Fix SSH proxy stripping shell quoting from forwarded commands

.github/workflows/release.yml

@@ -170,7 +170,6 @@ jobs:
         run: sudo apt update && sudo apt install -y -q gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu
 
       - name: Decode GPG signing key
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           GPG_RPM_PRIVATE_KEY: ${{ secrets.GPG_RPM_PRIVATE_KEY }}
         run: |
@@ -310,7 +309,6 @@ jobs:
         run: sudo apt update && sudo apt install -y -q libappindicator3-dev gir1.2-appindicator3-0.1 libxxf86vm-dev gcc-mingw-w64-x86-64
 
       - name: Decode GPG signing key
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           GPG_RPM_PRIVATE_KEY: ${{ secrets.GPG_RPM_PRIVATE_KEY }}
         run: |

.github/workflows/wasm-build-validation.yml

@@ -61,8 +61,8 @@ jobs:
 
           echo "Size: ${SIZE} bytes (${SIZE_MB} MB)"
 
-          if [ ${SIZE} -gt 58720256 ]; then
-            echo "Wasm binary size (${SIZE_MB}MB) exceeds 56MB limit!"
+          if [ ${SIZE} -gt 57671680 ]; then
+            echo "Wasm binary size (${SIZE_MB}MB) exceeds 55MB limit!"
             exit 1
           fi
 

.goreleaser.yaml

@@ -171,7 +171,6 @@ nfpms:
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client.
     homepage: https://netbird.io/
-    license: BSD-3-Clause
     id: netbird_deb
     bindir: /usr/bin
     builds:
@@ -185,7 +184,6 @@ nfpms:
   - maintainer: Netbird <dev@netbird.io>
     description: Netbird client.
     homepage: https://netbird.io/
-    license: BSD-3-Clause
     id: netbird_rpm
     bindir: /usr/bin
     builds:

client/android/client.go

@@ -203,11 +203,10 @@ func (c *Client) PeersList() *PeerInfoArray {
 	peerInfos := make([]PeerInfo, len(fullStatus.Peers))
 	for n, p := range fullStatus.Peers {
 		pi := PeerInfo{
-			IP:         p.IP,
-			IPv6:       p.IPv6,
-			FQDN:       p.FQDN,
-			ConnStatus: p.ConnStatus.String(),
-			Routes:     PeerRoutes{routes: maps.Keys(p.GetRoutes())},
+			p.IP,
+			p.FQDN,
+			p.ConnStatus.String(),
+			PeerRoutes{routes: maps.Keys(p.GetRoutes())},
 		}
 		peerInfos[n] = pi
 	}

client/android/peer_notifier.go

@@ -5,7 +5,6 @@ package android
 // PeerInfo describe information about the peers. It designed for the UI usage
 type PeerInfo struct {
 	IP         string
-	IPv6       string
 	FQDN       string
 	ConnStatus string // Todo replace to enum
 	Routes     PeerRoutes

client/android/preferences.go

@@ -307,24 +307,6 @@ func (p *Preferences) SetBlockInbound(block bool) {
 	p.configInput.BlockInbound = &block
 }
 
-// GetDisableIPv6 reads disable IPv6 setting from config file
-func (p *Preferences) GetDisableIPv6() (bool, error) {
-	if p.configInput.DisableIPv6 != nil {
-		return *p.configInput.DisableIPv6, nil
-	}
-
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
-	if err != nil {
-		return false, err
-	}
-	return cfg.DisableIPv6, err
-}
-
-// SetDisableIPv6 stores the given value and waits for commit
-func (p *Preferences) SetDisableIPv6(disable bool) {
-	p.configInput.DisableIPv6 = &disable
-}
-
 // Commit writes out the changes to the config file
 func (p *Preferences) Commit() error {
 	_, err := profilemanager.UpdateOrCreateConfig(p.configInput)

client/cmd/debug.go

@@ -181,11 +181,10 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 
 	if stateWasDown {
 		if _, err := client.Up(cmd.Context(), &proto.UpRequest{}); err != nil {
-			cmd.PrintErrf("Failed to bring service up: %v\n", status.Convert(err).Message())
-		} else {
-			cmd.Println("netbird up")
-			time.Sleep(time.Second * 10)
+			return fmt.Errorf("failed to up: %v", status.Convert(err).Message())
 		}
+		cmd.Println("netbird up")
+		time.Sleep(time.Second * 10)
 	}
 
 	initialLevelTrace := initialLogLevel.GetLevel() >= proto.LogLevel_TRACE
@@ -200,10 +199,9 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 	}
 
 	if _, err := client.Down(cmd.Context(), &proto.DownRequest{}); err != nil {
-		cmd.PrintErrf("Failed to bring service down: %v\n", status.Convert(err).Message())
-	} else {
-		cmd.Println("netbird down")
+		return fmt.Errorf("failed to down: %v", status.Convert(err).Message())
 	}
+	cmd.Println("netbird down")
 
 	time.Sleep(1 * time.Second)
 
@@ -211,14 +209,13 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 	if _, err := client.SetSyncResponsePersistence(cmd.Context(), &proto.SetSyncResponsePersistenceRequest{
 		Enabled: true,
 	}); err != nil {
-		cmd.PrintErrf("Failed to enable sync response persistence: %v\n", status.Convert(err).Message())
+		return fmt.Errorf("failed to enable sync response persistence: %v", status.Convert(err).Message())
 	}
 
 	if _, err := client.Up(cmd.Context(), &proto.UpRequest{}); err != nil {
-		cmd.PrintErrf("Failed to bring service up: %v\n", status.Convert(err).Message())
-	} else {
-		cmd.Println("netbird up")
+		return fmt.Errorf("failed to up: %v", status.Convert(err).Message())
 	}
+	cmd.Println("netbird up")
 
 	time.Sleep(3 * time.Second)
 
@@ -266,18 +263,16 @@ func runForDuration(cmd *cobra.Command, args []string) error {
 
 	if stateWasDown {
 		if _, err := client.Down(cmd.Context(), &proto.DownRequest{}); err != nil {
-			cmd.PrintErrf("Failed to restore service down state: %v\n", status.Convert(err).Message())
-		} else {
-			cmd.Println("netbird down")
+			return fmt.Errorf("failed to down: %v", status.Convert(err).Message())
 		}
+		cmd.Println("netbird down")
 	}
 
 	if !initialLevelTrace {
 		if _, err := client.SetLogLevel(cmd.Context(), &proto.SetLogLevelRequest{Level: initialLogLevel.GetLevel()}); err != nil {
-			cmd.PrintErrf("Failed to restore log level: %v\n", status.Convert(err).Message())
-		} else {
-			cmd.Println("Log level restored to", initialLogLevel.GetLevel())
+			return fmt.Errorf("failed to restore log level: %v", status.Convert(err).Message())
 		}
+		cmd.Println("Log level restored to", initialLogLevel.GetLevel())
 	}
 
 	cmd.Printf("Local file:\n%s\n", resp.GetPath())

client/cmd/status.go

@@ -20,7 +20,6 @@ import (
 var (
 	detailFlag           bool
 	ipv4Flag             bool
-	ipv6Flag             bool
 	jsonFlag             bool
 	yamlFlag             bool
 	ipsFilter            []string
@@ -46,9 +45,8 @@ func init() {
 	statusCmd.PersistentFlags().BoolVar(&jsonFlag, "json", false, "display detailed status information in json format")
 	statusCmd.PersistentFlags().BoolVar(&yamlFlag, "yaml", false, "display detailed status information in yaml format")
 	statusCmd.PersistentFlags().BoolVar(&ipv4Flag, "ipv4", false, "display only NetBird IPv4 of this peer, e.g., --ipv4 will output 100.64.0.33")
-	statusCmd.PersistentFlags().BoolVar(&ipv6Flag, "ipv6", false, "display only NetBird IPv6 of this peer")
-	statusCmd.MarkFlagsMutuallyExclusive("detail", "json", "yaml", "ipv4", "ipv6")
-	statusCmd.PersistentFlags().StringSliceVar(&ipsFilter, "filter-by-ips", []string{}, "filters the detailed output by a list of one or more IPs (v4 or v6), e.g., --filter-by-ips 100.64.0.100,fd00::1")
+	statusCmd.MarkFlagsMutuallyExclusive("detail", "json", "yaml", "ipv4")
+	statusCmd.PersistentFlags().StringSliceVar(&ipsFilter, "filter-by-ips", []string{}, "filters the detailed output by a list of one or more IPs, e.g., --filter-by-ips 100.64.0.100,100.64.0.200")
 	statusCmd.PersistentFlags().StringSliceVar(&prefixNamesFilter, "filter-by-names", []string{}, "filters the detailed output by a list of one or more peer FQDN or hostnames, e.g., --filter-by-names peer-a,peer-b.netbird.cloud")
 	statusCmd.PersistentFlags().StringVar(&statusFilter, "filter-by-status", "", "filters the detailed output by connection status(idle|connecting|connected), e.g., --filter-by-status connected")
 	statusCmd.PersistentFlags().StringVar(&connectionTypeFilter, "filter-by-connection-type", "", "filters the detailed output by connection type (P2P|Relayed), e.g., --filter-by-connection-type P2P")
@@ -103,14 +101,6 @@ func statusFunc(cmd *cobra.Command, args []string) error {
 		return nil
 	}
 
-	if ipv6Flag {
-		ipv6 := resp.GetFullStatus().GetLocalPeerState().GetIpv6()
-		if ipv6 != "" {
-			cmd.Print(parseInterfaceIP(ipv6))
-		}
-		return nil
-	}
-
 	pm := profilemanager.NewProfileManager()
 	var profName string
 	if activeProf, err := pm.GetActiveProfile(); err == nil {

client/cmd/system.go

@@ -8,7 +8,6 @@ const (
 	disableFirewallFlag     = "disable-firewall"
 	blockLANAccessFlag      = "block-lan-access"
 	blockInboundFlag        = "block-inbound"
-	disableIPv6Flag         = "disable-ipv6"
 )
 
 var (
@@ -18,7 +17,6 @@ var (
 	disableFirewall     bool
 	blockLANAccess      bool
 	blockInbound        bool
-	disableIPv6         bool
 )
 
 func init() {
@@ -41,7 +39,4 @@ func init() {
 	upCmd.PersistentFlags().BoolVar(&blockInbound, blockInboundFlag, false,
 		"Block inbound connections. If enabled, the client will not allow any inbound connections to the local machine nor routed networks.\n"+
 			"This overrides any policies received from the management service.")
-
-	upCmd.PersistentFlags().BoolVar(&disableIPv6, disableIPv6Flag, false,
-		"Disable IPv6 overlay. If enabled, the client won't request or use an IPv6 overlay address.")
 }

client/cmd/up.go

@@ -430,10 +430,6 @@ func setupSetConfigReq(customDNSAddressConverted []byte, cmd *cobra.Command, pro
 		req.BlockInbound = &blockInbound
 	}
 
-	if cmd.Flag(disableIPv6Flag).Changed {
-		req.DisableIpv6 = &disableIPv6
-	}
-
 	if cmd.Flag(enableLazyConnectionFlag).Changed {
 		req.LazyConnectionEnabled = &lazyConnEnabled
 	}
@@ -551,10 +547,6 @@ func setupConfig(customDNSAddressConverted []byte, cmd *cobra.Command, configFil
 		ic.BlockInbound = &blockInbound
 	}
 
-	if cmd.Flag(disableIPv6Flag).Changed {
-		ic.DisableIPv6 = &disableIPv6
-	}
-
 	if cmd.Flag(enableLazyConnectionFlag).Changed {
 		ic.LazyConnectionEnabled = &lazyConnEnabled
 	}
@@ -669,10 +661,6 @@ func setupLoginRequest(providedSetupKey string, customDNSAddressConverted []byte
 		loginRequest.BlockInbound = &blockInbound
 	}
 
-	if cmd.Flag(disableIPv6Flag).Changed {
-		loginRequest.DisableIpv6 = &disableIPv6
-	}
-
 	if cmd.Flag(enableLazyConnectionFlag).Changed {
 		loginRequest.LazyConnectionEnabled = &lazyConnEnabled
 	}

client/embed/embed.go

@@ -79,8 +79,6 @@ type Options struct {
 	StatePath string
 	// DisableClientRoutes disables the client routes
 	DisableClientRoutes bool
-	// DisableIPv6 disables IPv6 overlay addressing
-	DisableIPv6 bool
 	// BlockInbound blocks all inbound connections from peers
 	BlockInbound bool
 	// WireguardPort is the port for the WireGuard interface. Use 0 for a random port.
@@ -172,7 +170,6 @@ func New(opts Options) (*Client, error) {
 		PreSharedKey:        &opts.PreSharedKey,
 		DisableServerRoutes: &t,
 		DisableClientRoutes: &opts.DisableClientRoutes,
-		DisableIPv6:         &opts.DisableIPv6,
 		BlockInbound:        &opts.BlockInbound,
 		WireguardPort:       opts.WireguardPort,
 		MTU:                 opts.MTU,

client/iface/device/device_darwin.go

@@ -131,32 +131,23 @@ func (t *TunDevice) Device() *device.Device {
 
 // assignAddr Adds IP address to the tunnel interface and network route based on the range provided
 func (t *TunDevice) assignAddr() error {
-	if out, err := exec.Command("ifconfig", t.name, "inet", t.address.IP.String(), t.address.IP.String()).CombinedOutput(); err != nil {
-		return fmt.Errorf("add v4 address: %s: %w", string(out), err)
+	cmd := exec.Command("ifconfig", t.name, "inet", t.address.IP.String(), t.address.IP.String())
+	if out, err := cmd.CombinedOutput(); err != nil {
+		log.Errorf("adding address command '%v' failed with output: %s", cmd.String(), out)
+		return err
 	}
 
-	// Assign a dummy link-local so macOS enables IPv6 on the tun device.
-	// When a real overlay v6 is present, use that instead.
-	v6Addr := "fe80::/64"
-	if t.address.HasIPv6() {
-		v6Addr = t.address.IPv6String()
-	}
-	if out, err := exec.Command("ifconfig", t.name, "inet6", v6Addr).CombinedOutput(); err != nil {
-		log.Warnf("failed to assign IPv6 address %s, continuing v4-only: %s: %v", v6Addr, string(out), err)
-		t.address.ClearIPv6()
+	// dummy ipv6 so routing works
+	cmd = exec.Command("ifconfig", t.name, "inet6", "fe80::/64")
+	if out, err := cmd.CombinedOutput(); err != nil {
+		log.Debugf("adding address command '%v' failed with output: %s", cmd.String(), out)
 	}
 
-	if out, err := exec.Command("route", "add", "-net", t.address.Network.String(), "-interface", t.name).CombinedOutput(); err != nil {
-		return fmt.Errorf("add route %s via %s: %s: %w", t.address.Network, t.name, string(out), err)
+	routeCmd := exec.Command("route", "add", "-net", t.address.Network.String(), "-interface", t.name)
+	if out, err := routeCmd.CombinedOutput(); err != nil {
+		log.Errorf("adding route command '%v' failed with output: %s", routeCmd.String(), out)
+		return err
 	}
-
-	if t.address.HasIPv6() {
-		if out, err := exec.Command("route", "add", "-inet6", "-net", t.address.IPv6Net.String(), "-interface", t.name).CombinedOutput(); err != nil {
-			log.Warnf("failed to add route %s via %s, continuing v4-only: %s: %v", t.address.IPv6Net, t.name, string(out), err)
-			t.address.ClearIPv6()
-		}
-	}
-
 	return nil
 }
 

client/iface/device/device_ios.go

@@ -151,11 +151,8 @@ func (t *TunDevice) MTU() uint16 {
 	return t.mtu
 }
 
-// UpdateAddr updates the device address. On iOS the tunnel is managed by the
-// NetworkExtension, so we only store the new value. The extension picks up the
-// change on the next tunnel reconfiguration.
-func (t *TunDevice) UpdateAddr(addr wgaddr.Address) error {
-	t.address = addr
+func (t *TunDevice) UpdateAddr(_ wgaddr.Address) error {
+	// todo implement
 	return nil
 }
 

client/iface/device/device_kernel_unix.go

@@ -173,7 +173,7 @@ func (t *TunKernelDevice) FilteredDevice() *FilteredDevice {
 
 // assignAddr Adds IP address to the tunnel interface
 func (t *TunKernelDevice) assignAddr() error {
-	return t.link.assignAddr(&t.address)
+	return t.link.assignAddr(t.address)
 }
 
 func (t *TunKernelDevice) GetNet() *netstack.Net {

client/iface/device/device_netstack.go

@@ -3,7 +3,6 @@ package device
 import (
 	"errors"
 	"fmt"
-	"net/netip"
 
 	log "github.com/sirupsen/logrus"
 	"golang.zx2c4.com/wireguard/conn"
@@ -64,12 +63,8 @@ func (t *TunNetstackDevice) create() (WGConfigurer, error) {
 		return nil, fmt.Errorf("last ip: %w", err)
 	}
 
-	addresses := []netip.Addr{t.address.IP}
-	if t.address.HasIPv6() {
-		addresses = append(addresses, t.address.IPv6)
-	}
-	log.Debugf("netstack using addresses: %v", addresses)
-	t.nsTun = nbnetstack.NewNetStackTun(t.listenAddress, addresses, dnsAddr, int(t.mtu))
+	log.Debugf("netstack using address: %s", t.address.IP)
+	t.nsTun = nbnetstack.NewNetStackTun(t.listenAddress, t.address.IP, dnsAddr, int(t.mtu))
 	log.Debugf("netstack using dns address: %s", dnsAddr)
 	tunIface, net, err := t.nsTun.Create()
 	if err != nil {

client/iface/device/device_usp_unix.go

@@ -16,7 +16,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
 
-type TunDevice struct {
+type USPDevice struct {
 	name    string
 	address wgaddr.Address
 	port    int
@@ -30,10 +30,10 @@ type TunDevice struct {
 	configurer     WGConfigurer
 }
 
-func NewTunDevice(name string, address wgaddr.Address, port int, key string, mtu uint16, iceBind *bind.ICEBind) *TunDevice {
+func NewUSPDevice(name string, address wgaddr.Address, port int, key string, mtu uint16, iceBind *bind.ICEBind) *USPDevice {
 	log.Infof("using userspace bind mode")
 
-	return &TunDevice{
+	return &USPDevice{
 		name:    name,
 		address: address,
 		port:    port,
@@ -43,7 +43,7 @@ func NewTunDevice(name string, address wgaddr.Address, port int, key string, mtu
 	}
 }
 
-func (t *TunDevice) Create() (WGConfigurer, error) {
+func (t *USPDevice) Create() (WGConfigurer, error) {
 	log.Info("create tun interface")
 	tunIface, err := tun.CreateTUN(t.name, int(t.mtu))
 	if err != nil {
@@ -75,7 +75,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 	return t.configurer, nil
 }
 
-func (t *TunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (t *USPDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
 	if t.device == nil {
 		return nil, fmt.Errorf("device is not ready yet")
 	}
@@ -95,12 +95,12 @@ func (t *TunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
 	return udpMux, nil
 }
 
-func (t *TunDevice) UpdateAddr(address wgaddr.Address) error {
+func (t *USPDevice) UpdateAddr(address wgaddr.Address) error {
 	t.address = address
 	return t.assignAddr()
 }
 
-func (t *TunDevice) Close() error {
+func (t *USPDevice) Close() error {
 	if t.configurer != nil {
 		t.configurer.Close()
 	}
@@ -115,39 +115,39 @@ func (t *TunDevice) Close() error {
 	return nil
 }
 
-func (t *TunDevice) WgAddress() wgaddr.Address {
+func (t *USPDevice) WgAddress() wgaddr.Address {
 	return t.address
 }
 
-func (t *TunDevice) MTU() uint16 {
+func (t *USPDevice) MTU() uint16 {
 	return t.mtu
 }
 
-func (t *TunDevice) DeviceName() string {
+func (t *USPDevice) DeviceName() string {
 	return t.name
 }
 
-func (t *TunDevice) FilteredDevice() *FilteredDevice {
+func (t *USPDevice) FilteredDevice() *FilteredDevice {
 	return t.filteredDevice
 }
 
 // Device returns the wireguard device
-func (t *TunDevice) Device() *device.Device {
+func (t *USPDevice) Device() *device.Device {
 	return t.device
 }
 
 // assignAddr Adds IP address to the tunnel interface
-func (t *TunDevice) assignAddr() error {
+func (t *USPDevice) assignAddr() error {
 	link := newWGLink(t.name)
 
-	return link.assignAddr(&t.address)
+	return link.assignAddr(t.address)
 }
 
-func (t *TunDevice) GetNet() *netstack.Net {
+func (t *USPDevice) GetNet() *netstack.Net {
 	return nil
 }
 
 // GetICEBind returns the ICEBind instance
-func (t *TunDevice) GetICEBind() EndpointManager {
+func (t *USPDevice) GetICEBind() EndpointManager {
 	return t.iceBind
 }

client/iface/device/device_windows.go

@@ -87,19 +87,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 	err = nbiface.Set()
 	if err != nil {
 		t.device.Close()
-		return nil, fmt.Errorf("set IPv4 interface MTU: %s", err)
-	}
-
-	if t.address.HasIPv6() {
-		nbiface6, err := luid.IPInterface(windows.AF_INET6)
-		if err != nil {
-			log.Warnf("failed to get IPv6 interface for MTU: %v", err)
-		} else {
-			nbiface6.NLMTU = uint32(t.mtu)
-			if err := nbiface6.Set(); err != nil {
-				log.Warnf("failed to set IPv6 interface MTU: %v", err)
-			}
-		}
+		return nil, fmt.Errorf("got error when getting setting the interface mtu: %s", err)
 	}
 	err = t.assignAddr()
 	if err != nil {
@@ -190,21 +178,8 @@ func (t *TunDevice) GetInterfaceGUIDString() (string, error) {
 // assignAddr Adds IP address to the tunnel interface and network route based on the range provided
 func (t *TunDevice) assignAddr() error {
 	luid := winipcfg.LUID(t.nativeTunDevice.LUID())
-
-	v4Prefix := t.address.Prefix()
-	if t.address.HasIPv6() {
-		v6Prefix := t.address.IPv6Prefix()
-		log.Debugf("adding addresses %s, %s to interface: %s", v4Prefix, v6Prefix, t.name)
-		if err := luid.SetIPAddresses([]netip.Prefix{v4Prefix, v6Prefix}); err != nil {
-			log.Warnf("failed to assign dual-stack addresses, retrying v4-only: %v", err)
-			t.address.ClearIPv6()
-			return luid.SetIPAddresses([]netip.Prefix{v4Prefix})
-		}
-		return nil
-	}
-
-	log.Debugf("adding address %s to interface: %s", v4Prefix, t.name)
-	return luid.SetIPAddresses([]netip.Prefix{v4Prefix})
+	log.Debugf("adding address %s to interface: %s", t.address.IP, t.name)
+	return luid.SetIPAddresses([]netip.Prefix{netip.MustParsePrefix(t.address.String())})
 }
 
 func (t *TunDevice) GetNet() *netstack.Net {

client/iface/device/kernel_module.go

@@ -0,0 +1,8 @@
+//go:build (!linux && !freebsd) || android
+
+package device
+
+// WireGuardModuleIsLoaded check if we can load WireGuard mod (linux only)
+func WireGuardModuleIsLoaded() bool {
+	return false
+}

client/iface/device/kernel_module_freebsd.go

@@ -0,0 +1,18 @@
+package device
+
+// WireGuardModuleIsLoaded check if kernel support wireguard
+func WireGuardModuleIsLoaded() bool {
+	// Despite the fact FreeBSD natively support Wireguard (https://github.com/WireGuard/wireguard-freebsd)
+	//  we are currently do not use it, since it is required to add wireguard kernel support to
+	//   - https://github.com/netbirdio/netbird/tree/main/sharedsock
+	//   - https://github.com/mdlayher/socket
+	// TODO: implement kernel space
+	return false
+}
+
+// ModuleTunIsLoaded check if tun module exist, if is not attempt to load it
+func ModuleTunIsLoaded() bool {
+	// Assume tun supported by freebsd kernel by default
+	// TODO: implement check for module loaded in kernel or build-it
+	return true
+}

client/iface/device/kernel_module_nonlinux.go

@@ -1,13 +0,0 @@
-//go:build !linux || android
-
-package device
-
-// WireGuardModuleIsLoaded reports whether the kernel WireGuard module is available.
-func WireGuardModuleIsLoaded() bool {
-	return false
-}
-
-// ModuleTunIsLoaded reports whether the tun device is available.
-func ModuleTunIsLoaded() bool {
-	return true
-}

client/iface/device/wg_link_freebsd.go

@@ -2,7 +2,6 @@ package device
 
 import (
 	"fmt"
-	"os/exec"
 
 	log "github.com/sirupsen/logrus"
 
