Add DNS configuration snapshot and per-domain statistics tracking

.github/workflows/golang-test-linux.yml

@@ -217,7 +217,7 @@ jobs:
           - arch: "386"
             raceFlag: ""
           - arch: "amd64"
-            raceFlag: "-race"
+            raceFlag: ""
     runs-on: ubuntu-22.04
     steps:
       - name: Install Go

.github/workflows/release.yml

@@ -9,7 +9,7 @@ on:
   pull_request:
 
 env:
-  SIGN_PIPE_VER: "v0.0.23"
+  SIGN_PIPE_VER: "v0.0.22"
   GORELEASER_VER: "v2.3.2"
   PRODUCT_NAME: "NetBird"
   COPYRIGHT: "NetBird GmbH"

README.md

@@ -1,4 +1,3 @@
-
 <div align="center">
 <br/>
   <br/>
@@ -53,7 +52,7 @@
 
 ### Open Source Network Security in a Single Platform
 
-https://github.com/user-attachments/assets/10cec749-bb56-4ab3-97af-4e38850108d2
+<img width="1188" alt="centralized-network-management 1" src="https://github.com/user-attachments/assets/c28cc8e4-15d2-4d2f-bb97-a6433db39d56" />
 
 ### NetBird on Lawrence Systems (Video)
 [![Watch the video](https://img.youtube.com/vi/Kwrff6h0rEw/0.jpg)](https://www.youtube.com/watch?v=Kwrff6h0rEw)

client/Dockerfile

@@ -18,7 +18,7 @@ ENV \
     NB_LOG_FILE="console,/var/log/netbird/client.log" \
     NB_DAEMON_ADDR="unix:///var/run/netbird.sock" \
     NB_ENTRYPOINT_SERVICE_TIMEOUT="5" \
-    NB_ENTRYPOINT_LOGIN_TIMEOUT="5"
+    NB_ENTRYPOINT_LOGIN_TIMEOUT="1"
 
 ENTRYPOINT [ "/usr/local/bin/netbird-entrypoint.sh" ]
 

client/android/client.go

@@ -19,7 +19,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/stdnet"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/formatter"
-	"github.com/netbirdio/netbird/client/net"
+	"github.com/netbirdio/netbird/util/net"
 )
 
 // ConnectionListener export internal Listener for mobile

client/android/login.go

@@ -33,7 +33,6 @@ type ErrListener interface {
 // the backend want to show an url for the user
 type URLOpener interface {
 	Open(string)
-	OnLoginSuccess()
 }
 
 // Auth can register or login new client
@@ -182,11 +181,6 @@ func (a *Auth) login(urlOpener URLOpener) error {
 
 	err = a.withBackOff(a.ctx, func() error {
 		err := internal.Login(a.ctx, a.config, "", jwtToken)
-
-		if err == nil {
-			go urlOpener.OnLoginSuccess()
-		}
-
 		if s, ok := gstatus.FromError(err); ok && (s.Code() == codes.InvalidArgument || s.Code() == codes.PermissionDenied) {
 			return nil
 		}

client/cmd/debug.go

@@ -388,12 +388,12 @@ func generateDebugBundle(config *profilemanager.Config, recorder *peer.Status, c
 }
 
 func init() {
-	debugBundleCmd.Flags().Uint32VarP(&logFileCount, "log-file-count", "C", 1, "Number of rotated log files to include in debug bundle")
+	debugBundleCmd.Flags().Uint32VarP(&logFileCount, "log-file-count", "C", 10, "Number of rotated log files to include in debug bundle")
 	debugBundleCmd.Flags().BoolVarP(&systemInfoFlag, "system-info", "S", true, "Adds system information to the debug bundle")
 	debugBundleCmd.Flags().BoolVarP(&uploadBundleFlag, "upload-bundle", "U", false, "Uploads the debug bundle to a server")
 	debugBundleCmd.Flags().StringVar(&uploadBundleURLFlag, "upload-bundle-url", types.DefaultBundleURL, "Service URL to get an URL to upload the debug bundle")
 
-	forCmd.Flags().Uint32VarP(&logFileCount, "log-file-count", "C", 1, "Number of rotated log files to include in debug bundle")
+	forCmd.Flags().Uint32VarP(&logFileCount, "log-file-count", "C", 10, "Number of rotated log files to include in debug bundle")
 	forCmd.Flags().BoolVarP(&systemInfoFlag, "system-info", "S", true, "Adds system information to the debug bundle")
 	forCmd.Flags().BoolVarP(&uploadBundleFlag, "upload-bundle", "U", false, "Uploads the debug bundle to a server")
 	forCmd.Flags().StringVar(&uploadBundleURLFlag, "upload-bundle-url", types.DefaultBundleURL, "Service URL to get an URL to upload the debug bundle")

client/cmd/down.go

@@ -27,7 +27,7 @@ var downCmd = &cobra.Command{
 			return err
 		}
 
-		ctx, cancel := context.WithTimeout(context.Background(), time.Second*20)
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second*7)
 		defer cancel()
 
 		conn, err := DialClientGRPCServer(ctx, daemonAddr)

client/cmd/root.go

@@ -231,7 +231,7 @@ func FlagNameToEnvVar(cmdFlag string, prefix string) string {
 
 // DialClientGRPCServer returns client connection to the daemon server.
 func DialClientGRPCServer(ctx context.Context, addr string) (*grpc.ClientConn, error) {
-	ctx, cancel := context.WithTimeout(ctx, time.Second*10)
+	ctx, cancel := context.WithTimeout(ctx, time.Second*3)
 	defer cancel()
 
 	return grpc.DialContext(

client/cmd/up.go

@@ -230,9 +230,7 @@ func runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager
 
 	client := proto.NewDaemonServiceClient(conn)
 
