ctx context.Context, mgmClient *mgm.GrpcClient, pubSSHKey []byte, config *Config) (*wgtypes.Key, error) {
+func doMgmLogin(ctx context.Context, mgmClient *mgm.GrpcClient, pubSSHKey []byte) (*wgtypes.Key, error) {
 	serverKey, err := mgmClient.GetServerPublicKey()
 	if err != nil {
 		log.Errorf("failed while getting Management Service public key: %v", err)
@@ -108,22 +107,13 @@ func doMgmLogin(ctx context.Context, mgmClient *mgm.GrpcClient, pubSSHKey []byte
 	}
 
 	sysInfo := system.GetInfo(ctx)
-	sysInfo.SetFlags(
-		config.RosenpassEnabled,
-		config.RosenpassPermissive,
-		config.ServerSSHAllowed,
-		config.DisableClientRoutes,
-		config.DisableServerRoutes,
-		config.DisableDNS,
-		config.DisableFirewall,
-	)
 	_, err = mgmClient.Login(*serverKey, sysInfo, pubSSHKey)
 	return serverKey, err
 }
 
 // registerPeer checks whether setupKey was provided via cmd line and if not then it prompts user to enter a key.
 // Otherwise tries to register with the provided setupKey via command line.
-func registerPeer(ctx context.Context, serverPublicKey wgtypes.Key, client *mgm.GrpcClient, setupKey string, jwtToken string, pubSSHKey []byte, config *Config) (*mgmProto.LoginResponse, error) {
+func registerPeer(ctx context.Context, serverPublicKey wgtypes.Key, client *mgm.GrpcClient, setupKey string, jwtToken string, pubSSHKey []byte) (*mgmProto.LoginResponse, error) {
 	validSetupKey, err := uuid.Parse(setupKey)
 	if err != nil && jwtToken == "" {
 		return nil, status.Errorf(codes.InvalidArgument, "invalid setup-key or no sso information provided, err: %v", err)
@@ -131,15 +121,6 @@ func registerPeer(ctx context.Context, serverPublicKey wgtypes.Key, client *mgm.
 
 	log.Debugf("sending peer registration request to Management Service")
 	info := system.GetInfo(ctx)
-	info.SetFlags(
-		config.RosenpassEnabled,
-		config.RosenpassPermissive,
-		config.ServerSSHAllowed,
-		config.DisableClientRoutes,
-		config.DisableServerRoutes,
-		config.DisableDNS,
-		config.DisableFirewall,
-	)
 	loginResp, err := client.Register(serverPublicKey, validSetupKey.String(), jwtToken, info, pubSSHKey)
 	if err != nil {
 		log.Errorf("failed registering peer %v,%s", err, validSetupKey.String())

client/internal/peer/status.go

@@ -84,12 +84,6 @@ type LocalPeerState struct {
 	Routes          map[string]struct{}
 }
 
-// Clone returns a copy of the LocalPeerState
-func (l LocalPeerState) Clone() LocalPeerState {
-	l.Routes = maps.Clone(l.Routes)
-	return l
-}
-
 // SignalState contains the latest state of a signal connection
 type SignalState struct {
 	URL       string
@@ -507,7 +501,7 @@ func (d *Status) GetPeerStateChangeNotifier(peer string) <-chan struct{} {
 func (d *Status) GetLocalPeerState() LocalPeerState {
 	d.mux.Lock()
 	defer d.mux.Unlock()
-	return d.localPeer.Clone()
+	return d.localPeer
 }
 
 // UpdateLocalPeerState updates local peer status

client/internal/peer/worker_ice.go

@@ -255,10 +255,6 @@ func (w *WorkerICE) closeAgent(cancel context.CancelFunc) {
 	defer w.muxAgent.Unlock()
 
 	cancel()
-	if w.agent == nil {
-		return
-	}
-
 	if err := w.agent.Close(); err != nil {
 		w.log.Warnf("failed to close ICE agent: %s", err)
 	}

client/internal/routemanager/client.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"reflect"
-	runtime "runtime"
 	"time"
 
 	"github.com/hashicorp/go-multierror"
@@ -440,7 +439,7 @@ func handlerType(rt *route.Route, useNewDNSRoute bool) int {
 		return handlerTypeStatic
 	}
 
-	if useNewDNSRoute && runtime.GOOS != "ios" {
+	if useNewDNSRoute {
 		return handlerTypeDomain
 	}
 	return handlerTypeDynamic

client/internal/routemanager/dnsinterceptor/handler.go

@@ -67,6 +67,7 @@ func (d *DnsInterceptor) AddRoute(context.Context) error {
 
 func (d *DnsInterceptor) RemoveRoute() error {
 	d.mu.Lock()
+	defer d.mu.Unlock()
 
 	var merr *multierror.Error
 	for domain, prefixes := range d.interceptedDomains {
@@ -88,7 +89,6 @@ func (d *DnsInterceptor) RemoveRoute() error {
 	}
 
 	clear(d.interceptedDomains)
-	d.mu.Unlock()
 
 	d.dnsServer.DeregisterHandler(d.route.Domains.ToPunycodeList(), nbdns.PriorityDNSRoute)
 

client/internal/routemanager/manager.go

@@ -17,7 +17,6 @@ import (
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	"github.com/netbirdio/netbird/client/internal/listener"
 	"github.com/netbirdio/netbird/client/internal/peer"
@@ -48,21 +47,6 @@ type Manager interface {
 	Stop(stateManager *statemanager.Manager)
 }
 
-type ManagerConfig struct {
-	Context             context.Context
-	PublicKey           string
-	DNSRouteInterval    time.Duration
-	WGInterface         iface.IWGIface
-	StatusRecorder      *peer.Status
-	RelayManager        *relayClient.Manager
-	InitialRoutes       []*route.Route
-	StateManager        *statemanager.Manager
-	DNSServer           dns.Server
-	PeerStore           *peerstore.Store
-	DisableClientRoutes bool
-	DisableServerRoutes bool
-}
-
 // DefaultManager is the default instance of a route manager
 type DefaultManager struct {
 	ctx                  context.Context
@@ -70,7 +54,7 @@ type DefaultManager struct {
 	mux                  sync.Mutex
 	clientNetworks       map[route.HAUniqueID]*clientNetwork
 	routeSelector        *routeselector.RouteSelector
-	serverRouter         *serverRouter
+	serverRouter         serverRouter
 	sysOps               *systemops.SysOps
 	statusRecorder       *peer.Status
 	relayMgr             *relayClient.Manager
@@ -82,79 +66,60 @@ type DefaultManager struct {
 	dnsRouteInterval     time.Duration
 	stateManager         *statemanager.Manager
 	// clientRoutes is the most recent list of clientRoutes received from the Management Service
-	clientRoutes        route.HAMap
-	dnsServer           dns.Server
-	peerStore           *peerstore.Store
-	useNewDNSRoute      bool
-	disableClientRoutes bool
-	disableServerRoutes bool
+	clientRoutes   route.HAMap
+	dnsServer      dns.Server
+	peerStore      *peerstore.Store
+	useNewDNSRoute bool
 }
 
-func NewManager(config ManagerConfig) *DefaultManager {
-	mCTX, cancel := context.WithCancel(config.Context)
+func NewManager(
+	ctx context.Context,
+	pubKey string,
+	dnsRouteInterval time.Duration,
+	wgInterface iface.IWGIface,
+	statusRecorder *peer.Status,
+	relayMgr *relayClient.Manager,
+	initialRoutes []*route.Route,
+	stateManager *statemanager.Manager,
+	dnsServer dns.Server,
+	peerStore *peerstore.Store,
+) *DefaultManager {
+	mCTX, cancel := context.WithCancel(ctx)
 	notifier := notifier.NewNotifier()
-	sysOps := systemops.NewSysOps(config.WGInterface, notifier)
+	sysOps := systemops.NewSysOps(wgInterface, notifier)
 
 	dm := &DefaultManager{
-		ctx:                 mCTX,
-		stop:                cancel,
-		dnsRouteInterval:    config.DNSRouteInterval,
-		clientNetworks:      make(map[route.HAUniqueID]*clientNetwork),
-		relayMgr:            config.RelayManager,
-		sysOps:              sysOps,
-		statusRecorder:      config.StatusRecorder,
-		wgInterface:         config.WGInterface,
-		pubKey:              config.PublicKey,
-		notifier:            notifier,
-		stateManager:        config.StateManager,
-		dnsServer:           config.DNSServer,
-		peerStore:           config.PeerStore,
-		disableClientRoutes: config.DisableClientRoutes,
-		disableServerRoutes: config.DisableServerRoutes,
+		ctx:              mCTX,
+		stop:             cancel,
+		dnsRouteInterval: dnsRouteInterval,
+		clientNetworks:   make(map[route.HAUniqueID]*clientNetwork),
+		relayMgr:         relayMgr,
+		sysOps:           sysOps,
+		statusRecorder:   statusRecorder,
+		wgInterface:      wgInterface,
+		pubKey:           pubKey,
+		notifier:         notifier,
+		stateManager:     stateManager,
+		dnsServer:        dnsServer,
+		peerStore:        peerStore,
 	}
 
-	// don't proceed with client routes if it is disabled
-	if config.DisableClientRoutes {
-		return dm
-	}
-
-	dm.setupRefCounters()
-
-	if runtime.GOOS == "android" {
-		cr := dm.initialClientRoutes(config.InitialRoutes)
-		dm.notifier.SetInitialClientRoutes(cr)
-	}
-	return dm
-}
-
-func (m *DefaultManager) setupRefCounters() {
-	m.routeRefCounter = refcounter.New(
+	dm.routeRefCounter = refcounter.New(
 		func(prefix netip.Prefix, _ struct{}) (struct{}, error) {
-			return struct{}{}, m.sysOps.AddVPNRoute(prefix, m.wgInterface.ToInterface())
+			return struct{}{}, sysOps.AddVPNRoute(prefix, wgInterface.ToInterface())
 		},
 		func(prefix netip.Prefix, _ struct{}) error {
-			return m.sysOps.RemoveVPNRoute(prefix, m.wgInterface.ToInterface())
+			return sysOps.RemoveVPNRoute(prefix, wgInterface.ToInterface())
 		},
 	)
 
-	if netstack.IsEnabled() {
-		m.routeRefCounter = refcounter.New(
-			func(netip.Prefix, struct{}) (struct{}, error) {
-				return struct{}{}, refcounter.ErrIgnore
-			},
-			func(netip.Prefix, struct{}) error {
-				return nil
-			},
-		)
-	}
-
-	m.allowedIPsRefCounter = refcounter.New(
+	dm.allowedIPsRefCounter = refcounter.New(
 		func(prefix netip.Prefix, peerKey string) (string, error) {
 			// save peerKey to use it in the remove function
-			return peerKey, m.wgInterface.AddAllowedIP(peerKey, prefix.String())
+			return peerKey, wgInterface.AddAllowedIP(peerKey, prefix.String())
 		},
 		func(prefix netip.Prefix, peerKey string) error {
-			if err := m.wgInterface.RemoveAllowedIP(peerKey, prefix.String()); err != nil {
+			if err := wgInterface.RemoveAllowedIP(peerKey, prefix.String()); err != nil {
 				if !errors.Is(err, configurer.ErrPeerNotFound) && !errors.Is(err, configurer.ErrAllowedIPNotFound) {
 					return err
 				}
@@ -163,13 +128,19 @@ func (m *DefaultManager) setupRefCounters() {
 			return nil
 		},
 	)
+
+	if runtime.GOOS == "android" {
+		cr := dm.initialClientRoutes(initialRoutes)
+		dm.notifier.SetInitialClientRoutes(cr)
+	}
+	return dm
 }
 
 // Init sets up the routing
 func (m *DefaultManager) Init() (nbnet.AddHookFunc, nbnet.RemoveHookFunc, error) {
 	m.routeSelector = m.initSelector()
 
-	if nbnet.CustomRoutingDisabled() || m.disableClientRoutes {
+	if nbnet.CustomRoutingDisabled() {
 		return nil, nil, nil
 	}
 
@@ -215,15 +186,6 @@ func (m *DefaultManager) initSelector() *routeselector.RouteSelector {
 }
 
 func (m *DefaultManager) EnableServerRouter(firewall firewall.Manager) error {
-	if m.disableServerRoutes {
-		log.Info("server routes are disabled")
-		return nil
-	}
-
-	if firewall == nil {
-		return errors.New("firewall manager is not set")
-	}
-
 	var err error
 	m.serverRouter, err = newServerRouter(m.ctx, m.wgInterface, firewall, m.statusRecorder)
 	if err != nil {
@@ -250,7 +212,7 @@ func (m *DefaultManager) Stop(stateManager *statemanager.Manager) {
 		}
 	}
 
-	if !nbnet.CustomRoutingDisabled() && !m.disableClientRoutes {
+	if !nbnet.CustomRoutingDisabled() {
 		if err := m.sysOps.CleanupRouting(stateManager); err != nil {
 			log.Errorf("Error cleaning up routing: %v", err)
 		} else {
@@ -280,11 +242,9 @@ func (m *DefaultManager) UpdateRoutes(updateSerial uint64, newRoutes []*route.Ro
 
 	newServerRoutesMap, newClientRoutesIDMap := m.classifyRoutes(newRoutes)
 
-	if !m.disableClientRoutes {
-		filteredClientRoutes := m.routeSelector.FilterSelected(newClientRoutesIDMap)
-		m.updateClientNetworks(updateSerial, filteredClientRoutes)
-		m.notifier.OnNewRoutes(filteredClientRoutes)
-	}
+	filteredClientRoutes := m.routeSelector.FilterSelected(newClientRoutesIDMap)
+	m.updateClientNetworks(updateSerial, filteredClientRoutes)
+	m.notifier.OnNewRoutes(filteredClientRoutes)
 
 	if m.serverRouter != nil {
 		err := m.serverRouter.updateRoutes(newServerRoutesMap)

client/internal/routemanager/manager_test.go

@@ -424,12 +424,7 @@ func TestManagerUpdateRoutes(t *testing.T) {
 
 			statusRecorder := peer.NewRecorder("https://mgm")
 			ctx := context.TODO()
-			routeManager := NewManager(ManagerConfig{
-				Context:        ctx,
-				PublicKey:      localPeerKey,
-				WGInterface:    wgInterface,
-				StatusRecorder: statusRecorder,
-			})
+			routeManager := NewManager(ctx, localPeerKey, 0, wgInterface, statusRecorder, nil, nil, nil, nil, nil)
 
 			_, _, err = routeManager.Init()
 
@@ -455,7 +450,8 @@ func TestManagerUpdateRoutes(t *testing.T) {
 			require.Len(t, routeManager.clientNetworks, expectedWatchers, "client networks size should match")
 
 			if runtime.GOOS == "linux" && routeManager.serverRouter != nil {
-				require.Len(t, routeManager.serverRouter.routes, testCase.serverRoutesExpected, "server networks size should match")
+				sr := routeManager.serverRouter.(*defaultServerRouter)
+				require.Len(t, sr.routes, testCase.serverRoutesExpected, "server networks size should match")
 			}
 		})
 	}

client/internal/routemanager/server.go

@@ -0,0 +1,9 @@
+package routemanager
+
+import "github.com/netbirdio/netbird/route"
+
+type serverRouter interface {
+	updateRoutes(map[route.ID]*route.Route) error
+	removeFromServerNetwork(*route.Route) error
+	cleanUp()
+}

client/internal/routemanager/server_android.go

@@ -9,19 +9,8 @@ import (
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/internal/peer"
-	"github.com/netbirdio/netbird/route"
 )
 
