Brad Ison f400f4bee8 [proxy] Optionally refuse private addresses on direct-upstream dials (#7913) ...

Direct-upstream targets are dialled on the proxy host's network stack,
outside the embedded client's LAN blocking. A proxy that serves
untrusted accounts lets them reach the host's loopback, its LAN or
cluster, and the cloud metadata service through such a target.

NB_PROXY_DIRECT_UPSTREAM_BLOCK_PRIVATE adds a dialer control that
refuses addresses that are not globally reachable. It checks each
socket's resolved address just before connect, so hostnames and DNS
rebinding are covered, and IPv4 embedded in IPv6 addresses is checked
as IPv4. Refused dials are served as a 502. The setting defaults to
off for private and self-hosted proxies; an unparsable value turns it
on.

2026-10-02 12:02:06 +02:00

..

accesslog

[management, proxy] Add prompt-cache token and cost accounting to agent network usage (#6900)

2026-07-26 21:42:41 +02:00

acme

[management] validate the domain for the flock in proxy (#7501)

2026-09-11 13:51:03 +02:00

auth

[management,proxy] Use single-use codes for OIDC session handoff (#7635)

2026-09-29 18:29:55 +03:00

certwatch

[proxy] Wildcard certificate support (#5583)

2026-03-12 16:00:28 +01:00

conntrack

[management,proxy,client] Add L4 capabilities (TLS/TCP/UDP) (#5530)

2026-03-13 18:36:44 +01:00

crowdsec

[management, proxy] Add CrowdSec IP reputation integration for reverse proxy (#5722)

2026-04-14 12:14:58 +02:00

debug

[client, proxy] Make the buffer-pool retune reachable while a device is stalled (#7452)

2026-09-11 09:38:22 +02:00

flock

[management, reverse proxy] Add reverse proxy feature (#5291)

2026-02-13 19:37:43 +01:00

geolocation

[proxy, management] Add header auth, access restrictions, and session idle timeout (#5587)

2026-03-16 15:22:00 +01:00

grpc

[management, reverse proxy] Add reverse proxy feature (#5291)

2026-02-13 19:37:43 +01:00

health

[management, reverse proxy] Add reverse proxy feature (#5291)

2026-02-13 19:37:43 +01:00

k8s

[management, reverse proxy] Add reverse proxy feature (#5291)

2026-02-13 19:37:43 +01:00

llm

[proxy,management] Conform the Agent Network endpoint to the LLM gateway protocol (#7154)

2026-08-23 20:02:33 +02:00

metrics

[management,signal,proxy] add pyroscope profiling (#7536)

2026-09-23 18:01:35 +02:00

middleware

[management,proxy] Serve guardrail allowlists of declared model ids (#7389)

2026-09-02 18:57:02 +02:00

netutil

[management,proxy,client] Add L4 capabilities (TLS/TCP/UDP) (#5530)

2026-03-13 18:36:44 +01:00

proxy

[proxy] Optionally refuse private addresses on direct-upstream dials (#7913)

2026-10-02 12:02:06 +02:00

responsewriter

[proxy] Support WebSocket (#5312)

2026-02-17 12:53:34 +01:00

restrict

[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226)

2026-05-25 17:41:50 +02:00

roundtrip

[proxy] Optionally refuse private addresses on direct-upstream dials (#7913)

2026-10-02 12:02:06 +02:00

tcp

[management,proxy,client] 0.74.0 version (#6563)

2026-07-01 12:45:14 +02:00

types

[management, client, proxy] add expose NetBird-only services over tunnel peers (#6226)

2026-05-25 17:41:50 +02:00

udp

[management, proxy] Add CrowdSec IP reputation integration for reverse proxy (#5722)

2026-04-14 12:14:58 +02:00