-	status, err := client.Status(ctx, &proto.StatusRequest{
-		WaitForReady: func() *bool { b := true; return &b }(),
-	})
+	status, err := client.Status(ctx, &proto.StatusRequest{})
 	if err != nil {
 		return fmt.Errorf("unable to get daemon status: %v", err)
 	}

client/embed/embed.go

@@ -135,7 +135,7 @@ func (c *Client) Start(startCtx context.Context) error {
 
 	// either startup error (permanent backoff err) or nil err (successful engine up)
 	// TODO: make after-startup backoff err available
-	run := make(chan struct{})
+	run := make(chan struct{}, 1)
 	clientErr := make(chan error, 1)
 	go func() {
 		if err := client.Run(run); err != nil {

client/firewall/iptables/acl_linux.go

@@ -12,7 +12,7 @@ import (
 
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 const (

client/firewall/iptables/router_linux.go

@@ -19,7 +19,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager/ipfwdstate"
 	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 // constants needed to manage and create iptable rules

client/firewall/iptables/router_linux_test.go

@@ -14,7 +14,7 @@ import (
 
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/firewall/test"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 func isIptablesSupported() bool {

client/firewall/nftables/acl_linux.go

@@ -16,7 +16,7 @@ import (
 	"golang.org/x/sys/unix"
 
 	firewall "github.com/netbirdio/netbird/client/firewall/manager"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 const (

client/firewall/nftables/router_linux.go

@@ -22,7 +22,7 @@ import (
 	nbid "github.com/netbirdio/netbird/client/internal/acl/id"
 	"github.com/netbirdio/netbird/client/internal/routemanager/ipfwdstate"
 	"github.com/netbirdio/netbird/client/internal/routemanager/refcounter"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 const (

client/iface/bind/control.go

@@ -3,7 +3,7 @@ package bind
 import (
 	wireguard "golang.zx2c4.com/wireguard/conn"
 
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 // TODO: This is most likely obsolete since the control fns should be called by the wrapped udpconn (ice_bind.go)

client/iface/bind/ice_bind.go

@@ -15,9 +15,8 @@ import (
 	"golang.org/x/net/ipv6"
 	wgConn "golang.zx2c4.com/wireguard/conn"
 
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 type RecvMessage struct {
@@ -45,7 +44,7 @@ type ICEBind struct {
 	RecvChan chan RecvMessage
 
 	transportNet transport.Net
-	filterFn     udpmux.FilterFn
+	filterFn     FilterFn
 	endpoints    map[netip.Addr]net.Conn
 	endpointsMu  sync.Mutex
 	// every time when Close() is called (i.e. BindUpdate()) we need to close exit from the receiveRelayed and create a
@@ -55,13 +54,13 @@ type ICEBind struct {
 	closed       bool
 
 	muUDPMux         sync.Mutex
-	udpMux           *udpmux.UniversalUDPMuxDefault
+	udpMux           *UniversalUDPMuxDefault
 	address          wgaddr.Address
 	mtu              uint16
 	activityRecorder *ActivityRecorder
 }
 
-func NewICEBind(transportNet transport.Net, filterFn udpmux.FilterFn, address wgaddr.Address, mtu uint16) *ICEBind {
+func NewICEBind(transportNet transport.Net, filterFn FilterFn, address wgaddr.Address, mtu uint16) *ICEBind {
 	b, _ := wgConn.NewStdNetBind().(*wgConn.StdNetBind)
 	ib := &ICEBind{
 		StdNetBind:       b,
@@ -116,7 +115,7 @@ func (s *ICEBind) ActivityRecorder() *ActivityRecorder {
 }
 
 // GetICEMux returns the ICE UDPMux that was created and used by ICEBind
-func (s *ICEBind) GetICEMux() (*udpmux.UniversalUDPMuxDefault, error) {
+func (s *ICEBind) GetICEMux() (*UniversalUDPMuxDefault, error) {
 	s.muUDPMux.Lock()
 	defer s.muUDPMux.Unlock()
 	if s.udpMux == nil {
@@ -159,8 +158,8 @@ func (s *ICEBind) createIPv4ReceiverFn(pc *ipv4.PacketConn, conn *net.UDPConn, r
 	s.muUDPMux.Lock()
 	defer s.muUDPMux.Unlock()
 
-	s.udpMux = udpmux.NewUniversalUDPMuxDefault(
-		udpmux.UniversalUDPMuxParams{
+	s.udpMux = NewUniversalUDPMuxDefault(
+		UniversalUDPMuxParams{
 			UDPConn:   nbnet.WrapPacketConn(conn),
 			Net:       s.transportNet,
 			FilterFn:  s.filterFn,

client/iface/bind/udp_mux.go

@@ -1,4 +1,4 @@
-package udpmux
+package bind
 
 import (
 	"fmt"
@@ -22,9 +22,9 @@ import (
 
 const receiveMTU = 8192
 
-// SingleSocketUDPMux is an implementation of the interface
-type SingleSocketUDPMux struct {
-	params Params
+// UDPMuxDefault is an implementation of the interface
+type UDPMuxDefault struct {
+	params UDPMuxParams
 
 	closedChan chan struct{}
 	closeOnce  sync.Once
@@ -32,9 +32,6 @@ type SingleSocketUDPMux struct {
 	// connsIPv4 and connsIPv6 are maps of all udpMuxedConn indexed by ufrag|network|candidateType
 	connsIPv4, connsIPv6 map[string]*udpMuxedConn
 
-	// candidateConnMap maps local candidate IDs to their corresponding connection.
-	candidateConnMap map[string]*udpMuxedConn
-
 	addressMapMu sync.RWMutex
 	addressMap   map[string][]*udpMuxedConn
 
@@ -49,8 +46,8 @@ type SingleSocketUDPMux struct {
 
 const maxAddrSize = 512
 
-// Params are parameters for UDPMux.
-type Params struct {
+// UDPMuxParams are parameters for UDPMux.
+type UDPMuxParams struct {
 	Logger  logging.LeveledLogger
 	UDPConn net.PacketConn
 
@@ -150,19 +147,18 @@ func isZeros(ip net.IP) bool {
 	return true
 }
 
-// NewSingleSocketUDPMux creates an implementation of UDPMux
-func NewSingleSocketUDPMux(params Params) *SingleSocketUDPMux {
+// NewUDPMuxDefault creates an implementation of UDPMux
+func NewUDPMuxDefault(params UDPMuxParams) *UDPMuxDefault {
 	if params.Logger == nil {
 		params.Logger = getLogger()
 	}
 