-type serverRouter struct {
-}
-
-func (r serverRouter) cleanUp() {
-}
-
-func (r serverRouter) updateRoutes(map[route.ID]*route.Route) error {
-	return nil
-}
-
-func newServerRouter(context.Context, iface.IWGIface, firewall.Manager, *peer.Status) (*serverRouter, error) {
+func newServerRouter(context.Context, iface.IWGIface, firewall.Manager, *peer.Status) (serverRouter, error) {
 	return nil, fmt.Errorf("server route not supported on this os")
 }

client/internal/routemanager/server_nonandroid.go

@@ -17,7 +17,7 @@ import (
 	"github.com/netbirdio/netbird/route"
 )
 
-type serverRouter struct {
+type defaultServerRouter struct {
 	mux            sync.Mutex
 	ctx            context.Context
 	routes         map[route.ID]*route.Route
@@ -26,8 +26,8 @@ type serverRouter struct {
 	statusRecorder *peer.Status
 }
 
-func newServerRouter(ctx context.Context, wgInterface iface.IWGIface, firewall firewall.Manager, statusRecorder *peer.Status) (*serverRouter, error) {
-	return &serverRouter{
+func newServerRouter(ctx context.Context, wgInterface iface.IWGIface, firewall firewall.Manager, statusRecorder *peer.Status) (serverRouter, error) {
+	return &defaultServerRouter{
 		ctx:            ctx,
 		routes:         make(map[route.ID]*route.Route),
 		firewall:       firewall,
@@ -36,7 +36,7 @@ func newServerRouter(ctx context.Context, wgInterface iface.IWGIface, firewall f
 	}, nil
 }
 
-func (m *serverRouter) updateRoutes(routesMap map[route.ID]*route.Route) error {
+func (m *defaultServerRouter) updateRoutes(routesMap map[route.ID]*route.Route) error {
 	serverRoutesToRemove := make([]route.ID, 0)
 
 	for routeID := range m.routes {
@@ -80,72 +80,74 @@ func (m *serverRouter) updateRoutes(routesMap map[route.ID]*route.Route) error {
 	return nil
 }
 
-func (m *serverRouter) removeFromServerNetwork(route *route.Route) error {
-	if m.ctx.Err() != nil {
+func (m *defaultServerRouter) removeFromServerNetwork(route *route.Route) error {
+	select {
+	case <-m.ctx.Done():
 		log.Infof("Not removing from server network because context is done")
 		return m.ctx.Err()
+	default:
+		m.mux.Lock()
+		defer m.mux.Unlock()
+
+		routerPair, err := routeToRouterPair(route)
+		if err != nil {
+			return fmt.Errorf("parse prefix: %w", err)
+		}
+
+		err = m.firewall.RemoveNatRule(routerPair)
+		if err != nil {
+			return fmt.Errorf("remove routing rules: %w", err)
+		}
+
+		delete(m.routes, route.ID)
+
+		state := m.statusRecorder.GetLocalPeerState()
+		delete(state.Routes, route.Network.String())
+		m.statusRecorder.UpdateLocalPeerState(state)
+
+		return nil
 	}
-
-	m.mux.Lock()
-	defer m.mux.Unlock()
-
-	routerPair, err := routeToRouterPair(route)
-	if err != nil {
-		return fmt.Errorf("parse prefix: %w", err)
-	}
-
-	err = m.firewall.RemoveNatRule(routerPair)
-	if err != nil {
-		return fmt.Errorf("remove routing rules: %w", err)
-	}
-
-	delete(m.routes, route.ID)
-
-	state := m.statusRecorder.GetLocalPeerState()
-	delete(state.Routes, route.Network.String())
-	m.statusRecorder.UpdateLocalPeerState(state)
-
-	return nil
 }
 
-func (m *serverRouter) addToServerNetwork(route *route.Route) error {
-	if m.ctx.Err() != nil {
+func (m *defaultServerRouter) addToServerNetwork(route *route.Route) error {
+	select {
+	case <-m.ctx.Done():
 		log.Infof("Not adding to server network because context is done")
 		return m.ctx.Err()
+	default:
+		m.mux.Lock()
+		defer m.mux.Unlock()
+
+		routerPair, err := routeToRouterPair(route)
+		if err != nil {
+			return fmt.Errorf("parse prefix: %w", err)
+		}
+
+		err = m.firewall.AddNatRule(routerPair)
+		if err != nil {
+			return fmt.Errorf("insert routing rules: %w", err)
+		}
+
+		m.routes[route.ID] = route
+
+		state := m.statusRecorder.GetLocalPeerState()
+		if state.Routes == nil {
+			state.Routes = map[string]struct{}{}
+		}
+
+		routeStr := route.Network.String()
+		if route.IsDynamic() {
+			routeStr = route.Domains.SafeString()
+		}
+		state.Routes[routeStr] = struct{}{}
+
+		m.statusRecorder.UpdateLocalPeerState(state)
+
+		return nil
 	}
-
-	m.mux.Lock()
-	defer m.mux.Unlock()
-
-	routerPair, err := routeToRouterPair(route)
-	if err != nil {
-		return fmt.Errorf("parse prefix: %w", err)
-	}
-
-	err = m.firewall.AddNatRule(routerPair)
-	if err != nil {
-		return fmt.Errorf("insert routing rules: %w", err)
-	}
-
-	m.routes[route.ID] = route
-
-	state := m.statusRecorder.GetLocalPeerState()
-	if state.Routes == nil {
-		state.Routes = map[string]struct{}{}
-	}
-
-	routeStr := route.Network.String()
-	if route.IsDynamic() {
-		routeStr = route.Domains.SafeString()
-	}
-	state.Routes[routeStr] = struct{}{}
-
-	m.statusRecorder.UpdateLocalPeerState(state)
-
-	return nil
 }
 
-func (m *serverRouter) cleanUp() {
+func (m *defaultServerRouter) cleanUp() {
 	m.mux.Lock()
 	defer m.mux.Unlock()
 	for _, r := range m.routes {

client/internal/routemanager/systemops/systemops_generic.go

@@ -17,7 +17,6 @@ import (
 
 	nberrors "github.com/netbirdio/netbird/client/errors"
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
 	"github.com/netbirdio/netbird/client/internal/routemanager/util"
 	"github.com/netbirdio/netbird/client/internal/routemanager/vars"
@@ -63,17 +62,6 @@ func (r *SysOps) setupRefCounter(initAddresses []net.IP, stateManager *statemana
 		r.removeFromRouteTable,
 	)
 
-	if netstack.IsEnabled() {
-		refCounter = refcounter.New(
-			func(netip.Prefix, struct{}) (Nexthop, error) {
-				return Nexthop{}, refcounter.ErrIgnore
-			},
-			func(netip.Prefix, Nexthop) error {
-				return nil
-			},
-		)
-	}
-
 	r.refCounter = refCounter
 
 	return r.setupHooks(initAddresses, stateManager)

client/internal/routemanager/systemops/systemops_linux.go

@@ -266,7 +266,7 @@ func addRoute(prefix netip.Prefix, nexthop Nexthop, tableID int) error {
 		return fmt.Errorf("add gateway and device: %w", err)
 	}
 
-	if err := netlink.RouteAdd(route); err != nil && !errors.Is(err, syscall.EEXIST) && !isOpErr(err) {
+	if err := netlink.RouteAdd(route); err != nil && !errors.Is(err, syscall.EEXIST) && !errors.Is(err, syscall.EAFNOSUPPORT) {
 		return fmt.Errorf("netlink add route: %w", err)
 	}
 
@@ -289,7 +289,7 @@ func addUnreachableRoute(prefix netip.Prefix, tableID int) error {
 		Dst:    ipNet,
 	}
 
-	if err := netlink.RouteAdd(route); err != nil && !errors.Is(err, syscall.EEXIST) && !isOpErr(err) {
+	if err := netlink.RouteAdd(route); err != nil && !errors.Is(err, syscall.EEXIST) && !errors.Is(err, syscall.EAFNOSUPPORT) {
 		return fmt.Errorf("netlink add unreachable route: %w", err)
 	}
 
@@ -312,7 +312,7 @@ func removeUnreachableRoute(prefix netip.Prefix, tableID int) error {
 	if err := netlink.RouteDel(route); err != nil &&
 		!errors.Is(err, syscall.ESRCH) &&
 		!errors.Is(err, syscall.ENOENT) &&
-		!isOpErr(err) {
+		!errors.Is(err, syscall.EAFNOSUPPORT) {
 		return fmt.Errorf("netlink remove unreachable route: %w", err)
 	}
 
@@ -338,7 +338,7 @@ func removeRoute(prefix netip.Prefix, nexthop Nexthop, tableID int) error {
 		return fmt.Errorf("add gateway and device: %w", err)
 	}
 
-	if err := netlink.RouteDel(route); err != nil && !errors.Is(err, syscall.ESRCH) && !isOpErr(err) {
+	if err := netlink.RouteDel(route); err != nil && !errors.Is(err, syscall.ESRCH) && !errors.Is(err, syscall.EAFNOSUPPORT) {
 		return fmt.Errorf("netlink remove route: %w", err)
 	}
 
@@ -362,7 +362,7 @@ func flushRoutes(tableID, family int) error {
 				routes[i].Dst = &net.IPNet{IP: net.IPv6zero, Mask: net.CIDRMask(0, 128)}
 			}
 		}
-		if err := netlink.RouteDel(&routes[i]); err != nil && !isOpErr(err) {
+		if err := netlink.RouteDel(&routes[i]); err != nil && !errors.Is(err, syscall.EAFNOSUPPORT) {
 			result = multierror.Append(result, fmt.Errorf("failed to delete route %v from table %d: %w", routes[i], tableID, err))
 		}
 	}
@@ -450,7 +450,7 @@ func addRule(params ruleParams) error {
 	rule.Invert = params.invert
 	rule.SuppressPrefixlen = params.suppressPrefix
 
-	if err := netlink.RuleAdd(rule); err != nil && !errors.Is(err, syscall.EEXIST) && !isOpErr(err) {
+	if err := netlink.RuleAdd(rule); err != nil && !errors.Is(err, syscall.EEXIST) && !errors.Is(err, syscall.EAFNOSUPPORT) {
 		return fmt.Errorf("add routing rule: %w", err)
 	}
 
@@ -467,7 +467,7 @@ func removeRule(params ruleParams) error {
 	rule.Priority = params.priority
 	rule.SuppressPrefixlen = params.suppressPrefix
 
-	if err := netlink.RuleDel(rule); err != nil && !errors.Is(err, syscall.ENOENT) && !isOpErr(err) {
+	if err := netlink.RuleDel(rule); err != nil && !errors.Is(err, syscall.ENOENT) && !errors.Is(err, syscall.EAFNOSUPPORT) {
 		return fmt.Errorf("remove routing rule: %w", err)
 	}
 
@@ -509,13 +509,3 @@ func hasSeparateRouting() ([]netip.Prefix, error) {
 	}
 	return nil, ErrRoutingIsSeparate
 }
-
-func isOpErr(err error) bool {
-	// EAFTNOSUPPORT when ipv6 is disabled via sysctl, EOPNOTSUPP when disabled in boot options or otherwise not supported
-	if errors.Is(err, syscall.EAFNOSUPPORT) || errors.Is(err, syscall.EOPNOTSUPP) {
-		log.Debugf("route operation not supported: %v", err)
-		return true
-	}
-
-	return false
-}

client/internal/statemanager/manager.go

@@ -303,29 +303,20 @@ func (m *Manager) loadStateFile(deleteCorrupt bool) (map[string]json.RawMessage,
 
 	var rawStates map[string]json.RawMessage
 	if err := json.Unmarshal(data, &rawStates); err != nil {
-		m.handleCorruptedState(deleteCorrupt)
+		if deleteCorrupt {
+			log.Warn("State file appears to be corrupted, attempting to delete it", err)
+			if err := os.Remove(m.filePath); err != nil {
+				log.Errorf("Failed to delete corrupted state file: %v", err)
+			} else {
+				log.Info("State file deleted")
+			}
+		}
 		return nil, fmt.Errorf("unmarshal states: %w", err)
 	}
 
 	return rawStates, nil
 }
 
-// handleCorruptedState creates a backup of a corrupted state file by moving it
-func (m *Manager) handleCorruptedState(deleteCorrupt bool) {
-	if !deleteCorrupt {
-		return
-	}
-	log.Warn("State file appears to be corrupted, attempting to back it up")
-
-	backupPath := fmt.Sprintf("%s.corrupted.%d", m.filePath, time.Now().UnixNano())
-	if err := os.Rename(m.filePath, backupPath); err != nil {
-		log.Errorf("Failed to backup corrupted state file: %v", err)
-		return
-	}
-
-	log.Infof("Created backup of corrupted state file at: %s", backupPath)
-}
-
 // loadSingleRawState unmarshals a raw state into a concrete state object
 func (m *Manager) loadSingleRawState(name string, rawState json.RawMessage) (State, error) {
 	stateType, ok := m.stateTypes[name]

client/internal/statemanager/path.go

@@ -1,16 +1,23 @@
 package statemanager
 
 import (
-	"github.com/netbirdio/netbird/client/configs"
 	"os"
 	"path/filepath"
+	"runtime"
 )
 
 // GetDefaultStatePath returns the path to the state file based on the operating system
 // It returns an empty string if the path cannot be determined.
 func GetDefaultStatePath() string {
-	if path := os.Getenv("NB_DNS_STATE_FILE"); path != "" {
-		return path
+	switch runtime.GOOS {
+	case "windows":
+		return filepath.Join(os.Getenv("PROGRAMDATA"), "Netbird", "state.json")
+	case "darwin", "linux":
+		return "/var/lib/netbird/state.json"
+	case "freebsd", "openbsd", "netbsd", "dragonfly":
+		return "/var/db/netbird/state.json"
 	}
-	return filepath.Join(configs.StateDir, "state.json")
+
+	return ""
+
 }

client/ios/NetBirdSDK/client.go

@@ -207,7 +207,7 @@ func (c *Client) IsLoginRequired() bool {
 		ConfigPath: c.cfgFile,
 	})
 