@@ -58,32 +57,32 @@ func (l *wgLink) up() error {
 	return nil
 }
 
-func (l *wgLink) assignAddr(address *wgaddr.Address) error {
+func (l *wgLink) assignAddr(address wgaddr.Address) error {
 	link, err := freebsd.LinkByName(l.name)
 	if err != nil {
 		return fmt.Errorf("link by name: %w", err)
 	}
 
+	ip := address.IP.String()
+
+	// Convert prefix length to hex netmask
 	prefixLen := address.Network.Bits()
+	if !address.IP.Is4() {
+		return fmt.Errorf("IPv6 not supported for interface assignment")
+	}
+
 	maskBits := uint32(0xffffffff) << (32 - prefixLen)
 	mask := fmt.Sprintf("0x%08x", maskBits)
 
-	log.Infof("assign addr %s mask %s to %s interface", address.IP, mask, l.name)
+	log.Infof("assign addr %s mask %s to %s interface", ip, mask, l.name)
 
-	if err := link.AssignAddr(address.IP.String(), mask); err != nil {
+	err = link.AssignAddr(ip, mask)
+	if err != nil {
 		return fmt.Errorf("assign addr: %w", err)
 	}
 
-	if address.HasIPv6() {
-		log.Infof("assign IPv6 addr %s to %s interface", address.IPv6String(), l.name)
-		cmd := exec.Command("ifconfig", l.name, "inet6", address.IPv6String())
-		if out, err := cmd.CombinedOutput(); err != nil {
-			log.Warnf("failed to assign IPv6 address %s to %s, continuing v4-only: %s: %v", address.IPv6String(), l.name, string(out), err)
-			address.ClearIPv6()
-		}
-	}
-
-	if err := link.Up(); err != nil {
+	err = link.Up()
+	if err != nil {
 		return fmt.Errorf("up: %w", err)
 	}
 

client/iface/device/wg_link_linux.go

@@ -4,8 +4,6 @@ package device
 
 import (
 	"fmt"
-	"net"
-	"net/netip"
 	"os"
 
 	log "github.com/sirupsen/logrus"
@@ -94,7 +92,7 @@ func (l *wgLink) up() error {
 	return nil
 }
 
-func (l *wgLink) assignAddr(address *wgaddr.Address) error {
+func (l *wgLink) assignAddr(address wgaddr.Address) error {
 	//delete existing addresses
 	list, err := netlink.AddrList(l, 0)
 	if err != nil {
@@ -112,16 +110,20 @@ func (l *wgLink) assignAddr(address *wgaddr.Address) error {
 	}
 
 	name := l.attrs.Name
+	addrStr := address.String()
 
-	if err := l.addAddr(name, address.Prefix()); err != nil {
-		return err
+	log.Debugf("adding address %s to interface: %s", addrStr, name)
+
+	addr, err := netlink.ParseAddr(addrStr)
+	if err != nil {
+		return fmt.Errorf("parse addr: %w", err)
 	}
 
-	if address.HasIPv6() {
-		if err := l.addAddr(name, address.IPv6Prefix()); err != nil {
-			log.Warnf("failed to assign IPv6 address %s to %s, continuing v4-only: %v", address.IPv6Prefix(), name, err)
-			address.ClearIPv6()
-		}
+	err = netlink.AddrAdd(l, addr)
+	if os.IsExist(err) {
+		log.Infof("interface %s already has the address: %s", name, addrStr)
+	} else if err != nil {
+		return fmt.Errorf("add addr: %w", err)
 	}
 
 	// On linux, the link must be brought up
@@ -131,22 +133,3 @@ func (l *wgLink) assignAddr(address *wgaddr.Address) error {
 
 	return nil
 }
-
-func (l *wgLink) addAddr(ifaceName string, prefix netip.Prefix) error {
-	log.Debugf("adding address %s to interface: %s", prefix, ifaceName)
-
-	addr := &netlink.Addr{
-		IPNet: &net.IPNet{
-			IP:   prefix.Addr().AsSlice(),
-			Mask: net.CIDRMask(prefix.Bits(), prefix.Addr().BitLen()),
-		},
-	}
-
-	if err := netlink.AddrAdd(l, addr); os.IsExist(err) {
-		log.Infof("interface %s already has the address: %s", ifaceName, prefix)
-	} else if err != nil {
-		return fmt.Errorf("add addr %s: %w", prefix, err)
-	}
-
-	return nil
-}

client/iface/iface.go

@@ -57,7 +57,7 @@ type wgProxyFactory interface {
 
 type WGIFaceOpts struct {
 	IFaceName    string
-	Address      wgaddr.Address
+	Address      string
 	WGPort       int
 	WGPrivKey    string
 	MTU          uint16
@@ -141,11 +141,16 @@ func (w *WGIface) Up() (*udpmux.UniversalUDPMuxDefault, error) {
 }
 
 // UpdateAddr updates address of the interface
-func (w *WGIface) UpdateAddr(newAddr wgaddr.Address) error {
+func (w *WGIface) UpdateAddr(newAddr string) error {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 
-	return w.tun.UpdateAddr(newAddr)
+	addr, err := wgaddr.ParseWGAddress(newAddr)
+	if err != nil {
+		return err
+	}
+
+	return w.tun.UpdateAddr(addr)
 }
 
 // UpdatePeer updates existing Wireguard Peer or creates a new one if doesn't exist

client/iface/iface_new_android.go

@@ -4,17 +4,23 @@ import (
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 )
 
 // NewWGIFace Creates a new WireGuard interface instance
 func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
-	iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, opts.Address, opts.MTU)
+	wgAddress, err := wgaddr.ParseWGAddress(opts.Address)
+	if err != nil {
+		return nil, err
+	}
+
+	iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, wgAddress, opts.MTU)
 
 	if netstack.IsEnabled() {
 		wgIFace := &WGIface{
 			userspaceBind:  true,
-			tun:            device.NewNetstackDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, netstack.ListenAddr()),
+			tun:            device.NewNetstackDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, netstack.ListenAddr()),
 			wgProxyFactory: wgproxy.NewUSPFactory(iceBind, opts.MTU),
 		}
 		return wgIFace, nil
@@ -22,7 +28,7 @@ func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
 
 	wgIFace := &WGIface{
 		userspaceBind:  true,
-		tun:            device.NewTunDevice(opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, opts.MobileArgs.TunAdapter, opts.DisableDNS),
+		tun:            device.NewTunDevice(wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, opts.MobileArgs.TunAdapter, opts.DisableDNS),
 		wgProxyFactory: wgproxy.NewUSPFactory(iceBind, opts.MTU),
 	}
 	return wgIFace, nil

client/iface/iface_new_darwin.go

@@ -0,0 +1,35 @@
+//go:build !ios
+
+package iface
+
+import (
+	"github.com/netbirdio/netbird/client/iface/bind"
+	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgproxy"
+)
+
+// NewWGIFace Creates a new WireGuard interface instance
+func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
+	wgAddress, err := wgaddr.ParseWGAddress(opts.Address)
+	if err != nil {
+		return nil, err
+	}
+
+	iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, wgAddress, opts.MTU)
+
+	var tun WGTunDevice
+	if netstack.IsEnabled() {
+		tun = device.NewNetstackDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, netstack.ListenAddr())
+	} else {
+		tun = device.NewTunDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind)
+	}
+
+	wgIFace := &WGIface{
+		userspaceBind:  true,
+		tun:            tun,
+		wgProxyFactory: wgproxy.NewUSPFactory(iceBind, opts.MTU),
+	}
+	return wgIFace, nil
+}

client/iface/iface_new_freebsd.go

@@ -0,0 +1,41 @@
+//go:build freebsd
+
+package iface
+
+import (
+	"fmt"
+
+	"github.com/netbirdio/netbird/client/iface/bind"
+	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
+	"github.com/netbirdio/netbird/client/iface/wgproxy"
+)
+
+// NewWGIFace Creates a new WireGuard interface instance
+func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
+	wgAddress, err := wgaddr.ParseWGAddress(opts.Address)
+	if err != nil {
+		return nil, err
+	}
+
+	wgIFace := &WGIface{}
+
+	if netstack.IsEnabled() {
+		iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, wgAddress, opts.MTU)
+		wgIFace.tun = device.NewNetstackDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, netstack.ListenAddr())
+		wgIFace.userspaceBind = true
+		wgIFace.wgProxyFactory = wgproxy.NewUSPFactory(iceBind, opts.MTU)
+		return wgIFace, nil
+	}
+
+	if device.ModuleTunIsLoaded() {
+		iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, wgAddress, opts.MTU)
+		wgIFace.tun = device.NewUSPDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind)
+		wgIFace.userspaceBind = true
+		wgIFace.wgProxyFactory = wgproxy.NewUSPFactory(iceBind, opts.MTU)
+		return wgIFace, nil
+	}
+
+	return nil, fmt.Errorf("couldn't check or load tun module")
+}

client/iface/iface_new_ios.go

@@ -5,15 +5,21 @@ package iface
 import (
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 )
 
 // NewWGIFace Creates a new WireGuard interface instance
 func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
-	iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, opts.Address, opts.MTU)
+	wgAddress, err := wgaddr.ParseWGAddress(opts.Address)
+	if err != nil {
+		return nil, err
+	}
+
+	iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, wgAddress, opts.MTU)
 
 	wgIFace := &WGIface{
-		tun:            device.NewTunDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, opts.MobileArgs.TunFd),
+		tun:            device.NewTunDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, opts.MobileArgs.TunFd),
 		userspaceBind:  true,
 		wgProxyFactory: wgproxy.NewUSPFactory(iceBind, opts.MTU),
 	}

client/iface/iface_new_js.go

@@ -4,15 +4,21 @@ import (
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 )
 
 // NewWGIFace creates a new WireGuard interface for WASM (always uses netstack mode)
 func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
+	wgAddress, err := wgaddr.ParseWGAddress(opts.Address)
+	if err != nil {
+		return nil, err
+	}
+
 	relayBind := bind.NewRelayBindJS()
 
 	wgIface := &WGIface{
-		tun:            device.NewNetstackDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, relayBind, netstack.ListenAddr()),
+		tun:            device.NewNetstackDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, relayBind, netstack.ListenAddr()),
 		userspaceBind:  true,
 		wgProxyFactory: wgproxy.NewUSPFactory(relayBind, opts.MTU),
 	}

client/iface/iface_new_linux.go

@@ -3,40 +3,44 @@
 package iface
 
 import (
-	"errors"
+	"fmt"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
+	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 )
 
 // NewWGIFace Creates a new WireGuard interface instance
 func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
+	wgAddress, err := wgaddr.ParseWGAddress(opts.Address)
+	if err != nil {
+		return nil, err
+	}
+
+	wgIFace := &WGIface{}
+
 	if netstack.IsEnabled() {
-		iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, opts.Address, opts.MTU)
-		return &WGIface{
-			tun:            device.NewNetstackDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, netstack.ListenAddr()),
-			userspaceBind:  true,
-			wgProxyFactory: wgproxy.NewUSPFactory(iceBind, opts.MTU),
-		}, nil
+		iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, wgAddress, opts.MTU)
+		wgIFace.tun = device.NewNetstackDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, netstack.ListenAddr())
+		wgIFace.userspaceBind = true
+		wgIFace.wgProxyFactory = wgproxy.NewUSPFactory(iceBind, opts.MTU)
+		return wgIFace, nil
 	}
 
 	if device.WireGuardModuleIsLoaded() {
-		return &WGIface{
-			tun:            device.NewKernelDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, opts.TransportNet),
-			wgProxyFactory: wgproxy.NewKernelFactory(opts.WGPort, opts.MTU),
-		}, nil
+		wgIFace.tun = device.NewKernelDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, opts.TransportNet)
+		wgIFace.wgProxyFactory = wgproxy.NewKernelFactory(opts.WGPort, opts.MTU)
+		return wgIFace, nil
 	}
-
 	if device.ModuleTunIsLoaded() {
-		iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, opts.Address, opts.MTU)
-		return &WGIface{
-			tun:            device.NewTunDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind),
-			userspaceBind:  true,
-			wgProxyFactory: wgproxy.NewUSPFactory(iceBind, opts.MTU),
-		}, nil
+		iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, wgAddress, opts.MTU)
+		wgIFace.tun = device.NewUSPDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind)
+		wgIFace.userspaceBind = true
+		wgIFace.wgProxyFactory = wgproxy.NewUSPFactory(iceBind, opts.MTU)
+		return wgIFace, nil
 	}
 
-	return nil, errors.New("tun module not available")
+	return nil, fmt.Errorf("couldn't check or load tun module")
 }

client/iface/iface_new_windows.go

@@ -1,28 +1,33 @@
-//go:build !linux && !ios && !android && !js
-
 package iface
 
 import (
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
+	wgaddr "github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 )
 
 // NewWGIFace Creates a new WireGuard interface instance
 func NewWGIFace(opts WGIFaceOpts) (*WGIface, error) {
-	iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, opts.Address, opts.MTU)
+	wgAddress, err := wgaddr.ParseWGAddress(opts.Address)
+	if err != nil {
+		return nil, err
+	}
+	iceBind := bind.NewICEBind(opts.TransportNet, opts.FilterFn, wgAddress, opts.MTU)
 
 	var tun WGTunDevice
 	if netstack.IsEnabled() {
-		tun = device.NewNetstackDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, netstack.ListenAddr())
+		tun = device.NewNetstackDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind, netstack.ListenAddr())
 	} else {
-		tun = device.NewTunDevice(opts.IFaceName, opts.Address, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind)
+		tun = device.NewTunDevice(opts.IFaceName, wgAddress, opts.WGPort, opts.WGPrivKey, opts.MTU, iceBind)
 	}
 
-	return &WGIface{
+	wgIFace := &WGIface{
 		userspaceBind:  true,
 		tun:            tun,
 		wgProxyFactory: wgproxy.NewUSPFactory(iceBind, opts.MTU),
-	}, nil
+	}
+	return wgIFace, nil
+
 }

client/iface/iface_test.go

@@ -16,7 +16,6 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 )
 
@@ -49,7 +48,7 @@ func TestWGIface_UpdateAddr(t *testing.T) {
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
-		Address:      wgaddr.MustParseWGAddress(addr),
+		Address:      addr,
 		WGPort:       wgPort,
 		WGPrivKey:    key,
 		MTU:          DefaultMTU,
@@ -85,7 +84,7 @@ func TestWGIface_UpdateAddr(t *testing.T) {
 
 	//update WireGuard address
 	addr = "100.64.0.2/8"
-	err = iface.UpdateAddr(wgaddr.MustParseWGAddress(addr))
+	err = iface.UpdateAddr(addr)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -131,7 +130,7 @@ func Test_CreateInterface(t *testing.T) {
 	}
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
-		Address:      wgaddr.MustParseWGAddress(wgIP),
+		Address:      wgIP,
 		WGPort:       33100,
 		WGPrivKey:    key,
 		MTU:          DefaultMTU,
@@ -175,7 +174,7 @@ func Test_Close(t *testing.T) {
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
-		Address:      wgaddr.MustParseWGAddress(wgIP),
+		Address:      wgIP,
 		WGPort:       wgPort,
 		WGPrivKey:    key,
 		MTU:          DefaultMTU,
@@ -220,7 +219,7 @@ func TestRecreation(t *testing.T) {
 
 			opts := WGIFaceOpts{
 				IFaceName:    ifaceName,
-				Address:      wgaddr.MustParseWGAddress(wgIP),
+				Address:      wgIP,
 				WGPort:       wgPort,
 				WGPrivKey:    key,
 				MTU:          DefaultMTU,
@@ -292,7 +291,7 @@ func Test_ConfigureInterface(t *testing.T) {
 	}
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
-		Address:      wgaddr.MustParseWGAddress(wgIP),
+		Address:      wgIP,
 		WGPort:       wgPort,
 		WGPrivKey:    key,
 		MTU:          DefaultMTU,
@@ -348,7 +347,7 @@ func Test_UpdatePeer(t *testing.T) {
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
-		Address:      wgaddr.MustParseWGAddress(wgIP),
+		Address:      wgIP,
 		WGPort:       33100,
 		WGPrivKey:    key,
 		MTU:          DefaultMTU,
@@ -418,7 +417,7 @@ func Test_RemovePeer(t *testing.T) {
 
 	opts := WGIFaceOpts{
 		IFaceName:    ifaceName,
-		Address:      wgaddr.MustParseWGAddress(wgIP),
+		Address:      wgIP,
 		WGPort:       33100,
 		WGPrivKey:    key,
 		MTU:          DefaultMTU,
@@ -483,7 +482,7 @@ func Test_ConnectPeers(t *testing.T) {
 
 	optsPeer1 := WGIFaceOpts{
 		IFaceName:    peer1ifaceName,
-		Address:      wgaddr.MustParseWGAddress(peer1wgIP.String()),
+		Address:      peer1wgIP.String(),
 		WGPort:       peer1wgPort,
 		WGPrivKey:    peer1Key.String(),
 		MTU:          DefaultMTU,
@@ -523,7 +522,7 @@ func Test_ConnectPeers(t *testing.T) {
 
 	optsPeer2 := WGIFaceOpts{
 		IFaceName:    peer2ifaceName,
-		Address:      wgaddr.MustParseWGAddress(peer2wgIP.String()),
+		Address:      peer2wgIP.String(),
 		WGPort:       peer2wgPort,
 		WGPrivKey:    peer2Key.String(),
 		MTU:          DefaultMTU,

client/iface/netstack/tun.go

@@ -13,7 +13,7 @@ import (
 const EnvSkipProxy = "NB_NETSTACK_SKIP_PROXY"
 
 type NetStackTun struct { //nolint:revive
-	addresses     []netip.Addr
+	address       netip.Addr
 	dnsAddress    netip.Addr
 	mtu           int
 	listenAddress string
@@ -22,9 +22,9 @@ type NetStackTun struct { //nolint:revive
 	tundev tun.Device
 }
 
-func NewNetStackTun(listenAddress string, addresses []netip.Addr, dnsAddress netip.Addr, mtu int) *NetStackTun {
+func NewNetStackTun(listenAddress string, address netip.Addr, dnsAddress netip.Addr, mtu int) *NetStackTun {
 	return &NetStackTun{
-		addresses:     addresses,
+		address:       address,
 		dnsAddress:    dnsAddress,
 		mtu:           mtu,
 		listenAddress: listenAddress,
@@ -33,7 +33,7 @@ func NewNetStackTun(listenAddress string, addresses []netip.Addr, dnsAddress net
 
 func (t *NetStackTun) Create() (tun.Device, *netstack.Net, error) {
 	nsTunDev, tunNet, err := netstack.CreateNetTUN(
-		t.addresses,
+		[]netip.Addr{t.address},
 		[]netip.Addr{t.dnsAddress},
 		t.mtu)
 	if err != nil {

client/iface/wgaddr/address.go

@@ -3,18 +3,12 @@ package wgaddr
 import (
 	"fmt"
 	"net/netip"
-
-	"github.com/netbirdio/netbird/shared/netiputil"
 )
 
 // Address WireGuard parsed address
 type Address struct {
 	IP      netip.Addr
 	Network netip.Prefix
-
-	// IPv6 overlay address, if assigned.
-	IPv6    netip.Addr
-	IPv6Net netip.Prefix
 }
 
 // ParseWGAddress parse a string ("1.2.3.4/24") address to WG Address
@@ -29,60 +23,6 @@ func ParseWGAddress(address string) (Address, error) {
 	}, nil
 }
 
-// HasIPv6 reports whether a v6 overlay address is assigned.
-func (addr Address) HasIPv6() bool {
-	return addr.IPv6.IsValid()
-}
-
 func (addr Address) String() string {
-	return addr.Prefix().String()
-}
-
-// IPv6String returns the v6 address in CIDR notation, or empty string if none.
-func (addr Address) IPv6String() string {
-	if !addr.HasIPv6() {
-		return ""
-	}
-	return addr.IPv6Prefix().String()
-}
-
-// Prefix returns the v4 host address with its network prefix length (e.g. 100.64.0.1/16).
-func (addr Address) Prefix() netip.Prefix {
-	return netip.PrefixFrom(addr.IP, addr.Network.Bits())
-}
-
-// IPv6Prefix returns the v6 host address with its network prefix length, or a zero prefix if none.
-func (addr Address) IPv6Prefix() netip.Prefix {
-	if !addr.HasIPv6() {
-		return netip.Prefix{}
-	}
-	return netip.PrefixFrom(addr.IPv6, addr.IPv6Net.Bits())
-}
-
-// SetIPv6FromCompact decodes a compact prefix (5 or 17 bytes) and sets the IPv6 fields.
-// Returns an error if the bytes are invalid. A nil or empty input is a no-op.
-//
-//nolint:recvcheck
-func (addr *Address) SetIPv6FromCompact(raw []byte) error {
-	if len(raw) == 0 {
-		return nil
-	}
-	prefix, err := netiputil.DecodePrefix(raw)
-	if err != nil {
-		return fmt.Errorf("decode v6 overlay address: %w", err)
-	}
-	if !prefix.Addr().Is6() {
-		return fmt.Errorf("expected IPv6 address, got %s", prefix.Addr())
-	}
-	addr.IPv6 = prefix.Addr()
-	addr.IPv6Net = prefix.Masked()
-	return nil
-}
-
-// ClearIPv6 removes the IPv6 overlay address, leaving only v4.
-//
-//nolint:recvcheck
-func (addr *Address) ClearIPv6() {
-	addr.IPv6 = netip.Addr{}
-	addr.IPv6Net = netip.Prefix{}
+	return fmt.Sprintf("%s/%d", addr.IP.String(), addr.Network.Bits())
 }

client/iface/wgaddr/address_test_helpers.go

@@ -1,10 +0,0 @@
-package wgaddr
-
-// MustParseWGAddress parses and returns a WG Address, panicking on error.
-func MustParseWGAddress(address string) Address {
-	a, err := ParseWGAddress(address)
-	if err != nil {
-		panic(err)
-	}
-	return a
-}

client/internal/acl/manager.go

@@ -216,7 +216,6 @@ func (d *DefaultManager) protoRuleToFirewallRule(
 	r *mgmProto.FirewallRule,
 	ipsetName string,
 ) (id.RuleID, []firewall.Rule, error) {
-	//nolint:staticcheck // PeerIP used for backward compatibility with old management
 	ip := net.ParseIP(r.PeerIP)
 	if ip == nil {
 		return "", nil, fmt.Errorf("invalid IP address, skipping firewall rule")

client/internal/auth/auth.go

@@ -345,7 +345,6 @@ func (a *Auth) setSystemInfoFlags(info *system.Info) {
 		a.config.DisableFirewall,
 		a.config.BlockLANAccess,
 		a.config.BlockInbound,
-		a.config.DisableIPv6,
 		a.config.LazyConnectionEnabled,
 		a.config.EnableSSHRoot,
 		a.config.EnableSSHSFTP,

client/internal/connect.go

@@ -14,13 +14,10 @@ import (
 
 	"github.com/cenkalti/backoff/v4"
 	log "github.com/sirupsen/logrus"
-
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 	"google.golang.org/grpc/codes"
 	gstatus "google.golang.org/grpc/status"
 
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
-
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/iface/device"
 	"github.com/netbirdio/netbird/client/iface/netstack"
@@ -523,20 +520,9 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 	if config.NetworkMonitor != nil {
 		nm = *config.NetworkMonitor
 	}
-	wgAddr, err := wgaddr.ParseWGAddress(peerConfig.Address)
-	if err != nil {
-		return nil, fmt.Errorf("parse overlay address %q: %w", peerConfig.Address, err)
-	}
-
-	if !config.DisableIPv6 {
-		if err := wgAddr.SetIPv6FromCompact(peerConfig.GetAddressV6()); err != nil {
-			log.Warn(err)
-		}
-	}
-
 	engineConf := &EngineConfig{
 		WgIfaceName:                   config.WgIface,
-		WgAddr:                        wgAddr,
+		WgAddr:                        peerConfig.Address,
 		IFaceBlackList:                config.IFaceBlackList,
 		DisableIPv6Discovery:          config.DisableIPv6Discovery,
 		WgPrivateKey:                  key,
@@ -561,7 +547,6 @@ func createEngineConfig(key wgtypes.Key, config *profilemanager.Config, peerConf
 		DisableFirewall:     config.DisableFirewall,
 		BlockLANAccess:      config.BlockLANAccess,
 		BlockInbound:        config.BlockInbound,
-		DisableIPv6:         config.DisableIPv6,
 