-	mux := &SingleSocketUDPMux{
-		addressMap:       map[string][]*udpMuxedConn{},
-		params:           params,
-		connsIPv4:        make(map[string]*udpMuxedConn),
-		connsIPv6:        make(map[string]*udpMuxedConn),
-		candidateConnMap: make(map[string]*udpMuxedConn),
-		closedChan:       make(chan struct{}, 1),
+	mux := &UDPMuxDefault{
+		addressMap: map[string][]*udpMuxedConn{},
+		params:     params,
+		connsIPv4:  make(map[string]*udpMuxedConn),
+		connsIPv6:  make(map[string]*udpMuxedConn),
+		closedChan: make(chan struct{}, 1),
 		pool: &sync.Pool{
 			New: func() interface{} {
 				// big enough buffer to fit both packet and address
@@ -175,15 +171,15 @@ func NewSingleSocketUDPMux(params Params) *SingleSocketUDPMux {
 	return mux
 }
 
-func (m *SingleSocketUDPMux) updateLocalAddresses() {
+func (m *UDPMuxDefault) updateLocalAddresses() {
 	var localAddrsForUnspecified []net.Addr
 	if addr, ok := m.params.UDPConn.LocalAddr().(*net.UDPAddr); !ok {
 		m.params.Logger.Errorf("LocalAddr is not a net.UDPAddr, got %T", m.params.UDPConn.LocalAddr())
 	} else if ok && addr.IP.IsUnspecified() {
 		// For unspecified addresses, the correct behavior is to return errListenUnspecified, but
 		// it will break the applications that are already using unspecified UDP connection
-		// with SingleSocketUDPMux, so print a warn log and create a local address list for mux.
-		m.params.Logger.Warn("SingleSocketUDPMux should not listening on unspecified address, use NewMultiUDPMuxFromPort instead")
+		// with UDPMuxDefault, so print a warn log and create a local address list for mux.
+		m.params.Logger.Warn("UDPMuxDefault should not listening on unspecified address, use NewMultiUDPMuxFromPort instead")
 		var networks []ice.NetworkType
 		switch {
 
@@ -220,13 +216,13 @@ func (m *SingleSocketUDPMux) updateLocalAddresses() {
 	m.mu.Unlock()
 }
 
-// LocalAddr returns the listening address of this SingleSocketUDPMux
-func (m *SingleSocketUDPMux) LocalAddr() net.Addr {
+// LocalAddr returns the listening address of this UDPMuxDefault
+func (m *UDPMuxDefault) LocalAddr() net.Addr {
 	return m.params.UDPConn.LocalAddr()
 }
 
 // GetListenAddresses returns the list of addresses that this mux is listening on
-func (m *SingleSocketUDPMux) GetListenAddresses() []net.Addr {
+func (m *UDPMuxDefault) GetListenAddresses() []net.Addr {
 	m.updateLocalAddresses()
 
 	m.mu.Lock()
@@ -240,7 +236,7 @@ func (m *SingleSocketUDPMux) GetListenAddresses() []net.Addr {
 
 // GetConn returns a PacketConn given the connection's ufrag and network address
 // creates the connection if an existing one can't be found
-func (m *SingleSocketUDPMux) GetConn(ufrag string, addr net.Addr, candidateID string) (net.PacketConn, error) {
+func (m *UDPMuxDefault) GetConn(ufrag string, addr net.Addr) (net.PacketConn, error) {
 	// don't check addr for mux using unspecified address
 	m.mu.Lock()
 	lenLocalAddrs := len(m.localAddrsForUnspecified)
@@ -264,14 +260,12 @@ func (m *SingleSocketUDPMux) GetConn(ufrag string, addr net.Addr, candidateID st
 		return conn, nil
 	}
 
-	c := m.createMuxedConn(ufrag, candidateID)
+	c := m.createMuxedConn(ufrag)
 	go func() {
 		<-c.CloseChannel()
 		m.RemoveConnByUfrag(ufrag)
 	}()
 
-	m.candidateConnMap[candidateID] = c
-
 	if isIPv6 {
 		m.connsIPv6[ufrag] = c
 	} else {
@@ -282,7 +276,7 @@ func (m *SingleSocketUDPMux) GetConn(ufrag string, addr net.Addr, candidateID st
 }
 
 // RemoveConnByUfrag stops and removes the muxed packet connection
-func (m *SingleSocketUDPMux) RemoveConnByUfrag(ufrag string) {
+func (m *UDPMuxDefault) RemoveConnByUfrag(ufrag string) {
 	removedConns := make([]*udpMuxedConn, 0, 2)
 
 	// Keep lock section small to avoid deadlock with conn lock
@@ -290,12 +284,10 @@ func (m *SingleSocketUDPMux) RemoveConnByUfrag(ufrag string) {
 	if c, ok := m.connsIPv4[ufrag]; ok {
 		delete(m.connsIPv4, ufrag)
 		removedConns = append(removedConns, c)
-		delete(m.candidateConnMap, c.GetCandidateID())
 	}
 	if c, ok := m.connsIPv6[ufrag]; ok {
 		delete(m.connsIPv6, ufrag)
 		removedConns = append(removedConns, c)
-		delete(m.candidateConnMap, c.GetCandidateID())
 	}
 	m.mu.Unlock()
 
@@ -322,7 +314,7 @@ func (m *SingleSocketUDPMux) RemoveConnByUfrag(ufrag string) {
 }
 
 // IsClosed returns true if the mux had been closed
-func (m *SingleSocketUDPMux) IsClosed() bool {
+func (m *UDPMuxDefault) IsClosed() bool {
 	select {
 	case <-m.closedChan:
 		return true
@@ -332,7 +324,7 @@ func (m *SingleSocketUDPMux) IsClosed() bool {
 }
 