-	needsLogin, _ := internal.IsLoginRequired(ctx, cfg)
+	needsLogin, _ := internal.IsLoginRequired(ctx, cfg.PrivateKey, cfg.ManagementURL, cfg.SSHKey)
 	return needsLogin
 }
 

client/ios/NetBirdSDK/login.go

@@ -123,7 +123,7 @@ func (a *Auth) Login() error {
 
 	// check if we need to generate JWT token
 	err := a.withBackOff(a.ctx, func() (err error) {
-		needsLogin, err = internal.IsLoginRequired(a.ctx, a.config)
+		needsLogin, err = internal.IsLoginRequired(a.ctx, a.config.PrivateKey, a.config.ManagementURL, a.config.SSHKey)
 		return
 	})
 	if err != nil {

client/proto/daemon.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v4.23.4
+// 	protoc        v3.21.9
 // source: daemon.proto
 
 package proto
@@ -122,11 +122,6 @@ type LoginRequest struct {
 	ExtraIFaceBlacklist  []string             `protobuf:"bytes,17,rep,name=extraIFaceBlacklist,proto3" json:"extraIFaceBlacklist,omitempty"`
 	NetworkMonitor       *bool                `protobuf:"varint,18,opt,name=networkMonitor,proto3,oneof" json:"networkMonitor,omitempty"`
 	DnsRouteInterval     *durationpb.Duration `protobuf:"bytes,19,opt,name=dnsRouteInterval,proto3,oneof" json:"dnsRouteInterval,omitempty"`
-	DisableClientRoutes  *bool                `protobuf:"varint,20,opt,name=disable_client_routes,json=disableClientRoutes,proto3,oneof" json:"disable_client_routes,omitempty"`
-	DisableServerRoutes  *bool                `protobuf:"varint,21,opt,name=disable_server_routes,json=disableServerRoutes,proto3,oneof" json:"disable_server_routes,omitempty"`
-	DisableDns           *bool                `protobuf:"varint,22,opt,name=disable_dns,json=disableDns,proto3,oneof" json:"disable_dns,omitempty"`
-	DisableFirewall      *bool                `protobuf:"varint,23,opt,name=disable_firewall,json=disableFirewall,proto3,oneof" json:"disable_firewall,omitempty"`
-	BlockLanAccess       *bool                `protobuf:"varint,24,opt,name=block_lan_access,json=blockLanAccess,proto3,oneof" json:"block_lan_access,omitempty"`
 }
 
 func (x *LoginRequest) Reset() {
@@ -295,41 +290,6 @@ func (x *LoginRequest) GetDnsRouteInterval() *durationpb.Duration {
 	return nil
 }
 