 		LazyConnectionEnabled: config.LazyConnectionEnabled,
 
@@ -642,7 +627,6 @@ func loginToManagement(ctx context.Context, client mgm.Client, pubSSHKey []byte,
 		config.DisableFirewall,
 		config.BlockLANAccess,
 		config.BlockInbound,
-		config.DisableIPv6,
 		config.LazyConnectionEnabled,
 		config.EnableSSHRoot,
 		config.EnableSSHSFTP,

client/internal/debug/debug.go

@@ -522,7 +522,6 @@ func (g *BundleGenerator) addCommonConfigFields(configContent *strings.Builder)
 	configContent.WriteString(fmt.Sprintf("DisableFirewall: %v\n", g.internalConfig.DisableFirewall))
 	configContent.WriteString(fmt.Sprintf("BlockLANAccess: %v\n", g.internalConfig.BlockLANAccess))
 	configContent.WriteString(fmt.Sprintf("BlockInbound: %v\n", g.internalConfig.BlockInbound))
-	configContent.WriteString(fmt.Sprintf("DisableIPv6: %v\n", g.internalConfig.DisableIPv6))
 
 	if g.internalConfig.DisableNotifications != nil {
 		configContent.WriteString(fmt.Sprintf("DisableNotifications: %v\n", *g.internalConfig.DisableNotifications))
@@ -1271,9 +1270,8 @@ func anonymizeFirewallRule(rule *mgmProto.FirewallRule, anonymizer *anonymize.An
 		return
 	}
 
-	//nolint:staticcheck // PeerIP used for backward compatibility
 	if addr, err := netip.ParseAddr(rule.PeerIP); err == nil {
-		rule.PeerIP = anonymizer.AnonymizeIP(addr).String() //nolint:staticcheck
+		rule.PeerIP = anonymizer.AnonymizeIP(addr).String()
 	}
 }
 

client/internal/dns.go

@@ -12,83 +12,52 @@ import (
 	nbdns "github.com/netbirdio/netbird/dns"
 )
 
-func createPTRRecord(record nbdns.SimpleRecord, prefix netip.Prefix) (nbdns.SimpleRecord, bool) {
-	ip, err := netip.ParseAddr(record.RData)
+func createPTRRecord(aRecord nbdns.SimpleRecord, prefix netip.Prefix) (nbdns.SimpleRecord, bool) {
+	ip, err := netip.ParseAddr(aRecord.RData)
 	if err != nil {
-		log.Warnf("failed to parse IP address %s: %v", record.RData, err)
+		log.Warnf("failed to parse IP address %s: %v", aRecord.RData, err)
 		return nbdns.SimpleRecord{}, false
 	}
 
-	ip = ip.Unmap()
 	if !prefix.Contains(ip) {
 		return nbdns.SimpleRecord{}, false
 	}
 
-	var rdnsName string
-	if ip.Is4() {
-		octets := strings.Split(ip.String(), ".")
-		slices.Reverse(octets)
-		rdnsName = dns.Fqdn(strings.Join(octets, ".") + ".in-addr.arpa")
-	} else {
-		// Expand to full 32 nibbles in reverse order (LSB first) per RFC 3596.
-		raw := ip.As16()
-		nibbles := make([]string, 32)
-		for i := 0; i < 16; i++ {
-			nibbles[31-i*2] = fmt.Sprintf("%x", raw[i]>>4)
-			nibbles[31-i*2-1] = fmt.Sprintf("%x", raw[i]&0x0f)
-		}
-		rdnsName = dns.Fqdn(strings.Join(nibbles, ".") + ".ip6.arpa")
-	}
+	ipOctets := strings.Split(ip.String(), ".")
+	slices.Reverse(ipOctets)
+	rdnsName := dns.Fqdn(strings.Join(ipOctets, ".") + ".in-addr.arpa")
 
 	return nbdns.SimpleRecord{
 		Name:  rdnsName,
 		Type:  int(dns.TypePTR),
-		Class: record.Class,
-		TTL:   record.TTL,
-		RData: dns.Fqdn(record.Name),
+		Class: aRecord.Class,
+		TTL:   aRecord.TTL,
+		RData: dns.Fqdn(aRecord.Name),
 	}, true
 }
 
-// generateReverseZoneName creates the reverse DNS zone name for a given network.
-// For IPv4 it produces an in-addr.arpa name, for IPv6 an ip6.arpa name.
+// generateReverseZoneName creates the reverse DNS zone name for a given network
 func generateReverseZoneName(network netip.Prefix) (string, error) {
-	networkIP := network.Masked().Addr().Unmap()
-	bits := network.Bits()
+	networkIP := network.Masked().Addr()
 
-	if networkIP.Is4() {
-		// Round up to nearest byte.
-		octetsToUse := (bits + 7) / 8
-
-		octets := strings.Split(networkIP.String(), ".")
-		if octetsToUse > len(octets) {
-			return "", fmt.Errorf("invalid network mask size for reverse DNS: %d", bits)
-		}
-
-		reverseOctets := make([]string, octetsToUse)
-		for i := 0; i < octetsToUse; i++ {
-			reverseOctets[octetsToUse-1-i] = octets[i]
-		}
-
-		return dns.Fqdn(strings.Join(reverseOctets, ".") + ".in-addr.arpa"), nil
+	if !networkIP.Is4() {
+		return "", fmt.Errorf("reverse DNS is only supported for IPv4 networks, got: %s", networkIP)
 	}
 
-	// IPv6: round up to nearest nibble (4-bit boundary).
-	nibblesToUse := (bits + 3) / 4
+	// round up to nearest byte
+	octetsToUse := (network.Bits() + 7) / 8
 
-	raw := networkIP.As16()
-	allNibbles := make([]string, 32)
-	for i := 0; i < 16; i++ {
-		allNibbles[i*2] = fmt.Sprintf("%x", raw[i]>>4)
-		allNibbles[i*2+1] = fmt.Sprintf("%x", raw[i]&0x0f)
+	octets := strings.Split(networkIP.String(), ".")
+	if octetsToUse > len(octets) {
+		return "", fmt.Errorf("invalid network mask size for reverse DNS: %d", network.Bits())
 	}
 
-	// Take the first nibblesToUse nibbles (network portion), reverse them.
-	used := make([]string, nibblesToUse)
-	for i := 0; i < nibblesToUse; i++ {
-		used[nibblesToUse-1-i] = allNibbles[i]
+	reverseOctets := make([]string, octetsToUse)
+	for i := 0; i < octetsToUse; i++ {
+		reverseOctets[octetsToUse-1-i] = octets[i]
 	}
 
-	return dns.Fqdn(strings.Join(used, ".") + ".ip6.arpa"), nil
+	return dns.Fqdn(strings.Join(reverseOctets, ".") + ".in-addr.arpa"), nil
 }
 
 // zoneExists checks if a zone with the given name already exists in the configuration
@@ -102,7 +71,7 @@ func zoneExists(config *nbdns.Config, zoneName string) bool {
 	return false
 }
 
-// collectPTRRecords gathers all PTR records for the given network from A and AAAA records.
+// collectPTRRecords gathers all PTR records for the given network from A records
 func collectPTRRecords(config *nbdns.Config, prefix netip.Prefix) []nbdns.SimpleRecord {
 	var records []nbdns.SimpleRecord
 
@@ -111,7 +80,7 @@ func collectPTRRecords(config *nbdns.Config, prefix netip.Prefix) []nbdns.Simple
 			continue
 		}
 		for _, record := range zone.Records {
-			if record.Type != int(dns.TypeA) && record.Type != int(dns.TypeAAAA) {
+			if record.Type != int(dns.TypeA) {
 				continue
 			}
 

client/internal/dns/host_darwin.go

@@ -298,7 +298,6 @@ func (s *systemConfigurator) getSystemDNSSettings() (SystemDNSSettings, error) {
 			if ip, err := netip.ParseAddr(address); err == nil && !ip.IsUnspecified() {
 				ip = ip.Unmap()
 				serverAddresses = append(serverAddresses, ip)
-				// Prefer the first IPv4 server as ServerIP since our DNS listener is IPv4.
 				if !dnsSettings.ServerIP.IsValid() && ip.Is4() {
 					dnsSettings.ServerIP = ip
 				}

client/internal/dns/mock_server.go

@@ -85,11 +85,6 @@ func (m *MockServer) PopulateManagementDomain(mgmtURL *url.URL) error {
 	return nil
 }
 
-// SetRouteChecker mock implementation of SetRouteChecker from Server interface
-func (m *MockServer) SetRouteChecker(func(netip.Addr) bool) {
-	// Mock implementation - no-op
-}
-
 // BeginBatch mock implementation of BeginBatch from Server interface
 func (m *MockServer) BeginBatch() {
 	// Mock implementation - no-op

client/internal/dns/network_manager_unix.go

@@ -110,15 +110,8 @@ func (n *networkManagerDbusConfigurator) applyDNSConfig(config HostDNSConfig, st
 
 	connSettings.cleanDeprecatedSettings()
 
-	ipKey := networkManagerDbusIPv4Key
-	if config.ServerIP.Is6() {
-		ipKey = networkManagerDbusIPv6Key
-		raw := config.ServerIP.As16()
-		connSettings[ipKey][networkManagerDbusDNSKey] = dbus.MakeVariant([][]byte{raw[:]})
-	} else {
-		convDNSIP := binary.LittleEndian.Uint32(config.ServerIP.AsSlice())
-		connSettings[ipKey][networkManagerDbusDNSKey] = dbus.MakeVariant([]uint32{convDNSIP})
-	}
+	convDNSIP := binary.LittleEndian.Uint32(config.ServerIP.AsSlice())
+	connSettings[networkManagerDbusIPv4Key][networkManagerDbusDNSKey] = dbus.MakeVariant([]uint32{convDNSIP})
 	var (
 		searchDomains []string
 		matchDomains  []string
@@ -153,8 +146,8 @@ func (n *networkManagerDbusConfigurator) applyDNSConfig(config HostDNSConfig, st
 		n.routingAll = false
 	}
 
-	connSettings[ipKey][networkManagerDbusDNSPriorityKey] = dbus.MakeVariant(priority)
-	connSettings[ipKey][networkManagerDbusDNSSearchKey] = dbus.MakeVariant(newDomainList)
+	connSettings[networkManagerDbusIPv4Key][networkManagerDbusDNSPriorityKey] = dbus.MakeVariant(priority)
+	connSettings[networkManagerDbusIPv4Key][networkManagerDbusDNSSearchKey] = dbus.MakeVariant(newDomainList)
 
 	state := &ShutdownState{
 		ManagerType: networkManager,

client/internal/dns/server.go

@@ -57,7 +57,6 @@ type Server interface {
 	ProbeAvailability()
 	UpdateServerConfig(domains dnsconfig.ServerDomains) error
 	PopulateManagementDomain(mgmtURL *url.URL) error
-	SetRouteChecker(func(netip.Addr) bool)
 }
 
 type nsGroupsByDomain struct {
@@ -105,7 +104,6 @@ type DefaultServer struct {
 
 	statusRecorder *peer.Status
 	stateManager   *statemanager.Manager
-	routeMatch     func(netip.Addr) bool
 
 	probeMu     sync.Mutex
 	probeCancel context.CancelFunc
@@ -231,14 +229,6 @@ func newDefaultServer(
 	return defaultServer
 }
 
-// SetRouteChecker sets the function used by upstream resolvers to determine
-// whether an IP is routed through the tunnel.
-func (s *DefaultServer) SetRouteChecker(f func(netip.Addr) bool) {
-	s.mux.Lock()
-	defer s.mux.Unlock()
-	s.routeMatch = f
-}
-
 // RegisterHandler registers a handler for the given domains with the given priority.
 // Any previously registered handler for the same domain and priority will be replaced.
 func (s *DefaultServer) RegisterHandler(domains domain.List, handler dns.Handler, priority int) {
@@ -753,7 +743,6 @@ func (s *DefaultServer) registerFallback(config HostDNSConfig) {
 		log.Errorf("failed to create upstream resolver for original nameservers: %v", err)
 		return
 	}
-	handler.routeMatch = s.routeMatch
 
 	for _, ns := range originalNameservers {
 		if ns == config.ServerIP {
@@ -863,7 +852,6 @@ func (s *DefaultServer) createHandlersForDomainGroup(domainGroup nsGroupsByDomai
 		if err != nil {
 			return nil, fmt.Errorf("create upstream resolver: %v", err)
 		}
-		handler.routeMatch = s.routeMatch
 
 		for _, ns := range nsGroup.NameServers {
 			if ns.NSType != nbdns.UDPNameServerType {
@@ -1048,7 +1036,6 @@ func (s *DefaultServer) addHostRootZone() {
 		log.Errorf("unable to create a new upstream resolver, error: %v", err)
 		return
 	}
-	handler.routeMatch = s.routeMatch
 
 	handler.upstreamServers = maps.Keys(hostDNSServers)
 	handler.deactivate = func(error) {}

client/internal/dns/server_test.go

@@ -347,7 +347,7 @@ func TestUpdateDNSServer(t *testing.T) {
 
 			opts := iface.WGIFaceOpts{
 				IFaceName:    fmt.Sprintf("utun230%d", n),
-				Address:      wgaddr.MustParseWGAddress(fmt.Sprintf("100.66.100.%d/32", n+1)),
+				Address:      fmt.Sprintf("100.66.100.%d/32", n+1),
 				WGPort:       33100,
 				WGPrivKey:    privKey.String(),
 				MTU:          iface.DefaultMTU,
@@ -448,7 +448,7 @@ func TestDNSFakeResolverHandleUpdates(t *testing.T) {
 	privKey, _ := wgtypes.GeneratePrivateKey()
 	opts := iface.WGIFaceOpts{
 		IFaceName:    "utun2301",
-		Address:      wgaddr.MustParseWGAddress("100.66.100.1/32"),
+		Address:      "100.66.100.1/32",
 		WGPort:       33100,
 		WGPrivKey:    privKey.String(),
 		MTU:          iface.DefaultMTU,
@@ -929,7 +929,7 @@ func createWgInterfaceWithBind(t *testing.T) (*iface.WGIface, error) {
 
 	opts := iface.WGIFaceOpts{
 		IFaceName:    "utun2301",
-		Address:      wgaddr.MustParseWGAddress("100.66.100.2/24"),
+		Address:      "100.66.100.2/24",
 		WGPort:       33100,
 		WGPrivKey:    privKey.String(),
 		MTU:          iface.DefaultMTU,

client/internal/dns/systemd_linux.go

@@ -90,12 +90,8 @@ func (s *systemdDbusConfigurator) supportCustomPort() bool {
 }
 
 func (s *systemdDbusConfigurator) applyDNSConfig(config HostDNSConfig, stateManager *statemanager.Manager) error {
-	family := int32(unix.AF_INET)
-	if config.ServerIP.Is6() {
-		family = unix.AF_INET6
-	}
 	defaultLinkInput := systemdDbusDNSInput{
-		Family:  family,
+		Family:  unix.AF_INET,
 		Address: config.ServerIP.AsSlice(),
 	}
 	if err := s.callLinkMethod(systemdDbusSetDNSMethodSuffix, []systemdDbusDNSInput{defaultLinkInput}); err != nil {

client/internal/dns/upstream.go

@@ -70,7 +70,6 @@ type upstreamResolverBase struct {
 	deactivate     func(error)
 	reactivate     func()
 	statusRecorder *peer.Status
-	routeMatch     func(netip.Addr) bool
 }
 
 type upstreamFailure struct {

client/internal/dns/upstream_ios.go

@@ -21,8 +21,6 @@ type upstreamResolverIOS struct {
 	*upstreamResolverBase
 	lIP           netip.Addr
 	lNet          netip.Prefix
-	lIPv6         netip.Addr
-	lNetV6        netip.Prefix
 	interfaceName string
 }
 
@@ -39,8 +37,6 @@ func newUpstreamResolver(
 		upstreamResolverBase: upstreamResolverBase,
 		lIP:                  wgIface.Address().IP,
 		lNet:                 wgIface.Address().Network,
-		lIPv6:                wgIface.Address().IPv6,
-		lNetV6:               wgIface.Address().IPv6Net,
 		interfaceName:        wgIface.Name(),
 	}
 	ios.upstreamClient = ios
@@ -69,24 +65,11 @@ func (u *upstreamResolverIOS) exchange(ctx context.Context, upstream string, r *
 	} else {
 		upstreamIP = upstreamIP.Unmap()
 	}
-	needsPrivate := u.lNet.Contains(upstreamIP) ||
-		u.lNetV6.Contains(upstreamIP) ||
-		(u.routeMatch != nil && u.routeMatch(upstreamIP))
-	if needsPrivate {
-		var bindIP netip.Addr
-		switch {
-		case upstreamIP.Is6() && u.lIPv6.IsValid():
-			bindIP = u.lIPv6
-		case upstreamIP.Is4() && u.lIP.IsValid():
-			bindIP = u.lIP
-		}
-
-		if bindIP.IsValid() {
-			log.Debugf("using private client to query %s via upstream %s", r.Question[0].Name, upstream)
-			client, err = GetClientPrivate(bindIP, u.interfaceName, timeout)
-			if err != nil {
-				return nil, 0, fmt.Errorf("create private client: %s", err)
-			}
+	if u.lNet.Contains(upstreamIP) || upstreamIP.IsPrivate() {
+		log.Debugf("using private client to query upstream: %s", upstream)
+		client, err = GetClientPrivate(u.lIP, u.interfaceName, timeout)
+		if err != nil {
+			return nil, 0, fmt.Errorf("error while creating private client: %s", err)
 		}
 	}
 
@@ -103,18 +86,16 @@ func GetClientPrivate(ip netip.Addr, interfaceName string, dialTimeout time.Dura
 		return nil, err
 	}
 
-	proto, opt := unix.IPPROTO_IP, unix.IP_BOUND_IF
-	if ip.Is6() {
-		proto, opt = unix.IPPROTO_IPV6, unix.IPV6_BOUND_IF
-	}
-
 	dialer := &net.Dialer{
-		LocalAddr: net.UDPAddrFromAddrPort(netip.AddrPortFrom(ip, 0)),
+		LocalAddr: &net.UDPAddr{
+			IP:   ip.AsSlice(),
+			Port: 0, // Let the OS pick a free port
+		},
 		Timeout: dialTimeout,
 		Control: func(network, address string, c syscall.RawConn) error {
 			var operr error
 			fn := func(s uintptr) {
-				operr = unix.SetsockoptInt(int(s), proto, opt, index)
+				operr = unix.SetsockoptInt(int(s), unix.IPPROTO_IP, unix.IP_BOUND_IF, index)
 			}
 
 			if err := c.Control(fn); err != nil {

client/internal/dns_test.go

@@ -1,138 +0,0 @@
-package internal
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/miekg/dns"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	nbdns "github.com/netbirdio/netbird/dns"
-)
-
-func TestCreatePTRRecord_IPv4(t *testing.T) {
-	record := nbdns.SimpleRecord{
-		Name:  "peer1.netbird.cloud.",
-		Type:  int(dns.TypeA),
-		Class: nbdns.DefaultClass,
-		TTL:   300,
-		RData: "100.64.0.5",
-	}
-	prefix := netip.MustParsePrefix("100.64.0.0/16")
-
-	ptr, ok := createPTRRecord(record, prefix)
-	require.True(t, ok)
-	assert.Equal(t, "5.0.64.100.in-addr.arpa.", ptr.Name)
-	assert.Equal(t, int(dns.TypePTR), ptr.Type)
-	assert.Equal(t, "peer1.netbird.cloud.", ptr.RData)
-}
-
-func TestCreatePTRRecord_IPv6(t *testing.T) {
-	record := nbdns.SimpleRecord{
-		Name:  "peer1.netbird.cloud.",
-		Type:  int(dns.TypeAAAA),
-		Class: nbdns.DefaultClass,
-		TTL:   300,
-		RData: "fd00:1234:5678::1",
-	}
-	prefix := netip.MustParsePrefix("fd00:1234:5678::/48")
-
-	ptr, ok := createPTRRecord(record, prefix)
-	require.True(t, ok)
-	assert.Equal(t, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.7.6.5.4.3.2.1.0.0.d.f.ip6.arpa.", ptr.Name)
-	assert.Equal(t, int(dns.TypePTR), ptr.Type)
-	assert.Equal(t, "peer1.netbird.cloud.", ptr.RData)
-}
-
-func TestCreatePTRRecord_OutOfRange(t *testing.T) {
-	record := nbdns.SimpleRecord{
-		Name:  "peer1.netbird.cloud.",
-		Type:  int(dns.TypeA),
-		RData: "10.0.0.1",
-	}
-	prefix := netip.MustParsePrefix("100.64.0.0/16")
-
-	_, ok := createPTRRecord(record, prefix)
-	assert.False(t, ok)
-}
-
-func TestGenerateReverseZoneName_IPv4(t *testing.T) {
-	tests := []struct {
-		prefix   string
-		expected string
-	}{
-		{"100.64.0.0/16", "64.100.in-addr.arpa."},
-		{"10.0.0.0/8", "10.in-addr.arpa."},
-		{"192.168.1.0/24", "1.168.192.in-addr.arpa."},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.prefix, func(t *testing.T) {
-			zone, err := generateReverseZoneName(netip.MustParsePrefix(tt.prefix))
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, zone)
-		})
-	}
-}
-
-func TestGenerateReverseZoneName_IPv6(t *testing.T) {
-	tests := []struct {
-		prefix   string
-		expected string
-	}{
-		{"fd00:1234:5678::/48", "8.7.6.5.4.3.2.1.0.0.d.f.ip6.arpa."},
-		{"fd00::/16", "0.0.d.f.ip6.arpa."},
-		{"fd12:3456:789a:bcde::/64", "e.d.c.b.a.9.8.7.6.5.4.3.2.1.d.f.ip6.arpa."},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.prefix, func(t *testing.T) {
-			zone, err := generateReverseZoneName(netip.MustParsePrefix(tt.prefix))
-			require.NoError(t, err)
-			assert.Equal(t, tt.expected, zone)
-		})
-	}
-}
-
-func TestCollectPTRRecords_BothFamilies(t *testing.T) {
-	config := &nbdns.Config{
-		CustomZones: []nbdns.CustomZone{
-			{
-				Domain: "netbird.cloud.",
-				Records: []nbdns.SimpleRecord{
-					{Name: "peer1.netbird.cloud.", Type: int(dns.TypeA), RData: "100.64.0.1"},
-					{Name: "peer1.netbird.cloud.", Type: int(dns.TypeAAAA), RData: "fd00::1"},
-					{Name: "peer2.netbird.cloud.", Type: int(dns.TypeA), RData: "100.64.0.2"},
-				},
-			},
-		},
-	}
-
-	v4Records := collectPTRRecords(config, netip.MustParsePrefix("100.64.0.0/16"))
-	assert.Len(t, v4Records, 2, "should collect 2 A record PTRs for the v4 prefix")
-
-	v6Records := collectPTRRecords(config, netip.MustParsePrefix("fd00::/64"))
-	assert.Len(t, v6Records, 1, "should collect 1 AAAA record PTR for the v6 prefix")
-}
-
-func TestAddReverseZone_IPv6(t *testing.T) {
-	config := &nbdns.Config{
-		CustomZones: []nbdns.CustomZone{
-			{
-				Domain: "netbird.cloud.",
-				Records: []nbdns.SimpleRecord{
-					{Name: "peer1.netbird.cloud.", Type: int(dns.TypeAAAA), RData: "fd00:1234:5678::1"},
-				},
-			},
-		},
-	}
-
-	addReverseZone(config, netip.MustParsePrefix("fd00:1234:5678::/48"))
-
-	require.Len(t, config.CustomZones, 2)
-	reverseZone := config.CustomZones[1]
-	assert.Equal(t, "8.7.6.5.4.3.2.1.0.0.d.f.ip6.arpa.", reverseZone.Domain)
-	assert.Len(t, reverseZone.Records, 1)
-	assert.Equal(t, int(dns.TypePTR), reverseZone.Records[0].Type)
-}

client/internal/engine.go

@@ -31,7 +31,6 @@ import (
 	"github.com/netbirdio/netbird/client/iface/device"
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
 	"github.com/netbirdio/netbird/client/iface/udpmux"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/acl"
 	"github.com/netbirdio/netbird/client/internal/debug"
 	"github.com/netbirdio/netbird/client/internal/dns"
@@ -62,7 +61,6 @@ import (
 	mgm "github.com/netbirdio/netbird/shared/management/client"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-	"github.com/netbirdio/netbird/shared/netiputil"
 	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 	signal "github.com/netbirdio/netbird/shared/signal/client"
@@ -86,9 +84,8 @@ type EngineConfig struct {
 	WgPort      int
 	WgIfaceName string
 
-	// WgAddr is the Wireguard local address (Netbird Network IP).
-	// Contains both v4 and optional v6 overlay addresses.
-	WgAddr wgaddr.Address
+	// WgAddr is a Wireguard local address (Netbird Network IP)
+	WgAddr string
 