 // Close the mux, no further connections could be created
-func (m *SingleSocketUDPMux) Close() error {
+func (m *UDPMuxDefault) Close() error {
 	var err error
 	m.closeOnce.Do(func() {
 		m.mu.Lock()
@@ -355,11 +347,11 @@ func (m *SingleSocketUDPMux) Close() error {
 	return err
 }
 
-func (m *SingleSocketUDPMux) writeTo(buf []byte, rAddr net.Addr) (n int, err error) {
+func (m *UDPMuxDefault) writeTo(buf []byte, rAddr net.Addr) (n int, err error) {
 	return m.params.UDPConn.WriteTo(buf, rAddr)
 }
 
-func (m *SingleSocketUDPMux) registerConnForAddress(conn *udpMuxedConn, addr string) {
+func (m *UDPMuxDefault) registerConnForAddress(conn *udpMuxedConn, addr string) {
 	if m.IsClosed() {
 		return
 	}
@@ -376,109 +368,81 @@ func (m *SingleSocketUDPMux) registerConnForAddress(conn *udpMuxedConn, addr str
 	log.Debugf("ICE: registered %s for %s", addr, conn.params.Key)
 }
 
-func (m *SingleSocketUDPMux) createMuxedConn(key string, candidateID string) *udpMuxedConn {
+func (m *UDPMuxDefault) createMuxedConn(key string) *udpMuxedConn {
 	c := newUDPMuxedConn(&udpMuxedConnParams{
-		Mux:         m,
-		Key:         key,
-		AddrPool:    m.pool,
-		LocalAddr:   m.LocalAddr(),
-		Logger:      m.params.Logger,
-		CandidateID: candidateID,
+		Mux:       m,
+		Key:       key,
+		AddrPool:  m.pool,
+		LocalAddr: m.LocalAddr(),
+		Logger:    m.params.Logger,
 	})
 	return c
 }
 
 // HandleSTUNMessage handles STUN packets and forwards them to underlying pion/ice library
-func (m *SingleSocketUDPMux) HandleSTUNMessage(msg *stun.Message, addr net.Addr) error {
+func (m *UDPMuxDefault) HandleSTUNMessage(msg *stun.Message, addr net.Addr) error {
+
 	remoteAddr, ok := addr.(*net.UDPAddr)
 	if !ok {
 		return fmt.Errorf("underlying PacketConn did not return a UDPAddr")
 	}
 
-	// Try to route to specific candidate connection first
-	if conn := m.findCandidateConnection(msg); conn != nil {
-		return conn.writePacket(msg.Raw, remoteAddr)
-	}
-
-	// Fallback: route to all possible connections
-	return m.forwardToAllConnections(msg, addr, remoteAddr)
-}
-
-// findCandidateConnection attempts to find the specific connection for a STUN message
-func (m *SingleSocketUDPMux) findCandidateConnection(msg *stun.Message) *udpMuxedConn {
-	candidatePairID, ok, err := ice.CandidatePairIDFromSTUN(msg)
-	if err != nil {
-		return nil
-	} else if !ok {
-		return nil
-	}
-
-	m.mu.Lock()
-	defer m.mu.Unlock()
-	conn, exists := m.candidateConnMap[candidatePairID.TargetCandidateID()]
-	if !exists {
-		return nil
-	}
-	return conn
-}
-
-// forwardToAllConnections forwards STUN message to all relevant connections
-func (m *SingleSocketUDPMux) forwardToAllConnections(msg *stun.Message, addr net.Addr, remoteAddr *net.UDPAddr) error {
-	var destinationConnList []*udpMuxedConn
-
-	// Add connections from address map
+	// If we have already seen this address dispatch to the appropriate destination
+	// If you are using the same socket for the Host and SRFLX candidates, it might be that there are more than one
+	// muxed connection - one for the SRFLX candidate and the other one for the HOST one.
+	// We will then forward STUN packets to each of these connections.
 	m.addressMapMu.RLock()
+	var destinationConnList []*udpMuxedConn
 	if storedConns, ok := m.addressMap[addr.String()]; ok {
 		destinationConnList = append(destinationConnList, storedConns...)
 	}
 	m.addressMapMu.RUnlock()
 
-	if conn, ok := m.findConnectionByUsername(msg, addr); ok {
-		// If we have already seen this address dispatch to the appropriate destination
-		// If you are using the same socket for the Host and SRFLX candidates, it might be that there are more than one
-		// muxed connection - one for the SRFLX candidate and the other one for the HOST one.
-		// We will then forward STUN packets to each of these connections.
-		if !m.connectionExists(conn, destinationConnList) {
-			destinationConnList = append(destinationConnList, conn)
-		}
+	var isIPv6 bool
+	if udpAddr, _ := addr.(*net.UDPAddr); udpAddr != nil && udpAddr.IP.To4() == nil {
+		isIPv6 = true
 	}
 
-	// Forward to all found connections
+	// This block is needed to discover Peer Reflexive Candidates for which we don't know the Endpoint upfront.
+	// However, we can take a username attribute from the STUN message which contains ufrag.
+	// We can use ufrag to identify the destination conn to route packet to.
+	attr, stunAttrErr := msg.Get(stun.AttrUsername)
+	if stunAttrErr == nil {
+		ufrag := strings.Split(string(attr), ":")[0]
+
+		m.mu.Lock()
+		destinationConn := m.connsIPv4[ufrag]
+		if isIPv6 {
+			destinationConn = m.connsIPv6[ufrag]
+		}
+
+		if destinationConn != nil {
+			exists := false
+			for _, conn := range destinationConnList {
+				if conn.params.Key == destinationConn.params.Key {
+					exists = true
+					break
+				}
+			}
+			if !exists {
+				destinationConnList = append(destinationConnList, destinationConn)
+			}
+		}
+		m.mu.Unlock()
+	}
+
+	// Forward STUN packets to each destination connections even thought the STUN packet might not belong there.
+	// It will be discarded by the further ICE candidate logic if so.
 	for _, conn := range destinationConnList {
 		if err := conn.writePacket(msg.Raw, remoteAddr); err != nil {
 			log.Errorf("could not write packet: %v", err)
 		}
 	}
+
 	return nil
 }
 