-func (x *LoginRequest) GetDisableClientRoutes() bool {
-	if x != nil && x.DisableClientRoutes != nil {
-		return *x.DisableClientRoutes
-	}
-	return false
-}
-
-func (x *LoginRequest) GetDisableServerRoutes() bool {
-	if x != nil && x.DisableServerRoutes != nil {
-		return *x.DisableServerRoutes
-	}
-	return false
-}
-
-func (x *LoginRequest) GetDisableDns() bool {
-	if x != nil && x.DisableDns != nil {
-		return *x.DisableDns
-	}
-	return false
-}
-
-func (x *LoginRequest) GetDisableFirewall() bool {
-	if x != nil && x.DisableFirewall != nil {
-		return *x.DisableFirewall
-	}
-	return false
-}
-
-func (x *LoginRequest) GetBlockLanAccess() bool {
-	if x != nil && x.BlockLanAccess != nil {
-		return *x.BlockLanAccess
-	}
-	return false
-}
-
 type LoginResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -2581,7 +2541,7 @@ var file_daemon_proto_rawDesc = []byte{
 	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74,
 	0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
 	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x95, 0x0b, 0x0a, 0x0c, 0x4c, 0x6f,
+	0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xb0, 0x08, 0x0a, 0x0c, 0x4c, 0x6f,
 	0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65,
 	0x74, 0x75, 0x70, 0x4b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x65,
 	0x74, 0x75, 0x70, 0x4b, 0x65, 0x79, 0x12, 0x26, 0x0a, 0x0c, 0x70, 0x72, 0x65, 0x53, 0x68, 0x61,
@@ -2636,371 +2596,349 @@ var file_daemon_proto_rawDesc = []byte{
 	0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x18, 0x13, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67,
 	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44,
 	0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x08, 0x52, 0x10, 0x64, 0x6e, 0x73, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x37,
-	0x0a, 0x15, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
-	0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x14, 0x20, 0x01, 0x28, 0x08, 0x48, 0x09, 0x52,
-	0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x6f,
-	0x75, 0x74, 0x65, 0x73, 0x88, 0x01, 0x01, 0x12, 0x37, 0x0a, 0x15, 0x64, 0x69, 0x73, 0x61, 0x62,
-	0x6c, 0x65, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
-	0x18, 0x15, 0x20, 0x01, 0x28, 0x08, 0x48, 0x0a, 0x52, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x88, 0x01, 0x01,
-	0x12, 0x24, 0x0a, 0x0b, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x64, 0x6e, 0x73, 0x18,
-	0x16, 0x20, 0x01, 0x28, 0x08, 0x48, 0x0b, 0x52, 0x0a, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65,
-	0x44, 0x6e, 0x73, 0x88, 0x01, 0x01, 0x12, 0x2e, 0x0a, 0x10, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
-	0x65, 0x5f, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x18, 0x17, 0x20, 0x01, 0x28, 0x08,
-	0x48, 0x0c, 0x52, 0x0f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x46, 0x69, 0x72, 0x65, 0x77,
-	0x61, 0x6c, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x2d, 0x0a, 0x10, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x5f,
-	0x6c, 0x61, 0x6e, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x18, 0x18, 0x20, 0x01, 0x28, 0x08,
-	0x48, 0x0d, 0x52, 0x0e, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x4c, 0x61, 0x6e, 0x41, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x88, 0x01, 0x01, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70,
-	0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x69,
-	0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x42, 0x10, 0x0a, 0x0e,
-	0x5f, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x42, 0x17,
-	0x0a, 0x15, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x50, 0x72, 0x65, 0x53, 0x68,
-	0x61, 0x72, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x42, 0x15, 0x0a, 0x13, 0x5f, 0x64, 0x69, 0x73, 0x61,
-	0x62, 0x6c, 0x65, 0x41, 0x75, 0x74, 0x6f, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x42, 0x13,
-	0x0a, 0x11, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x53, 0x48, 0x41, 0x6c, 0x6c, 0x6f,
-	0x77, 0x65, 0x64, 0x42, 0x16, 0x0a, 0x14, 0x5f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73,
-	0x73, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x42, 0x11, 0x0a, 0x0f, 0x5f,
-	0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x6f, 0x6e, 0x69, 0x74, 0x6f, 0x72, 0x42, 0x13,
-	0x0a, 0x11, 0x5f, 0x64, 0x6e, 0x73, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x6e, 0x74, 0x65, 0x72,
-	0x76, 0x61, 0x6c, 0x42, 0x18, 0x0a, 0x16, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f,
-	0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x42, 0x18, 0x0a,
-	0x16, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x5f, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x42, 0x0e, 0x0a, 0x0c, 0x5f, 0x64, 0x69, 0x73, 0x61,
-	0x62, 0x6c, 0x65, 0x5f, 0x64, 0x6e, 0x73, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x64, 0x69, 0x73, 0x61,
-	0x62, 0x6c, 0x65, 0x5f, 0x66, 0x69, 0x72, 0x65, 0x77, 0x61, 0x6c, 0x6c, 0x42, 0x13, 0x0a, 0x11,
-	0x5f, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x5f, 0x6c, 0x61, 0x6e, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73,
-	0x73, 0x22, 0xb5, 0x01, 0x0a, 0x0d, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x6e, 0x65, 0x65, 0x64, 0x73, 0x53, 0x53, 0x4f, 0x4c,
-	0x6f, 0x67, 0x69, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x6e, 0x65, 0x65, 0x64,
-	0x73, 0x53, 0x53, 0x4f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65,
-	0x72, 0x43, 0x6f, 0x64, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65,
-	0x72, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x28, 0x0a, 0x0f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x55, 0x52, 0x49, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f,
-	0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x55, 0x52, 0x49, 0x12,
-	0x38, 0x0a, 0x17, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x55,
-	0x52, 0x49, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x17, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x55, 0x52,
-	0x49, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x22, 0x4d, 0x0a, 0x13, 0x57, 0x61, 0x69,
-	0x74, 0x53, 0x53, 0x4f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x1a, 0x0a, 0x08,
-	0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x16, 0x0a, 0x14, 0x57, 0x61, 0x69, 0x74,
-	0x53, 0x53, 0x4f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x0b, 0x0a, 0x09, 0x55, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x0c, 0x0a,
-	0x0a, 0x55, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x3d, 0x0a, 0x0d, 0x53,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2c, 0x0a, 0x11,
-	0x67, 0x65, 0x74, 0x46, 0x75, 0x6c, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x67, 0x65, 0x74, 0x46, 0x75, 0x6c, 0x6c,
-	0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x82, 0x01, 0x0a, 0x0e, 0x53,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a,
-	0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73,
-	0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x32, 0x0a, 0x0a, 0x66, 0x75, 0x6c, 0x6c, 0x53, 0x74, 0x61,
-	0x74, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x64, 0x61, 0x65, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x46, 0x75, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x0a, 0x66,
-	0x75, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x24, 0x0a, 0x0d, 0x64, 0x61, 0x65,
-	0x6d, 0x6f, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0d, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22,
-	0x0d, 0x0a, 0x0b, 0x44, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x0e,
-	0x0a, 0x0c, 0x44, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x12,
-	0x0a, 0x10, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x22, 0xb9, 0x03, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61,
-	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x55, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x55, 0x72, 0x6c, 0x12, 0x1e,
-	0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x46, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x18,
-	0x0a, 0x07, 0x6c, 0x6f, 0x67, 0x46, 0x69, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x6c, 0x6f, 0x67, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x70, 0x72, 0x65, 0x53,
-	0x68, 0x61, 0x72, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c,
-	0x70, 0x72, 0x65, 0x53, 0x68, 0x61, 0x72, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x12, 0x1a, 0x0a, 0x08,
-	0x61, 0x64, 0x6d, 0x69, 0x6e, 0x55, 0x52, 0x4c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
-	0x61, 0x64, 0x6d, 0x69, 0x6e, 0x55, 0x52, 0x4c, 0x12, 0x24, 0x0a, 0x0d, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x66, 0x61, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0d, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x24,
-	0x0a, 0x0d, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64,
-	0x50, 0x6f, 0x72, 0x74, 0x12, 0x2e, 0x0a, 0x12, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x41,
-	0x75, 0x74, 0x6f, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x12, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x41, 0x75, 0x74, 0x6f, 0x43, 0x6f, 0x6e,
-	0x6e, 0x65, 0x63, 0x74, 0x12, 0x2a, 0x0a, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x53,
-	0x48, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x53, 0x48, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64,
-	0x12, 0x2a, 0x0a, 0x10, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x6f, 0x73, 0x65,
-	0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x30, 0x0a, 0x13,
-	0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73,
-	0x69, 0x76, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e,
-	0x70, 0x61, 0x73, 0x73, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x22, 0xde,
-	0x05, 0x0a, 0x09, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02,
-	0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06,
-	0x70, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70, 0x75,
-	0x62, 0x4b, 0x65, 0x79, 0x12, 0x1e, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x53, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x53, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x12, 0x46, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x53, 0x74, 0x61, 0x74,
-	0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x6e,
-	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07,
-	0x72, 0x65, 0x6c, 0x61, 0x79, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x72,
-	0x65, 0x6c, 0x61, 0x79, 0x65, 0x64, 0x12, 0x34, 0x0a, 0x15, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49,
-	0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x63, 0x65, 0x43,
-	0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x36, 0x0a, 0x16,
-	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61,
-	0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x16, 0x72, 0x65,
-	0x6d, 0x6f, 0x74, 0x65, 0x49, 0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65,
-	0x54, 0x79, 0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18, 0x09, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x3c, 0x0a, 0x19, 0x6c, 0x6f, 0x63, 0x61,
-	0x6c, 0x49, 0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x64,
-	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x19, 0x6c, 0x6f, 0x63,
-	0x61, 0x6c, 0x49, 0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x3e, 0x0a, 0x1a, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65,
-	0x49, 0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x64, 0x70,
-	0x6f, 0x69, 0x6e, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1a, 0x72, 0x65, 0x6d, 0x6f,
-	0x74, 0x65, 0x49, 0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x52, 0x0a, 0x16, 0x6c, 0x61, 0x73, 0x74, 0x57, 0x69,
-	0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65,
-	0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
-	0x6d, 0x70, 0x52, 0x16, 0x6c, 0x61, 0x73, 0x74, 0x57, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72,
-	0x64, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x62, 0x79,
-	0x74, 0x65, 0x73, 0x52, 0x78, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x62, 0x79, 0x74,
-	0x65, 0x73, 0x52, 0x78, 0x12, 0x18, 0x0a, 0x07, 0x62, 0x79, 0x74, 0x65, 0x73, 0x54, 0x78, 0x18,
-	0x0e, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x62, 0x79, 0x74, 0x65, 0x73, 0x54, 0x78, 0x12, 0x2a,
-	0x0a, 0x10, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70,
-	0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x6e, 0x65,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x18, 0x10, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x65,
-	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x12, 0x33, 0x0a, 0x07, 0x6c, 0x61, 0x74, 0x65, 0x6e, 0x63,
-	0x79, 0x18, 0x11, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x52, 0x07, 0x6c, 0x61, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x12, 0x22, 0x0a, 0x0c, 0x72,
-	0x65, 0x6c, 0x61, 0x79, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x12, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0c, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22,
-	0xf0, 0x01, 0x0a, 0x0e, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61,
-	0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
-	0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x06, 0x70, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x28, 0x0a, 0x0f, 0x6b, 0x65,
-	0x72, 0x6e, 0x65, 0x6c, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x0f, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x49, 0x6e, 0x74, 0x65, 0x72,
-	0x66, 0x61, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x12, 0x2a, 0x0a, 0x10, 0x72, 0x6f, 0x73, 0x65,
-	0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x10, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61,
-	0x62, 0x6c, 0x65, 0x64, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73,
-	0x73, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x65, 0x72, 0x6d,
-	0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
-	0x6b, 0x73, 0x22, 0x53, 0x0a, 0x0b, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x12, 0x10, 0x0a, 0x03, 0x55, 0x52, 0x4c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
-	0x55, 0x52, 0x4c, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65,
-	0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0x57, 0x0a, 0x0f, 0x4d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x55, 0x52,
-	0x4c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x55, 0x52, 0x4c, 0x12, 0x1c, 0x0a, 0x09,
-	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72,
-	0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72,
-	0x22, 0x52, 0x0a, 0x0a, 0x52, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x10,
-	0x0a, 0x03, 0x55, 0x52, 0x49, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x55, 0x52, 0x49,
-	0x12, 0x1c, 0x0a, 0x09, 0x61, 0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x09, 0x61, 0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x14,
-	0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65,
-	0x72, 0x72, 0x6f, 0x72, 0x22, 0x72, 0x0a, 0x0c, 0x4e, 0x53, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18,
-	0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x18,
-	0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52,
-	0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62,
-	0x6c, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c,
-	0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0xd2, 0x02, 0x0a, 0x0a, 0x46, 0x75, 0x6c,
-	0x6c, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x41, 0x0a, 0x0f, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x17, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x0f, 0x6d, 0x61, 0x6e, 0x61, 0x67,
-	0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x35, 0x0a, 0x0b, 0x73, 0x69,
-	0x67, 0x6e, 0x61, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x13, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x52, 0x0b, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x12, 0x3e, 0x0a, 0x0e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74,
-	0x61, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x64, 0x61, 0x65, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x52, 0x0e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x12, 0x27, 0x0a, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x11, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74,
-	0x61, 0x74, 0x65, 0x52, 0x05, 0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2a, 0x0a, 0x06, 0x72, 0x65,
-	0x6c, 0x61, 0x79, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x64, 0x61, 0x65,
-	0x6d, 0x6f, 0x6e, 0x2e, 0x52, 0x65, 0x6c, 0x61, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x06,
-	0x72, 0x65, 0x6c, 0x61, 0x79, 0x73, 0x12, 0x35, 0x0a, 0x0b, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x64, 0x61,
-	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4e, 0x53, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x52, 0x0a, 0x64, 0x6e, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x22, 0x15, 0x0a,
-	0x13, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x22, 0x3f, 0x0a, 0x14, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x27, 0x0a, 0x06,
-	0x72, 0x6f, 0x75, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x64,
-	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x06, 0x72,
-	0x6f, 0x75, 0x74, 0x65, 0x73, 0x22, 0x61, 0x0a, 0x15, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1e,
-	0x0a, 0x0a, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x49, 0x44, 0x73, 0x18, 0x01, 0x20, 0x03,
-	0x28, 0x09, 0x52, 0x0a, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x49, 0x44, 0x73, 0x12, 0x16,
-	0x0a, 0x06, 0x61, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06,
-	0x61, 0x70, 0x70, 0x65, 0x6e, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x61, 0x6c, 0x6c, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x03, 0x61, 0x6c, 0x6c, 0x22, 0x18, 0x0a, 0x16, 0x53, 0x65, 0x6c, 0x65,
-	0x63, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x1a, 0x0a, 0x06, 0x49, 0x50, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03,
-	0x69, 0x70, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x69, 0x70, 0x73, 0x22, 0xf9,
-	0x01, 0x0a, 0x07, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x44, 0x12, 0x14, 0x0a, 0x05, 0x72, 0x61,
-	0x6e, 0x67, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65,
-	0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x08, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07,
-	0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64,
-	0x6f, 0x6d, 0x61, 0x69, 0x6e, 0x73, 0x12, 0x42, 0x0a, 0x0b, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76,
-	0x65, 0x64, 0x49, 0x50, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x64, 0x61,
-	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x52, 0x65, 0x73,
-	0x6f, 0x6c, 0x76, 0x65, 0x64, 0x49, 0x50, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0b, 0x72,
-	0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x49, 0x50, 0x73, 0x1a, 0x4e, 0x0a, 0x10, 0x52, 0x65,
-	0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x49, 0x50, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
-	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
-	0x12, 0x24, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x0e, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x49, 0x50, 0x4c, 0x69, 0x73, 0x74, 0x52,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x6a, 0x0a, 0x12, 0x44, 0x65,
-	0x62, 0x75, 0x67, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x1c, 0x0a, 0x09, 0x61, 0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x69, 0x7a, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x09, 0x61, 0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x69, 0x7a, 0x65, 0x12, 0x16,
-	0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
-	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d,
-	0x49, 0x6e, 0x66, 0x6f, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x79, 0x73, 0x74,
-	0x65, 0x6d, 0x49, 0x6e, 0x66, 0x6f, 0x22, 0x29, 0x0a, 0x13, 0x44, 0x65, 0x62, 0x75, 0x67, 0x42,
-	0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a,
-	0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74,
-	0x68, 0x22, 0x14, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x3d, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x4c, 0x6f,
-	0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26,
-	0x0a, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x10, 0x2e,
-	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52,
-	0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x22, 0x3c, 0x0a, 0x12, 0x53, 0x65, 0x74, 0x4c, 0x6f, 0x67,
-	0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x26, 0x0a, 0x05,
-	0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x10, 0x2e, 0x64, 0x61,
-	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x05, 0x6c,
-	0x65, 0x76, 0x65, 0x6c, 0x22, 0x15, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65,
-	0x76, 0x65, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1b, 0x0a, 0x05, 0x53,
-	0x74, 0x61, 0x74, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x13, 0x0a, 0x11, 0x4c, 0x69, 0x73, 0x74,
-	0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x3b, 0x0a,
-	0x12, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x25, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x0d, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x74, 0x61,
-	0x74, 0x65, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x65, 0x73, 0x22, 0x44, 0x0a, 0x11, 0x43, 0x6c,
-	0x65, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x74, 0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x10,
-	0x0a, 0x03, 0x61, 0x6c, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x61, 0x6c, 0x6c,
-	0x22, 0x3b, 0x0a, 0x12, 0x43, 0x6c, 0x65, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x63, 0x6c, 0x65, 0x61, 0x6e, 0x65,
+	0x75, 0x74, 0x65, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x88, 0x01, 0x01, 0x42, 0x13,
+	0x0a, 0x11, 0x5f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62,
+	0x6c, 0x65, 0x64, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63,
+	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75,
+	0x61, 0x72, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x42, 0x17, 0x0a, 0x15, 0x5f, 0x6f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x61, 0x6c, 0x50, 0x72, 0x65, 0x53, 0x68, 0x61, 0x72, 0x65, 0x64, 0x4b, 0x65, 0x79,
+	0x42, 0x15, 0x0a, 0x13, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x41, 0x75, 0x74, 0x6f,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x53, 0x53, 0x48, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x42, 0x16, 0x0a, 0x14,
+	0x5f, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73,
+	0x73, 0x69, 0x76, 0x65, 0x42, 0x11, 0x0a, 0x0f, 0x5f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x4d, 0x6f, 0x6e, 0x69, 0x74, 0x6f, 0x72, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x64, 0x6e, 0x73, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x22, 0xb5, 0x01, 0x0a,
+	0x0d, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24,
+	0x0a, 0x0d, 0x6e, 0x65, 0x65, 0x64, 0x73, 0x53, 0x53, 0x4f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0d, 0x6e, 0x65, 0x65, 0x64, 0x73, 0x53, 0x53, 0x4f, 0x4c,
+	0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x43, 0x6f, 0x64, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x43, 0x6f, 0x64, 0x65,
+	0x12, 0x28, 0x0a, 0x0f, 0x76, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x55, 0x52, 0x49, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x76, 0x65, 0x72, 0x69, 0x66,
+	0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x55, 0x52, 0x49, 0x12, 0x38, 0x0a, 0x17, 0x76, 0x65,
+	0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x55, 0x52, 0x49, 0x43, 0x6f, 0x6d,
+	0x70, 0x6c, 0x65, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x17, 0x76, 0x65, 0x72,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x55, 0x52, 0x49, 0x43, 0x6f, 0x6d, 0x70,
+	0x6c, 0x65, 0x74, 0x65, 0x22, 0x4d, 0x0a, 0x13, 0x57, 0x61, 0x69, 0x74, 0x53, 0x53, 0x4f, 0x4c,
+	0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x75,
+	0x73, 0x65, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75,
+	0x73, 0x65, 0x72, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x6e,
+	0x61, 0x6d, 0x65, 0x22, 0x16, 0x0a, 0x14, 0x57, 0x61, 0x69, 0x74, 0x53, 0x53, 0x4f, 0x4c, 0x6f,
+	0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x0b, 0x0a, 0x09, 0x55,
+	0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x0c, 0x0a, 0x0a, 0x55, 0x70, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x3d, 0x0a, 0x0d, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2c, 0x0a, 0x11, 0x67, 0x65, 0x74, 0x46, 0x75,
+	0x6c, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x11, 0x67, 0x65, 0x74, 0x46, 0x75, 0x6c, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x22, 0x82, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x12, 0x32, 0x0a, 0x0a, 0x66, 0x75, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x46, 0x75,
+	0x6c, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x0a, 0x66, 0x75, 0x6c, 0x6c, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x12, 0x24, 0x0a, 0x0d, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x56, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x0d, 0x0a, 0x0b, 0x44, 0x6f,
+	0x77, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x0e, 0x0a, 0x0c, 0x44, 0x6f, 0x77,
+	0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x12, 0x0a, 0x10, 0x47, 0x65, 0x74,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xb9, 0x03,
+	0x0a, 0x11, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e,
+	0x74, 0x55, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6d, 0x61, 0x6e, 0x61,
+	0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x55, 0x72, 0x6c, 0x12, 0x1e, 0x0a, 0x0a, 0x63, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x46, 0x69, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x6c, 0x6f, 0x67,
+	0x46, 0x69, 0x6c, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6c, 0x6f, 0x67, 0x46,
+	0x69, 0x6c, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x70, 0x72, 0x65, 0x53, 0x68, 0x61, 0x72, 0x65, 0x64,
+	0x4b, 0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x70, 0x72, 0x65, 0x53, 0x68,
+	0x61, 0x72, 0x65, 0x64, 0x4b, 0x65, 0x79, 0x12, 0x1a, 0x0a, 0x08, 0x61, 0x64, 0x6d, 0x69, 0x6e,
+	0x55, 0x52, 0x4c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x64, 0x6d, 0x69, 0x6e,
+	0x55, 0x52, 0x4c, 0x12, 0x24, 0x0a, 0x0d, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x69, 0x6e, 0x74, 0x65,
+	0x72, 0x66, 0x61, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x24, 0x0a, 0x0d, 0x77, 0x69, 0x72,
+	0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x0d, 0x77, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x12,
+	0x2e, 0x0a, 0x12, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x41, 0x75, 0x74, 0x6f, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x64, 0x69, 0x73,
+	0x61, 0x62, 0x6c, 0x65, 0x41, 0x75, 0x74, 0x6f, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x12,
+	0x2a, 0x0a, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x53, 0x53, 0x48, 0x41, 0x6c, 0x6c, 0x6f,
+	0x77, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x53, 0x53, 0x48, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x12, 0x2a, 0x0a, 0x10, 0x72,
+	0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
+	0x0b, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73,
+	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e,
+	0x70, 0x61, 0x73, 0x73, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x18, 0x0c,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50,
+	0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x22, 0xde, 0x05, 0x0a, 0x09, 0x50, 0x65,
+	0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x50, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x75, 0x62, 0x4b, 0x65,
+	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x12,
+	0x1e, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
+	0x46, 0x0a, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x55, 0x70, 0x64,
+	0x61, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x10, 0x63, 0x6f, 0x6e, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x72, 0x65, 0x6c, 0x61, 0x79,
+	0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x65,
+	0x64, 0x12, 0x34, 0x0a, 0x15, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x63, 0x65, 0x43, 0x61, 0x6e,
+	0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x15, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64,
+	0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x36, 0x0a, 0x16, 0x72, 0x65, 0x6d, 0x6f, 0x74,
+	0x65, 0x49, 0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70,
+	0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x16, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49,
+	0x63, 0x65, 0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12,
+	0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66,
+	0x71, 0x64, 0x6e, 0x12, 0x3c, 0x0a, 0x19, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x63, 0x65, 0x43,
+	0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x19, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x49, 0x63, 0x65,
+	0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x12, 0x3e, 0x0a, 0x1a, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x63, 0x65, 0x43, 0x61,
+	0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18,
+	0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1a, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x49, 0x63, 0x65,
+	0x43, 0x61, 0x6e, 0x64, 0x69, 0x64, 0x61, 0x74, 0x65, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x12, 0x52, 0x0a, 0x16, 0x6c, 0x61, 0x73, 0x74, 0x57, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61,
+	0x72, 0x64, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x16, 0x6c,
+	0x61, 0x73, 0x74, 0x57, 0x69, 0x72, 0x65, 0x67, 0x75, 0x61, 0x72, 0x64, 0x48, 0x61, 0x6e, 0x64,
+	0x73, 0x68, 0x61, 0x6b, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x62, 0x79, 0x74, 0x65, 0x73, 0x52, 0x78,
+	0x18, 0x0d, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x62, 0x79, 0x74, 0x65, 0x73, 0x52, 0x78, 0x12,
+	0x18, 0x0a, 0x07, 0x62, 0x79, 0x74, 0x65, 0x73, 0x54, 0x78, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x07, 0x62, 0x79, 0x74, 0x65, 0x73, 0x54, 0x78, 0x12, 0x2a, 0x0a, 0x10, 0x72, 0x6f, 0x73,
+	0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x0f, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x10, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e,
+	0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x73, 0x18, 0x10, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x73, 0x12, 0x33, 0x0a, 0x07, 0x6c, 0x61, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x18, 0x11, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x6c,
+	0x61, 0x74, 0x65, 0x6e, 0x63, 0x79, 0x12, 0x22, 0x0a, 0x0c, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x41,
+	0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x18, 0x12, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x72, 0x65,
+	0x6c, 0x61, 0x79, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x22, 0xf0, 0x01, 0x0a, 0x0e, 0x4c,
+	0x6f, 0x63, 0x61, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x0e, 0x0a,
+	0x02, 0x49, 0x50, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x49, 0x50, 0x12, 0x16, 0x0a,
+	0x06, 0x70, 0x75, 0x62, 0x4b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70,
+	0x75, 0x62, 0x4b, 0x65, 0x79, 0x12, 0x28, 0x0a, 0x0f, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x49,
+	0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f,
+	0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x66, 0x61, 0x63, 0x65, 0x12,
+	0x12, 0x0a, 0x04, 0x66, 0x71, 0x64, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66,
+	0x71, 0x64, 0x6e, 0x12, 0x2a, 0x0a, 0x10, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73,
+	0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x72,
+	0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12,
+	0x30, 0x0a, 0x13, 0x72, 0x6f, 0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x65, 0x72, 0x6d,
+	0x69, 0x73, 0x73, 0x69, 0x76, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13, 0x72, 0x6f,
+	0x73, 0x65, 0x6e, 0x70, 0x61, 0x73, 0x73, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x76,
+	0x65, 0x12, 0x1a, 0x0a, 0x08, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x18, 0x07, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x08, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x22, 0x53, 0x0a,
+	0x0b, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03,
+	0x55, 0x52, 0x4c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x55, 0x52, 0x4c, 0x12, 0x1c,
+	0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72,
+	0x6f, 0x72, 0x22, 0x57, 0x0a, 0x0f, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x55, 0x52, 0x4c, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x55, 0x52, 0x4c, 0x12, 0x1c, 0x0a, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0x52, 0x0a, 0x0a, 0x52,
+	0x65, 0x6c, 0x61, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x55, 0x52, 0x49,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x55, 0x52, 0x49, 0x12, 0x1c, 0x0a, 0x09, 0x61,
+	0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
+	0x61, 0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72,
+	0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22,
+	0x72, 0x0a, 0x0c, 0x4e, 0x53, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12,
+	0x18, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d,
+	0x61, 0x69, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61,
+	0x69, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x14, 0x0a,
+	0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x22, 0xd2, 0x02, 0x0a, 0x0a, 0x46, 0x75, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x12, 0x41, 0x0a, 0x0f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x64, 0x61,
+	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x52, 0x0f, 0x6d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x35, 0x0a, 0x0b, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52,
+	0x0b, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x3e, 0x0a, 0x0e,
+	0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x6f,
+	0x63, 0x61, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x0e, 0x6c, 0x6f,
+	0x63, 0x61, 0x6c, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x27, 0x0a, 0x05,
+	0x70, 0x65, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x64, 0x61,
+	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x50, 0x65, 0x65, 0x72, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x05,
+	0x70, 0x65, 0x65, 0x72, 0x73, 0x12, 0x2a, 0x0a, 0x06, 0x72, 0x65, 0x6c, 0x61, 0x79, 0x73, 0x18,
+	0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x52,
+	0x65, 0x6c, 0x61, 0x79, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x06, 0x72, 0x65, 0x6c, 0x61, 0x79,
+	0x73, 0x12, 0x35, 0x0a, 0x0b, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
+	0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x4e, 0x53, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x0a, 0x64, 0x6e,
+	0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x22, 0x15, 0x0a, 0x13, 0x4c, 0x69, 0x73, 0x74,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22,
+	0x3f, 0x0a, 0x14, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x27, 0x0a, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65,
+	0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x52, 0x06, 0x72, 0x6f, 0x75, 0x74, 0x65, 0x73,
+	0x22, 0x61, 0x0a, 0x15, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1e, 0x0a, 0x0a, 0x6e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x49, 0x44, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x6e,
+	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x49, 0x44, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x61, 0x70, 0x70,
+	0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x61, 0x70, 0x70, 0x65, 0x6e,
+	0x64, 0x12, 0x10, 0x0a, 0x03, 0x61, 0x6c, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03,
+	0x61, 0x6c, 0x6c, 0x22, 0x18, 0x0a, 0x16, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1a, 0x0a,
+	0x06, 0x49, 0x50, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x69, 0x70, 0x73, 0x18, 0x01,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x69, 0x70, 0x73, 0x22, 0xf9, 0x01, 0x0a, 0x07, 0x4e, 0x65,
+	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x0e, 0x0a, 0x02, 0x49, 0x44, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x49, 0x44, 0x12, 0x14, 0x0a, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x73,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x73,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69,
+	0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x64, 0x6f, 0x6d, 0x61, 0x69, 0x6e,
+	0x73, 0x12, 0x42, 0x0a, 0x0b, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x49, 0x50, 0x73,
+	0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64,
+	0x49, 0x50, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0b, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76,
+	0x65, 0x64, 0x49, 0x50, 0x73, 0x1a, 0x4e, 0x0a, 0x10, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65,
+	0x64, 0x49, 0x50, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x24, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x0e, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x49, 0x50, 0x4c, 0x69, 0x73, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x6a, 0x0a, 0x12, 0x44, 0x65, 0x62, 0x75, 0x67, 0x42, 0x75,
+	0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x61,
+	0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x69, 0x7a, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
+	0x61, 0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x69, 0x7a, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x12, 0x1e, 0x0a, 0x0a, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x49, 0x6e, 0x66, 0x6f, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x49, 0x6e, 0x66,
+	0x6f, 0x22, 0x29, 0x0a, 0x13, 0x44, 0x65, 0x62, 0x75, 0x67, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x22, 0x14, 0x0a, 0x12,
+	0x47, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x22, 0x3d, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65,
+	0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x26, 0x0a, 0x05, 0x6c, 0x65, 0x76,
+	0x65, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x10, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x05, 0x6c, 0x65, 0x76, 0x65,
+	0x6c, 0x22, 0x3c, 0x0a, 0x12, 0x53, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x26, 0x0a, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x10, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x22,
+	0x15, 0x0a, 0x13, 0x53, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x1b, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12,
+	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x22, 0x13, 0x0a, 0x11, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x3b, 0x0a, 0x12, 0x4c, 0x69, 0x73, 0x74,
+	0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x25,
+	0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0d,
+	0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x06, 0x73,
+	0x74, 0x61, 0x74, 0x65, 0x73, 0x22, 0x44, 0x0a, 0x11, 0x43, 0x6c, 0x65, 0x61, 0x6e, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x73, 0x74, 0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x61, 0x6c, 0x6c,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x61, 0x6c, 0x6c, 0x22, 0x3b, 0x0a, 0x12, 0x43,
+	0x6c, 0x65, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x25, 0x0a, 0x0e, 0x63, 0x6c, 0x65, 0x61, 0x6e, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x61,
+	0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0d, 0x63, 0x6c, 0x65, 0x61, 0x6e,
+	0x65, 0x64, 0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x22, 0x45, 0x0a, 0x12, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1d,
+	0x0a, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x09, 0x73, 0x74, 0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a,
+	0x03, 0x61, 0x6c, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x61, 0x6c, 0x6c, 0x22,
+	0x3c, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65,
 	0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0d,
-	0x63, 0x6c, 0x65, 0x61, 0x6e, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x22, 0x45, 0x0a,
-	0x12, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x65, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x74, 0x61, 0x74, 0x65, 0x4e, 0x61,
-	0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x61, 0x6c, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52,
-	0x03, 0x61, 0x6c, 0x6c, 0x22, 0x3c, 0x0a, 0x13, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74,
-	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x25, 0x0a, 0x0e, 0x64,
-	0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x73, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x05, 0x52, 0x0d, 0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x73, 0x22, 0x3b, 0x0a, 0x1f, 0x53, 0x65, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x4d, 0x61, 0x70, 0x50, 0x65, 0x72, 0x73, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22,
-	0x22, 0x0a, 0x20, 0x53, 0x65, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70,
-	0x50, 0x65, 0x72, 0x73, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x2a, 0x62, 0x0a, 0x08, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12,
-	0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05,
-	0x50, 0x41, 0x4e, 0x49, 0x43, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x46, 0x41, 0x54, 0x41, 0x4c,
-	0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x03, 0x12, 0x08, 0x0a,
-	0x04, 0x57, 0x41, 0x52, 0x4e, 0x10, 0x04, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x46, 0x4f, 0x10,
-	0x05, 0x12, 0x09, 0x0a, 0x05, 0x44, 0x45, 0x42, 0x55, 0x47, 0x10, 0x06, 0x12, 0x09, 0x0a, 0x05,
-	0x54, 0x52, 0x41, 0x43, 0x45, 0x10, 0x07, 0x32, 0x93, 0x09, 0x0a, 0x0d, 0x44, 0x61, 0x65, 0x6d,
-	0x6f, 0x6e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x36, 0x0a, 0x05, 0x4c, 0x6f, 0x67,
-	0x69, 0x6e, 0x12, 0x14, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x6f, 0x67, 0x69,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x4b, 0x0a, 0x0c, 0x57, 0x61, 0x69, 0x74, 0x53, 0x53, 0x4f, 0x4c, 0x6f, 0x67, 0x69,
-	0x6e, 0x12, 0x1b, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x57, 0x61, 0x69, 0x74, 0x53,
-	0x53, 0x4f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c,
-	0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x57, 0x61, 0x69, 0x74, 0x53, 0x53, 0x4f, 0x4c,
-	0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x2d,
-	0x0a, 0x02, 0x55, 0x70, 0x12, 0x11, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x55, 0x70,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x12, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x55, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x39, 0x0a,
-	0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x15, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16,
-	0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x33, 0x0a, 0x04, 0x44, 0x6f, 0x77, 0x6e,
-	0x12, 0x13, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x6f, 0x77, 0x6e, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x14, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44,
-	0x6f, 0x77, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x42, 0x0a,
-	0x09, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x2e, 0x64, 0x61, 0x65,
-	0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65,
-	0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x4b, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
-	0x73, 0x12, 0x1b, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e,
-	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c,
-	0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x51,
-	0x0a, 0x0e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73,
+	0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x22, 0x3b, 0x0a,
+	0x1f, 0x53, 0x65, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x50, 0x65,
+	0x72, 0x73, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x07, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x22, 0x22, 0x0a, 0x20, 0x53, 0x65,
+	0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x50, 0x65, 0x72, 0x73, 0x69,
+	0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2a, 0x62,
+	0x0a, 0x08, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e,
+	0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x50, 0x41, 0x4e, 0x49, 0x43,
+	0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x46, 0x41, 0x54, 0x41, 0x4c, 0x10, 0x02, 0x12, 0x09, 0x0a,
+	0x05, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x03, 0x12, 0x08, 0x0a, 0x04, 0x57, 0x41, 0x52, 0x4e,
+	0x10, 0x04, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x46, 0x4f, 0x10, 0x05, 0x12, 0x09, 0x0a, 0x05,
+	0x44, 0x45, 0x42, 0x55, 0x47, 0x10, 0x06, 0x12, 0x09, 0x0a, 0x05, 0x54, 0x52, 0x41, 0x43, 0x45,
+	0x10, 0x07, 0x32, 0x93, 0x09, 0x0a, 0x0d, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x36, 0x0a, 0x05, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x14, 0x2e,
+	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x6f, 0x67,
+	0x69, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4b, 0x0a, 0x0c,
+	0x57, 0x61, 0x69, 0x74, 0x53, 0x53, 0x4f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x12, 0x1b, 0x2e, 0x64,
+	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x57, 0x61, 0x69, 0x74, 0x53, 0x53, 0x4f, 0x4c, 0x6f, 0x67,
+	0x69, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x64, 0x61, 0x65, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x57, 0x61, 0x69, 0x74, 0x53, 0x53, 0x4f, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x2d, 0x0a, 0x02, 0x55, 0x70, 0x12,
+	0x11, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x55, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x12, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x55, 0x70, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x39, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x12, 0x15, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x74, 0x61, 0x74,
+	0x75, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x64, 0x61, 0x65, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x12, 0x33, 0x0a, 0x04, 0x44, 0x6f, 0x77, 0x6e, 0x12, 0x13, 0x2e, 0x64, 0x61,
+	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x14, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x6f, 0x77, 0x6e, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x42, 0x0a, 0x09, 0x47, 0x65, 0x74, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x47,
+	0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x19, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x4b, 0x0a, 0x0c,
+	0x4c, 0x69, 0x73, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x12, 0x1b, 0x2e, 0x64,
+	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1c, 0x2e, 0x64, 0x61, 0x65, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x51, 0x0a, 0x0e, 0x53, 0x65, 0x6c,
+	0x65, 0x63, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x12, 0x1d, 0x2e, 0x64, 0x61,
+	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x53, 0x0a, 0x10,
+	0x44, 0x65, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73,
 	0x12, 0x1d, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
 	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
 	0x1e, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e,
 	0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0x00, 0x12, 0x53, 0x0a, 0x10, 0x44, 0x65, 0x73, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e, 0x65, 0x74,
-	0x77, 0x6f, 0x72, 0x6b, 0x73, 0x12, 0x1d, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53,
-	0x65, 0x6c, 0x65, 0x63, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65,
-	0x6c, 0x65, 0x63, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0b, 0x44, 0x65, 0x62, 0x75, 0x67, 0x42,
-	0x75, 0x6e, 0x64, 0x6c, 0x65, 0x12, 0x1a, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44,
-	0x65, 0x62, 0x75, 0x67, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x1b, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x65, 0x62, 0x75, 0x67,
-	0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00,
-	0x12, 0x48, 0x0a, 0x0b, 0x47, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12,
-	0x1a, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c,
-	0x65, 0x76, 0x65, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x64, 0x61,
-	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0b, 0x53, 0x65,
-	0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x1a, 0x2e, 0x64, 0x61, 0x65, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53,
-	0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x0a, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x73, 0x12, 0x19, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x69, 0x73, 0x74,
-	0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e,
+	0x00, 0x12, 0x48, 0x0a, 0x0b, 0x44, 0x65, 0x62, 0x75, 0x67, 0x42, 0x75, 0x6e, 0x64, 0x6c, 0x65,
+	0x12, 0x1a, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x65, 0x62, 0x75, 0x67, 0x42,
+	0x75, 0x6e, 0x64, 0x6c, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x64,
+	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x65, 0x62, 0x75, 0x67, 0x42, 0x75, 0x6e, 0x64, 0x6c,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0b, 0x47,
+	0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x1a, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x47, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a, 0x0b, 0x53, 0x65, 0x74, 0x4c, 0x6f, 0x67, 0x4c,
+	0x65, 0x76, 0x65, 0x6c, 0x12, 0x1a, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65,
+	0x74, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x1b, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x74, 0x4c, 0x6f, 0x67,
+	0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
+	0x45, 0x0a, 0x0a, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x12, 0x19, 0x2e,
 	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x0a, 0x43,
-	0x6c, 0x65, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x19, 0x2e, 0x64, 0x61, 0x65, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x43, 0x6c, 0x65, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6c,
-	0x65, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0x00, 0x12, 0x48, 0x0a, 0x0b, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74,
-	0x65, 0x12, 0x1a, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74,
-	0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e,
-	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61,
-	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6f, 0x0a, 0x18,
-	0x53, 0x65, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x50, 0x65, 0x72,
-	0x73, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x12, 0x27, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x53, 0x65, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x50,
-	0x65, 0x72, 0x73, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x28, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x74, 0x4e, 0x65,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1a, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x0a, 0x43, 0x6c, 0x65, 0x61, 0x6e, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x12, 0x19, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6c,
+	0x65, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1a, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6c, 0x65, 0x61, 0x6e, 0x53, 0x74,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x48, 0x0a,
+	0x0b, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x1a, 0x2e, 0x64,
+	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6f, 0x0a, 0x18, 0x53, 0x65, 0x74, 0x4e, 0x65,
 	0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x50, 0x65, 0x72, 0x73, 0x69, 0x73, 0x74, 0x65,
-	0x6e, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x08, 0x5a,
-	0x06, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6e, 0x63, 0x65, 0x12, 0x27, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x74,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x4d, 0x61, 0x70, 0x50, 0x65, 0x72, 0x73, 0x69, 0x73,
+	0x74, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x64,
+	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x74, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b,
+	0x4d, 0x61, 0x70, 0x50, 0x65, 0x72, 0x73, 0x69, 0x73, 0x74, 0x65, 0x6e, 0x63, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42, 0x08, 0x5a, 0x06, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (

client/proto/daemon.proto

@@ -107,13 +107,6 @@ message LoginRequest {
   optional bool networkMonitor = 18;
 
   optional google.protobuf.Duration dnsRouteInterval = 19;
-
-  optional bool disable_client_routes = 20;
-  optional bool disable_server_routes = 21;
-  optional bool disable_dns = 22;
-  optional bool disable_firewall = 23;
-
-  optional bool block_lan_access = 24;
 }
 
 message LoginResponse {

client/server/debug.go

@@ -16,7 +16,6 @@ import (
 	"net/netip"
 	"os"
 	"path/filepath"
-	"runtime"
 	"sort"
 	"strings"
 	"time"
@@ -41,8 +40,6 @@ netbird.err: Most recent, anonymized stderr log file of the NetBird client.
 netbird.out: Most recent, anonymized stdout log file of the NetBird client.
 routes.txt: Anonymized system routes, if --system-info flag was provided.
 interfaces.txt: Anonymized network interface information, if --system-info flag was provided.
-iptables.txt: Anonymized iptables rules with packet counters, if --system-info flag was provided.
-nftables.txt: Anonymized nftables rules with packet counters, if --system-info flag was provided.
 config.txt: Anonymized configuration information of the NetBird client.
 network_map.json: Anonymized network map containing peer configurations, routes, DNS settings, and firewall rules.
 state.json: Anonymized client state dump containing netbird states.
@@ -109,33 +106,12 @@ The config.txt file contains anonymized configuration information of the NetBird
 - CustomDNSAddress
 
 Other non-sensitive configuration options are included without anonymization.
-
-Firewall Rules (Linux only)
-The bundle includes two separate firewall rule files:
-
-iptables.txt:
-- Complete iptables ruleset with packet counters using 'iptables -v -n -L'
-- Includes all tables (filter, nat, mangle, raw, security)
-- Shows packet and byte counters for each rule
-- All IP addresses are anonymized
-- Chain names, table names, and other non-sensitive information remain unchanged
-
-nftables.txt:
-- Complete nftables ruleset obtained via 'nft -a list ruleset'
-- Includes rule handle numbers and packet counters
-- All tables, chains, and rules are included
-- Shows packet and byte counters for each rule
-- All IP addresses are anonymized
-- Chain names, table names, and other non-sensitive information remain unchanged
 `
 
 const (
 	clientLogFile = "client.log"
 	errorLogFile  = "netbird.err"
 	stdoutLogFile = "netbird.out"
-
-	darwinErrorLogPath  = "/var/log/netbird.out.log"
-	darwinStdoutLogPath = "/var/log/netbird.err.log"
 )
 