 	// WgPrivateKey is a Wireguard private key of our peer (it MUST never leave the machine)
 	WgPrivateKey wgtypes.Key
@@ -133,7 +130,6 @@ type EngineConfig struct {
 	DisableFirewall     bool
 	BlockLANAccess      bool
 	BlockInbound        bool
-	DisableIPv6         bool
 
 	LazyConnectionEnabled bool
 
@@ -503,17 +499,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 
 	e.routeManager.SetRouteChangeListener(e.mobileDep.NetworkChangeListener)
 
-	e.dnsServer.SetRouteChecker(func(ip netip.Addr) bool {
-		for _, routes := range e.routeManager.GetClientRoutes() {
-			for _, r := range routes {
-				if r.Network.Contains(ip) {
-					return true
-				}
-			}
-		}
-		return false
-	})
-
 	if err = e.wgInterfaceCreate(); err != nil {
 		log.Errorf("failed creating tunnel interface %s: [%s]", e.config.WgIfaceName, err.Error())
 		e.close()
@@ -718,7 +703,7 @@ func (e *Engine) modifyPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
 		if !ok {
 			continue
 		}
-		if !compareNetIPLists(allowedIPs, e.filterAllowedIPs(p.GetAllowedIps())) {
+		if !compareNetIPLists(allowedIPs, p.GetAllowedIps()) {
 			modified = append(modified, p)
 			continue
 		}
@@ -992,7 +977,6 @@ func (e *Engine) updateChecksIfNew(checks []*mgmProto.Checks) error {
 		e.config.DisableFirewall,
 		e.config.BlockLANAccess,
 		e.config.BlockInbound,
-		e.config.DisableIPv6,
 		e.config.LazyConnectionEnabled,
 		e.config.EnableSSHRoot,
 		e.config.EnableSSHSFTP,
@@ -1020,13 +1004,6 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 		return ErrResetConnection
 	}
 
-	if !e.config.DisableIPv6 && e.hasIPv6Changed(conf) {
-		log.Infof("peer IPv6 address changed, restarting client")
-		_ = CtxGetState(e.ctx).Wrap(ErrResetConnection)
-		e.clientCancel()
-		return ErrResetConnection
-	}
-
 	if conf.GetSshConfig() != nil {
 		if err := e.updateSSH(conf.GetSshConfig()); err != nil {
 			log.Warnf("failed handling SSH server setup: %v", err)
@@ -1035,7 +1012,6 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 
 	state := e.statusRecorder.GetLocalPeerState()
 	state.IP = e.wgInterface.Address().String()
-	state.IPv6 = e.wgInterface.Address().IPv6String()
 	state.PubKey = e.config.WgPrivateKey.PublicKey().String()
 	state.KernelInterface = !e.wgInterface.IsUserspaceBind()
 	state.FQDN = conf.GetFqdn()
@@ -1044,28 +1020,6 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 
 	return nil
 }
-
-// hasIPv6Changed reports whether the IPv6 overlay address in the peer config
-// differs from the configured address (added, removed, or changed).
-// Compares against e.config.WgAddr (not the interface address, which may have
-// been cleared by ClearIPv6 if OS assignment failed).
-func (e *Engine) hasIPv6Changed(conf *mgmProto.PeerConfig) bool {
-	current := e.config.WgAddr
-	raw := conf.GetAddressV6()
-
-	if len(raw) == 0 {
-		return current.HasIPv6()
-	}
-
-	prefix, err := netiputil.DecodePrefix(raw)
-	if err != nil {
-		log.Warnf("decode v6 overlay address: %v", err)
-		return false
-	}
-
-	return !current.HasIPv6() || current.IPv6 != prefix.Addr() || current.IPv6Net != prefix.Masked()
-}
-
 func (e *Engine) receiveJobEvents() {
 	e.jobExecutorWG.Add(1)
 	go func() {
@@ -1163,7 +1117,6 @@ func (e *Engine) receiveManagementEvents() {
 			e.config.DisableFirewall,
 			e.config.BlockLANAccess,
 			e.config.BlockInbound,
-			e.config.DisableIPv6,
 			e.config.LazyConnectionEnabled,
 			e.config.EnableSSHRoot,
 			e.config.EnableSSHSFTP,
@@ -1263,7 +1216,7 @@ func (e *Engine) updateNetworkMap(networkMap *mgmProto.NetworkMap) error {
 		protoDNSConfig = &mgmProto.DNSConfig{}
 	}
 
-	dnsConfig := toDNSConfig(protoDNSConfig, e.wgInterface.Address())
+	dnsConfig := toDNSConfig(protoDNSConfig, e.wgInterface.Address().Network)
 
 	if err := e.dnsServer.UpdateDNSServer(serial, dnsConfig); err != nil {
 		log.Errorf("failed to update dns server, err: %v", err)
@@ -1418,9 +1371,7 @@ func toRouteDomains(myPubKey string, routes []*route.Route) []*dnsfwd.ForwarderE
 	return entries
 }
 
-func toDNSConfig(protoDNSConfig *mgmProto.DNSConfig, addr wgaddr.Address) nbdns.Config {
-	network := addr.Network
-	networkV6 := addr.IPv6Net
+func toDNSConfig(protoDNSConfig *mgmProto.DNSConfig, network netip.Prefix) nbdns.Config {
 	//nolint
 	forwarderPort := uint16(protoDNSConfig.GetForwarderPort())
 	if forwarderPort == 0 {
@@ -1477,9 +1428,6 @@ func toDNSConfig(protoDNSConfig *mgmProto.DNSConfig, addr wgaddr.Address) nbdns.
 
 	if len(dnsUpdate.CustomZones) > 0 {
 		addReverseZone(&dnsUpdate, network)
-		if networkV6.IsValid() {
-			addReverseZone(&dnsUpdate, networkV6)
-		}
 	}
 
 	return dnsUpdate
@@ -1489,10 +1437,8 @@ func (e *Engine) updateOfflinePeers(offlinePeers []*mgmProto.RemotePeerConfig) {
 	replacement := make([]peer.State, len(offlinePeers))
 	for i, offlinePeer := range offlinePeers {
 		log.Debugf("added offline peer %s", offlinePeer.Fqdn)
-		v4, v6 := splitAllowedIPs(offlinePeer.GetAllowedIps(), e.wgInterface.Address().IPv6Net)
 		replacement[i] = peer.State{
-			IP:               v4,
-			IPv6:             v6,
+			IP:               strings.Join(offlinePeer.GetAllowedIps(), ","),
 			PubKey:           offlinePeer.GetWgPubKey(),
 			FQDN:             offlinePeer.GetFqdn(),
 			ConnStatus:       peer.StatusIdle,
@@ -1503,30 +1449,6 @@ func (e *Engine) updateOfflinePeers(offlinePeers []*mgmProto.RemotePeerConfig) {
 	e.statusRecorder.ReplaceOfflinePeers(replacement)
 }
 
-// splitAllowedIPs separates the peer's overlay v4 (/32) and v6 (/128) addresses
-// from a list of AllowedIPs CIDRs. The v6 address is only matched if it falls
-// within ourV6Net (the local overlay v6 subnet), to avoid confusing routed /128
-// prefixes with the peer's overlay address.
-func splitAllowedIPs(allowedIPs []string, ourV6Net netip.Prefix) (v4, v6 string) {
-	for _, cidr := range allowedIPs {
-		prefix, err := netip.ParsePrefix(cidr)
-		if err != nil {
-			log.Warnf("failed to parse AllowedIP %q: %v", cidr, err)
-			continue
-		}
-		switch {
-		case prefix.Addr().Is4() && prefix.Bits() == 32 && v4 == "":
-			v4 = prefix.Addr().String()
-		case prefix.Addr().Is6() && prefix.Bits() == 128 && ourV6Net.Contains(prefix.Addr()) && v6 == "":
-			v6 = prefix.Addr().String()
-		}
-		if v4 != "" && v6 != "" {
-			break
-		}
-	}
-	return
-}
-
 // addNewPeers adds peers that were not know before but arrived from the Management service with the update
 func (e *Engine) addNewPeers(peersUpdate []*mgmProto.RemotePeerConfig) error {
 	for _, p := range peersUpdate {
@@ -1552,23 +1474,15 @@ func (e *Engine) addNewPeer(peerConfig *mgmProto.RemotePeerConfig) error {
 			log.Errorf("failed to parse allowedIPS: %v", err)
 			return err
 		}
-		if allowedNetIP.Addr().Is6() && !e.wgInterface.Address().HasIPv6() {
-			continue
-		}
 		peerIPs = append(peerIPs, allowedNetIP)
 	}
 
-	if len(peerIPs) == 0 {
-		return fmt.Errorf("peer %s has no usable AllowedIPs", peerKey)
-	}
-
 	conn, err := e.createPeerConn(peerKey, peerIPs, peerConfig.AgentVersion)
 	if err != nil {
 		return fmt.Errorf("create peer connection: %w", err)
 	}
 
-	peerV4, peerV6 := splitAllowedIPs(peerConfig.GetAllowedIps(), e.wgInterface.Address().IPv6Net)
-	err = e.statusRecorder.AddPeer(peerKey, peerConfig.Fqdn, peerV4, peerV6)
+	err = e.statusRecorder.AddPeer(peerKey, peerConfig.Fqdn, peerIPs[0].Addr().String())
 	if err != nil {
 		log.Warnf("error adding peer %s to status recorder, got error: %v", peerKey, err)
 	}
@@ -1791,7 +1705,6 @@ func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, err
 		e.config.DisableFirewall,
 		e.config.BlockLANAccess,
 		e.config.BlockInbound,
-		e.config.DisableIPv6,
 		e.config.LazyConnectionEnabled,
 		e.config.EnableSSHRoot,
 		e.config.EnableSSHSFTP,
@@ -1805,7 +1718,7 @@ func (e *Engine) readInitialSettings() ([]*route.Route, *nbdns.Config, bool, err
 		return nil, nil, false, err
 	}
 	routes := toRoutes(netMap.GetRoutes())
-	dnsCfg := toDNSConfig(netMap.GetDNSConfig(), e.wgInterface.Address())
+	dnsCfg := toDNSConfig(netMap.GetDNSConfig(), e.wgInterface.Address().Network)
 	dnsFeatureFlag := toDNSFeatureFlag(netMap)
 	return routes, &dnsCfg, dnsFeatureFlag, nil
 }
@@ -1847,8 +1760,7 @@ func (e *Engine) wgInterfaceCreate() (err error) {
 	case "android":
 		err = e.wgInterface.CreateOnAndroid(e.routeManager.InitialRouteRange(), e.dnsServer.DnsIP().String(), e.dnsServer.SearchDomains())
 	case "ios":
-		e.mobileDep.NetworkChangeListener.SetInterfaceIP(e.config.WgAddr.String())
-		e.mobileDep.NetworkChangeListener.SetInterfaceIPv6(e.config.WgAddr.IPv6String())
+		e.mobileDep.NetworkChangeListener.SetInterfaceIP(e.config.WgAddr)
 		err = e.wgInterface.Create()
 	default:
 		err = e.wgInterface.Create()
@@ -2357,24 +2269,6 @@ func getInterfacePrefixes() ([]netip.Prefix, error) {
 	return prefixes, nberrors.FormatErrorOrNil(merr)
 }
 
-// filterAllowedIPs strips IPv6 entries when the local interface has no v6 address.
-// This covers both the explicit --disable-ipv6 flag (v6 never assigned) and the
-// case where OS v6 assignment failed (ClearIPv6). Without this, WireGuard would
-// accept v6 traffic that the native firewall cannot filter.
-func (e *Engine) filterAllowedIPs(ips []string) []string {
-	if e.wgInterface.Address().HasIPv6() {
-		return ips
-	}
-	filtered := make([]string, 0, len(ips))
-	for _, s := range ips {
-		p, err := netip.ParsePrefix(s)
-		if err != nil || !p.Addr().Is6() {
-			filtered = append(filtered, s)
-		}
-	}
-	return filtered
-}
-
 // compareNetIPLists compares a list of netip.Prefix with a list of strings.
 // return true if both lists are equal, false otherwise.
 func compareNetIPLists(list1 []netip.Prefix, list2 []string) bool {

client/internal/engine_test.go

@@ -66,7 +66,6 @@ import (
 	mgmt "github.com/netbirdio/netbird/shared/management/client"
 	mgmtProto "github.com/netbirdio/netbird/shared/management/proto"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
-	"github.com/netbirdio/netbird/shared/netiputil"
 	signal "github.com/netbirdio/netbird/shared/signal/client"
 	"github.com/netbirdio/netbird/shared/signal/proto"
 	signalServer "github.com/netbirdio/netbird/signal/server"
@@ -95,7 +94,7 @@ type MockWGIface struct {
 	AddressFunc                func() wgaddr.Address
 	ToInterfaceFunc            func() *net.Interface
 	UpFunc                     func() (*udpmux.UniversalUDPMuxDefault, error)
-	UpdateAddrFunc             func(newAddr wgaddr.Address) error
+	UpdateAddrFunc             func(newAddr string) error
 	UpdatePeerFunc             func(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	RemovePeerFunc             func(peerKey string) error
 	AddAllowedIPFunc           func(peerKey string, allowedIP netip.Prefix) error
@@ -157,7 +156,7 @@ func (m *MockWGIface) Up() (*udpmux.UniversalUDPMuxDefault, error) {
 	return m.UpFunc()
 }
 
-func (m *MockWGIface) UpdateAddr(newAddr wgaddr.Address) error {
+func (m *MockWGIface) UpdateAddr(newAddr string) error {
 	return m.UpdateAddrFunc(newAddr)
 }
 
@@ -254,7 +253,7 @@ func TestEngine_SSH(t *testing.T) {
 		ctx, cancel,
 		&EngineConfig{
 			WgIfaceName:      "utun101",
-			WgAddr:           wgaddr.MustParseWGAddress("100.64.0.1/24"),
+			WgAddr:           "100.64.0.1/24",
 			WgPrivateKey:     key,
 			WgPort:           33100,
 			ServerSSHAllowed: true,
@@ -431,7 +430,7 @@ func TestEngine_UpdateNetworkMap(t *testing.T) {
 	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
 	engine := NewEngine(ctx, cancel, &EngineConfig{
 		WgIfaceName:  "utun102",
-		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgAddr:       "100.64.0.1/24",
 		WgPrivateKey: key,
 		WgPort:       33100,
 		MTU:          iface.DefaultMTU,
@@ -655,7 +654,7 @@ func TestEngine_Sync(t *testing.T) {
 	relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
 	engine := NewEngine(ctx, cancel, &EngineConfig{
 		WgIfaceName:  "utun103",
-		WgAddr:       wgaddr.MustParseWGAddress("100.64.0.1/24"),
+		WgAddr:       "100.64.0.1/24",
 		WgPrivateKey: key,
 		WgPort:       33100,
 		MTU:          iface.DefaultMTU,
@@ -825,7 +824,7 @@ func TestEngine_UpdateNetworkMapWithRoutes(t *testing.T) {
 			relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
 			engine := NewEngine(ctx, cancel, &EngineConfig{
 				WgIfaceName:  wgIfaceName,
-				WgAddr:       wgaddr.MustParseWGAddress(wgAddr),
+				WgAddr:       wgAddr,
 				WgPrivateKey: key,
 				WgPort:       33100,
 				MTU:          iface.DefaultMTU,
@@ -843,7 +842,7 @@ func TestEngine_UpdateNetworkMapWithRoutes(t *testing.T) {
 
 			opts := iface.WGIFaceOpts{
 				IFaceName:    wgIfaceName,
-				Address:      wgaddr.MustParseWGAddress(wgAddr),
+				Address:      wgAddr,
 				WGPort:       engine.config.WgPort,
 				WGPrivKey:    key.String(),
 				MTU:          iface.DefaultMTU,
@@ -1032,7 +1031,7 @@ func TestEngine_UpdateNetworkMapWithDNSUpdate(t *testing.T) {
 			relayMgr := relayClient.NewManager(ctx, nil, key.PublicKey().String(), iface.DefaultMTU)
 			engine := NewEngine(ctx, cancel, &EngineConfig{
 				WgIfaceName:  wgIfaceName,
-				WgAddr:       wgaddr.MustParseWGAddress(wgAddr),
+				WgAddr:       wgAddr,
 				WgPrivateKey: key,
 				WgPort:       33100,
 				MTU:          iface.DefaultMTU,
@@ -1050,7 +1049,7 @@ func TestEngine_UpdateNetworkMapWithDNSUpdate(t *testing.T) {
 			}
 			opts := iface.WGIFaceOpts{
 				IFaceName:    wgIfaceName,
-				Address:      wgaddr.MustParseWGAddress(wgAddr),
+				Address:      wgAddr,
 				WGPort:       33100,
 				WGPrivKey:    key.String(),
 				MTU:          iface.DefaultMTU,
@@ -1560,7 +1559,7 @@ func createEngine(ctx context.Context, cancel context.CancelFunc, setupKey strin
 	wgPort := 33100 + i
 	conf := &EngineConfig{
 		WgIfaceName:  ifaceName,
-		WgAddr:       wgaddr.MustParseWGAddress(resp.PeerConfig.Address),
+		WgAddr:       resp.PeerConfig.Address,
 		WgPrivateKey: key,
 		WgPort:       wgPort,
 		MTU:          iface.DefaultMTU,
@@ -1705,209 +1704,3 @@ func getPeers(e *Engine) int {
 
 	return len(e.peerStore.PeersPubKey())
 }
-
-func TestEngine_hasIPv6Changed(t *testing.T) {
-	v4Only := wgaddr.MustParseWGAddress("100.64.0.1/16")
-
-	v4v6 := wgaddr.MustParseWGAddress("100.64.0.1/16")
-	v4v6.IPv6 = netip.MustParseAddr("fd00::1")
-	v4v6.IPv6Net = netip.MustParsePrefix("fd00::1/64").Masked()
-
-	tests := []struct {
-		name     string
-		current  wgaddr.Address
-		confV6   []byte
-		expected bool
-	}{
-		{
-			name:     "no v6 before, no v6 now",
-			current:  v4Only,
-			confV6:   nil,
-			expected: false,
-		},
-		{
-			name:     "no v6 before, v6 added",
-			current:  v4Only,
-			confV6:   netiputil.EncodePrefix(netip.MustParsePrefix("fd00::1/64")),
-			expected: true,
-		},
-		{
-			name:     "had v6, now removed",
-			current:  v4v6,
-			confV6:   nil,
-			expected: true,
-		},
-		{
-			name:     "had v6, same v6",
-			current:  v4v6,
-			confV6:   netiputil.EncodePrefix(netip.MustParsePrefix("fd00::1/64")),
-			expected: false,
-		},
-		{
-			name:     "had v6, different v6",
-			current:  v4v6,
-			confV6:   netiputil.EncodePrefix(netip.MustParsePrefix("fd00::2/64")),
-			expected: true,
-		},
-		{
-			name:     "same v6 addr, different prefix length",
-			current:  v4v6,
-			confV6:   netiputil.EncodePrefix(netip.MustParsePrefix("fd00::1/80")),
-			expected: true,
-		},
-		{
-			name:     "decode error keeps status quo",
-			current:  v4Only,
-			confV6:   []byte{1, 2, 3},
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			engine := &Engine{
-				config: &EngineConfig{WgAddr: tt.current},
-			}
-			conf := &mgmtProto.PeerConfig{
-				AddressV6: tt.confV6,
-			}
-			assert.Equal(t, tt.expected, engine.hasIPv6Changed(conf))
-		})
-	}
-}
-
-func TestFilterAllowedIPs(t *testing.T) {
-	v4v6Addr := wgaddr.MustParseWGAddress("100.64.0.1/16")
-	v4v6Addr.IPv6 = netip.MustParseAddr("fd00::1")
-	v4v6Addr.IPv6Net = netip.MustParsePrefix("fd00::1/64").Masked()
-
-	v4OnlyAddr := wgaddr.MustParseWGAddress("100.64.0.1/16")
-
-	tests := []struct {
-		name     string
-		addr     wgaddr.Address
-		input    []string
-		expected []string
-	}{
-		{
-			name:     "interface has v6, keep all",
-			addr:     v4v6Addr,
-			input:    []string{"100.64.0.1/32", "fd00::1/128"},
-			expected: []string{"100.64.0.1/32", "fd00::1/128"},
-		},
-		{
-			name:     "no v6, strip v6",
-			addr:     v4OnlyAddr,
-			input:    []string{"100.64.0.1/32", "fd00::1/128"},
-			expected: []string{"100.64.0.1/32"},
-		},
-		{
-			name:     "no v6, only v4",
-			addr:     v4OnlyAddr,
-			input:    []string{"100.64.0.1/32", "10.0.0.0/8"},
-			expected: []string{"100.64.0.1/32", "10.0.0.0/8"},
-		},
-		{
-			name:     "no v6, only v6 input",
-			addr:     v4OnlyAddr,
-			input:    []string{"fd00::1/128", "::/0"},
-			expected: []string{},
-		},
-		{
-			name:     "no v6, invalid prefix preserved",
-			addr:     v4OnlyAddr,
-			input:    []string{"100.64.0.1/32", "garbage"},
-			expected: []string{"100.64.0.1/32", "garbage"},
-		},
-		{
-			name:     "no v6, empty input",
-			addr:     v4OnlyAddr,
-			input:    []string{},
-			expected: []string{},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			addr := tt.addr
-			engine := &Engine{
-				config: &EngineConfig{},
-				wgInterface: &MockWGIface{
-					AddressFunc: func() wgaddr.Address { return addr },
-				},
-			}
-			result := engine.filterAllowedIPs(tt.input)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestSplitAllowedIPs(t *testing.T) {
-	ourV6Net := netip.MustParsePrefix("fd00:1234:5678:abcd::/64")
-
-	tests := []struct {
-		name       string
-		allowedIPs []string
-		ourV6Net   netip.Prefix
-		wantV4     string
-		wantV6     string
-	}{
-		{
-			name:       "v4 only",
-			allowedIPs: []string{"100.64.0.1/32"},
-			ourV6Net:   ourV6Net,
-			wantV4:     "100.64.0.1",
-			wantV6:     "",
-		},
-		{
-			name:       "v4 and v6 overlay",
-			allowedIPs: []string{"100.64.0.1/32", "fd00:1234:5678:abcd::1/128"},
-			ourV6Net:   ourV6Net,
-			wantV4:     "100.64.0.1",
-			wantV6:     "fd00:1234:5678:abcd::1",
-		},
-		{
-			name:       "v4, routed v6, overlay v6",
-			allowedIPs: []string{"100.64.0.1/32", "2001:db8::1/128", "fd00:1234:5678:abcd::1/128"},
-			ourV6Net:   ourV6Net,
-			wantV4:     "100.64.0.1",
-			wantV6:     "fd00:1234:5678:abcd::1",
-		},
-		{
-			name:       "routed v6 /128 outside our subnet is ignored",
-			allowedIPs: []string{"100.64.0.1/32", "2001:db8::1/128"},
-			ourV6Net:   ourV6Net,
-			wantV4:     "100.64.0.1",
-			wantV6:     "",
-		},
-		{
-			name:       "routed v6 prefix is ignored",
-			allowedIPs: []string{"100.64.0.1/32", "fd00:1234:5678:abcd::/64"},
-			ourV6Net:   ourV6Net,
-			wantV4:     "100.64.0.1",
-			wantV6:     "",
-		},
-		{
-			name:       "no v6 subnet configured",
-			allowedIPs: []string{"100.64.0.1/32", "fd00:1234:5678:abcd::1/128"},
-			ourV6Net:   netip.Prefix{},
-			wantV4:     "100.64.0.1",
-			wantV6:     "",
-		},
-		{
-			name:       "v4 /24 route is ignored",
-			allowedIPs: []string{"100.64.0.0/24", "100.64.0.1/32"},
-			ourV6Net:   ourV6Net,
-			wantV4:     "100.64.0.1",
-			wantV6:     "",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			v4, v6 := splitAllowedIPs(tt.allowedIPs, tt.ourV6Net)
-			assert.Equal(t, tt.wantV4, v4, "v4")
-			assert.Equal(t, tt.wantV6, v6, "v6")
-		})
-	}
-}

client/internal/iface_common.go

@@ -26,7 +26,7 @@ type wgIfaceBase interface {
 	Address() wgaddr.Address
 	ToInterface() *net.Interface
 	Up() (*udpmux.UniversalUDPMuxDefault, error)
-	UpdateAddr(newAddr wgaddr.Address) error
+	UpdateAddr(newAddr string) error
 	GetProxy() wgproxy.Proxy
 	GetProxyPort() uint16
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error

client/internal/listener/network_change.go

@@ -5,5 +5,4 @@ type NetworkChangeListener interface {
 	// OnNetworkChanged invoke when network settings has been changed
 	OnNetworkChanged(string)
 	SetInterfaceIP(string)
-	SetInterfaceIPv6(string)
 }

client/internal/peer/status.go

@@ -53,7 +53,6 @@ type RouterState struct {
 type State struct {
 	Mux                        *sync.RWMutex
 	IP                         string
-	IPv6                       string
 	PubKey                     string
 	FQDN                       string
 	ConnStatus                 ConnStatus
@@ -107,7 +106,6 @@ func (s *State) GetRoutes() map[string]struct{} {
 // LocalPeerState contains the latest state of the local peer
 type LocalPeerState struct {
 	IP              string
-	IPv6            string
 	PubKey          string
 	KernelInterface bool
 	FQDN            string
@@ -261,7 +259,7 @@ func (d *Status) ReplaceOfflinePeers(replacement []State) {
 }
 