-// findConnectionByUsername finds connection using username attribute from STUN message
-func (m *SingleSocketUDPMux) findConnectionByUsername(msg *stun.Message, addr net.Addr) (*udpMuxedConn, bool) {
-	attr, err := msg.Get(stun.AttrUsername)
-	if err != nil {
-		return nil, false
-	}
-
-	ufrag := strings.Split(string(attr), ":")[0]
-	isIPv6 := isIPv6Address(addr)
-
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	return m.getConn(ufrag, isIPv6)
-}
-
-// connectionExists checks if a connection already exists in the list
-func (m *SingleSocketUDPMux) connectionExists(target *udpMuxedConn, conns []*udpMuxedConn) bool {
-	for _, conn := range conns {
-		if conn.params.Key == target.params.Key {
-			return true
-		}
-	}
-	return false
-}
-
-func (m *SingleSocketUDPMux) getConn(ufrag string, isIPv6 bool) (val *udpMuxedConn, ok bool) {
+func (m *UDPMuxDefault) getConn(ufrag string, isIPv6 bool) (val *udpMuxedConn, ok bool) {
 	if isIPv6 {
 		val, ok = m.connsIPv6[ufrag]
 	} else {
@@ -487,13 +451,6 @@ func (m *SingleSocketUDPMux) getConn(ufrag string, isIPv6 bool) (val *udpMuxedCo
 	return
 }
 
-func isIPv6Address(addr net.Addr) bool {
-	if udpAddr, ok := addr.(*net.UDPAddr); ok {
-		return udpAddr.IP.To4() == nil
-	}
-	return false
-}
-
 type bufferHolder struct {
 	buf []byte
 }

client/iface/bind/udp_mux_generic.go

@@ -1,12 +1,12 @@
 //go:build !ios
 
-package udpmux
+package bind
 
 import (
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
-func (m *SingleSocketUDPMux) notifyAddressRemoval(addr string) {
+func (m *UDPMuxDefault) notifyAddressRemoval(addr string) {
 	// Kernel mode: direct nbnet.PacketConn (SharedSocket wrapped with nbnet)
 	if conn, ok := m.params.UDPConn.(*nbnet.PacketConn); ok {
 		conn.RemoveAddress(addr)

client/iface/bind/udp_mux_ios.go

@@ -0,0 +1,7 @@
+//go:build ios
+
+package bind
+
+func (m *UDPMuxDefault) notifyAddressRemoval(addr string) {
+	// iOS doesn't support nbnet hooks, so this is a no-op
+}

client/iface/bind/udp_mux_universal.go

@@ -1,4 +1,4 @@
-package udpmux
+package bind
 
 /*
  Most of this code was copied from https://github.com/pion/ice and modified to fulfill NetBird's requirements.
@@ -29,7 +29,7 @@ type FilterFn func(address netip.Addr) (bool, netip.Prefix, error)
 // UniversalUDPMuxDefault handles STUN and TURN servers packets by wrapping the original UDPConn
 // It then passes packets to the UDPMux that does the actual connection muxing.
 type UniversalUDPMuxDefault struct {
-	*SingleSocketUDPMux
+	*UDPMuxDefault
 	params UniversalUDPMuxParams
 
 	// since we have a shared socket, for srflx candidates it makes sense to have a shared mapped address across all the agents
@@ -72,12 +72,12 @@ func NewUniversalUDPMuxDefault(params UniversalUDPMuxParams) *UniversalUDPMuxDef
 		address:    params.WGAddress,
 	}
 
-	udpMuxParams := Params{
+	udpMuxParams := UDPMuxParams{
 		Logger:  params.Logger,
 		UDPConn: m.params.UDPConn,
 		Net:     m.params.Net,
 	}
-	m.SingleSocketUDPMux = NewSingleSocketUDPMux(udpMuxParams)
+	m.UDPMuxDefault = NewUDPMuxDefault(udpMuxParams)
 
 	return m
 }
@@ -211,8 +211,8 @@ func (m *UniversalUDPMuxDefault) GetRelayedAddr(turnAddr net.Addr, deadline time
 
 // GetConnForURL add uniques to the muxed connection by concatenating ufrag and URL (e.g. STUN URL) to be able to support multiple STUN/TURN servers
 // and return a unique connection per server.
-func (m *UniversalUDPMuxDefault) GetConnForURL(ufrag string, url string, addr net.Addr, candidateID string) (net.PacketConn, error) {
-	return m.SingleSocketUDPMux.GetConn(fmt.Sprintf("%s%s", ufrag, url), addr, candidateID)
+func (m *UniversalUDPMuxDefault) GetConnForURL(ufrag string, url string, addr net.Addr) (net.PacketConn, error) {
+	return m.UDPMuxDefault.GetConn(fmt.Sprintf("%s%s", ufrag, url), addr)
 }
 
 // HandleSTUNMessage discovers STUN packets that carry a XOR mapped address from a STUN server.
@@ -233,7 +233,7 @@ func (m *UniversalUDPMuxDefault) HandleSTUNMessage(msg *stun.Message, addr net.A
 		}
 		return nil
 	}
-	return m.SingleSocketUDPMux.HandleSTUNMessage(msg, addr)
+	return m.UDPMuxDefault.HandleSTUNMessage(msg, addr)
 }
 
 // isXORMappedResponse indicates whether the message is a XORMappedAddress and is coming from the known STUN server.

client/iface/bind/udp_muxed_conn.go

@@ -1,4 +1,4 @@
-package udpmux
+package bind
 
 /*
  Most of this code was copied from https://github.com/pion/ice and modified to fulfill NetBird's requirements
@@ -16,12 +16,11 @@ import (
 )
 
 type udpMuxedConnParams struct {
-	Mux         *SingleSocketUDPMux
-	AddrPool    *sync.Pool
-	Key         string
-	LocalAddr   net.Addr
-	Logger      logging.LeveledLogger
-	CandidateID string
+	Mux       *UDPMuxDefault
+	AddrPool  *sync.Pool
+	Key       string
+	LocalAddr net.Addr
+	Logger    logging.LeveledLogger
 }
 