 // DebugBundle creates a debug bundle and returns the location.
@@ -143,6 +119,10 @@ func (s *Server) DebugBundle(_ context.Context, req *proto.DebugBundleRequest) (
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
+	if s.logFile == "console" {
+		return nil, fmt.Errorf("log file is set to console, cannot create debug bundle")
+	}
+
 	bundlePath, err := os.CreateTemp("", "netbird.debug.*.zip")
 	if err != nil {
 		return nil, fmt.Errorf("create zip file: %w", err)
@@ -185,7 +165,13 @@ func (s *Server) createArchive(bundlePath *os.File, req *proto.DebugBundleReques
 	}
 
 	if req.GetSystemInfo() {
-		s.addSystemInfo(req, anonymizer, archive)
+		if err := s.addRoutes(req, anonymizer, archive); err != nil {
+			log.Errorf("Failed to add routes to debug bundle: %v", err)
+		}
+
+		if err := s.addInterfaces(req, anonymizer, archive); err != nil {
+			log.Errorf("Failed to add interfaces to debug bundle: %v", err)
+		}
 	}
 
 	if err := s.addNetworkMap(req, anonymizer, archive); err != nil {
@@ -196,14 +182,8 @@ func (s *Server) createArchive(bundlePath *os.File, req *proto.DebugBundleReques
 		log.Errorf("Failed to add state file to debug bundle: %v", err)
 	}
 
-	if err := s.addCorruptedStateFiles(archive); err != nil {
-		log.Errorf("Failed to add corrupted state files to debug bundle: %v", err)
-	}
-
-	if s.logFile != "console" {
-		if err := s.addLogfile(req, anonymizer, archive); err != nil {
-			return fmt.Errorf("add log file: %w", err)
-		}
+	if err := s.addLogfile(req, anonymizer, archive); err != nil {
+		return fmt.Errorf("add log file: %w", err)
 	}
 
 	if err := archive.Close(); err != nil {
@@ -212,20 +192,6 @@ func (s *Server) createArchive(bundlePath *os.File, req *proto.DebugBundleReques
 	return nil
 }
 
-func (s *Server) addSystemInfo(req *proto.DebugBundleRequest, anonymizer *anonymize.Anonymizer, archive *zip.Writer) {
-	if err := s.addRoutes(req, anonymizer, archive); err != nil {
-		log.Errorf("Failed to add routes to debug bundle: %v", err)
-	}
-
-	if err := s.addInterfaces(req, anonymizer, archive); err != nil {
-		log.Errorf("Failed to add interfaces to debug bundle: %v", err)
-	}
-
-	if err := s.addFirewallRules(req, anonymizer, archive); err != nil {
-		log.Errorf("Failed to add firewall rules to debug bundle: %v", err)
-	}
-}
-
 func (s *Server) addReadme(req *proto.DebugBundleRequest, archive *zip.Writer) error {
 	if req.GetAnonymize() {
 		readmeReader := strings.NewReader(readmeContent)
@@ -301,13 +267,6 @@ func (s *Server) addCommonConfigFields(configContent *strings.Builder) {
 	}
 	configContent.WriteString(fmt.Sprintf("DisableAutoConnect: %v\n", s.config.DisableAutoConnect))
 	configContent.WriteString(fmt.Sprintf("DNSRouteInterval: %s\n", s.config.DNSRouteInterval))
-
-	configContent.WriteString(fmt.Sprintf("DisableClientRoutes: %v\n", s.config.DisableClientRoutes))
-	configContent.WriteString(fmt.Sprintf("DisableServerRoutes: %v\n", s.config.DisableServerRoutes))
-	configContent.WriteString(fmt.Sprintf("DisableDNS: %v\n", s.config.DisableDNS))
-	configContent.WriteString(fmt.Sprintf("DisableFirewall: %v\n", s.config.DisableFirewall))
-
-	configContent.WriteString(fmt.Sprintf("BlockLANAccess: %v\n", s.config.BlockLANAccess))
 }
 
 func (s *Server) addRoutes(req *proto.DebugBundleRequest, anonymizer *anonymize.Anonymizer, archive *zip.Writer) error {
@@ -411,36 +370,6 @@ func (s *Server) addStateFile(req *proto.DebugBundleRequest, anonymizer *anonymi
 	return nil
 }
 
-func (s *Server) addCorruptedStateFiles(archive *zip.Writer) error {
-	pattern := statemanager.GetDefaultStatePath()
-	if pattern == "" {
-		return nil
-	}
-	pattern += "*.corrupted.*"
-	matches, err := filepath.Glob(pattern)
-	if err != nil {
-		return fmt.Errorf("find corrupted state files: %w", err)
-	}
-
-	for _, match := range matches {
-		data, err := os.ReadFile(match)
-		if err != nil {
-			log.Warnf("Failed to read corrupted state file %s: %v", match, err)
-			continue
-		}
-
-		fileName := filepath.Base(match)
-		if err := addFileToZip(archive, bytes.NewReader(data), "corrupted_states/"+fileName); err != nil {
-			log.Warnf("Failed to add corrupted state file %s to zip: %v", fileName, err)
-			continue
-		}
-
-		log.Debugf("Added corrupted state file to debug bundle: %s", fileName)
-	}
-
-	return nil
-}
-
 func (s *Server) addLogfile(req *proto.DebugBundleRequest, anonymizer *anonymize.Anonymizer, archive *zip.Writer) error {
 	logDir := filepath.Dir(s.logFile)
 
@@ -448,17 +377,12 @@ func (s *Server) addLogfile(req *proto.DebugBundleRequest, anonymizer *anonymize
 		return fmt.Errorf("add client log file to zip: %w", err)
 	}
 
-	stdErrLogPath := filepath.Join(logDir, errorLogFile)
-	stdoutLogPath := filepath.Join(logDir, stdoutLogFile)
-	if runtime.GOOS == "darwin" {
-		stdErrLogPath = darwinErrorLogPath
-		stdoutLogPath = darwinStdoutLogPath
-	}
-
-	if err := s.addSingleLogfile(stdErrLogPath, errorLogFile, req, anonymizer, archive); err != nil {
+	errLogPath := filepath.Join(logDir, errorLogFile)
+	if err := s.addSingleLogfile(errLogPath, errorLogFile, req, anonymizer, archive); err != nil {
 		log.Warnf("Failed to add %s to zip: %v", errorLogFile, err)
 	}
 
+	stdoutLogPath := filepath.Join(logDir, stdoutLogFile)
 	if err := s.addSingleLogfile(stdoutLogPath, stdoutLogFile, req, anonymizer, archive); err != nil {
 		log.Warnf("Failed to add %s to zip: %v", stdoutLogFile, err)
 	}

