mirror of
https://github.com/netbirdio/netbird.git
synced 2026-05-16 05:39:56 +00:00
130 lines
5.1 KiB
Markdown
130 lines
5.1 KiB
Markdown
# Settings — Tabs & Controls
|
|
|
|
Each row has a title and short description. Booleans default to **toggle switch**; pick another control only when noted.
|
|
|
|
Tab order: **General · Network · SSH · Troubleshooting · About**.
|
|
|
|
---
|
|
|
|
## 1. General
|
|
|
|
App behavior + how the client connects.
|
|
|
|
### Startup
|
|
|
|
- **Connect on startup** — `disableAutoConnect` (inverted) · *toggle switch*
|
|
- Automatically connect to NetBird when the app launches.
|
|
- **Show notifications** — `disableNotifications` (inverted) · *toggle switch*
|
|
- Show desktop notifications for connection events and updates.
|
|
|
|
### Connection
|
|
|
|
- **Management URL** — `managementUrl` · *text input*
|
|
- The NetBird management server this client connects to.
|
|
- **Admin URL** — `adminUrl` · *text input*
|
|
- Web dashboard URL used by "Open Admin Panel".
|
|
- **Pre-shared key** — `preSharedKey` · *password input with reveal toggle*
|
|
- Optional WireGuard pre-shared key for an extra layer of symmetric encryption.
|
|
|
|
### Interface
|
|
|
|
- **Interface name** — `interfaceName` · *text input*
|
|
- Name of the WireGuard network interface created on this host.
|
|
- **WireGuard port** — `wireguardPort` · *number input*
|
|
- Local UDP port the WireGuard interface listens on.
|
|
- **MTU** — `mtu` · *number input*
|
|
- Maximum transmission unit for the WireGuard interface.
|
|
|
|
---
|
|
|
|
## 2. Network
|
|
|
|
Routing, DNS, firewall, and encryption — everything the daemon does on the wire and to the host network.
|
|
|
|
### Routing & DNS
|
|
|
|
- **Lazy connections** — `lazyConnectionEnabled` · *toggle switch*
|
|
- Only establish peer tunnels on first traffic instead of eagerly at startup.
|
|
- **Network monitor** — `networkMonitor` · *toggle switch*
|
|
- Reconnect automatically when the host network changes (Wi-Fi switch, VPN, sleep/wake).
|
|
- **Enable DNS** — `disableDns` (inverted) · *toggle switch*
|
|
- Apply NetBird-managed DNS settings to the host resolver.
|
|
- **Enable client routes** — `disableClientRoutes` (inverted) · *toggle switch*
|
|
- Accept routes advertised by other peers so this client can reach their networks.
|
|
- **Enable server routes** — `disableServerRoutes` (inverted) · *toggle switch*
|
|
- Advertise this host's local routes to other peers.
|
|
|
|
### Firewall
|
|
|
|
- **Block inbound traffic** — `blockInbound` · *toggle switch*
|
|
- Drop all unsolicited inbound traffic on the NetBird interface.
|
|
- **Block LAN access** — `blockLanAccess` · *toggle switch*
|
|
- Prevent peers from reaching this host's local network.
|
|
|
|
### Encryption
|
|
|
|
- **Quantum-resistant encryption** — `rosenpassEnabled` · *toggle switch*
|
|
- Add a post-quantum key exchange (Rosenpass) on top of WireGuard.
|
|
- **Permissive mode** — `rosenpassPermissive` · *toggle switch* (nested, only when above is on)
|
|
- Allow connections to peers without quantum-resistance support.
|
|
|
|
---
|
|
|
|
## 3. SSH
|
|
|
|
NetBird SSH server config. Master switch at the top; sub-toggles greyed out with an inline notice ("Enable Allow SSH to configure") when the master is off.
|
|
|
|
### Server
|
|
|
|
- **Allow SSH** — `serverSshAllowed` · *toggle switch* (master)
|
|
- Run the NetBird SSH server on this host so other peers can connect to it.
|
|
- **Allow root login** — `enableSshRoot` · *toggle switch*
|
|
- Permit incoming SSH sessions to authenticate as `root`.
|
|
- **Enable SFTP** — `enableSshSftp` · *toggle switch*
|
|
- Allow file transfers over the NetBird SSH server.
|
|
- **Local port forwarding** — `enableSshLocalPortForwarding` · *toggle switch*
|
|
- Allow clients to forward local ports through this host.
|
|
- **Remote port forwarding** — `enableSshRemotePortForwarding` · *toggle switch*
|
|
- Allow clients to expose remote ports back through this host.
|
|
|
|
### Authentication
|
|
|
|
- **Disable SSH auth** — `disableSshAuth` · *toggle switch*
|
|
- Skip JWT authentication for incoming SSH sessions. **Insecure — diagnostics only.**
|
|
- **JWT cache TTL** — `sshJwtCacheTtl` · *number input (seconds)*
|
|
- How long verified JWTs are cached before re-validation.
|
|
|
|
---
|
|
|
|
## 4. Troubleshooting
|
|
|
|
Everything you reach for when something is wrong. Config + actions deliberately mixed — they're used together.
|
|
|
|
### Logging
|
|
|
|
- **Log level** — *dropdown: Debug / Info / Warn / Error*
|
|
- Verbosity of the daemon log. Raise to Debug when reproducing an issue.
|
|
- **Log file path** — *read-only text + Copy + Reveal in Finder/Explorer*
|
|
- **Config file path** — *read-only text + Copy + Reveal in Finder/Explorer*
|
|
|
|
### Debug bundle
|
|
|
|
- **Anonymize** — *toggle switch*
|
|
- Strip IPs, hostnames, and peer names from the bundle before saving.
|
|
- **Include system info** — *toggle switch*
|
|
- Add OS, kernel, and network interface details to the bundle.
|
|
- **Upload on create** — *toggle switch*
|
|
- When on, reveals an upload URL field and uploads the bundle after creation.
|
|
- **Create Bundle** — *button* → progress indicator → resulting path or upload URL.
|
|
|
|
---
|
|
|
|
## 5. About
|
|
|
|
Version, update flow, and identity reference.
|
|
|
|
- App version, daemon version
|
|
- **Check for Updates** — *button* (drives auto-update flow; 15-min timeout, success/error states)
|
|
- Local peer info quick-reference (FQDN, IP) — same data shown in the connection-state view
|
|
- Links: docs, GitHub repo, license
|