 // udpMuxedConn represents a logical packet conn for a single remote as identified by ufrag
@@ -120,10 +119,6 @@ func (c *udpMuxedConn) Close() error {
 	return err
 }
 
-func (c *udpMuxedConn) GetCandidateID() string {
-	return c.params.CandidateID
-}
-
 func (c *udpMuxedConn) isClosed() bool {
 	select {
 	case <-c.closedChan:

client/iface/configurer/usp.go

@@ -17,8 +17,8 @@ import (
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
 	"github.com/netbirdio/netbird/client/iface/bind"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/monotime"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 const (
@@ -409,7 +409,7 @@ func toBytes(s string) (int64, error) {
 }
 
 func getFwmark() int {
-	if nbnet.AdvancedRouting() && runtime.GOOS == "linux" {
+	if nbnet.AdvancedRouting() {
 		return nbnet.ControlPlaneMark
 	}
 	return 0

client/iface/device.go

@@ -7,14 +7,14 @@ import (
 
 	wgdevice "golang.zx2c4.com/wireguard/device"
 
+	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
 
 type WGTunDevice interface {
 	Create() (device.WGConfigurer, error)
-	Up() (*udpmux.UniversalUDPMuxDefault, error)
+	Up() (*bind.UniversalUDPMuxDefault, error)
 	UpdateAddr(address wgaddr.Address) error
 	WgAddress() wgaddr.Address
 	MTU() uint16

client/iface/device/device_android.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
 
@@ -30,7 +29,7 @@ type WGTunDevice struct {
 	name           string
 	device         *device.Device
 	filteredDevice *FilteredDevice
-	udpMux         *udpmux.UniversalUDPMuxDefault
+	udpMux         *bind.UniversalUDPMuxDefault
 	configurer     WGConfigurer
 }
 
@@ -89,7 +88,7 @@ func (t *WGTunDevice) Create(routes []string, dns string, searchDomains []string
 	}
 	return t.configurer, nil
 }
-func (t *WGTunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (t *WGTunDevice) Up() (*bind.UniversalUDPMuxDefault, error) {
 	err := t.device.Up()
 	if err != nil {
 		return nil, err

client/iface/device/device_darwin.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
 
@@ -27,7 +26,7 @@ type TunDevice struct {
 
 	device         *device.Device
 	filteredDevice *FilteredDevice
-	udpMux         *udpmux.UniversalUDPMuxDefault
+	udpMux         *bind.UniversalUDPMuxDefault
 	configurer     WGConfigurer
 }
 
@@ -72,7 +71,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 	return t.configurer, nil
 }
 
-func (t *TunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (t *TunDevice) Up() (*bind.UniversalUDPMuxDefault, error) {
 	err := t.device.Up()
 	if err != nil {
 		return nil, err

client/iface/device/device_ios.go

@@ -14,7 +14,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
 
@@ -29,7 +28,7 @@ type TunDevice struct {
 
 	device         *device.Device
 	filteredDevice *FilteredDevice
-	udpMux         *udpmux.UniversalUDPMuxDefault
+	udpMux         *bind.UniversalUDPMuxDefault
 	configurer     WGConfigurer
 }
 
@@ -84,7 +83,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 	return t.configurer, nil
 }
 
-func (t *TunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (t *TunDevice) Up() (*bind.UniversalUDPMuxDefault, error) {
 	err := t.device.Up()
 	if err != nil {
 		return nil, err

client/iface/device/device_kernel_unix.go

@@ -12,11 +12,11 @@ import (
 	"golang.zx2c4.com/wireguard/device"
 	"golang.zx2c4.com/wireguard/tun/netstack"
 
+	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/sharedsock"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 type TunKernelDevice struct {
@@ -31,9 +31,9 @@ type TunKernelDevice struct {
 
 	link       *wgLink
 	udpMuxConn net.PacketConn
-	udpMux     *udpmux.UniversalUDPMuxDefault
+	udpMux     *bind.UniversalUDPMuxDefault
 
-	filterFn udpmux.FilterFn
+	filterFn bind.FilterFn
 }
 
 func NewKernelDevice(name string, address wgaddr.Address, wgPort int, key string, mtu uint16, transportNet transport.Net) *TunKernelDevice {
@@ -79,7 +79,7 @@ func (t *TunKernelDevice) Create() (WGConfigurer, error) {
 	return configurer, nil
 }
 
-func (t *TunKernelDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (t *TunKernelDevice) Up() (*bind.UniversalUDPMuxDefault, error) {
 	if t.udpMux != nil {
 		return t.udpMux, nil
 	}
@@ -101,14 +101,19 @@ func (t *TunKernelDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
 		return nil, err
 	}
 
-	bindParams := udpmux.UniversalUDPMuxParams{
-		UDPConn:   nbnet.WrapPacketConn(rawSock),
+	var udpConn net.PacketConn = rawSock
+	if !nbnet.AdvancedRouting() {
+		udpConn = nbnet.WrapPacketConn(rawSock)
+	}
+
+	bindParams := bind.UniversalUDPMuxParams{
+		UDPConn:   udpConn,
 		Net:       t.transportNet,
 		FilterFn:  t.filterFn,
 		WGAddress: t.address,
 		MTU:       t.mtu,
 	}
-	mux := udpmux.NewUniversalUDPMuxDefault(bindParams)
+	mux := bind.NewUniversalUDPMuxDefault(bindParams)
 	go mux.ReadFromConn(t.ctx)
 	t.udpMuxConn = rawSock
 	t.udpMux = mux

client/iface/device/device_netstack.go

@@ -10,9 +10,8 @@ import (
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 type TunNetstackDevice struct {
@@ -27,7 +26,7 @@ type TunNetstackDevice struct {
 	device         *device.Device
 	filteredDevice *FilteredDevice
 	nsTun          *nbnetstack.NetStackTun
-	udpMux         *udpmux.UniversalUDPMuxDefault
+	udpMux         *bind.UniversalUDPMuxDefault
 	configurer     WGConfigurer
 
 	net *netstack.Net
@@ -81,7 +80,7 @@ func (t *TunNetstackDevice) create() (WGConfigurer, error) {
 	return t.configurer, nil
 }
 