 // AddPeer adds peer to Daemon status map
-func (d *Status) AddPeer(peerPubKey string, fqdn string, ip string, ipv6 string) error {
+func (d *Status) AddPeer(peerPubKey string, fqdn string, ip string) error {
 	d.mux.Lock()
 	defer d.mux.Unlock()
 
@@ -272,7 +270,6 @@ func (d *Status) AddPeer(peerPubKey string, fqdn string, ip string, ipv6 string)
 	d.peers[peerPubKey] = State{
 		PubKey:     peerPubKey,
 		IP:         ip,
-		IPv6:       ipv6,
 		ConnStatus: StatusIdle,
 		FQDN:       fqdn,
 		Mux:        new(sync.RWMutex),
@@ -1242,7 +1239,6 @@ func (fs FullStatus) ToProto() *proto.FullStatus {
 	}
 
 	pbFullStatus.LocalPeerState.IP = fs.LocalPeerState.IP
-	pbFullStatus.LocalPeerState.Ipv6 = fs.LocalPeerState.IPv6
 	pbFullStatus.LocalPeerState.PubKey = fs.LocalPeerState.PubKey
 	pbFullStatus.LocalPeerState.KernelInterface = fs.LocalPeerState.KernelInterface
 	pbFullStatus.LocalPeerState.Fqdn = fs.LocalPeerState.FQDN
@@ -1258,7 +1254,6 @@ func (fs FullStatus) ToProto() *proto.FullStatus {
 
 		pbPeerState := &proto.PeerState{
 			IP:                         peerState.IP,
-			Ipv6:                       peerState.IPv6,
 			PubKey:                     peerState.PubKey,
 			ConnStatus:                 peerState.ConnStatus.String(),
 			ConnStatusUpdate:           timestamppb.New(peerState.ConnStatusUpdate),

client/internal/peer/status_test.go

@@ -14,13 +14,13 @@ func TestAddPeer(t *testing.T) {
 	key := "abc"
 	ip := "100.108.254.1"
 	status := NewRecorder("https://mgm")
-	err := status.AddPeer(key, "abc.netbird", ip, "")
+	err := status.AddPeer(key, "abc.netbird", ip)
 	assert.NoError(t, err, "shouldn't return error")
 
 	_, exists := status.peers[key]
 	assert.True(t, exists, "value was found")
 
-	err = status.AddPeer(key, "abc.netbird", ip, "")
+	err = status.AddPeer(key, "abc.netbird", ip)
 
 	assert.Error(t, err, "should return error on duplicate")
 }
@@ -29,7 +29,7 @@ func TestGetPeer(t *testing.T) {
 	key := "abc"
 	ip := "100.108.254.1"
 	status := NewRecorder("https://mgm")
-	err := status.AddPeer(key, "abc.netbird", ip, "")
+	err := status.AddPeer(key, "abc.netbird", ip)
 	assert.NoError(t, err, "shouldn't return error")
 
 	peerStatus, err := status.GetPeer(key)
@@ -46,7 +46,7 @@ func TestUpdatePeerState(t *testing.T) {
 	ip := "10.10.10.10"
 	fqdn := "peer-a.netbird.local"
 	status := NewRecorder("https://mgm")
-	_ = status.AddPeer(key, fqdn, ip, "")
+	_ = status.AddPeer(key, fqdn, ip)
 
 	peerState := State{
 		PubKey:           key,
@@ -85,7 +85,7 @@ func TestGetPeerStateChangeNotifierLogic(t *testing.T) {
 	key := "abc"
 	ip := "10.10.10.10"
 	status := NewRecorder("https://mgm")
-	_ = status.AddPeer(key, "abc.netbird", ip, "")
+	_ = status.AddPeer(key, "abc.netbird", ip)
 
 	sub := status.SubscribeToPeerStateChanges(context.Background(), key)
 	assert.NotNil(t, sub, "channel shouldn't be nil")

client/internal/profilemanager/config.go

@@ -77,7 +77,6 @@ type ConfigInput struct {
 	DisableFirewall     *bool
 	BlockLANAccess      *bool
 	BlockInbound        *bool
-	DisableIPv6         *bool
 
 	DisableNotifications *bool
 
@@ -116,7 +115,6 @@ type Config struct {
 	DisableFirewall     bool
 	BlockLANAccess      bool
 	BlockInbound        bool
-	DisableIPv6         bool
 
 	DisableNotifications *bool
 
@@ -532,16 +530,6 @@ func (config *Config) apply(input ConfigInput) (updated bool, err error) {
 		updated = true
 	}
 
-	if input.DisableIPv6 != nil && *input.DisableIPv6 != config.DisableIPv6 {
-		if *input.DisableIPv6 {
-			log.Infof("disabling IPv6 overlay")
-		} else {
-			log.Infof("enabling IPv6 overlay")
-		}
-		config.DisableIPv6 = *input.DisableIPv6
-		updated = true
-	}
-
 	if input.DisableNotifications != nil && input.DisableNotifications != config.DisableNotifications {
 		if *input.DisableNotifications {
 			log.Infof("disabling notifications")

client/internal/routemanager/client/client_bench_test.go

@@ -46,7 +46,7 @@ func generateBenchmarkData(tier benchmarkTier) (*peer.Status, map[route.ID]*rout
 		fqdn := fmt.Sprintf("peer-%d.example.com", i)
 		ip := fmt.Sprintf("10.0.%d.%d", i/256, i%256)
 
-		err := statusRecorder.AddPeer(peerKey, fqdn, ip, "")
+		err := statusRecorder.AddPeer(peerKey, fqdn, ip)
 		if err != nil {
 			panic(fmt.Sprintf("failed to add peer: %v", err))
 		}

client/internal/routemanager/manager_test.go

@@ -12,7 +12,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/route"
 )
@@ -410,7 +409,7 @@ func TestManagerUpdateRoutes(t *testing.T) {
 			}
 			opts := iface.WGIFaceOpts{
 				IFaceName:    fmt.Sprintf("utun43%d", n),
-				Address:      wgaddr.MustParseWGAddress("100.65.65.2/24"),
+				Address:      "100.65.65.2/24",
 				WGPort:       33100,
 				WGPrivKey:    peerPrivateKey.String(),
 				MTU:          iface.DefaultMTU,

client/internal/routemanager/systemops/systemops_generic_test.go

@@ -21,7 +21,6 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/internal/routemanager/vars"
 	nbnet "github.com/netbirdio/netbird/client/net"
 )
@@ -442,7 +441,7 @@ func createWGInterface(t *testing.T, interfaceName, ipAddressCIDR string, listen
 
 	opts := iface.WGIFaceOpts{
 		IFaceName:    interfaceName,
-		Address:      wgaddr.MustParseWGAddress(ipAddressCIDR),
+		Address:      ipAddressCIDR,
 		WGPrivKey:    peerPrivateKey.String(),
 		WGPort:       listenPort,
 		MTU:          iface.DefaultMTU,

client/ios/NetBirdSDK/client.go

@@ -194,7 +194,6 @@ func (c *Client) GetStatusDetails() *StatusDetails {
 		}
 		pi := PeerInfo{
 			IP:                         p.IP,
-			IPv6:                       p.IPv6,
 			FQDN:                       p.FQDN,
 			LocalIceCandidateEndpoint:  p.LocalIceCandidateEndpoint,
 			RemoteIceCandidateEndpoint: p.RemoteIceCandidateEndpoint,
@@ -213,7 +212,7 @@ func (c *Client) GetStatusDetails() *StatusDetails {
 		}
 		peerInfos[n] = pi
 	}
-	return &StatusDetails{items: peerInfos, fqdn: fullStatus.LocalPeerState.FQDN, ip: fullStatus.LocalPeerState.IP, ipv6: fullStatus.LocalPeerState.IPv6}
+	return &StatusDetails{items: peerInfos, fqdn: fullStatus.LocalPeerState.FQDN, ip: fullStatus.LocalPeerState.IP}
 }
 
 // SetConnectionListener set the network connection listener

client/ios/NetBirdSDK/peer_notifier.go

@@ -5,7 +5,6 @@ package NetBirdSDK
 // PeerInfo describe information about the peers. It designed for the UI usage
 type PeerInfo struct {
 	IP                         string
-	IPv6                       string
 	FQDN                       string
 	LocalIceCandidateEndpoint  string
 	RemoteIceCandidateEndpoint string
@@ -24,11 +23,6 @@ type PeerInfo struct {
 	Routes                     RoutesDetails
 }
 
-// GetIPv6 returns the IPv6 address of the peer
-func (p PeerInfo) GetIPv6() string {
-	return p.IPv6
-}
-
 // GetRoutes return with RouteDetails
 func (p PeerInfo) GetRouteDetails() *RoutesDetails {
 	return &p.Routes
@@ -63,7 +57,6 @@ type StatusDetails struct {
 	items []PeerInfo
 	fqdn  string
 	ip    string
-	ipv6  string
 }
 
 // Add new PeerInfo to the collection
@@ -107,8 +100,3 @@ func (array StatusDetails) GetFQDN() string {
 func (array StatusDetails) GetIP() string {
 	return array.ip
 }
-
-// GetIPv6 return with the IPv6 of the local peer
-func (array StatusDetails) GetIPv6() string {
-	return array.ipv6
-}

client/ios/NetBirdSDK/preferences.go

@@ -110,24 +110,6 @@ func (p *Preferences) GetRosenpassPermissive() (bool, error) {
 	return cfg.RosenpassPermissive, err
 }
 
-// GetDisableIPv6 reads disable IPv6 setting from config file
-func (p *Preferences) GetDisableIPv6() (bool, error) {
-	if p.configInput.DisableIPv6 != nil {
-		return *p.configInput.DisableIPv6, nil
-	}
-
-	cfg, err := profilemanager.ReadConfig(p.configInput.ConfigPath)
-	if err != nil {
-		return false, err
-	}
-	return cfg.DisableIPv6, err
-}
-
-// SetDisableIPv6 stores the given value and waits for commit
-func (p *Preferences) SetDisableIPv6(disable bool) {
-	p.configInput.DisableIPv6 = &disable
-}
-
 // Commit write out the changes into config file
 func (p *Preferences) Commit() error {
 	// Use DirectUpdateOrCreateConfig to avoid atomic file operations (temp file + rename)

client/proto/daemon.proto

@@ -209,7 +209,6 @@ message LoginRequest {
   optional bool enableSSHRemotePortForwarding = 37;
   optional bool disableSSHAuth = 38;
   optional int32 sshJWTCacheTTL = 39;
-  optional bool disable_ipv6 = 40;
 }
 
 message LoginResponse {
@@ -317,8 +316,6 @@ message GetConfigResponse {
   bool disableSSHAuth = 25;
 
   int32 sshJWTCacheTTL = 26;
-
-  bool disable_ipv6 = 27;
 }
 
 // PeerState contains the latest state of a peer
@@ -341,7 +338,6 @@ message PeerState {
   google.protobuf.Duration latency = 17;
   string relayAddress = 18;
   bytes sshHostKey = 19;
-  string ipv6 = 20;
 }
 
 // LocalPeerState contains the latest state of the local peer
@@ -353,7 +349,6 @@ message LocalPeerState {
   bool rosenpassEnabled = 5;
   bool rosenpassPermissive = 6;
   repeated string networks = 7;
-  string ipv6 = 8;
 }
 
 // SignalState contains the latest state of a signal connection
@@ -682,7 +677,6 @@ message SetConfigRequest {
   optional bool enableSSHRemotePortForwarding = 32;
   optional bool disableSSHAuth = 33;
   optional int32 sshJWTCacheTTL = 34;
-  optional bool disable_ipv6 = 35;
 }
 
 message SetConfigResponse{}

client/server/server.go

@@ -375,7 +375,6 @@ func (s *Server) SetConfig(callerCtx context.Context, msg *proto.SetConfigReques
 	config.DisableNotifications = msg.DisableNotifications
 	config.LazyConnectionEnabled = msg.LazyConnectionEnabled
 	config.BlockInbound = msg.BlockInbound
-	config.DisableIPv6 = msg.DisableIpv6
 	config.EnableSSHRoot = msg.EnableSSHRoot
 	config.EnableSSHSFTP = msg.EnableSSHSFTP
 	config.EnableSSHLocalPortForwarding = msg.EnableSSHLocalPortForwarding
@@ -1470,7 +1469,6 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 	disableDNS := cfg.DisableDNS
 	disableClientRoutes := cfg.DisableClientRoutes
 	disableServerRoutes := cfg.DisableServerRoutes
-	disableIPv6 := cfg.DisableIPv6
 	blockLANAccess := cfg.BlockLANAccess
 
 	enableSSHRoot := false
@@ -1521,7 +1519,6 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 		DisableDns:                    disableDNS,
 		DisableClientRoutes:           disableClientRoutes,
 		DisableServerRoutes:           disableServerRoutes,
-		DisableIpv6:                   disableIPv6,
 		BlockLanAccess:                blockLANAccess,
 		EnableSSHRoot:                 enableSSHRoot,
 		EnableSSHSFTP:                 enableSSHSFTP,

client/server/setconfig_test.go

@@ -71,7 +71,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	disableNotifications := true
 	lazyConnectionEnabled := true
 	blockInbound := true
-	disableIPv6 := true
 	mtu := int64(1280)
 	sshJWTCacheTTL := int32(300)
 
@@ -96,7 +95,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 		DisableNotifications:  &disableNotifications,
 		LazyConnectionEnabled: &lazyConnectionEnabled,
 		BlockInbound:          &blockInbound,
-		DisableIpv6:          &disableIPv6,
 		NatExternalIPs:        []string{"1.2.3.4", "5.6.7.8"},
 		CleanNATExternalIPs:   false,
 		CustomDNSAddress:      []byte("1.1.1.1:53"),
@@ -142,7 +140,6 @@ func TestSetConfig_AllFieldsSaved(t *testing.T) {
 	require.Equal(t, disableNotifications, *cfg.DisableNotifications)
 	require.Equal(t, lazyConnectionEnabled, cfg.LazyConnectionEnabled)
 	require.Equal(t, blockInbound, cfg.BlockInbound)
-	require.Equal(t, disableIPv6, cfg.DisableIPv6)
 	require.Equal(t, []string{"1.2.3.4", "5.6.7.8"}, cfg.NATExternalIPs)
 	require.Equal(t, "1.1.1.1:53", cfg.CustomDNSAddress)
 	// IFaceBlackList contains defaults + extras
@@ -192,7 +189,6 @@ func verifyAllFieldsCovered(t *testing.T, req *proto.SetConfigRequest) {
 		"DisableNotifications":          true,
 		"LazyConnectionEnabled":         true,
 		"BlockInbound":                  true,
-		"DisableIpv6":                   true,
 		"NatExternalIPs":                true,
 		"CustomDNSAddress":              true,
 		"ExtraIFaceBlacklist":           true,
@@ -251,7 +247,6 @@ func TestCLIFlags_MappedToSetConfig(t *testing.T) {
 		"disable-firewall":                  "DisableFirewall",
 		"block-lan-access":                  "BlockLanAccess",
 		"block-inbound":                     "BlockInbound",
-		"disable-ipv6":                      "DisableIpv6",
 		"enable-lazy-connection":            "LazyConnectionEnabled",
 		"external-ip-map":                   "NatExternalIPs",
 		"dns-resolver-address":              "CustomDNSAddress",

client/ssh/proxy/proxy.go

@@ -141,7 +141,7 @@ func (p *SSHProxy) runProxySSHServer(jwtToken string) error {
 
 func (p *SSHProxy) handleSSHSession(session ssh.Session) {
 	ptyReq, winCh, isPty := session.Pty()
-	hasCommand := len(session.Command()) > 0
+	hasCommand := session.RawCommand() != ""
 
 	sshClient, err := p.getOrCreateBackendClient(session.Context(), session.User())
 	if err != nil {
@@ -180,7 +180,7 @@ func (p *SSHProxy) handleSSHSession(session ssh.Session) {
 	}
 
 	if hasCommand {
-		if err := serverSession.Run(strings.Join(session.Command(), " ")); err != nil {
+		if err := serverSession.Run(session.RawCommand()); err != nil {
 			log.Debugf("run command: %v", err)
 			p.handleProxyExitCode(session, err)
 		}

client/ssh/proxy/proxy_test.go

@@ -1,6 +1,7 @@
 package proxy
 
 import (
+	"bytes"
 	"context"
 	"crypto/rand"
 	"crypto/rsa"
@@ -245,6 +246,191 @@ func TestSSHProxy_Connect(t *testing.T) {
 	cancel()
 }
 
+// TestSSHProxy_CommandQuoting verifies that the proxy preserves shell quoting
+// when forwarding commands to the backend. This is critical for tools like
+// Ansible that send commands such as:
+//
+//	/bin/sh -c '( umask 77 && mkdir -p ... ) && sleep 0'
+//
+// The single quotes must be preserved so the backend shell receives the
+// subshell expression as a single argument to -c.
+func TestSSHProxy_CommandQuoting(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+
+	sshClient, cleanup := setupProxySSHClient(t)
+	defer cleanup()
+
+	// These commands simulate what the SSH protocol delivers as exec payloads.
+	// When a user types: ssh host '/bin/sh -c "( echo hello )"'
+	// the local shell strips the outer single quotes, and the SSH exec request
+	// contains the raw string: /bin/sh -c "( echo hello )"
+	//
+	// The proxy must forward this string verbatim. Using session.Command()
+	// (shlex.Split + strings.Join) strips the inner double quotes, breaking
+	// the command on the backend.
+	tests := []struct {
+		name    string
+		command string
+		expect  string
+	}{
+		{
+			name:    "subshell_in_double_quotes",
+			command: `/bin/sh -c "( echo from-subshell ) && echo outer"`,
+			expect:  "from-subshell\nouter\n",
+		},
+		{
+			name:    "printf_with_special_chars",
+			command: `/bin/sh -c "printf '%s\n' 'hello world'"`,
+			expect:  "hello world\n",
+		},
+		{
+			name:    "nested_command_substitution",
+			command: `/bin/sh -c "echo $(echo nested)"`,
+			expect:  "nested\n",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			session, err := sshClient.NewSession()
+			require.NoError(t, err)
+			defer func() { _ = session.Close() }()
+
+			var stderrBuf bytes.Buffer
+			session.Stderr = &stderrBuf
+
+			outputCh := make(chan []byte, 1)
+			errCh := make(chan error, 1)
+			go func() {
+				output, err := session.Output(tc.command)
+				outputCh <- output
+				errCh <- err
+			}()
+
+			select {
+			case output := <-outputCh:
+				err := <-errCh
+				if stderrBuf.Len() > 0 {
+					t.Logf("stderr: %s", stderrBuf.String())
+				}
+				require.NoError(t, err, "command should succeed: %s", tc.command)
+				assert.Equal(t, tc.expect, string(output), "output mismatch for: %s", tc.command)
+			case <-time.After(5 * time.Second):
+				t.Fatalf("command timed out: %s", tc.command)
+			}
+		})
+	}
+}
+
+// setupProxySSHClient creates a full proxy test environment and returns
+// an SSH client connected through the proxy to a backend NetBird SSH server.
+func setupProxySSHClient(t *testing.T) (*cryptossh.Client, func()) {
+	t.Helper()
+
+	const (
+		issuer   = "https://test-issuer.example.com"
+		audience = "test-audience"
+	)
+
+	jwksServer, privateKey, jwksURL := setupJWKSServer(t)
+
+	hostKey, err := nbssh.GeneratePrivateKey(nbssh.ED25519)
+	require.NoError(t, err)
+	hostPubKey, err := nbssh.GeneratePublicKey(hostKey)
+	require.NoError(t, err)
+
+	serverConfig := &server.Config{
+		HostKeyPEM: hostKey,
+		JWT: &server.JWTConfig{
+			Issuer:       issuer,
+			Audiences:    []string{audience},
+			KeysLocation: jwksURL,
+		},
+	}
+	sshServer := server.New(serverConfig)
+	sshServer.SetAllowRootLogin(true)
+
+	testUsername := testutil.GetTestUsername(t)
+	testJWTUser := "test-username"
+	testUserHash, err := sshuserhash.HashUserID(testJWTUser)
+	require.NoError(t, err)
+
+	authConfig := &sshauth.Config{
+		UserIDClaim:     sshauth.DefaultUserIDClaim,
+		AuthorizedUsers: []sshuserhash.UserIDHash{testUserHash},
+		MachineUsers: map[string][]uint32{
+			testUsername: {0},
+		},
+	}
+	sshServer.UpdateSSHAuth(authConfig)
+
+	sshServerAddr := server.StartTestServer(t, sshServer)
+
+	mockDaemon := startMockDaemon(t)
+
+	host, portStr, err := net.SplitHostPort(sshServerAddr)
+	require.NoError(t, err)
+	port, err := strconv.Atoi(portStr)
+	require.NoError(t, err)
+
+	mockDaemon.setHostKey(host, hostPubKey)
+
+	validToken := generateValidJWT(t, privateKey, issuer, audience, testJWTUser)
+	mockDaemon.setJWTToken(validToken)
+
+	proxyInstance, err := New(mockDaemon.addr, host, port, io.Discard, nil)
+	require.NoError(t, err)
+
+	origStdin := os.Stdin
+	origStdout := os.Stdout
+
+	stdinReader, stdinWriter, err := os.Pipe()
+	require.NoError(t, err)
+	stdoutReader, stdoutWriter, err := os.Pipe()
+	require.NoError(t, err)
+
+	os.Stdin = stdinReader
+	os.Stdout = stdoutWriter
+
+	clientConn, proxyConn := net.Pipe()
+
+	go func() { _, _ = io.Copy(stdinWriter, proxyConn) }()
+	go func() { _, _ = io.Copy(proxyConn, stdoutReader) }()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+
+	go func() {
+		_ = proxyInstance.Connect(ctx)
+	}()
+
+	sshConfig := &cryptossh.ClientConfig{
+		User:            testutil.GetTestUsername(t),
+		Auth:            []cryptossh.AuthMethod{},
+		HostKeyCallback: cryptossh.InsecureIgnoreHostKey(),
+		Timeout:         5 * time.Second,
+	}
+
+	sshClientConn, chans, reqs, err := cryptossh.NewClientConn(clientConn, "test", sshConfig)
+	require.NoError(t, err)
+
+	client := cryptossh.NewClient(sshClientConn, chans, reqs)
+
+	cleanupFn := func() {
+		_ = client.Close()
+		_ = clientConn.Close()
+		cancel()
+		os.Stdin = origStdin
+		os.Stdout = origStdout
+		_ = sshServer.Stop()
+		mockDaemon.stop()
+		jwksServer.Close()
+	}
+
+	return client, cleanupFn
+}
+
 type mockDaemonServer struct {
 	proto.UnimplementedDaemonServiceServer
 	hostKeys map[string][]byte

client/ssh/server/session_handlers.go

@@ -60,7 +60,7 @@ func (s *Server) sessionHandler(session ssh.Session) {
 	}
 
 	ptyReq, winCh, isPty := session.Pty()
-	hasCommand := len(session.Command()) > 0
+	hasCommand := session.RawCommand() != ""
 
 	if isPty && !hasCommand {
 		// ssh <host> - PTY interactive session (login)

client/status/status.go

@@ -60,7 +60,6 @@ type ConvertOptions struct {
 type PeerStateDetailOutput struct {
 	FQDN                   string           `json:"fqdn" yaml:"fqdn"`
 	IP                     string           `json:"netbirdIp" yaml:"netbirdIp"`
-	IPv6                   string           `json:"netbirdIpv6,omitempty" yaml:"netbirdIpv6,omitempty"`
 	PubKey                 string           `json:"publicKey" yaml:"publicKey"`
 	Status                 string           `json:"status" yaml:"status"`
 	LastStatusUpdate       time.Time        `json:"lastStatusUpdate" yaml:"lastStatusUpdate"`
@@ -140,7 +139,6 @@ type OutputOverview struct {
 	SignalState             SignalStateOutput          `json:"signal" yaml:"signal"`
 	Relays                  RelayStateOutput           `json:"relays" yaml:"relays"`
 	IP                      string                     `json:"netbirdIp" yaml:"netbirdIp"`
-	IPv6                    string                     `json:"netbirdIpv6,omitempty" yaml:"netbirdIpv6,omitempty"`
 	PubKey                  string                     `json:"publicKey" yaml:"publicKey"`
 	KernelInterface         bool                       `json:"usesKernelInterface" yaml:"usesKernelInterface"`
 	FQDN                    string                     `json:"fqdn" yaml:"fqdn"`
@@ -184,7 +182,6 @@ func ConvertToStatusOutputOverview(pbFullStatus *proto.FullStatus, opts ConvertO
 		SignalState:             signalOverview,
 		Relays:                  relayOverview,
 		IP:                      pbFullStatus.GetLocalPeerState().GetIP(),
-		IPv6:                    pbFullStatus.GetLocalPeerState().GetIpv6(),
 		PubKey:                  pbFullStatus.GetLocalPeerState().GetPubKey(),
 		KernelInterface:         pbFullStatus.GetLocalPeerState().GetKernelInterface(),
 		FQDN:                    pbFullStatus.GetLocalPeerState().GetFqdn(),
@@ -320,7 +317,6 @@ func mapPeers(
 		timeLocal := pbPeerState.GetConnStatusUpdate().AsTime().Local()
 		peerState := PeerStateDetailOutput{
 			IP:               pbPeerState.GetIP(),
-			IPv6:             pbPeerState.GetIpv6(),
 			PubKey:           pbPeerState.GetPubKey(),
 			Status:           pbPeerState.GetConnStatus(),
 			LastStatusUpdate: timeLocal,
@@ -421,11 +417,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		interfaceIP = "N/A"
 	}
 
