Settings — Tabs & Controls

Each row has a title and short description. Booleans default to toggle switch; pick another control only when noted.

Tab order: General · Network · SSH · Troubleshooting · About.

1. General

App behavior + how the client connects.

Startup

Connect on startup — disableAutoConnect (inverted) · toggle switch
- Automatically connect to NetBird when the app launches.
Show notifications — disableNotifications (inverted) · toggle switch
- Show desktop notifications for connection events and updates.

Connection

Management URL — managementUrl · text input
- The NetBird management server this client connects to.
Admin URL — adminUrl · text input
- Web dashboard URL used by "Open Admin Panel".
Pre-shared key — preSharedKey · password input with reveal toggle
- Optional WireGuard pre-shared key for an extra layer of symmetric encryption.

Interface

Interface name — interfaceName · text input
- Name of the WireGuard network interface created on this host.
WireGuard port — wireguardPort · number input
- Local UDP port the WireGuard interface listens on.
MTU — mtu · number input
- Maximum transmission unit for the WireGuard interface.

2. Network

Routing, DNS, firewall, and encryption — everything the daemon does on the wire and to the host network.

Routing & DNS

Lazy connections — lazyConnectionEnabled · toggle switch
- Only establish peer tunnels on first traffic instead of eagerly at startup.
Network monitor — networkMonitor · toggle switch
- Reconnect automatically when the host network changes (Wi-Fi switch, VPN, sleep/wake).
Enable DNS — disableDns (inverted) · toggle switch
- Apply NetBird-managed DNS settings to the host resolver.
Enable client routes — disableClientRoutes (inverted) · toggle switch
- Accept routes advertised by other peers so this client can reach their networks.
Enable server routes — disableServerRoutes (inverted) · toggle switch
- Advertise this host's local routes to other peers.

Firewall

Block inbound traffic — blockInbound · toggle switch
- Drop all unsolicited inbound traffic on the NetBird interface.
Block LAN access — blockLanAccess · toggle switch
- Prevent peers from reaching this host's local network.

Encryption

Quantum-resistant encryption — rosenpassEnabled · toggle switch
- Add a post-quantum key exchange (Rosenpass) on top of WireGuard.
- Permissive mode — rosenpassPermissive · toggle switch (nested, only when above is on)
  - Allow connections to peers without quantum-resistance support.

3. SSH

NetBird SSH server config. Master switch at the top; sub-toggles greyed out with an inline notice ("Enable Allow SSH to configure") when the master is off.

Server

Allow SSH — serverSshAllowed · toggle switch (master)
- Run the NetBird SSH server on this host so other peers can connect to it.
Allow root login — enableSshRoot · toggle switch
- Permit incoming SSH sessions to authenticate as root.
Enable SFTP — enableSshSftp · toggle switch
- Allow file transfers over the NetBird SSH server.
Local port forwarding — enableSshLocalPortForwarding · toggle switch
- Allow clients to forward local ports through this host.
Remote port forwarding — enableSshRemotePortForwarding · toggle switch
- Allow clients to expose remote ports back through this host.

Authentication

Disable SSH auth — disableSshAuth · toggle switch
- Skip JWT authentication for incoming SSH sessions. Insecure — diagnostics only.
JWT cache TTL — sshJwtCacheTtl · number input (seconds)
- How long verified JWTs are cached before re-validation.

4. Troubleshooting

Everything you reach for when something is wrong. Config + actions deliberately mixed — they're used together.

Logging

Log level — dropdown: Debug / Info / Warn / Error
- Verbosity of the daemon log. Raise to Debug when reproducing an issue.
Log file path — read-only text + Copy + Reveal in Finder/Explorer
Config file path — read-only text + Copy + Reveal in Finder/Explorer

Debug bundle

Anonymize — toggle switch
- Strip IPs, hostnames, and peer names from the bundle before saving.
Include system info — toggle switch
- Add OS, kernel, and network interface details to the bundle.
Upload on create — toggle switch
- When on, reveals an upload URL field and uploads the bundle after creation.
Create Bundle — button → progress indicator → resulting path or upload URL.

5. About

Version, update flow, and identity reference.

App version, daemon version
Check for Updates — button (drives auto-update flow; 15-min timeout, success/error states)
Local peer info quick-reference (FQDN, IP) — same data shown in the connection-state view
Links: docs, GitHub repo, license

5.1 KiB Raw Blame History