-func (t *TunNetstackDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (t *TunNetstackDevice) Up() (*bind.UniversalUDPMuxDefault, error) {
 	if t.device == nil {
 		return nil, fmt.Errorf("device is not ready yet")
 	}

client/iface/device/device_usp_unix.go

@@ -12,7 +12,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
 
@@ -26,7 +25,7 @@ type USPDevice struct {
 
 	device         *device.Device
 	filteredDevice *FilteredDevice
-	udpMux         *udpmux.UniversalUDPMuxDefault
+	udpMux         *bind.UniversalUDPMuxDefault
 	configurer     WGConfigurer
 }
 
@@ -75,7 +74,7 @@ func (t *USPDevice) Create() (WGConfigurer, error) {
 	return t.configurer, nil
 }
 
-func (t *USPDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (t *USPDevice) Up() (*bind.UniversalUDPMuxDefault, error) {
 	if t.device == nil {
 		return nil, fmt.Errorf("device is not ready yet")
 	}

client/iface/device/device_windows.go

@@ -13,7 +13,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
 
@@ -30,7 +29,7 @@ type TunDevice struct {
 	device          *device.Device
 	nativeTunDevice *tun.NativeTun
 	filteredDevice  *FilteredDevice
-	udpMux          *udpmux.UniversalUDPMuxDefault
+	udpMux          *bind.UniversalUDPMuxDefault
 	configurer      WGConfigurer
 }
 
@@ -105,7 +104,7 @@ func (t *TunDevice) Create() (WGConfigurer, error) {
 	return t.configurer, nil
 }
 
-func (t *TunDevice) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (t *TunDevice) Up() (*bind.UniversalUDPMuxDefault, error) {
 	err := t.device.Up()
 	if err != nil {
 		return nil, err

client/iface/device_android.go

@@ -5,14 +5,14 @@ import (
 
 	"golang.zx2c4.com/wireguard/tun/netstack"
 
+	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 )
 
 type WGTunDevice interface {
 	Create(routes []string, dns string, searchDomains []string) (device.WGConfigurer, error)
-	Up() (*udpmux.UniversalUDPMuxDefault, error)
+	Up() (*bind.UniversalUDPMuxDefault, error)
 	UpdateAddr(address wgaddr.Address) error
 	WgAddress() wgaddr.Address
 	MTU() uint16

client/iface/iface.go

@@ -16,9 +16,9 @@ import (
 	wgdevice "golang.zx2c4.com/wireguard/device"
 
 	"github.com/netbirdio/netbird/client/errors"
+	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 	"github.com/netbirdio/netbird/monotime"
@@ -61,7 +61,7 @@ type WGIFaceOpts struct {
 	MTU          uint16
 	MobileArgs   *device.MobileIFaceArguments
 	TransportNet transport.Net
-	FilterFn     udpmux.FilterFn
+	FilterFn     bind.FilterFn
 	DisableDNS   bool
 }
 
@@ -114,7 +114,7 @@ func (r *WGIface) ToInterface() *net.Interface {
 
 // Up configures a Wireguard interface
 // The interface must exist before calling this method (e.g. call interface.Create() before)
-func (w *WGIface) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (w *WGIface) Up() (*bind.UniversalUDPMuxDefault, error) {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 

client/iface/udpmux/doc.go

@@ -1,64 +0,0 @@
-// Package udpmux provides a custom implementation of a UDP multiplexer
-// that allows multiple logical ICE connections to share a single underlying
-// UDP socket. This is based on Pion's ICE library, with modifications for
-// NetBird's requirements.
-//
-// # Background
-//
-// In WebRTC and NAT traversal scenarios, ICE (Interactive Connectivity
-// Establishment) is responsible for discovering candidate network paths
-// and maintaining connectivity between peers. Each ICE connection
-// normally requires a dedicated UDP socket. However, using one socket
-// per candidate can be inefficient and difficult to manage.
-//
-// This package introduces SingleSocketUDPMux, which allows multiple ICE
-// candidate connections (muxed connections) to share a single UDP socket.
-// It handles demultiplexing of packets based on ICE ufrag values, STUN
-// attributes, and candidate IDs.
-//
-// # Usage
-//
-// The typical flow is:
-//
-//  1. Create a UDP socket (net.PacketConn).
-//  2. Construct Params with the socket and optional logger/net stack.
-//  3. Call NewSingleSocketUDPMux(params).
-//  4. For each ICE candidate ufrag, call GetConn(ufrag, addr, candidateID)
-//     to obtain a logical PacketConn.
-//  5. Use the returned PacketConn just like a normal UDP connection.
-//
-// # STUN Message Routing Logic
-//
-//		When a STUN packet arrives, the mux decides which connection should
-//		receive it using this routing logic:
-//
-//		Primary Routing: Candidate Pair ID
-//		  - Extract the candidate pair ID from the STUN message using
-//		    ice.CandidatePairIDFromSTUN(msg)
-//	   - The target candidate is the locally generated candidate that
-//	     corresponds to the connection that should handle this STUN message
-//		  - If found, use the target candidate ID to lookup the specific
-//		    connection in candidateConnMap
-//		  - Route the message directly to that connection
-//
-//		Fallback Routing: Broadcasting
-//		  When candidate pair ID is not available or lookup fails:
-//		  - Collect connections from addressMap based on source address
-//		  - Find connection using username attribute (ufrag) from STUN message
-//		  - Remove duplicate connections from the list
-//		  - Send the STUN message to all collected connections
-//
-// # Peer Reflexive Candidate Discovery
-//
-//	When a remote peer sends a STUN message from an unknown source address
-//	(from a candidate that has not been exchanged via signal), the ICE
-//	library will:
-//	  - Generate a new peer reflexive candidate for this source address
-//	  - Extract or assign a candidate ID based on the STUN message attributes
-//	  - Create a mapping between the new peer reflexive candidate ID and
-//	    the appropriate local connection
-//
-//	This discovery mechanism ensures that STUN messages from newly discovered
-//	peer reflexive candidates can be properly routed to the correct local
-//	connection without requiring fallback broadcasting.
-package udpmux