-	ipv6Line := ""
-	if o.IPv6 != "" {
-		ipv6Line = fmt.Sprintf("NetBird IPv6: %s\n", o.IPv6)
-	}
-
 	var relaysString string
 	if showRelays {
 		for _, relay := range o.Relays.Details {
@@ -558,7 +549,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 			"Nameservers: %s\n"+
 			"FQDN: %s\n"+
 			"NetBird IP: %s\n"+
-			"%s"+
 			"Interface type: %s\n"+
 			"Quantum resistance: %s\n"+
 			"Lazy connection: %s\n"+
@@ -576,7 +566,6 @@ func (o *OutputOverview) GeneralSummary(showURL bool, showRelays bool, showNameS
 		dnsServersString,
 		domain.Domain(o.FQDN).SafeString(),
 		interfaceIP,
-		ipv6Line,
 		interfaceTypeString,
 		rosenpassEnabledStatus,
 		lazyConnectionEnabledStatus,
@@ -627,7 +616,6 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 	}
 
 	pbFullStatus.LocalPeerState.IP = fullStatus.LocalPeerState.IP
-	pbFullStatus.LocalPeerState.Ipv6 = fullStatus.LocalPeerState.IPv6
 	pbFullStatus.LocalPeerState.PubKey = fullStatus.LocalPeerState.PubKey
 	pbFullStatus.LocalPeerState.KernelInterface = fullStatus.LocalPeerState.KernelInterface
 	pbFullStatus.LocalPeerState.Fqdn = fullStatus.LocalPeerState.FQDN
@@ -640,7 +628,6 @@ func ToProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 	for _, peerState := range fullStatus.Peers {
 		pbPeerState := &proto.PeerState{
 			IP:                         peerState.IP,
-			Ipv6:                       peerState.IPv6,
 			PubKey:                     peerState.PubKey,
 			ConnStatus:                 peerState.ConnStatus.String(),
 			ConnStatusUpdate:           timestamppb.New(peerState.ConnStatusUpdate),
@@ -746,15 +733,9 @@ func parsePeers(peers PeersStateOutput, rosenpassEnabled, rosenpassPermissive bo
 			networks = strings.Join(peerState.Networks, ", ")
 		}
 
-		ipv6Line := ""
-		if peerState.IPv6 != "" {
-			ipv6Line = fmt.Sprintf("  NetBird IPv6: %s\n", peerState.IPv6)
-		}
-
 		peerString := fmt.Sprintf(
 			"\n %s:\n"+
 				"  NetBird IP: %s\n"+
-				"%s"+
 				"  Public key: %s\n"+
 				"  Status: %s\n"+
 				"  -- detail --\n"+
@@ -770,7 +751,6 @@ func parsePeers(peers PeersStateOutput, rosenpassEnabled, rosenpassPermissive bo
 				"  Latency: %s\n",
 			domain.Domain(peerState.FQDN).SafeString(),
 			peerState.IP,
-			ipv6Line,
 			peerState.PubKey,
 			peerState.Status,
 			peerState.ConnType,
@@ -807,9 +787,6 @@ func skipDetailByFilters(peerState *proto.PeerState, peerStatus string, statusFi
 
 	if len(ipsFilter) > 0 {
 		_, ok := ipsFilter[peerState.IP]
-		if !ok {
-			_, ok = ipsFilter[peerState.Ipv6]
-		}
 		if !ok {
 			ipEval = true
 		}
@@ -928,7 +905,6 @@ func anonymizePeerDetail(a *anonymize.Anonymizer, peer *PeerStateDetailOutput) {
 		peer.IceCandidateEndpoint.Remote = fmt.Sprintf("%s:%s", a.AnonymizeIPString(remoteIP), port)
 	}
 
-	peer.IPv6 = a.AnonymizeIPString(peer.IPv6)
 	peer.RelayAddress = a.AnonymizeURI(peer.RelayAddress)
 
 	for i, route := range peer.Networks {
@@ -953,7 +929,6 @@ func anonymizeOverview(a *anonymize.Anonymizer, overview *OutputOverview) {
 	overview.SignalState.Error = a.AnonymizeString(overview.SignalState.Error)
 
 	overview.IP = a.AnonymizeIPString(overview.IP)
-	overview.IPv6 = a.AnonymizeIPString(overview.IPv6)
 	for i, detail := range overview.Relays.Details {
 		detail.URI = a.AnonymizeURI(detail.URI)
 		detail.Error = a.AnonymizeString(detail.Error)

client/status/status_test.go

@@ -32,7 +32,6 @@ var resp = &proto.StatusResponse{
 		Peers: []*proto.PeerState{
 			{
 				IP:                         "192.168.178.101",
-				Ipv6:                       "fd00::1",
 				PubKey:                     "Pubkey1",
 				Fqdn:                       "peer-1.awesome-domain.com",
 				ConnStatus:                 "Connected",
@@ -91,7 +90,6 @@ var resp = &proto.StatusResponse{
 		},
 		LocalPeerState: &proto.LocalPeerState{
 			IP:              "192.168.178.100/16",
-			Ipv6:            "fd00::100",
 			PubKey:          "Some-Pub-Key",
 			KernelInterface: true,
 			Fqdn:            "some-localhost.awesome-domain.com",
@@ -132,7 +130,6 @@ var overview = OutputOverview{
 		Details: []PeerStateDetailOutput{
 			{
 				IP:               "192.168.178.101",
-				IPv6:             "fd00::1",
 				PubKey:           "Pubkey1",
 				FQDN:             "peer-1.awesome-domain.com",
 				Status:           "Connected",
@@ -207,7 +204,6 @@ var overview = OutputOverview{
 		},
 	},
 	IP:              "192.168.178.100/16",
-	IPv6:            "fd00::100",
 	PubKey:          "Some-Pub-Key",
 	KernelInterface: true,
 	FQDN:            "some-localhost.awesome-domain.com",
@@ -288,7 +284,6 @@ func TestParsingToJSON(t *testing.T) {
               {
                 "fqdn": "peer-1.awesome-domain.com",
                 "netbirdIp": "192.168.178.101",
-                "netbirdIpv6": "fd00::1",
                 "publicKey": "Pubkey1",
                 "status": "Connected",
                 "lastStatusUpdate": "2001-01-01T01:01:01Z",
@@ -366,7 +361,6 @@ func TestParsingToJSON(t *testing.T) {
             ]
           },
           "netbirdIp": "192.168.178.100/16",
-          "netbirdIpv6": "fd00::100",
           "publicKey": "Some-Pub-Key",
           "usesKernelInterface": true,
           "fqdn": "some-localhost.awesome-domain.com",
@@ -424,7 +418,6 @@ func TestParsingToYAML(t *testing.T) {
     details:
         - fqdn: peer-1.awesome-domain.com
           netbirdIp: 192.168.178.101
-          netbirdIpv6: fd00::1
           publicKey: Pubkey1
           status: Connected
           lastStatusUpdate: 2001-01-01T01:01:01Z
@@ -484,7 +477,6 @@ relays:
           available: false
           error: 'context: deadline exceeded'
 netbirdIp: 192.168.178.100/16
-netbirdIpv6: fd00::100
 publicKey: Some-Pub-Key
 usesKernelInterface: true
 fqdn: some-localhost.awesome-domain.com
@@ -531,7 +523,6 @@ func TestParsingToDetail(t *testing.T) {
 		`Peers detail:
  peer-1.awesome-domain.com:
   NetBird IP: 192.168.178.101
-  NetBird IPv6: fd00::1
   Public key: Pubkey1
   Status: Connected
   -- detail --
@@ -577,7 +568,6 @@ Nameservers:
   [1.1.1.1:53, 2.2.2.2:53] for [example.com, example.net] is Unavailable, reason: timeout
 FQDN: some-localhost.awesome-domain.com
 NetBird IP: 192.168.178.100/16
-NetBird IPv6: fd00::100
 Interface type: Kernel
 Quantum resistance: false
 Lazy connection: false
@@ -602,7 +592,6 @@ Relays: 1/2 Available
 Nameservers: 1/2 Available
 FQDN: some-localhost.awesome-domain.com
 NetBird IP: 192.168.178.100/16
-NetBird IPv6: fd00::100
 Interface type: Kernel
 Quantum resistance: false
 Lazy connection: false

client/system/info.go

@@ -70,7 +70,6 @@ type Info struct {
 	DisableFirewall     bool
 	BlockLANAccess      bool
 	BlockInbound        bool
-	DisableIPv6         bool
 
 	LazyConnectionEnabled bool
 
@@ -85,7 +84,7 @@ func (i *Info) SetFlags(
 	rosenpassEnabled, rosenpassPermissive bool,
 	serverSSHAllowed *bool,
 	disableClientRoutes, disableServerRoutes,
-	disableDNS, disableFirewall, blockLANAccess, blockInbound, disableIPv6, lazyConnectionEnabled bool,
+	disableDNS, disableFirewall, blockLANAccess, blockInbound, lazyConnectionEnabled bool,
 	enableSSHRoot, enableSSHSFTP, enableSSHLocalPortForwarding, enableSSHRemotePortForwarding *bool,
 	disableSSHAuth *bool,
 ) {
@@ -101,7 +100,6 @@ func (i *Info) SetFlags(
 	i.DisableFirewall = disableFirewall
 	i.BlockLANAccess = blockLANAccess
 	i.BlockInbound = blockInbound
-	i.DisableIPv6 = disableIPv6
 
 	i.LazyConnectionEnabled = lazyConnectionEnabled
 

client/ui/client_ui.go

@@ -278,7 +278,6 @@ type serviceClient struct {
 	sDisableDNS                 *widget.Check
 	sDisableClientRoutes        *widget.Check
 	sDisableServerRoutes        *widget.Check
-	sDisableIPv6                *widget.Check
 	sBlockLANAccess             *widget.Check
 	sEnableSSHRoot              *widget.Check
 	sEnableSSHSFTP              *widget.Check
@@ -299,7 +298,6 @@ type serviceClient struct {
 	disableDNS                 bool
 	disableClientRoutes        bool
 	disableServerRoutes        bool
-	disableIPv6                bool
 	blockLANAccess             bool
 	enableSSHRoot              bool
 	enableSSHSFTP              bool
@@ -465,7 +463,6 @@ func (s *serviceClient) showSettingsUI() {
 	s.sDisableDNS = widget.NewCheck("Keeps system DNS settings unchanged", nil)
 	s.sDisableClientRoutes = widget.NewCheck("This peer won't route traffic to other peers", nil)
 	s.sDisableServerRoutes = widget.NewCheck("This peer won't act as router for others", nil)
-	s.sDisableIPv6 = widget.NewCheck("Disable IPv6 overlay addressing", nil)
 	s.sBlockLANAccess = widget.NewCheck("Blocks local network access when used as exit node", nil)
 	s.sEnableSSHRoot = widget.NewCheck("Enable SSH Root Login", nil)
 	s.sEnableSSHSFTP = widget.NewCheck("Enable SSH SFTP", nil)
@@ -583,7 +580,6 @@ func (s *serviceClient) hasSettingsChanged(iMngURL string, port, mtu int64) bool
 		s.disableDNS != s.sDisableDNS.Checked ||
 		s.disableClientRoutes != s.sDisableClientRoutes.Checked ||
 		s.disableServerRoutes != s.sDisableServerRoutes.Checked ||
-		s.disableIPv6 != s.sDisableIPv6.Checked ||
 		s.blockLANAccess != s.sBlockLANAccess.Checked ||
 		s.hasSSHChanges()
 }
@@ -636,7 +632,6 @@ func (s *serviceClient) buildSetConfigRequest(iMngURL string, port, mtu int64) (
 	req.DisableDns = &s.sDisableDNS.Checked
 	req.DisableClientRoutes = &s.sDisableClientRoutes.Checked
 	req.DisableServerRoutes = &s.sDisableServerRoutes.Checked
-	req.DisableIpv6 = &s.sDisableIPv6.Checked
 	req.BlockLanAccess = &s.sBlockLANAccess.Checked
 
 	req.EnableSSHRoot = &s.sEnableSSHRoot.Checked
@@ -676,23 +671,24 @@ func (s *serviceClient) sendConfigUpdate(req *proto.SetConfigRequest) error {
 		return fmt.Errorf("set config: %w", err)
 	}
 
-	// Reconnect if connected to apply the new settings.
-	// Use a background context so the reconnect outlives the settings window.
+	// Reconnect if connected to apply the new settings
 	go func() {
-		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-		defer cancel()
-		status, err := conn.Status(ctx, &proto.StatusRequest{})
+		status, err := conn.Status(s.ctx, &proto.StatusRequest{})
 		if err != nil {
-			log.Errorf("failed to get service status: %v", err)
+			log.Errorf("get service status: %v", err)
 			return
 		}
 		if status.Status == string(internal.StatusConnected) {
-			if _, err = conn.Down(ctx, &proto.DownRequest{}); err != nil {
-				log.Errorf("failed to stop service: %v", err)
+			// run down & up
+			_, err = conn.Down(s.ctx, &proto.DownRequest{})
+			if err != nil {
+				log.Errorf("down service: %v", err)
 			}
-			// TODO: wait for the service to be idle before calling Up, or use a fresh connection
-			if _, err = conn.Up(ctx, &proto.UpRequest{}); err != nil {
-				log.Errorf("failed to start service: %v", err)
+
+			_, err = conn.Up(s.ctx, &proto.UpRequest{})
+			if err != nil {
+				log.Errorf("up service: %v", err)
+				return
 			}
 		}
 	}()
@@ -729,7 +725,6 @@ func (s *serviceClient) getNetworkForm() *widget.Form {
 			{Text: "Disable DNS", Widget: s.sDisableDNS},
 			{Text: "Disable Client Routes", Widget: s.sDisableClientRoutes},
 			{Text: "Disable Server Routes", Widget: s.sDisableServerRoutes},
-			{Text: "Disable IPv6", Widget: s.sDisableIPv6},
 			{Text: "Disable LAN Access", Widget: s.sBlockLANAccess},
 		},
 	}
@@ -1374,7 +1369,6 @@ func (s *serviceClient) getSrvConfig() {
 	s.disableDNS = cfg.DisableDNS
 	s.disableClientRoutes = cfg.DisableClientRoutes
 	s.disableServerRoutes = cfg.DisableServerRoutes
-	s.disableIPv6 = cfg.DisableIPv6
 	s.blockLANAccess = cfg.BlockLANAccess
 
 	if cfg.EnableSSHRoot != nil {
@@ -1415,7 +1409,6 @@ func (s *serviceClient) getSrvConfig() {
 		s.sDisableDNS.SetChecked(cfg.DisableDNS)
 		s.sDisableClientRoutes.SetChecked(cfg.DisableClientRoutes)
 		s.sDisableServerRoutes.SetChecked(cfg.DisableServerRoutes)
-		s.sDisableIPv6.SetChecked(cfg.DisableIPv6)
 		s.sBlockLANAccess.SetChecked(cfg.BlockLANAccess)
 		if cfg.EnableSSHRoot != nil {
 			s.sEnableSSHRoot.SetChecked(*cfg.EnableSSHRoot)
@@ -1503,7 +1496,6 @@ func protoConfigToConfig(cfg *proto.GetConfigResponse) *profilemanager.Config {
 	config.DisableDNS = cfg.DisableDns
 	config.DisableClientRoutes = cfg.DisableClientRoutes
 	config.DisableServerRoutes = cfg.DisableServerRoutes
-	config.DisableIPv6 = cfg.DisableIpv6
 	config.BlockLANAccess = cfg.BlockLanAccess
 
 	config.EnableSSHRoot = &cfg.EnableSSHRoot

client/ui/network.go

@@ -195,7 +195,7 @@ func getOverlappingNetworks(routes []*proto.Network) []*proto.Network {
 func getExitNodeNetworks(routes []*proto.Network) []*proto.Network {
 	var filteredRoutes []*proto.Network
 	for _, route := range routes {
-		if route.Range == "0.0.0.0/0" || route.Range == "::/0" {
+		if route.Range == "0.0.0.0/0" {
 			filteredRoutes = append(filteredRoutes, route)
 		}
 	}
@@ -489,7 +489,7 @@ func (s *serviceClient) getExitNodes(conn proto.DaemonServiceClient) ([]*proto.N
 
 	var exitNodes []*proto.Network
 	for _, network := range resp.Routes {
-		if network.Range == "0.0.0.0/0" || network.Range == "::/0" {
+		if network.Range == "0.0.0.0/0" {
 			exitNodes = append(exitNodes, network)
 		}
 	}

client/wasm/cmd/main.go

@@ -5,7 +5,6 @@ package main
 import (
 	"context"
 	"fmt"
-	"net"
 	"syscall/js"
 	"time"
 
@@ -82,10 +81,6 @@ func parseClientOptions(jsOptions js.Value) (netbird.Options, error) {
 		options.DeviceName = deviceName.String()
 	}
 
-	if disableIPv6 := jsOptions.Get("disableIPv6"); !disableIPv6.IsNull() && !disableIPv6.IsUndefined() {
-		options.DisableIPv6 = disableIPv6.Bool()
-	}
-
 	return options, nil
 }
 
@@ -232,7 +227,7 @@ func performPingTCP(client *netbird.Client, hostname string, port int) {
 	ctx, cancel := context.WithTimeout(context.Background(), pingTimeout)
 	defer cancel()
 
-	address := net.JoinHostPort(hostname, fmt.Sprintf("%d", port))
+	address := fmt.Sprintf("%s:%d", hostname, port)
 	start := time.Now()
 	conn, err := client.Dial(ctx, "tcp", address)
 	if err != nil {

client/wasm/internal/rdp/rdcleanpath.go

@@ -82,7 +82,7 @@ func NewRDCleanPathProxy(client interface {
 
 // CreateProxy creates a new proxy endpoint for the given destination
 func (p *RDCleanPathProxy) CreateProxy(hostname, port string) js.Value {
-	destination := net.JoinHostPort(hostname, port)
+	destination := fmt.Sprintf("%s:%s", hostname, port)
 
 	return js.Global().Get("Promise").New(js.FuncOf(func(_ js.Value, args []js.Value) any {
 		resolve := args[0]

client/wasm/internal/ssh/client.go

@@ -6,7 +6,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"net"
 	"sync"
 	"time"
 
@@ -48,7 +47,7 @@ func NewClient(nbClient *netbird.Client) *Client {
 
 // Connect establishes an SSH connection through NetBird network
 func (c *Client) Connect(host string, port int, username, jwtToken string) error {
-	addr := net.JoinHostPort(host, fmt.Sprintf("%d", port))
+	addr := fmt.Sprintf("%s:%d", host, port)
 	logrus.Infof("SSH: Connecting to %s as %s", addr, username)
 
 	authMethods, err := c.getAuthMethods(jwtToken)

go.mod

@@ -30,10 +30,10 @@ require (
 require (
 	fyne.io/fyne/v2 v2.7.0
 	fyne.io/systray v1.12.1-0.20260116214250-81f8e1a496f9
+	github.com/TheJumpCloud/jcapi-go v3.0.0+incompatible
 	github.com/awnumar/memguard v0.23.0
 	github.com/aws/aws-sdk-go-v2 v1.36.3
 	github.com/aws/aws-sdk-go-v2/config v1.29.14
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.67
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.79.2
 	github.com/c-robinson/iplib v1.0.3
 	github.com/caddyserver/certmagic v0.21.3
@@ -144,6 +144,7 @@ require (
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/awnumar/memcall v0.4.0 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.10 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.67 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.30 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.34 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.34 // indirect
@@ -254,7 +255,7 @@ require (
 	github.com/russellhaering/goxmldsig v1.5.0 // indirect
 	github.com/rymdport/portal v0.4.2 // indirect
 	github.com/shirou/gopsutil/v4 v4.25.1 // indirect
-	github.com/shoenig/go-m1cpu v0.2.1 // indirect
+	github.com/shoenig/go-m1cpu v0.2.0 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/spf13/cast v1.7.0 // indirect
 	github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c // indirect

go.sum

@@ -34,6 +34,8 @@ github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSC
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
+github.com/TheJumpCloud/jcapi-go v3.0.0+incompatible h1:hqcTK6ZISdip65SR792lwYJTa/axESA0889D3UlZbLo=
+github.com/TheJumpCloud/jcapi-go v3.0.0+incompatible/go.mod h1:6B1nuc1MUs6c62ODZDl7hVE5Pv7O2XGSkgg2olnq34I=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
 github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
@@ -511,8 +513,8 @@ github.com/shirou/gopsutil/v3 v3.24.4/go.mod h1:lTd2mdiOspcqLgAnr9/nGi71NkeMpWKd
 github.com/shirou/gopsutil/v4 v4.25.1 h1:QSWkTc+fu9LTAWfkZwZ6j8MSUk4A2LV7rbH0ZqmLjXs=
 github.com/shirou/gopsutil/v4 v4.25.1/go.mod h1:RoUCUpndaJFtT+2zsZzzmhvbfGoDCJ7nFXKJf8GqJbI=
 github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
-github.com/shoenig/go-m1cpu v0.2.1 h1:yqRB4fvOge2+FyRXFkXqsyMoqPazv14Yyy+iyccT2E4=
-github.com/shoenig/go-m1cpu v0.2.1/go.mod h1:KkDOw6m3ZJQAPHbrzkZki4hnx+pDRR1Lo+ldA56wD5w=
+github.com/shoenig/go-m1cpu v0.2.0 h1:t4GNqvPZ84Vjtpboo/kT3pIkbaK3vc+JIlD/Wz1zSFY=
+github.com/shoenig/go-m1cpu v0.2.0/go.mod h1:KkDOw6m3ZJQAPHbrzkZki4hnx+pDRR1Lo+ldA56wD5w=
 github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
 github.com/shoenig/test v1.7.0 h1:eWcHtTXa6QLnBvm0jgEabMRN/uJ4DMV3M8xUGgRkZmk=
 github.com/shoenig/test v1.7.0/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=

management/internals/modules/reverseproxy/service/service.go

@@ -262,9 +262,7 @@ func (s *Service) ToAPIResponse() *api.Service {
 		if opts == nil {
 			opts = &api.ServiceTargetOptions{}
 		}
-		if target.ProxyProtocol {
-			opts.ProxyProtocol = &target.ProxyProtocol
-		}
+		opts.ProxyProtocol = &target.ProxyProtocol
 		st.Options = opts
 		apiTargets = append(apiTargets, st)
 	}
@@ -850,7 +848,7 @@ func IsPortBasedProtocol(mode string) bool {
 }
 
 const (
-	maxCustomHeaders  = 16
+	maxCustomHeaders = 16
 	maxHeaderKeyLen   = 128
 	maxHeaderValueLen = 4096
 )
@@ -947,6 +945,7 @@ func containsCRLF(s string) bool {
 }
 