client/server/debug_linux.go

@@ -1,693 +0,0 @@
-//go:build linux && !android
-
-package server
-
-import (
-	"archive/zip"
-	"bytes"
-	"encoding/binary"
-	"fmt"
-	"os/exec"
-	"sort"
-	"strings"
-
-	"github.com/google/nftables"
-	"github.com/google/nftables/expr"
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/anonymize"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// addFirewallRules collects and adds firewall rules to the archive
-func (s *Server) addFirewallRules(req *proto.DebugBundleRequest, anonymizer *anonymize.Anonymizer, archive *zip.Writer) error {
-	log.Info("Collecting firewall rules")
-	// Collect and add iptables rules
-	iptablesRules, err := collectIPTablesRules()
-	if err != nil {
-		log.Warnf("Failed to collect iptables rules: %v", err)
-	} else {
-		if req.GetAnonymize() {
-			iptablesRules = anonymizer.AnonymizeString(iptablesRules)
-		}
-		if err := addFileToZip(archive, strings.NewReader(iptablesRules), "iptables.txt"); err != nil {
-			log.Warnf("Failed to add iptables rules to bundle: %v", err)
-		}
-	}
-
-	// Collect and add nftables rules
-	nftablesRules, err := collectNFTablesRules()
-	if err != nil {
-		log.Warnf("Failed to collect nftables rules: %v", err)
-	} else {
-		if req.GetAnonymize() {
-			nftablesRules = anonymizer.AnonymizeString(nftablesRules)
-		}
-		if err := addFileToZip(archive, strings.NewReader(nftablesRules), "nftables.txt"); err != nil {
-			log.Warnf("Failed to add nftables rules to bundle: %v", err)
-		}
-	}
-
-	return nil
-}
-
-// collectIPTablesRules collects rules using both iptables-save and verbose listing
-func collectIPTablesRules() (string, error) {
-	var builder strings.Builder
-
-	// First try using iptables-save
-	saveOutput, err := collectIPTablesSave()
-	if err != nil {
-		log.Warnf("Failed to collect iptables rules using iptables-save: %v", err)
-	} else {
-		builder.WriteString("=== iptables-save output ===\n")
-		builder.WriteString(saveOutput)
-		builder.WriteString("\n")
-	}
-
-	// Then get verbose statistics for each table
-	builder.WriteString("=== iptables -v -n -L output ===\n")
-
-	// Get list of tables
-	tables := []string{"filter", "nat", "mangle", "raw", "security"}
-
-	for _, table := range tables {
-		builder.WriteString(fmt.Sprintf("*%s\n", table))
-
-		// Get verbose statistics for the entire table
-		stats, err := getTableStatistics(table)
-		if err != nil {
-			log.Warnf("Failed to get statistics for table %s: %v", table, err)
-			continue
-		}
-		builder.WriteString(stats)
-		builder.WriteString("\n")
-	}
-
-	return builder.String(), nil
-}
-
-// collectIPTablesSave uses iptables-save to get rule definitions
-func collectIPTablesSave() (string, error) {
-	cmd := exec.Command("iptables-save")
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
-
-	if err := cmd.Run(); err != nil {
-		return "", fmt.Errorf("execute iptables-save: %w (stderr: %s)", err, stderr.String())
-	}
-
-	rules := stdout.String()
-	if strings.TrimSpace(rules) == "" {
-		return "", fmt.Errorf("no iptables rules found")
-	}
-
-	return rules, nil
-}
-
-// getTableStatistics gets verbose statistics for an entire table using iptables command
-func getTableStatistics(table string) (string, error) {
-	cmd := exec.Command("iptables", "-v", "-n", "-L", "-t", table)
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
-
-	if err := cmd.Run(); err != nil {
-		return "", fmt.Errorf("execute iptables -v -n -L: %w (stderr: %s)", err, stderr.String())
-	}
-
-	return stdout.String(), nil
-}
-
-// collectNFTablesRules attempts to collect nftables rules using either nft command or netlink
-func collectNFTablesRules() (string, error) {
-	// First try using nft command
-	rules, err := collectNFTablesFromCommand()
-	if err != nil {
-		log.Debugf("Failed to collect nftables rules using nft command: %v, falling back to netlink", err)
-		// Fall back to netlink
-		rules, err = collectNFTablesFromNetlink()
-		if err != nil {
-			return "", fmt.Errorf("collect nftables rules using both nft and netlink failed: %w", err)
-		}
-	}
-	return rules, nil
-}
-
-// collectNFTablesFromCommand attempts to collect rules using nft command
-func collectNFTablesFromCommand() (string, error) {
-	cmd := exec.Command("nft", "-a", "list", "ruleset")
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
-
-	if err := cmd.Run(); err != nil {
-		return "", fmt.Errorf("execute nft list ruleset: %w (stderr: %s)", err, stderr.String())
-	}
-
-	rules := stdout.String()
-	if strings.TrimSpace(rules) == "" {
-		return "", fmt.Errorf("no nftables rules found")
-	}
-
-	return rules, nil
-}
-
-// collectNFTablesFromNetlink collects rules using netlink library
-func collectNFTablesFromNetlink() (string, error) {
-	conn, err := nftables.New()
-	if err != nil {
-		return "", fmt.Errorf("create nftables connection: %w", err)
-	}
-
-	tables, err := conn.ListTables()
-	if err != nil {
-		return "", fmt.Errorf("list tables: %w", err)
-	}
-
-	sortTables(tables)
-	return formatTables(conn, tables), nil
-}
-
-func formatTables(conn *nftables.Conn, tables []*nftables.Table) string {
-	var builder strings.Builder
-
-	for _, table := range tables {
-		builder.WriteString(fmt.Sprintf("table %s %s {\n", formatFamily(table.Family), table.Name))
-
-		chains, err := getAndSortTableChains(conn, table)
-		if err != nil {
-			log.Warnf("Failed to list chains for table %s: %v", table.Name, err)
-			continue
-		}
-
-		// Format chains
-		for _, chain := range chains {
-			formatChain(conn, table, chain, &builder)
-		}
-
-		// Format sets
-		if sets, err := conn.GetSets(table); err != nil {
-			log.Warnf("Failed to get sets for table %s: %v", table.Name, err)
-		} else if len(sets) > 0 {
-			builder.WriteString("\n")
-			for _, set := range sets {
-				builder.WriteString(formatSet(conn, set))
-			}
-		}
-
-		builder.WriteString("}\n")
-	}
-
-	return builder.String()
-}
-
-func getAndSortTableChains(conn *nftables.Conn, table *nftables.Table) ([]*nftables.Chain, error) {
-	chains, err := conn.ListChains()
-	if err != nil {
-		return nil, err
-	}
-
-	var tableChains []*nftables.Chain
-	for _, chain := range chains {
-		if chain.Table.Name == table.Name && chain.Table.Family == table.Family {
-			tableChains = append(tableChains, chain)
-		}
-	}
-
-	sort.Slice(tableChains, func(i, j int) bool {
-		return tableChains[i].Name < tableChains[j].Name
-	})
-
-	return tableChains, nil
-}
-
-func formatChain(conn *nftables.Conn, table *nftables.Table, chain *nftables.Chain, builder *strings.Builder) {
-	builder.WriteString(fmt.Sprintf("\tchain %s {\n", chain.Name))
-
-	if chain.Type != "" {
-		var policy string
-		if chain.Policy != nil {
-			policy = fmt.Sprintf("; policy %s", formatPolicy(*chain.Policy))
-		}
-		builder.WriteString(fmt.Sprintf("\t\ttype %s hook %s priority %d%s\n",
-			formatChainType(chain.Type),
-			formatChainHook(chain.Hooknum),
-			chain.Priority,
-			policy))
-	}
-
-	rules, err := conn.GetRules(table, chain)
-	if err != nil {
-		log.Warnf("Failed to get rules for chain %s: %v", chain.Name, err)
-	} else {
-		sort.Slice(rules, func(i, j int) bool {
-			return rules[i].Position < rules[j].Position
-		})
-		for _, rule := range rules {
-			builder.WriteString(formatRule(rule))
-		}
-	}
-
-	builder.WriteString("\t}\n")
-}
-
-func sortTables(tables []*nftables.Table) {
-	sort.Slice(tables, func(i, j int) bool {
-		if tables[i].Family != tables[j].Family {
-			return tables[i].Family < tables[j].Family
-		}
-		return tables[i].Name < tables[j].Name
-	})
-}
-
-func formatFamily(family nftables.TableFamily) string {
-	switch family {
-	case nftables.TableFamilyIPv4:
-		return "ip"
-	case nftables.TableFamilyIPv6:
-		return "ip6"
-	case nftables.TableFamilyINet:
-		return "inet"
-	case nftables.TableFamilyARP:
-		return "arp"
-	case nftables.TableFamilyBridge:
-		return "bridge"
-	case nftables.TableFamilyNetdev:
-		return "netdev"
-	default:
-		return fmt.Sprintf("family-%d", family)
-	}
-}
-
-func formatChainType(typ nftables.ChainType) string {
-	switch typ {
-	case nftables.ChainTypeFilter:
-		return "filter"
-	case nftables.ChainTypeNAT:
-		return "nat"
-	case nftables.ChainTypeRoute:
-		return "route"
-	default:
-		return fmt.Sprintf("type-%s", typ)
-	}
-}
-
-func formatChainHook(hook *nftables.ChainHook) string {
-	if hook == nil {
-		return "none"
-	}
-	switch *hook {
-	case *nftables.ChainHookPrerouting:
-		return "prerouting"
-	case *nftables.ChainHookInput:
-		return "input"
-	case *nftables.ChainHookForward:
-		return "forward"
-	case *nftables.ChainHookOutput:
-		return "output"
-	case *nftables.ChainHookPostrouting:
-		return "postrouting"
-	default:
-		return fmt.Sprintf("hook-%d", *hook)
-	}
-}
-
-func formatPolicy(policy nftables.ChainPolicy) string {
-	switch policy {
-	case nftables.ChainPolicyDrop:
-		return "drop"
-	case nftables.ChainPolicyAccept:
-		return "accept"
-	default:
-		return fmt.Sprintf("policy-%d", policy)
-	}
-}
-
-func formatRule(rule *nftables.Rule) string {
-	var builder strings.Builder
-	builder.WriteString("\t\t")
-
-	for i := 0; i < len(rule.Exprs); i++ {
-		if i > 0 {
-			builder.WriteString(" ")
-		}
-		i = formatExprSequence(&builder, rule.Exprs, i)
-	}
-
-	builder.WriteString("\n")
-	return builder.String()
-}
-
-func formatExprSequence(builder *strings.Builder, exprs []expr.Any, i int) int {
-	curr := exprs[i]
-
-	// Handle Meta + Cmp sequence
-	if meta, ok := curr.(*expr.Meta); ok && i+1 < len(exprs) {
-		if cmp, ok := exprs[i+1].(*expr.Cmp); ok {
-			if formatted := formatMetaWithCmp(meta, cmp); formatted != "" {
-				builder.WriteString(formatted)
-				return i + 1
-			}
-		}
-	}
-
-	// Handle Payload + Cmp sequence
-	if payload, ok := curr.(*expr.Payload); ok && i+1 < len(exprs) {
-		if cmp, ok := exprs[i+1].(*expr.Cmp); ok {
-			builder.WriteString(formatPayloadWithCmp(payload, cmp))
-			return i + 1
-		}
-	}
-
-	builder.WriteString(formatExpr(curr))
-	return i
-}
-
-func formatMetaWithCmp(meta *expr.Meta, cmp *expr.Cmp) string {
-	switch meta.Key {
-	case expr.MetaKeyIIFNAME:
-		name := strings.TrimRight(string(cmp.Data), "\x00")
-		return fmt.Sprintf("iifname %s %q", formatCmpOp(cmp.Op), name)
-	case expr.MetaKeyOIFNAME:
-		name := strings.TrimRight(string(cmp.Data), "\x00")
-		return fmt.Sprintf("oifname %s %q", formatCmpOp(cmp.Op), name)
-	case expr.MetaKeyMARK:
-		if len(cmp.Data) == 4 {
-			val := binary.BigEndian.Uint32(cmp.Data)
-			return fmt.Sprintf("meta mark %s 0x%x", formatCmpOp(cmp.Op), val)
-		}
-	}
-	return ""
-}
-
-func formatPayloadWithCmp(p *expr.Payload, cmp *expr.Cmp) string {
-	if p.Base == expr.PayloadBaseNetworkHeader {
-		switch p.Offset {
-		case 12: // Source IP
-			if p.Len == 4 {
-				return fmt.Sprintf("ip saddr %s %s", formatCmpOp(cmp.Op), formatIPBytes(cmp.Data))
-			} else if p.Len == 2 {
-				return fmt.Sprintf("ip saddr %s %s", formatCmpOp(cmp.Op), formatIPBytes(cmp.Data))
-			}
-		case 16: // Destination IP
-			if p.Len == 4 {
-				return fmt.Sprintf("ip daddr %s %s", formatCmpOp(cmp.Op), formatIPBytes(cmp.Data))
-			} else if p.Len == 2 {
-				return fmt.Sprintf("ip daddr %s %s", formatCmpOp(cmp.Op), formatIPBytes(cmp.Data))
-			}
-		}
-	}
-	return fmt.Sprintf("%d reg%d [%d:%d] %s %v",
-		p.Base, p.DestRegister, p.Offset, p.Len,
-		formatCmpOp(cmp.Op), cmp.Data)
-}
-
-func formatIPBytes(data []byte) string {
-	if len(data) == 4 {
-		return fmt.Sprintf("%d.%d.%d.%d", data[0], data[1], data[2], data[3])
-	} else if len(data) == 2 {
-		return fmt.Sprintf("%d.%d.0.0/16", data[0], data[1])
-	}
-	return fmt.Sprintf("%v", data)
-}
-
-func formatCmpOp(op expr.CmpOp) string {
-	switch op {
-	case expr.CmpOpEq:
-		return "=="
-	case expr.CmpOpNeq:
-		return "!="
-	case expr.CmpOpLt:
-		return "<"
-	case expr.CmpOpLte:
-		return "<="
-	case expr.CmpOpGt:
-		return ">"
-	case expr.CmpOpGte:
-		return ">="
-	default:
-		return fmt.Sprintf("op-%d", op)
-	}
-}
-
-// formatExpr formats an expression in nft-like syntax
-func formatExpr(exp expr.Any) string {
-	switch e := exp.(type) {
-	case *expr.Meta:
-		return formatMeta(e)
-	case *expr.Cmp:
-		return formatCmp(e)
-	case *expr.Payload:
-		return formatPayload(e)
-	case *expr.Verdict:
-		return formatVerdict(e)
-	case *expr.Counter:
-		return fmt.Sprintf("counter packets %d bytes %d", e.Packets, e.Bytes)
-	case *expr.Masq:
-		return "masquerade"
-	case *expr.NAT:
-		return formatNat(e)
-	case *expr.Match:
-		return formatMatch(e)
-	case *expr.Queue:
-		return fmt.Sprintf("queue num %d", e.Num)
-	case *expr.Lookup:
-		return fmt.Sprintf("@%s", e.SetName)
-	case *expr.Bitwise:
-		return formatBitwise(e)
-	case *expr.Fib:
-		return formatFib(e)
-	case *expr.Target:
-		return fmt.Sprintf("jump %s", e.Name) // Properly format jump targets
-	case *expr.Immediate:
-		if e.Register == 1 {
-			return formatImmediateData(e.Data)
-		}
-		return fmt.Sprintf("immediate %v", e.Data)
-	default:
-		return fmt.Sprintf("<%T>", exp)
-	}
-}
-
-func formatImmediateData(data []byte) string {
-	// For IP addresses (4 bytes)
-	if len(data) == 4 {
-		return fmt.Sprintf("%d.%d.%d.%d", data[0], data[1], data[2], data[3])
-	}
-	return fmt.Sprintf("%v", data)
-}
-
-func formatMeta(e *expr.Meta) string {
-	// Handle source register case first (meta mark set)
-	if e.SourceRegister {
-		return fmt.Sprintf("meta %s set reg %d", formatMetaKey(e.Key), e.Register)
-	}
-
-	// For interface names, handle register load operation
-	switch e.Key {
-	case expr.MetaKeyIIFNAME,
-		expr.MetaKeyOIFNAME,
-		expr.MetaKeyBRIIIFNAME,
-		expr.MetaKeyBRIOIFNAME:
-		// Simply the key name with no register reference
-		return formatMetaKey(e.Key)
-
-	case expr.MetaKeyMARK:
-		// For mark operations, we want just "mark"
-		return "mark"
-	}
-
-	// For other meta keys, show as loading into register
-	return fmt.Sprintf("meta %s => reg %d", formatMetaKey(e.Key), e.Register)
-}
-
-func formatMetaKey(key expr.MetaKey) string {
-	switch key {
-	case expr.MetaKeyLEN:
-		return "length"
-	case expr.MetaKeyPROTOCOL:
-		return "protocol"
-	case expr.MetaKeyPRIORITY:
-		return "priority"
-	case expr.MetaKeyMARK:
-		return "mark"
-	case expr.MetaKeyIIF:
-		return "iif"
-	case expr.MetaKeyOIF:
-		return "oif"
-	case expr.MetaKeyIIFNAME:
-		return "iifname"
-	case expr.MetaKeyOIFNAME:
-		return "oifname"
-	case expr.MetaKeyIIFTYPE:
-		return "iiftype"
-	case expr.MetaKeyOIFTYPE:
-		return "oiftype"
-	case expr.MetaKeySKUID:
-		return "skuid"
-	case expr.MetaKeySKGID:
-		return "skgid"
-	case expr.MetaKeyNFTRACE:
-		return "nftrace"
-	case expr.MetaKeyRTCLASSID:
-		return "rtclassid"
-	case expr.MetaKeySECMARK:
-		return "secmark"
-	case expr.MetaKeyNFPROTO:
-		return "nfproto"
-	case expr.MetaKeyL4PROTO:
-		return "l4proto"
-	case expr.MetaKeyBRIIIFNAME:
-		return "briifname"
-	case expr.MetaKeyBRIOIFNAME:
-		return "broifname"
-	case expr.MetaKeyPKTTYPE:
-		return "pkttype"
-	case expr.MetaKeyCPU:
-		return "cpu"
-	case expr.MetaKeyIIFGROUP:
-		return "iifgroup"
-	case expr.MetaKeyOIFGROUP:
-		return "oifgroup"
-	case expr.MetaKeyCGROUP:
-		return "cgroup"
-	case expr.MetaKeyPRANDOM:
-		return "prandom"
-	default:
-		return fmt.Sprintf("meta-%d", key)
-	}
-}
-
-func formatCmp(e *expr.Cmp) string {
-	ops := map[expr.CmpOp]string{
-		expr.CmpOpEq:  "==",
-		expr.CmpOpNeq: "!=",
-		expr.CmpOpLt:  "<",
-		expr.CmpOpLte: "<=",
-		expr.CmpOpGt:  ">",
-		expr.CmpOpGte: ">=",
-	}
-	return fmt.Sprintf("%s %v", ops[e.Op], e.Data)
-}
-
-func formatPayload(e *expr.Payload) string {
-	var proto string
-	switch e.Base {
-	case expr.PayloadBaseNetworkHeader:
-		proto = "ip"
-	case expr.PayloadBaseTransportHeader:
-		proto = "tcp"
-	default:
-		proto = fmt.Sprintf("payload-%d", e.Base)
-	}
-	return fmt.Sprintf("%s reg%d [%d:%d]", proto, e.DestRegister, e.Offset, e.Len)
-}
-
-func formatVerdict(e *expr.Verdict) string {
-	switch e.Kind {
-	case expr.VerdictAccept:
-		return "accept"
-	case expr.VerdictDrop:
-		return "drop"
-	case expr.VerdictJump:
-		return fmt.Sprintf("jump %s", e.Chain)
-	case expr.VerdictGoto:
-		return fmt.Sprintf("goto %s", e.Chain)
-	case expr.VerdictReturn:
-		return "return"
-	default:
-		return fmt.Sprintf("verdict-%d", e.Kind)
-	}
-}
-
-func formatNat(e *expr.NAT) string {
-	switch e.Type {
-	case expr.NATTypeSourceNAT:
-		return "snat"
-	case expr.NATTypeDestNAT:
-		return "dnat"
-	default:
-		return fmt.Sprintf("nat-%d", e.Type)
-	}
-}
-
-func formatMatch(e *expr.Match) string {
-	return fmt.Sprintf("match %s rev %d", e.Name, e.Rev)
-}
-
-func formatBitwise(e *expr.Bitwise) string {
-	return fmt.Sprintf("bitwise reg%d = reg%d & %v ^ %v",
-		e.DestRegister, e.SourceRegister, e.Mask, e.Xor)
-}
-
-func formatFib(e *expr.Fib) string {
-	var flags []string
-	if e.FlagSADDR {
-		flags = append(flags, "saddr")
-	}
-	if e.FlagDADDR {
-		flags = append(flags, "daddr")
-	}
-	if e.FlagMARK {
-		flags = append(flags, "mark")
-	}
-	if e.FlagIIF {
-		flags = append(flags, "iif")
-	}
-	if e.FlagOIF {
-		flags = append(flags, "oif")
-	}
-	if e.ResultADDRTYPE {
-		flags = append(flags, "type")
-	}
-	return fmt.Sprintf("fib reg%d %s", e.Register, strings.Join(flags, ","))
-}
-
-func formatSet(conn *nftables.Conn, set *nftables.Set) string {
-	var builder strings.Builder
-	builder.WriteString(fmt.Sprintf("\tset %s {\n", set.Name))
-	builder.WriteString(fmt.Sprintf("\t\ttype %s\n", formatSetKeyType(set.KeyType)))
-	if set.ID > 0 {
-		builder.WriteString(fmt.Sprintf("\t\t# handle %d\n", set.ID))
-	}
-
-	elements, err := conn.GetSetElements(set)
-	if err != nil {
-		log.Warnf("Failed to get elements for set %s: %v", set.Name, err)
-	} else if len(elements) > 0 {
-		builder.WriteString("\t\telements = {")
-		for i, elem := range elements {
-			if i > 0 {
-				builder.WriteString(", ")
-			}
-			builder.WriteString(fmt.Sprintf("%v", elem.Key))
-		}
-		builder.WriteString("}\n")
-	}
-
-	builder.WriteString("\t}\n")
-	return builder.String()
-}
-
-func formatSetKeyType(keyType nftables.SetDatatype) string {
-	switch keyType {
-	case nftables.TypeInvalid:
-		return "invalid"
-	case nftables.TypeIPAddr:
-		return "ipv4_addr"
-	case nftables.TypeIP6Addr:
-		return "ipv6_addr"
-	case nftables.TypeEtherAddr:
-		return "ether_addr"
-	case nftables.TypeInetProto:
-		return "inet_proto"
-	case nftables.TypeInetService:
-		return "inet_service"
-	case nftables.TypeMark:
-		return "mark"
-	default:
-		return fmt.Sprintf("type-%v", keyType)
-	}
-}

client/server/debug_nonlinux.go

@@ -1,15 +0,0 @@
-//go:build !linux || android
-
-package server
-
-import (
-	"archive/zip"
-
-	"github.com/netbirdio/netbird/client/anonymize"
-	"github.com/netbirdio/netbird/client/proto"
-)
-
-// collectFirewallRules returns nothing on non-linux systems
-func (s *Server) addFirewallRules(req *proto.DebugBundleRequest, anonymizer *anonymize.Anonymizer, archive *zip.Writer) error {
-	return nil
-}

client/server/debug_test.go

@@ -428,116 +428,3 @@ func isInCGNATRange(ip net.IP) bool {
 	}
 	return cgnat.Contains(ip)
 }
-
-func TestAnonymizeFirewallRules(t *testing.T) {
-	// TODO: Add ipv6
-
-	// Example iptables-save output
-	iptablesSave := `# Generated by iptables-save v1.8.7 on Thu Dec 19 10:00:00 2024
-*filter
-:INPUT ACCEPT [0:0]
-:FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [0:0]
--A INPUT -s 192.168.1.0/24 -j ACCEPT
--A INPUT -s 44.192.140.1/32 -j DROP
--A FORWARD -s 10.0.0.0/8 -j DROP
--A FORWARD -s 44.192.140.0/24 -d 52.84.12.34/24 -j ACCEPT
-COMMIT
-
-*nat
-:PREROUTING ACCEPT [0:0]
-:INPUT ACCEPT [0:0]
-:OUTPUT ACCEPT [0:0]
-:POSTROUTING ACCEPT [0:0]
--A POSTROUTING -s 192.168.100.0/24 -j MASQUERADE
--A PREROUTING -d 44.192.140.10/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80
-COMMIT`
-
-	// Example iptables -v -n -L output
-	iptablesVerbose := `Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
-    pkts bytes target     prot opt in     out     source               destination         
-       0     0 ACCEPT     all  --  *      *       192.168.1.0/24       0.0.0.0/0           
-     100  1024 DROP       all  --  *      *       44.192.140.1         0.0.0.0/0
-
-Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
-    pkts bytes target     prot opt in     out     source               destination         
-       0     0 DROP       all  --  *      *       10.0.0.0/8           0.0.0.0/0           
-      25   256 ACCEPT     all  --  *      *       44.192.140.0/24      52.84.12.34/24
-
-Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
-    pkts bytes target     prot opt in     out     source               destination`
-
-	// Example nftables output
-	nftablesRules := `table inet filter {
-        chain input {
-                type filter hook input priority filter; policy accept;
-                ip saddr 192.168.1.1 accept
-                ip saddr 44.192.140.1 drop
-        }
-        chain forward {
-                type filter hook forward priority filter; policy accept;
-                ip saddr 10.0.0.0/8 drop
-                ip saddr 44.192.140.0/24 ip daddr 52.84.12.34/24 accept
-        }
-    }`
-
-	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
-
-	// Test iptables-save anonymization
-	anonIptablesSave := anonymizer.AnonymizeString(iptablesSave)
-
-	// Private IP addresses should remain unchanged
-	assert.Contains(t, anonIptablesSave, "192.168.1.0/24")
-	assert.Contains(t, anonIptablesSave, "10.0.0.0/8")
-	assert.Contains(t, anonIptablesSave, "192.168.100.0/24")
-	assert.Contains(t, anonIptablesSave, "192.168.1.10")
-
-	// Public IP addresses should be anonymized to the default range
-	assert.NotContains(t, anonIptablesSave, "44.192.140.1")
-	assert.NotContains(t, anonIptablesSave, "44.192.140.0/24")
-	assert.NotContains(t, anonIptablesSave, "52.84.12.34")
-	assert.Contains(t, anonIptablesSave, "198.51.100.") // Default anonymous range
-
-	// Structure should be preserved
-	assert.Contains(t, anonIptablesSave, "*filter")
-	assert.Contains(t, anonIptablesSave, ":INPUT ACCEPT [0:0]")
-	assert.Contains(t, anonIptablesSave, "COMMIT")
-	assert.Contains(t, anonIptablesSave, "-j MASQUERADE")
-	assert.Contains(t, anonIptablesSave, "--dport 80")
-
-	// Test iptables verbose output anonymization
-	anonIptablesVerbose := anonymizer.AnonymizeString(iptablesVerbose)
-
-	// Private IP addresses should remain unchanged
-	assert.Contains(t, anonIptablesVerbose, "192.168.1.0/24")
-	assert.Contains(t, anonIptablesVerbose, "10.0.0.0/8")
-
-	// Public IP addresses should be anonymized to the default range
-	assert.NotContains(t, anonIptablesVerbose, "44.192.140.1")
-	assert.NotContains(t, anonIptablesVerbose, "44.192.140.0/24")
-	assert.NotContains(t, anonIptablesVerbose, "52.84.12.34")
-	assert.Contains(t, anonIptablesVerbose, "198.51.100.") // Default anonymous range
-
-	// Structure and counters should be preserved
-	assert.Contains(t, anonIptablesVerbose, "Chain INPUT (policy ACCEPT 0 packets, 0 bytes)")
-	assert.Contains(t, anonIptablesVerbose, "100  1024 DROP")
-	assert.Contains(t, anonIptablesVerbose, "pkts bytes target")
-
-	// Test nftables anonymization
-	anonNftables := anonymizer.AnonymizeString(nftablesRules)
-
-	// Private IP addresses should remain unchanged
-	assert.Contains(t, anonNftables, "192.168.1.1")
-	assert.Contains(t, anonNftables, "10.0.0.0/8")
-
-	// Public IP addresses should be anonymized to the default range
-	assert.NotContains(t, anonNftables, "44.192.140.1")
-	assert.NotContains(t, anonNftables, "44.192.140.0/24")
-	assert.NotContains(t, anonNftables, "52.84.12.34")
-	assert.Contains(t, anonNftables, "198.51.100.") // Default anonymous range
-
-	// Structure should be preserved
-	assert.Contains(t, anonNftables, "table inet filter {")
-	assert.Contains(t, anonNftables, "chain input {")
-	assert.Contains(t, anonNftables, "type filter hook input priority filter; policy accept;")
-}

client/server/server.go

@@ -91,8 +91,6 @@ func New(ctx context.Context, configPath, logFile string) *Server {
 		signalProbe: internal.NewProbe(),
 		relayProbe:  internal.NewProbe(),
 		wgProbe:     internal.NewProbe(),
-
-		persistNetworkMap: true,
 	}
 }
 
@@ -399,28 +397,6 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		s.latestConfigInput.DNSRouteInterval = &duration
 	}
 
-	if msg.DisableClientRoutes != nil {
-		inputConfig.DisableClientRoutes = msg.DisableClientRoutes
-		s.latestConfigInput.DisableClientRoutes = msg.DisableClientRoutes
-	}
-	if msg.DisableServerRoutes != nil {
-		inputConfig.DisableServerRoutes = msg.DisableServerRoutes
-		s.latestConfigInput.DisableServerRoutes = msg.DisableServerRoutes
-	}
-	if msg.DisableDns != nil {
-		inputConfig.DisableDNS = msg.DisableDns
-		s.latestConfigInput.DisableDNS = msg.DisableDns
-	}
-	if msg.DisableFirewall != nil {
-		inputConfig.DisableFirewall = msg.DisableFirewall
-		s.latestConfigInput.DisableFirewall = msg.DisableFirewall
-	}
-
-	if msg.BlockLanAccess != nil {
-		inputConfig.BlockLANAccess = msg.BlockLanAccess
-		s.latestConfigInput.BlockLANAccess = msg.BlockLanAccess
-	}
-
 	s.mutex.Unlock()
 
 	if msg.OptionalPreSharedKey != nil {

client/ssh/login.go

@@ -2,29 +2,14 @@ package ssh
 
 import (
 	"fmt"
+	"github.com/netbirdio/netbird/util"
 	"net"
 	"net/netip"
-	"os"
 	"os/exec"
 	"runtime"
-
-	"github.com/netbirdio/netbird/util"
 )
 
-func isRoot() bool {
-	return os.Geteuid() == 0
-}
-
 func getLoginCmd(user string, remoteAddr net.Addr) (loginPath string, args []string, err error) {
-	if !isRoot() {
-		shell := getUserShell(user)
-		if shell == "" {
-			shell = "/bin/sh"
-		}
-
-		return shell, []string{"-l"}, nil
-	}
-
 	loginPath, err = exec.LookPath("login")
 	if err != nil {
 		return "", nil, err
@@ -35,17 +20,17 @@ func getLoginCmd(user string, remoteAddr net.Addr) (loginPath string, args []str
 		return "", nil, err
 	}
 
-	switch runtime.GOOS {
-	case "linux":
+	if runtime.GOOS == "linux" {
+
 		if util.FileExists("/etc/arch-release") && !util.FileExists("/etc/pam.d/remote") {
+			// detect if Arch Linux
 			return loginPath, []string{"-f", user, "-p"}, nil
 		}
+
 		return loginPath, []string{"-f", user, "-h", addrPort.Addr().String(), "-p"}, nil
-	case "darwin":
+	} else if runtime.GOOS == "darwin" {
 		return loginPath, []string{"-fp", "-h", addrPort.Addr().String(), user}, nil
-	case "freebsd":
-		return loginPath, []string{"-f", user, "-h", addrPort.Addr().String(), "-p"}, nil
-	default:
-		return "", nil, fmt.Errorf("unsupported platform: %s", runtime.GOOS)
 	}
+
+	return "", nil, fmt.Errorf("unsupported platform")
 }

client/ssh/lookup.go

@@ -6,9 +6,5 @@ package ssh
 import "os/user"
 
 func userNameLookup(username string) (*user.User, error) {
-	if username == "" || (username == "root" && !isRoot()) {
-		return user.Current()
-	}
-
 	return user.Lookup(username)
 }

client/ssh/lookup_darwin.go

@@ -12,10 +12,6 @@ import (
 )
 
 func userNameLookup(username string) (*user.User, error) {
-	if username == "" || (username == "root" && !isRoot()) {
-		return user.Current()
-	}
-
 	var userObject *user.User
 	userObject, err := user.Lookup(username)
 	if err != nil && err.Error() == user.UnknownUserError(username).Error() {

client/ssh/server.go

@@ -168,12 +168,8 @@ func (srv *DefaultServer) sessionHandler(session ssh.Session) {
 		cmd := exec.Command(loginCmd, loginArgs...)
 		go func() {
 			<-session.Context().Done()
-			if cmd.Process == nil {
-				return
-			}
 			err := cmd.Process.Kill()
 			if err != nil {
-				log.Debugf("failed killing SSH process %v", err)
 				return
 			}
 		}()
@@ -189,7 +185,7 @@ func (srv *DefaultServer) sessionHandler(session ssh.Session) {
 		log.Debugf("Login command: %s", cmd.String())
 		file, err := pty.Start(cmd)
 		if err != nil {
-			log.Errorf("failed starting SSH server: %v", err)
+			log.Errorf("failed starting SSH server %v", err)
 		}
 
 		go func() {

client/system/info.go

@@ -59,31 +59,6 @@ type Info struct {
 	SystemManufacturer string
 	Environment        Environment
 	Files              []File // for posture checks
-
-	RosenpassEnabled    bool
-	RosenpassPermissive bool
-	ServerSSHAllowed    bool
-	DisableClientRoutes bool
-	DisableServerRoutes bool
-	DisableDNS          bool
-	DisableFirewall     bool
-}
-
-func (i *Info) SetFlags(
-	rosenpassEnabled, rosenpassPermissive bool,
-	serverSSHAllowed *bool,
-	disableClientRoutes, disableServerRoutes,
-	disableDNS, disableFirewall bool,
-) {
-	i.RosenpassEnabled = rosenpassEnabled
-	i.RosenpassPermissive = rosenpassPermissive
-	if serverSSHAllowed != nil {
-		i.ServerSSHAllowed = *serverSSHAllowed
-	}
-	i.DisableClientRoutes = disableClientRoutes
-	i.DisableServerRoutes = disableServerRoutes
-	i.DisableDNS = disableDNS
-	i.DisableFirewall = disableFirewall
 }
 
 // StaticInfo is an object that contains machine information that does not change

client/system/info_android.go

@@ -39,9 +39,6 @@ func GetInfo(ctx context.Context) *Info {
 		WiretrusteeVersion: version.NetbirdVersion(),
 		UIVersion:          extractUIVersion(ctx),
 		KernelVersion:      kernelVersion,
-		SystemSerialNumber: serial(),
-		SystemProductName:  productModel(),
-		SystemManufacturer: productManufacturer(),
 	}
 
 	return gio
@@ -52,42 +49,13 @@ func checkFileAndProcess(paths []string) ([]File, error) {
 	return []File{}, nil
 }
 
-func serial() string {
-	// try to fetch serial ID using different properties
-	properties := []string{"ril.serialnumber", "ro.serialno", "ro.boot.serialno", "sys.serialnumber"}
-	var value string
-
-	for _, property := range properties {
-		value = getprop(property)
-		if len(value) > 0 {
-			return value
-		}
-	}
-
-	// unable to get serial ID, fallback to ANDROID_ID
-	return androidId()
-}
-
-func androidId() string {
-	// this is a uniq id defined on first initialization, id will be a new one if user wipes his device
-	return run("/system/bin/settings", "get", "secure", "android_id")
-}
-
-func productModel() string {
-	return getprop("ro.product.model")
-}
-
-func productManufacturer() string {
-	return getprop("ro.product.manufacturer")
-}
-
 func uname() []string {
 	res := run("/system/bin/uname", "-a")
 	return strings.Split(res, " ")
 }
 
 func osVersion() string {
-	return getprop("ro.build.version.release")
+	return run("/system/bin/getprop", "ro.build.version.release")
 }
 
 func extractUIVersion(ctx context.Context) string {
@@ -98,10 +66,6 @@ func extractUIVersion(ctx context.Context) string {
 	return v
 }
 
-func getprop(arg ...string) string {
-	return run("/system/bin/getprop", arg...)
-}
-
 func run(name string, arg ...string) string {
 	cmd := exec.Command(name, arg...)
 	cmd.Stdin = strings.NewReader("some")

client/system/info_windows.go

@@ -105,7 +105,7 @@ func getOSNameAndVersion() (string, string) {
 
 	split := strings.Split(dst[0].Caption, " ")
 
-	if len(split) <= 3 {
+	if len(split) < 3 {
 		return "Windows", getBuildVersion()
 	}
 

client/ui/client_ui.go

@@ -1,4 +1,4 @@
-//go:build !(linux && 386)
+//go:build !(linux && 386) && !freebsd
 
 package main
 
@@ -876,7 +876,7 @@ func openURL(url string) error {
 		err = exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start()
 	case "darwin":
 		err = exec.Command("open", url).Start()
-	case "linux", "freebsd":
+	case "linux":
 		err = exec.Command("xdg-open", url).Start()
 	default:
 		err = fmt.Errorf("unsupported platform")

client/ui/font_bsd.go

@@ -1,4 +1,4 @@
-//go:build freebsd || openbsd || netbsd || dragonfly
+//go:build darwin
 
 package main
 
@@ -9,22 +9,18 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
+const defaultFontPath = "/Library/Fonts/Arial Unicode.ttf"
+
 func (s *serviceClient) setDefaultFonts() {
-	paths := []string{
-		"/usr/local/share/fonts/TTF/DejaVuSans.ttf",
-		"/usr/local/share/fonts/dejavu/DejaVuSans.ttf",
-		"/usr/local/share/noto/NotoSans-Regular.ttf",
-		"/usr/local/share/fonts/noto/NotoSans-Regular.ttf",
-		"/usr/local/share/fonts/liberation-fonts-ttf/LiberationSans-Regular.ttf",
+	// TODO: add other bsd paths
+	if runtime.GOOS != "darwin" {
+		return
 	}
 
-	for _, fontPath := range paths {
-		if _, err := os.Stat(fontPath); err == nil {
-			os.Setenv("FYNE_FONT", fontPath)
-			log.Debugf("Using font: %s", fontPath)
-			return
-		}
+	if _, err := os.Stat(defaultFontPath); err != nil {
+		log.Errorf("Failed to find default font file: %v", err)
+		return
 	}
 
-	log.Errorf("Failed to find any suitable font files for %s", runtime.GOOS)
+	os.Setenv("FYNE_FONT", defaultFontPath)
 }