 func validateHeaderAuths(headers []*HeaderAuthConfig) error {
+	seen := make(map[string]struct{})
 	for i, h := range headers {
 		if h == nil || !h.Enabled {
 			continue
@@ -967,6 +966,10 @@ func validateHeaderAuths(headers []*HeaderAuthConfig) error {
 		if canonical == "Host" {
 			return fmt.Errorf("header_auths[%d]: Host header cannot be used for auth", i)
 		}
+		if _, dup := seen[canonical]; dup {
+			return fmt.Errorf("header_auths[%d]: duplicate header %q (same canonical form already configured)", i, h.Header)
+		}
+		seen[canonical] = struct{}{}
 		if len(h.Value) > maxHeaderValueLen {
 			return fmt.Errorf("header_auths[%d]: value exceeds maximum length of %d", i, maxHeaderValueLen)
 		}

management/internals/modules/reverseproxy/service/service_test.go

@@ -935,107 +935,3 @@ func TestExposeServiceRequest_Validate_HTTPAllowsAuth(t *testing.T) {
 	req := ExposeServiceRequest{Port: 8080, Mode: "http", Pin: "123456"}
 	require.NoError(t, req.Validate())
 }
-
-func TestValidate_HeaderAuths(t *testing.T) {
-	t.Run("single valid header", func(t *testing.T) {
-		rp := validProxy()
-		rp.Auth = AuthConfig{
-			HeaderAuths: []*HeaderAuthConfig{
-				{Enabled: true, Header: "X-API-Key", Value: "secret"},
-			},
-		}
-		require.NoError(t, rp.Validate())
-	})
-
-	t.Run("multiple headers same canonical name allowed", func(t *testing.T) {
-		rp := validProxy()
-		rp.Auth = AuthConfig{
-			HeaderAuths: []*HeaderAuthConfig{
-				{Enabled: true, Header: "Authorization", Value: "Bearer token-1"},
-				{Enabled: true, Header: "Authorization", Value: "Bearer token-2"},
-			},
-		}
-		require.NoError(t, rp.Validate())
-	})
-
-	t.Run("multiple headers different case same canonical allowed", func(t *testing.T) {
-		rp := validProxy()
-		rp.Auth = AuthConfig{
-			HeaderAuths: []*HeaderAuthConfig{
-				{Enabled: true, Header: "x-api-key", Value: "key-1"},
-				{Enabled: true, Header: "X-Api-Key", Value: "key-2"},
-			},
-		}
-		require.NoError(t, rp.Validate())
-	})
-
-	t.Run("multiple different headers allowed", func(t *testing.T) {
-		rp := validProxy()
-		rp.Auth = AuthConfig{
-			HeaderAuths: []*HeaderAuthConfig{
-				{Enabled: true, Header: "Authorization", Value: "Bearer tok"},
-				{Enabled: true, Header: "X-API-Key", Value: "key"},
-			},
-		}
-		require.NoError(t, rp.Validate())
-	})
-
-	t.Run("empty header name rejected", func(t *testing.T) {
-		rp := validProxy()
-		rp.Auth = AuthConfig{
-			HeaderAuths: []*HeaderAuthConfig{
-				{Enabled: true, Header: "", Value: "val"},
-			},
-		}
-		err := rp.Validate()
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "header name is required")
-	})
-
-	t.Run("hop-by-hop header rejected", func(t *testing.T) {
-		rp := validProxy()
-		rp.Auth = AuthConfig{
-			HeaderAuths: []*HeaderAuthConfig{
-				{Enabled: true, Header: "Connection", Value: "val"},
-			},
-		}
-		err := rp.Validate()
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "hop-by-hop")
-	})
-
-	t.Run("host header rejected", func(t *testing.T) {
-		rp := validProxy()
-		rp.Auth = AuthConfig{
-			HeaderAuths: []*HeaderAuthConfig{
-				{Enabled: true, Header: "Host", Value: "val"},
-			},
-		}
-		err := rp.Validate()
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "Host header cannot be used")
-	})
-
-	t.Run("disabled entries skipped", func(t *testing.T) {
-		rp := validProxy()
-		rp.Auth = AuthConfig{
-			HeaderAuths: []*HeaderAuthConfig{
-				{Enabled: false, Header: "", Value: ""},
-				{Enabled: true, Header: "X-Key", Value: "val"},
-			},
-		}
-		require.NoError(t, rp.Validate())
-	})
-
-	t.Run("value too long rejected", func(t *testing.T) {
-		rp := validProxy()
-		rp.Auth = AuthConfig{
-			HeaderAuths: []*HeaderAuthConfig{
-				{Enabled: true, Header: "X-Key", Value: strings.Repeat("a", maxHeaderValueLen+1)},
-			},
-		}
-		err := rp.Validate()
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "exceeds maximum length")
-	})
-}

management/internals/shared/grpc/conversion.go

@@ -284,8 +284,7 @@ func toProtocolFirewallRules(rules []*types.FirewallRule) []*proto.FirewallRule
 
 		fwRule := &proto.FirewallRule{
 			PolicyID:  []byte(rule.PolicyID),
-			PeerIP:    rule.PeerIP, //nolint:staticcheck // populated for backward compatibility
-
+			PeerIP:    rule.PeerIP,
 			Direction: getProtoDirection(rule.Direction),
 			Action:    getProtoAction(rule.Action),
 			Protocol:  getProtoProtocol(rule.Protocol),

management/server/idp/idp.go

@@ -197,7 +197,6 @@ func NewManager(ctx context.Context, config Config, appMetrics telemetry.AppMetr
 	case "jumpcloud":
 		return NewJumpCloudManager(JumpCloudClientConfig{
 			APIToken: config.ExtraConfig["ApiToken"],
-			ApiUrl:   config.ExtraConfig["ApiUrl"],
 		}, appMetrics)
 	case "pocketid":
 		return NewPocketIdManager(PocketIdClientConfig{

management/server/idp/jumpcloud.go

@@ -1,40 +1,24 @@
 package idp
 
 import (
-	"bytes"
 	"context"
-	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
 	"strings"
 
+	v1 "github.com/TheJumpCloud/jcapi-go/v1"
+
 	"github.com/netbirdio/netbird/management/server/telemetry"
 )
 
 const (
-	jumpCloudDefaultApiUrl  = "https://console.jumpcloud.com"
-	jumpCloudSearchPageSize = 100
+	contentType = "application/json"
+	accept      = "application/json"
 )
 
-// jumpCloudUser represents a JumpCloud V1 API system user.
-type jumpCloudUser struct {
-	ID         string `json:"_id"`
-	Email      string `json:"email"`
-	Firstname  string `json:"firstname"`
-	Middlename string `json:"middlename"`
-	Lastname   string `json:"lastname"`
-}
-
-// jumpCloudUserList represents the response from the JumpCloud search endpoint.
-type jumpCloudUserList struct {
-	Results    []jumpCloudUser `json:"results"`
-	TotalCount int             `json:"totalCount"`
-}
-
 // JumpCloudManager JumpCloud manager client instance.
 type JumpCloudManager struct {
-	apiBase     string
+	client      *v1.APIClient
 	apiToken    string
 	httpClient  ManagerHTTPClient
 	credentials ManagerCredentials
@@ -45,7 +29,6 @@ type JumpCloudManager struct {
 // JumpCloudClientConfig JumpCloud manager client configurations.
 type JumpCloudClientConfig struct {
 	APIToken string
-	ApiUrl   string
 }
 
 // JumpCloudCredentials JumpCloud authentication information.
@@ -72,15 +55,7 @@ func NewJumpCloudManager(config JumpCloudClientConfig, appMetrics telemetry.AppM
 		return nil, fmt.Errorf("jumpCloud IdP configuration is incomplete, ApiToken is missing")
 	}
 
-	apiBase := config.ApiUrl
-	if apiBase == "" {
-		apiBase = jumpCloudDefaultApiUrl
-	}
-	apiBase = strings.TrimSuffix(apiBase, "/")
-	if !strings.HasSuffix(apiBase, "/api") {
-		apiBase += "/api"
-	}
-
+	client := v1.NewAPIClient(v1.NewConfiguration())
 	credentials := &JumpCloudCredentials{
 		clientConfig: config,
 		httpClient:   httpClient,
@@ -89,7 +64,7 @@ func NewJumpCloudManager(config JumpCloudClientConfig, appMetrics telemetry.AppM
 	}
 
 	return &JumpCloudManager{
-		apiBase:     apiBase,
+		client:      client,
 		apiToken:    config.APIToken,
 		httpClient:  httpClient,
 		credentials: credentials,
@@ -103,35 +78,10 @@ func (jc *JumpCloudCredentials) Authenticate(_ context.Context) (JWTToken, error
 	return JWTToken{}, nil
 }
 
-// doRequest executes an HTTP request against the JumpCloud V1 API.
-func (jm *JumpCloudManager) doRequest(ctx context.Context, method, path string, body io.Reader) ([]byte, error) {
-	reqURL := jm.apiBase + path
-	req, err := http.NewRequestWithContext(ctx, method, reqURL, body)
-	if err != nil {
-		return nil, err
-	}
-
-	req.Header.Set("x-api-key", jm.apiToken)
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Accept", "application/json")
-
-	resp, err := jm.httpClient.Do(req)
-	if err != nil {
-		if jm.appMetrics != nil {
-			jm.appMetrics.IDPMetrics().CountRequestError()
-		}
-		return nil, err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		if jm.appMetrics != nil {
-			jm.appMetrics.IDPMetrics().CountRequestStatusError()
-		}
-		return nil, fmt.Errorf("JumpCloud API request %s %s failed with status %d", method, path, resp.StatusCode)
-	}
-
-	return io.ReadAll(resp.Body)
+func (jm *JumpCloudManager) authenticationContext() context.Context {
+	return context.WithValue(context.Background(), v1.ContextAPIKey, v1.APIKey{
+		Key: jm.apiToken,
+	})
 }
 
 // UpdateUserAppMetadata updates user app metadata based on userID and metadata map.
@@ -140,21 +90,25 @@ func (jm *JumpCloudManager) UpdateUserAppMetadata(_ context.Context, _ string, _
 }
 
 // GetUserDataByID requests user data from JumpCloud via ID.
-func (jm *JumpCloudManager) GetUserDataByID(ctx context.Context, userID string, appMetadata AppMetadata) (*UserData, error) {
-	body, err := jm.doRequest(ctx, http.MethodGet, "/systemusers/"+userID, nil)
+func (jm *JumpCloudManager) GetUserDataByID(_ context.Context, userID string, appMetadata AppMetadata) (*UserData, error) {
+	authCtx := jm.authenticationContext()
+	user, resp, err := jm.client.SystemusersApi.SystemusersGet(authCtx, userID, contentType, accept, nil)
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		if jm.appMetrics != nil {
+			jm.appMetrics.IDPMetrics().CountRequestStatusError()
+		}
+		return nil, fmt.Errorf("unable to get user %s, statusCode %d", userID, resp.StatusCode)
+	}
 
 	if jm.appMetrics != nil {
 		jm.appMetrics.IDPMetrics().CountGetUserDataByID()
 	}
 
-	var user jumpCloudUser
-	if err = jm.helper.Unmarshal(body, &user); err != nil {
-		return nil, err
-	}
-
 	userData := parseJumpCloudUser(user)
 	userData.AppMetadata = appMetadata
 
@@ -162,20 +116,30 @@ func (jm *JumpCloudManager) GetUserDataByID(ctx context.Context, userID string,
 }
 
 // GetAccount returns all the users for a given profile.
-func (jm *JumpCloudManager) GetAccount(ctx context.Context, accountID string) ([]*UserData, error) {
-	allUsers, err := jm.searchAllUsers(ctx)
+func (jm *JumpCloudManager) GetAccount(_ context.Context, accountID string) ([]*UserData, error) {
+	authCtx := jm.authenticationContext()
+	userList, resp, err := jm.client.SearchApi.SearchSystemusersPost(authCtx, contentType, accept, nil)
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		if jm.appMetrics != nil {
+			jm.appMetrics.IDPMetrics().CountRequestStatusError()
+		}
+		return nil, fmt.Errorf("unable to get account %s users, statusCode %d", accountID, resp.StatusCode)
+	}
 
 	if jm.appMetrics != nil {
 		jm.appMetrics.IDPMetrics().CountGetAccount()
 	}
 
-	users := make([]*UserData, 0, len(allUsers))
-	for _, user := range allUsers {
+	users := make([]*UserData, 0)
+	for _, user := range userList.Results {
 		userData := parseJumpCloudUser(user)
 		userData.AppMetadata.WTAccountID = accountID
+
 		users = append(users, userData)
 	}
 
@@ -184,18 +148,27 @@ func (jm *JumpCloudManager) GetAccount(ctx context.Context, accountID string) ([
 
 // GetAllAccounts gets all registered accounts with corresponding user data.
 // It returns a list of users indexed by accountID.
-func (jm *JumpCloudManager) GetAllAccounts(ctx context.Context) (map[string][]*UserData, error) {
-	allUsers, err := jm.searchAllUsers(ctx)
+func (jm *JumpCloudManager) GetAllAccounts(_ context.Context) (map[string][]*UserData, error) {
+	authCtx := jm.authenticationContext()
+	userList, resp, err := jm.client.SearchApi.SearchSystemusersPost(authCtx, contentType, accept, nil)
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		if jm.appMetrics != nil {
+			jm.appMetrics.IDPMetrics().CountRequestStatusError()
+		}
+		return nil, fmt.Errorf("unable to get all accounts, statusCode %d", resp.StatusCode)
+	}
 
 	if jm.appMetrics != nil {
 		jm.appMetrics.IDPMetrics().CountGetAllAccounts()
 	}
 
 	indexedUsers := make(map[string][]*UserData)
-	for _, user := range allUsers {
+	for _, user := range userList.Results {
 		userData := parseJumpCloudUser(user)
 		indexedUsers[UnsetAccountID] = append(indexedUsers[UnsetAccountID], userData)
 	}
@@ -203,41 +176,6 @@ func (jm *JumpCloudManager) GetAllAccounts(ctx context.Context) (map[string][]*U
 	return indexedUsers, nil
 }
 
-// searchAllUsers paginates through all system users using limit/skip.
-func (jm *JumpCloudManager) searchAllUsers(ctx context.Context) ([]jumpCloudUser, error) {
-	var allUsers []jumpCloudUser
-
-	for skip := 0; ; skip += jumpCloudSearchPageSize {
-		searchReq := map[string]int{
-			"limit": jumpCloudSearchPageSize,
-			"skip":  skip,
-		}
-
-		payload, err := json.Marshal(searchReq)
-		if err != nil {
-			return nil, err
-		}
-
-		body, err := jm.doRequest(ctx, http.MethodPost, "/search/systemusers", bytes.NewReader(payload))
-		if err != nil {
-			return nil, err
-		}
-
-		var userList jumpCloudUserList
-		if err = jm.helper.Unmarshal(body, &userList); err != nil {
-			return nil, err
-		}
-
-		allUsers = append(allUsers, userList.Results...)
-
-		if skip+len(userList.Results) >= userList.TotalCount {
-			break
-		}
-	}
-
-	return allUsers, nil
-}
-
 // CreateUser creates a new user in JumpCloud Idp and sends an invitation.
 func (jm *JumpCloudManager) CreateUser(_ context.Context, _, _, _, _ string) (*UserData, error) {
 	return nil, fmt.Errorf("method CreateUser not implemented")
@@ -245,7 +183,7 @@ func (jm *JumpCloudManager) CreateUser(_ context.Context, _, _, _, _ string) (*U
 
 // GetUserByEmail searches users with a given email.
 // If no users have been found, this function returns an empty list.
-func (jm *JumpCloudManager) GetUserByEmail(ctx context.Context, email string) ([]*UserData, error) {
+func (jm *JumpCloudManager) GetUserByEmail(_ context.Context, email string) ([]*UserData, error) {
 	searchFilter := map[string]interface{}{
 		"searchFilter": map[string]interface{}{
 			"filter": []string{email},
@@ -253,26 +191,25 @@ func (jm *JumpCloudManager) GetUserByEmail(ctx context.Context, email string) ([
 		},
 	}
 
-	payload, err := json.Marshal(searchFilter)
+	authCtx := jm.authenticationContext()
+	userList, resp, err := jm.client.SearchApi.SearchSystemusersPost(authCtx, contentType, accept, searchFilter)
 	if err != nil {
 		return nil, err
 	}
+	defer resp.Body.Close()
 
-	body, err := jm.doRequest(ctx, http.MethodPost, "/search/systemusers", bytes.NewReader(payload))
-	if err != nil {
-		return nil, err
+	if resp.StatusCode != http.StatusOK {
+		if jm.appMetrics != nil {
+			jm.appMetrics.IDPMetrics().CountRequestStatusError()
+		}
+		return nil, fmt.Errorf("unable to get user %s, statusCode %d", email, resp.StatusCode)
 	}
 
 	if jm.appMetrics != nil {
 		jm.appMetrics.IDPMetrics().CountGetUserByEmail()
 	}
 
-	var userList jumpCloudUserList
-	if err = jm.helper.Unmarshal(body, &userList); err != nil {
-		return nil, err
-	}
-
-	usersData := make([]*UserData, 0, len(userList.Results))
+	usersData := make([]*UserData, 0)
 	for _, user := range userList.Results {
 		usersData = append(usersData, parseJumpCloudUser(user))
 	}
@@ -287,11 +224,20 @@ func (jm *JumpCloudManager) InviteUserByID(_ context.Context, _ string) error {
 }
 
 // DeleteUser from jumpCloud directory
-func (jm *JumpCloudManager) DeleteUser(ctx context.Context, userID string) error {
-	_, err := jm.doRequest(ctx, http.MethodDelete, "/systemusers/"+userID, nil)
+func (jm *JumpCloudManager) DeleteUser(_ context.Context, userID string) error {
+	authCtx := jm.authenticationContext()
+	_, resp, err := jm.client.SystemusersApi.SystemusersDelete(authCtx, userID, contentType, accept, nil)
 	if err != nil {
 		return err
 	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		if jm.appMetrics != nil {
+			jm.appMetrics.IDPMetrics().CountRequestStatusError()
+		}
+		return fmt.Errorf("unable to delete user, statusCode %d", resp.StatusCode)
+	}
 
 	if jm.appMetrics != nil {
 		jm.appMetrics.IDPMetrics().CountDeleteUser()
@@ -301,11 +247,11 @@ func (jm *JumpCloudManager) DeleteUser(ctx context.Context, userID string) error
 }
 
 // parseJumpCloudUser parse JumpCloud system user returned from API V1 to UserData.
-func parseJumpCloudUser(user jumpCloudUser) *UserData {
+func parseJumpCloudUser(user v1.Systemuserreturn) *UserData {
 	names := []string{user.Firstname, user.Middlename, user.Lastname}
 	return &UserData{
 		Email: user.Email,
 		Name:  strings.Join(names, " "),
-		ID:    user.ID,
+		ID:    user.Id,
 	}
 }

management/server/idp/jumpcloud_test.go

@@ -1,15 +1,8 @@
 package idp
 
 import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
 	"testing"
 
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/management/server/telemetry"
@@ -51,212 +44,3 @@ func TestNewJumpCloudManager(t *testing.T) {
 		})
 	}
 }
-
-func TestJumpCloudGetUserDataByID(t *testing.T) {
-	userResponse := jumpCloudUser{
-		ID:         "user123",
-		Email:      "test@example.com",
-		Firstname:  "John",
-		Middlename: "",
-		Lastname:   "Doe",
-	}
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, "/systemusers/user123", r.URL.Path)
-		assert.Equal(t, http.MethodGet, r.Method)
-		assert.Equal(t, "test-api-key", r.Header.Get("x-api-key"))
-
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(userResponse)
-	}))
-	defer server.Close()
-
-	manager := newTestJumpCloudManager(t, server.URL)
-
-	userData, err := manager.GetUserDataByID(context.Background(), "user123", AppMetadata{WTAccountID: "acc1"})
-	require.NoError(t, err)
-
-	assert.Equal(t, "user123", userData.ID)
-	assert.Equal(t, "test@example.com", userData.Email)
-	assert.Equal(t, "John  Doe", userData.Name)
-	assert.Equal(t, "acc1", userData.AppMetadata.WTAccountID)
-}
-
-func TestJumpCloudGetAccount(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, "/search/systemusers", r.URL.Path)
-		assert.Equal(t, http.MethodPost, r.Method)
-
-		var reqBody map[string]any
-		assert.NoError(t, json.NewDecoder(r.Body).Decode(&reqBody))
-		assert.Contains(t, reqBody, "limit")
-		assert.Contains(t, reqBody, "skip")
-
-		resp := jumpCloudUserList{
-			Results: []jumpCloudUser{
-				{ID: "u1", Email: "a@test.com", Firstname: "Alice", Lastname: "Smith"},
-				{ID: "u2", Email: "b@test.com", Firstname: "Bob", Lastname: "Jones"},
-			},
-			TotalCount: 2,
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(resp)
-	}))
-	defer server.Close()
-
-	manager := newTestJumpCloudManager(t, server.URL)
-
-	users, err := manager.GetAccount(context.Background(), "testAccount")
-	require.NoError(t, err)
-	assert.Len(t, users, 2)
-	assert.Equal(t, "testAccount", users[0].AppMetadata.WTAccountID)
-	assert.Equal(t, "testAccount", users[1].AppMetadata.WTAccountID)
-}
-
-func TestJumpCloudGetAllAccounts(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		resp := jumpCloudUserList{
-			Results: []jumpCloudUser{
-				{ID: "u1", Email: "a@test.com", Firstname: "Alice"},
-				{ID: "u2", Email: "b@test.com", Firstname: "Bob"},
-			},
-			TotalCount: 2,
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(resp)
-	}))
-	defer server.Close()
-
-	manager := newTestJumpCloudManager(t, server.URL)
-
-	indexedUsers, err := manager.GetAllAccounts(context.Background())
-	require.NoError(t, err)
-	assert.Len(t, indexedUsers[UnsetAccountID], 2)
-}
-
-func TestJumpCloudGetAllAccountsPagination(t *testing.T) {
-	totalUsers := 250
-	allUsers := make([]jumpCloudUser, totalUsers)
-	for i := range allUsers {
-		allUsers[i] = jumpCloudUser{
-			ID:        fmt.Sprintf("u%d", i),
-			Email:     fmt.Sprintf("user%d@test.com", i),
-			Firstname: fmt.Sprintf("User%d", i),
-		}
-	}
-
-	requestCount := 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var reqBody map[string]int
-		assert.NoError(t, json.NewDecoder(r.Body).Decode(&reqBody))
-
-		limit := reqBody["limit"]
-		skip := reqBody["skip"]
-		requestCount++
-
-		end := skip + limit
-		if end > totalUsers {
-			end = totalUsers
-		}
-
-		resp := jumpCloudUserList{
-			Results:    allUsers[skip:end],
-			TotalCount: totalUsers,
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(resp)
-	}))
-	defer server.Close()
-
-	manager := newTestJumpCloudManager(t, server.URL)
-
-	indexedUsers, err := manager.GetAllAccounts(context.Background())
-	require.NoError(t, err)
-	assert.Len(t, indexedUsers[UnsetAccountID], totalUsers)
-	assert.Equal(t, 3, requestCount, "should require 3 pages for 250 users at page size 100")
-}
-
-func TestJumpCloudGetUserByEmail(t *testing.T) {
-	searchResponse := jumpCloudUserList{
-		Results: []jumpCloudUser{
-			{ID: "u1", Email: "alice@test.com", Firstname: "Alice", Lastname: "Smith"},
-		},
-		TotalCount: 1,
-	}
-
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, "/search/systemusers", r.URL.Path)
-		assert.Equal(t, http.MethodPost, r.Method)
-
-		body, err := io.ReadAll(r.Body)
-		assert.NoError(t, err)
-		assert.Contains(t, string(body), "alice@test.com")
-
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(searchResponse)
-	}))
-	defer server.Close()
-
-	manager := newTestJumpCloudManager(t, server.URL)
-
-	users, err := manager.GetUserByEmail(context.Background(), "alice@test.com")
-	require.NoError(t, err)
-	assert.Len(t, users, 1)
-	assert.Equal(t, "alice@test.com", users[0].Email)
-}
-
-func TestJumpCloudDeleteUser(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		assert.Equal(t, "/systemusers/user123", r.URL.Path)
-		assert.Equal(t, http.MethodDelete, r.Method)
-		assert.Equal(t, "test-api-key", r.Header.Get("x-api-key"))
-
-		w.Header().Set("Content-Type", "application/json")
-		_ = json.NewEncoder(w).Encode(map[string]string{"_id": "user123"})
-	}))
-	defer server.Close()
-
-	manager := newTestJumpCloudManager(t, server.URL)
-
-	err := manager.DeleteUser(context.Background(), "user123")
-	require.NoError(t, err)
-}
-
-func TestJumpCloudAPIError(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		w.WriteHeader(http.StatusUnauthorized)
-	}))
-	defer server.Close()
-
-	manager := newTestJumpCloudManager(t, server.URL)
-
-	_, err := manager.GetUserDataByID(context.Background(), "user123", AppMetadata{})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "401")
-}
-
-func TestParseJumpCloudUser(t *testing.T) {
-	user := jumpCloudUser{
-		ID:         "abc123",
-		Email:      "test@example.com",
-		Firstname:  "John",
-		Middlename: "M",
-		Lastname:   "Doe",
-	}
-
-	userData := parseJumpCloudUser(user)
-	assert.Equal(t, "abc123", userData.ID)
-	assert.Equal(t, "test@example.com", userData.Email)
-	assert.Equal(t, "John M Doe", userData.Name)
-}
-
-func newTestJumpCloudManager(t *testing.T, apiBase string) *JumpCloudManager {
-	t.Helper()
-	return &JumpCloudManager{
-		apiBase:    apiBase,
-		apiToken:   "test-api-key",
-		httpClient: http.DefaultClient,
-		helper:     JsonParser{},
-		appMetrics: nil,
-	}
-}

management/server/peer.go

@@ -249,7 +249,7 @@ func (am *DefaultAccountManager) UpdatePeer(ctx context.Context, accountID, user
 			if err != nil {
 				newLabel = ""
 			} else {
-				_, err := transaction.GetPeerIdByLabel(ctx, store.LockingStrengthNone, accountID, newLabel)
+				_, err := transaction.GetPeerIdByLabel(ctx, store.LockingStrengthNone, accountID, update.Name)
 				if err == nil {
 					newLabel = ""
 				}

management/server/peer_test.go

@@ -37,7 +37,6 @@ import (
 	"github.com/netbirdio/netbird/management/server/job"
 	"github.com/netbirdio/netbird/management/server/permissions"
 	"github.com/netbirdio/netbird/management/server/settings"
-	"github.com/netbirdio/netbird/shared/auth"
 	"github.com/netbirdio/netbird/shared/management/status"
 
 	"github.com/netbirdio/netbird/management/server/util"
@@ -1253,7 +1252,6 @@ func TestToSyncResponse(t *testing.T) {
 	assert.Equal(t, int64(53), response.NetworkMap.DNSConfig.NameServerGroups[0].NameServers[0].GetPort())
 	// assert network map Firewall
 	assert.Equal(t, 1, len(response.NetworkMap.FirewallRules))
-	//nolint:staticcheck // testing backward-compatible field
 	assert.Equal(t, "192.168.1.2", response.NetworkMap.FirewallRules[0].PeerIP)
 	assert.Equal(t, proto.RuleDirection_IN, response.NetworkMap.FirewallRules[0].Direction)
 	assert.Equal(t, proto.RuleAction_ACCEPT, response.NetworkMap.FirewallRules[0].Action)
@@ -2740,70 +2738,3 @@ func TestProcessPeerAddAuth(t *testing.T) {
 		assert.Empty(t, config.GroupsToAdd)
 	})
 }
-
-func TestUpdatePeer_DnsLabelCollisionWithFQDN(t *testing.T) {
-	manager, _, err := createManager(t)
-	require.NoError(t, err, "unable to create account manager")
-
-	accountID, err := manager.GetAccountIDByUserID(context.Background(), auth.UserAuth{UserId: userID})
-	require.NoError(t, err, "unable to create an account")
-
-	// Add first peer with hostname that produces DNS label "netbird1"
-	key1, err := wgtypes.GenerateKey()
-	require.NoError(t, err)
-	peer1, _, _, err := manager.AddPeer(context.Background(), "", "", userID, &nbpeer.Peer{
-		Key:  key1.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "netbird1.netbird.cloud"},
-	}, false)
-	require.NoError(t, err, "unable to add first peer")
-	assert.Equal(t, "netbird1", peer1.DNSLabel)
-
-	// Add second peer with a different hostname
-	key2, err := wgtypes.GenerateKey()
-	require.NoError(t, err)
-	peer2, _, _, err := manager.AddPeer(context.Background(), "", "", userID, &nbpeer.Peer{
-		Key:  key2.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "ip-10-29-5-130"},
-	}, false)
-	require.NoError(t, err)
-
-	update := peer2.Copy()
-	update.Name = "netbird1.demo.netbird.cloud"
-	updated, err := manager.UpdatePeer(context.Background(), accountID, userID, update)
-	require.NoError(t, err, "renaming peer should not fail with duplicate DNS label error")
-	assert.Equal(t, "netbird1.demo.netbird.cloud", updated.Name)
-	assert.NotEqual(t, "netbird1", updated.DNSLabel, "DNS label should not collide with existing peer")
-	assert.Contains(t, updated.DNSLabel, "netbird1-", "DNS label should be IP-based fallback")
-}
-
-func TestUpdatePeer_DnsLabelUniqueName(t *testing.T) {
-	manager, _, err := createManager(t)
-	require.NoError(t, err, "unable to create account manager")
-
-	accountID, err := manager.GetAccountIDByUserID(context.Background(), auth.UserAuth{UserId: userID})
-	require.NoError(t, err, "unable to create an account")
-
-	key1, err := wgtypes.GenerateKey()
-	require.NoError(t, err)
-	peer1, _, _, err := manager.AddPeer(context.Background(), "", "", userID, &nbpeer.Peer{
-		Key:  key1.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "web-server"},
-	}, false)
-	require.NoError(t, err)
-	assert.Equal(t, "web-server", peer1.DNSLabel)
-
-	// Add second peer and rename it to a unique FQDN whose first label doesn't collide
-	key2, err := wgtypes.GenerateKey()
-	require.NoError(t, err)
-	peer2, _, _, err := manager.AddPeer(context.Background(), "", "", userID, &nbpeer.Peer{
-		Key:  key2.PublicKey().String(),
-		Meta: nbpeer.PeerSystemMeta{Hostname: "old-name"},
-	}, false)
-	require.NoError(t, err)
-
-	update := peer2.Copy()
-	update.Name = "api-server.example.com"
-	updated, err := manager.UpdatePeer(context.Background(), accountID, userID, update)
-	require.NoError(t, err, "renaming to unique FQDN should succeed")
-	assert.Equal(t, "api-server", updated.DNSLabel, "DNS label should be first label of FQDN")
-}

proxy/internal/auth/middleware_test.go

@@ -932,71 +932,3 @@ func TestProtect_HeaderAuth_SubsequentRequestUsesSessionCookie(t *testing.T) {
 	assert.Equal(t, "header-user", capturedData2.GetUserID())
 	assert.Equal(t, "header", capturedData2.GetAuthMethod())
 }
-
-// TestProtect_HeaderAuth_MultipleValuesSameHeader verifies that the proxy
-// correctly handles multiple valid credentials for the same header name.
-// In production, the mgmt gRPC authenticateHeader iterates all configured
-// header auths and accepts if any hash matches (OR semantics). The proxy
-// creates one Header scheme per entry, but a single gRPC call checks all.
-func TestProtect_HeaderAuth_MultipleValuesSameHeader(t *testing.T) {
-	mw := NewMiddleware(log.StandardLogger(), nil, nil)
-	kp := generateTestKeyPair(t)
-
-	// Mock simulates mgmt behavior: accepts either token-a or token-b.
-	accepted := map[string]bool{"Bearer token-a": true, "Bearer token-b": true}
-	mock := &mockAuthenticator{fn: func(_ context.Context, req *proto.AuthenticateRequest) (*proto.AuthenticateResponse, error) {
-		ha := req.GetHeaderAuth()
-		if ha != nil && accepted[ha.GetHeaderValue()] {
-			token, err := sessionkey.SignToken(kp.PrivateKey, "header-user", "example.com", auth.MethodHeader, time.Hour)
-			require.NoError(t, err)
-			return &proto.AuthenticateResponse{Success: true, SessionToken: token}, nil
-		}
-		return &proto.AuthenticateResponse{Success: false}, nil
-	}}
-
-	// Single Header scheme (as if one entry existed), but the mock checks both values.
-	hdr := NewHeader(mock, "svc1", "acc1", "Authorization")
-	require.NoError(t, mw.AddDomain("example.com", []Scheme{hdr}, kp.PublicKey, time.Hour, "acc1", "svc1", nil))
-
-	var backendCalled bool
-	handler := mw.Protect(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		backendCalled = true
-		w.WriteHeader(http.StatusOK)
-	}))
-
-	t.Run("first value accepted", func(t *testing.T) {
-		backendCalled = false
-		req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
-		req.Header.Set("Authorization", "Bearer token-a")
-		req = req.WithContext(proxy.WithCapturedData(req.Context(), proxy.NewCapturedData("")))
-		rec := httptest.NewRecorder()
-		handler.ServeHTTP(rec, req)
-
-		assert.Equal(t, http.StatusOK, rec.Code)
-		assert.True(t, backendCalled, "first token should be accepted")
-	})
-
-	t.Run("second value accepted", func(t *testing.T) {
-		backendCalled = false
-		req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
-		req.Header.Set("Authorization", "Bearer token-b")
-		req = req.WithContext(proxy.WithCapturedData(req.Context(), proxy.NewCapturedData("")))
-		rec := httptest.NewRecorder()
-		handler.ServeHTTP(rec, req)
-
-		assert.Equal(t, http.StatusOK, rec.Code)
-		assert.True(t, backendCalled, "second token should be accepted")
-	})
-
-	t.Run("unknown value rejected", func(t *testing.T) {
-		backendCalled = false
-		req := httptest.NewRequest(http.MethodGet, "http://example.com/", nil)
-		req.Header.Set("Authorization", "Bearer token-c")
-		req = req.WithContext(proxy.WithCapturedData(req.Context(), proxy.NewCapturedData("")))
-		rec := httptest.NewRecorder()
-		handler.ServeHTTP(rec, req)
-
-		assert.Equal(t, http.StatusUnauthorized, rec.Code)
-		assert.False(t, backendCalled, "unknown token should be rejected")
-	})
-}

release_files/install.sh

@@ -128,7 +128,7 @@ cat <<-EOF | ${SUDO} tee /etc/yum.repos.d/netbird.repo
 name=NetBird
 baseurl=https://pkgs.netbird.io/yum/
 enabled=1
-gpgcheck=1
+gpgcheck=0
 gpgkey=https://pkgs.netbird.io/yum/repodata/repomd.xml.key
 repo_gpgcheck=1
 EOF

shared/management/client/grpc.go

@@ -924,22 +924,8 @@ func infoToMetaData(info *system.Info) *proto.PeerSystemMeta {
 			DisableFirewall:     info.DisableFirewall,
 			BlockLANAccess:      info.BlockLANAccess,
 			BlockInbound:        info.BlockInbound,
-			DisableIPv6:         info.DisableIPv6,
 
 			LazyConnectionEnabled: info.LazyConnectionEnabled,
 		},
-
-		Capabilities: peerCapabilities(*info),
 	}
 }
-
-// peerCapabilities returns the capabilities this client supports.
-func peerCapabilities(info system.Info) []proto.PeerCapability {
-	caps := []proto.PeerCapability{
-		proto.PeerCapability_PeerCapabilitySourcePrefixes,
-	}
-	if !info.DisableIPv6 {
-		caps = append(caps, proto.PeerCapability_PeerCapabilityIPv6Overlay)
-	}
-	return caps
-}

shared/management/proto/management.proto

@@ -200,18 +200,6 @@ message Flags {
   bool enableSSHLocalPortForwarding = 13;
   bool enableSSHRemotePortForwarding = 14;
   bool disableSSHAuth = 15;
-
-  bool disableIPv6 = 16;
-}
-
-// PeerCapability represents a feature the client binary supports.
-// Reported in PeerSystemMeta.capabilities on every login/sync.
-enum PeerCapability {
-  PeerCapabilityUnknown = 0;
-  // Client reads SourcePrefixes instead of the deprecated PeerIP string.
-  PeerCapabilitySourcePrefixes = 1;
-  // Client handles IPv6 overlay addresses and firewall rules.
-  PeerCapabilityIPv6Overlay = 2;
 }
 
 // PeerSystemMeta is machine meta data like OS and version.
@@ -233,8 +221,6 @@ message PeerSystemMeta {
   Environment environment = 15;
   repeated File files = 16;
   Flags flags = 17;
-
-  repeated PeerCapability capabilities = 18;
 }
 
 message LoginResponse {
@@ -349,9 +335,6 @@ message PeerConfig {
 
   // Auto-update config
   AutoUpdateSettings autoUpdate = 8;
-
-  // IPv6 overlay address as compact bytes: 16 bytes IP + 1 byte prefix length.
-  bytes address_v6 = 9;
 }
 
 message AutoUpdateSettings {
@@ -584,8 +567,7 @@ enum RuleAction {
 
 // FirewallRule represents a firewall rule
 message FirewallRule {
-  // Use sourcePrefixes instead.
-  string PeerIP = 1 [deprecated = true];
+  string PeerIP = 1;
   RuleDirection Direction = 2;
   RuleAction Action = 3;
   RuleProtocol Protocol = 4;
@@ -594,13 +576,6 @@ message FirewallRule {
 
   // PolicyID is the ID of the policy that this rule belongs to
   bytes PolicyID = 7;
-
-  // CustomProtocol is a custom protocol ID when Protocol is CUSTOM.
-  uint32 customProtocol = 8;
-
-  // Compact source IP prefixes for this rule, supersedes PeerIP.
-  // Each entry is 5 bytes (v4) or 17 bytes (v6): [IP bytes][1 byte prefix_len].
-  repeated bytes sourcePrefixes = 9;
 }
 
 message NetworkAddress {

shared/netiputil/compact.go

@@ -1,72 +0,0 @@
-// Package netiputil provides compact binary encoding for IP prefixes used in
-// the management proto wire format.
-//
-// Format: [IP bytes][1 byte prefix_len]
-//   - IPv4: 5 bytes total (4 IP + 1 prefix_len, 0-32)
-//   - IPv6: 17 bytes total (16 IP + 1 prefix_len, 0-128)
-//
-// Address family is determined by length: 5 = v4, 17 = v6.
-package netiputil
-
-import (
-	"fmt"
-	"net/netip"
-)
-
-// EncodePrefix encodes a netip.Prefix into compact bytes.
-// The address is always unmapped before encoding.
-func EncodePrefix(p netip.Prefix) []byte {
-	addr := p.Addr().Unmap()
-	return append(addr.AsSlice(), byte(p.Bits()))
-}
-
-// DecodePrefix decodes compact bytes into a netip.Prefix.
-func DecodePrefix(b []byte) (netip.Prefix, error) {
-	switch len(b) {
-	case 5:
-		var ip4 [4]byte
-		copy(ip4[:], b)
-		bits := int(b[len(b)-1])
-		if bits > 32 {
-			return netip.Prefix{}, fmt.Errorf("invalid IPv4 prefix length %d (max 32)", bits)
-		}
-		return netip.PrefixFrom(netip.AddrFrom4(ip4), bits), nil
-	case 17:
-		var ip6 [16]byte
-		copy(ip6[:], b)
-		addr := netip.AddrFrom16(ip6).Unmap()
-		bits := int(b[len(b)-1])
-		if addr.Is4() {
-			if bits > 32 {
-				bits = 32
-			}
-		} else if bits > 128 {
-			return netip.Prefix{}, fmt.Errorf("invalid IPv6 prefix length %d (max 128)", bits)
-		}
-		return netip.PrefixFrom(addr, bits), nil
-	default:
-		return netip.Prefix{}, fmt.Errorf("invalid compact prefix length %d (expected 5 or 17)", len(b))
-	}
-}
-
-// EncodeAddr encodes a netip.Addr into compact prefix bytes with a host prefix
-// length (/32 for v4, /128 for v6). The address is always unmapped before encoding.
-func EncodeAddr(a netip.Addr) []byte {
-	a = a.Unmap()
-	bits := 128
-	if a.Is4() {
-		bits = 32
-	}
-	return EncodePrefix(netip.PrefixFrom(a, bits))
-}
-
-// DecodeAddr decodes compact prefix bytes and returns only the address,
-// discarding the prefix length. Useful when the prefix length is implied
-// (e.g. peer overlay IPs are always /32 or /128).
-func DecodeAddr(b []byte) (netip.Addr, error) {
-	p, err := DecodePrefix(b)
-	if err != nil {
-		return netip.Addr{}, err
-	}
-	return p.Addr(), nil
-}

shared/netiputil/compact_test.go

@@ -1,143 +0,0 @@
-package netiputil
-
-import (
-	"net/netip"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestEncodeDecodePrefix(t *testing.T) {
-	tests := []struct {
-		name   string
-		prefix string
-		size   int
-	}{
-		{
-			name:   "v4 host",
-			prefix: "100.64.0.1/32",
-			size:   5,
-		},
-		{
-			name:   "v4 network",
-			prefix: "10.0.0.0/8",
-			size:   5,
-		},
-		{
-			name:   "v4 default",
-			prefix: "0.0.0.0/0",
-			size:   5,
-		},
-		{
-			name:   "v6 host",
-			prefix: "fd00::1/128",
-			size:   17,
-		},
-		{
-			name:   "v6 network",
-			prefix: "fd00:1234:5678::/48",
-			size:   17,
-		},
-		{
-			name:   "v6 default",
-			prefix: "::/0",
-			size:   17,
-		},
-		{
-			name:   "v4 /16 overlay",
-			prefix: "100.64.0.1/16",
-			size:   5,
-		},
-		{
-			name:   "v6 /64 overlay",
-			prefix: "fd00::abcd:1/64",
-			size:   17,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			p := netip.MustParsePrefix(tt.prefix)
-			b := EncodePrefix(p)
-			assert.Equal(t, tt.size, len(b), "encoded size")
-
-			decoded, err := DecodePrefix(b)
-			require.NoError(t, err)
-			assert.Equal(t, p, decoded)
-		})
-	}
-}
-
-func TestEncodePrefixUnmaps(t *testing.T) {
-	// v4-mapped v6 address should encode as v4
-	mapped := netip.MustParsePrefix("::ffff:10.1.2.3/32")
-	b := EncodePrefix(mapped)
-	assert.Equal(t, 5, len(b), "v4-mapped should encode as 5 bytes")
-
-	decoded, err := DecodePrefix(b)
-	require.NoError(t, err)
-	assert.Equal(t, netip.MustParsePrefix("10.1.2.3/32"), decoded)
-}
-
-func TestDecodeAddr(t *testing.T) {
-	v4 := netip.MustParseAddr("100.64.0.5")
-	b := EncodeAddr(v4)
-	assert.Equal(t, 5, len(b))
-
-	got, err := DecodeAddr(b)
-	require.NoError(t, err)
-	assert.Equal(t, v4, got)
-
-	v6 := netip.MustParseAddr("fd00::1")
-	b = EncodeAddr(v6)
-	assert.Equal(t, 17, len(b))
-
-	got, err = DecodeAddr(b)
-	require.NoError(t, err)
-	assert.Equal(t, v6, got)
-}
-
-func TestDecodePrefixInvalidLength(t *testing.T) {
-	_, err := DecodePrefix([]byte{1, 2, 3})
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "invalid compact prefix length 3")
-
-	_, err = DecodePrefix(nil)
-	assert.Error(t, err)
-
-	_, err = DecodePrefix([]byte{})
-	assert.Error(t, err)
-}
-
-func TestDecodePrefixInvalidBits(t *testing.T) {
-	// v4 with bits > 32
-	b := []byte{10, 0, 0, 1, 33}
-	_, err := DecodePrefix(b)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "invalid IPv4 prefix length 33")
-
-	// v6 with bits > 128
-	b = make([]byte, 17)
-	b[0] = 0xfd
-	b[16] = 129
-	_, err = DecodePrefix(b)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "invalid IPv6 prefix length 129")
-}
-
-func TestDecodePrefixUnmapsV6Input(t *testing.T) {
-	// If someone encodes a v4-mapped v6 as 17 bytes, decode should unmap it
-	// and clamp the prefix length to 32 for v4
-	addr := netip.MustParseAddr("::ffff:192.168.1.1")
-
-	raw := addr.As16()
-	b := make([]byte, 17)
-	copy(b, raw[:])
-	b[16] = 128
-
-	decoded, err := DecodePrefix(b)
-	require.NoError(t, err)
-	assert.True(t, decoded.Addr().Is4(), "should be unmapped to v4")
-	assert.Equal(t, netip.MustParsePrefix("192.168.1.1/32"), decoded)
-}

upload-server/server/s3_test.go

@@ -5,12 +5,13 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"runtime"
 	"testing"
 
 	"github.com/aws/aws-sdk-go-v2/config"
-	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/testcontainers/testcontainers-go"
 	"github.com/testcontainers/testcontainers-go/wait"
@@ -19,55 +20,45 @@ import (
 )
 
 func Test_S3HandlerGetUploadURL(t *testing.T) {
-	if runtime.GOOS != "linux" {
-		t.Skip("Skipping test on non-Linux due to docker dependency")
+	if runtime.GOOS != "linux" && os.Getenv("CI") == "true" {
+		t.Skip("Skipping test on non-Linux and CI environment due to docker dependency")
+	}
+	if runtime.GOOS == "windows" {
+		t.Skip("Skipping test on Windows due to potential docker dependency")
 	}
 
+	awsEndpoint := "http://127.0.0.1:4566"
 	awsRegion := "us-east-1"
 
 	ctx := context.Background()
+	containerRequest := testcontainers.ContainerRequest{
+		Image:        "localstack/localstack:s3-latest",
+		ExposedPorts: []string{"4566:4566/tcp"},
+		WaitingFor:   wait.ForLog("Ready"),
+	}
+
 	c, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
-		ContainerRequest: testcontainers.ContainerRequest{
-			Image:        "minio/minio:RELEASE.2025-04-22T22-12-26Z",
-			ExposedPorts: []string{"9000/tcp"},
-			Env: map[string]string{
-				"MINIO_ROOT_USER":     "minioadmin",
-				"MINIO_ROOT_PASSWORD": "minioadmin",
-			},
-			Cmd:        []string{"server", "/data"},
-			WaitingFor: wait.ForHTTP("/minio/health/ready").WithPort("9000"),
-		},
-		Started: true,
+		ContainerRequest: containerRequest,
+		Started:          true,
 	})
-	require.NoError(t, err)
-	t.Cleanup(func() {
+	if err != nil {
+		t.Error(err)
+	}
+	defer func(c testcontainers.Container, ctx context.Context) {
 		if err := c.Terminate(ctx); err != nil {
 			t.Log(err)
 		}
-	})
-
-	mappedPort, err := c.MappedPort(ctx, "9000")
-	require.NoError(t, err)
-
-	hostIP, err := c.Host(ctx)
-	require.NoError(t, err)
-
-	awsEndpoint := "http://" + hostIP + ":" + mappedPort.Port()
+	}(c, ctx)
 
 	t.Setenv("AWS_REGION", awsRegion)
 	t.Setenv("AWS_ENDPOINT_URL", awsEndpoint)
-	t.Setenv("AWS_ACCESS_KEY_ID", "minioadmin")
-	t.Setenv("AWS_SECRET_ACCESS_KEY", "minioadmin")
-	t.Setenv("AWS_CONFIG_FILE", "")
-	t.Setenv("AWS_SHARED_CREDENTIALS_FILE", "")
-	t.Setenv("AWS_PROFILE", "")
+	t.Setenv("AWS_ACCESS_KEY_ID", "test")
+	t.Setenv("AWS_SECRET_ACCESS_KEY", "test")
 
-	cfg, err := config.LoadDefaultConfig(ctx,
-		config.WithRegion(awsRegion),
-		config.WithBaseEndpoint(awsEndpoint),
-		config.WithCredentialsProvider(credentials.NewStaticCredentialsProvider("minioadmin", "minioadmin", "")),
-	)
-	require.NoError(t, err)
+	cfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(awsRegion), config.WithBaseEndpoint(awsEndpoint))
+	if err != nil {
+		t.Error(err)
+	}
 
 	client := s3.NewFromConfig(cfg, func(o *s3.Options) {
 		o.UsePathStyle = true
@@ -75,16 +66,19 @@ func Test_S3HandlerGetUploadURL(t *testing.T) {
 	})
 
 	bucketName := "test"
-	_, err = client.CreateBucket(ctx, &s3.CreateBucketInput{
+	if _, err := client.CreateBucket(ctx, &s3.CreateBucketInput{
 		Bucket: &bucketName,
-	})
-	require.NoError(t, err)
+	}); err != nil {
+		t.Error(err)
+	}
 
 	list, err := client.ListBuckets(ctx, &s3.ListBucketsInput{})
-	require.NoError(t, err)
+	if err != nil {
+		t.Error(err)
+	}
 
-	require.Len(t, list.Buckets, 1)
-	require.Equal(t, bucketName, *list.Buckets[0].Name)
+	assert.Equal(t, len(list.Buckets), 1)
+	assert.Equal(t, *list.Buckets[0].Name, bucketName)
 
 	t.Setenv(bucketVar, bucketName)