client/iface/udpmux/mux_ios.go

@@ -1,7 +0,0 @@
-//go:build ios
-
-package udpmux
-
-func (m *SingleSocketUDPMux) notifyAddressRemoval(addr string) {
-	// iOS doesn't support nbnet hooks, so this is a no-op
-}

client/iface/wgproxy/ebpf/proxy.go

@@ -20,7 +20,7 @@ import (
 	"github.com/netbirdio/netbird/client/iface/bufsize"
 	"github.com/netbirdio/netbird/client/internal/ebpf"
 	ebpfMgr "github.com/netbirdio/netbird/client/internal/ebpf/manager"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 const (

client/internal/connect.go

@@ -34,7 +34,7 @@ import (
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 	signal "github.com/netbirdio/netbird/shared/signal/client"
 	"github.com/netbirdio/netbird/util"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 	"github.com/netbirdio/netbird/version"
 )
 
@@ -280,12 +280,15 @@ func (c *ConnectClient) run(mobileDependency MobileDependency, runningChan chan
 			return wrapErr(err)
 		}
 
+
 		log.Infof("Netbird engine started, the IP is: %s", peerConfig.GetAddress())
 		state.Set(StatusConnected)
 
 		if runningChan != nil {
-			close(runningChan)
-			runningChan = nil
+			select {
+			case runningChan <- struct{}{}:
+			default:
+			}
 		}
 
 		<-engineCtx.Done()

client/internal/debug/debug.go

@@ -315,6 +315,10 @@ func (g *BundleGenerator) createArchive() error {
 		return fmt.Errorf("add sync response: %w", err)
 	}
 
+	if err := g.addDNSConfig(); err != nil {
+		log.Errorf("failed to add DNS config to debug bundle: %v", err)
+	}
+
 	if err := g.addStateFile(); err != nil {
 		log.Errorf("failed to add state file to debug bundle: %v", err)
 	}
@@ -341,6 +345,50 @@ func (g *BundleGenerator) createArchive() error {
 	return nil
 }
 
+// addDNSConfig writes a dns_config.json snapshot with routed domains and NS group status
+func (g *BundleGenerator) addDNSConfig() error {
+	type nsGroup struct {
+		ID      string   `json:"id"`
+		Servers []string `json:"servers"`
+		Domains []string `json:"domains"`
+		Enabled bool     `json:"enabled"`
+		Error   string   `json:"error,omitempty"`
+	}
+	type dnsConfig struct {
+		Groups []nsGroup `json:"name_server_groups"`
+	}
+
+	if g.statusRecorder == nil {
+		return nil
+	}
+
+	states := g.statusRecorder.GetDNSStates()
+	cfg := dnsConfig{Groups: make([]nsGroup, 0, len(states))}
+	for _, st := range states {
+		var servers []string
+		for _, ap := range st.Servers {
+			servers = append(servers, ap.String())
+		}
+		var errStr string
+		if st.Error != nil {
+			errStr = st.Error.Error()
+		}
+		cfg.Groups = append(cfg.Groups, nsGroup{
+			ID:      st.ID,
+			Servers: servers,
+			Domains: st.Domains,
+			Enabled: st.Enabled,
+			Error:   errStr,
+		})
+	}
+
+	bs, err := json.MarshalIndent(cfg, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal dns config: %w", err)
+	}
+	return g.addFileToZip(bytes.NewReader(bs), "dns_config.json")
+}
+
 func (g *BundleGenerator) addSystemInfo() {
 	if err := g.addRoutes(); err != nil {
 		log.Errorf("failed to add routes to debug bundle: %v", err)

client/internal/dns/service_memory.go

@@ -10,7 +10,7 @@ import (
 	"github.com/miekg/dns"
 	log "github.com/sirupsen/logrus"
 
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 type ServiceViaMemory struct {

client/internal/dns/upstream_android.go

@@ -10,7 +10,7 @@ import (
 	"github.com/miekg/dns"
 
 	"github.com/netbirdio/netbird/client/internal/peer"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 type upstreamResolver struct {

client/internal/dnsfwd/forwarder.go

@@ -46,6 +46,18 @@ type DNSForwarder struct {
 	fwdEntries []*ForwarderEntry
 	firewall   firewaller
 	resolver   resolver
+
+	// failure rate tracking for routed domains
+	failureMu      sync.Mutex
+	failureCounts  map[string]int
+	failureWindow  time.Duration
+	lastLogPerHost map[string]time.Time
+
+	// per-domain rolling stats and windows
+	statsMu sync.Mutex
+	stats   map[string]*domainStats
+	winSize time.Duration
+	slowT   time.Duration
 }
 
 func NewDNSForwarder(listenAddress string, ttl uint32, firewall firewaller, statusRecorder *peer.Status) *DNSForwarder {
@@ -56,9 +68,25 @@ func NewDNSForwarder(listenAddress string, ttl uint32, firewall firewaller, stat
 		firewall:       firewall,
 		statusRecorder: statusRecorder,
 		resolver:       net.DefaultResolver,
+		failureCounts:  make(map[string]int),
+		failureWindow:  10 * time.Second,
+		lastLogPerHost: make(map[string]time.Time),
+		stats:          make(map[string]*domainStats),
+		winSize:        10 * time.Second,
+		slowT:          300 * time.Millisecond,
 	}
 }
 
+type domainStats struct {
+	total    int
+	success  int
+	timeouts int
+	notfound int
+	failures int // other failures (incl. SERVFAIL-like)
+	slow     int
+	lastLog  time.Time
+}
+
 func (f *DNSForwarder) Listen(entries []*ForwarderEntry) error {
 	log.Infof("starting DNS forwarder on address=%s", f.listenAddress)
 
@@ -163,12 +191,19 @@ func (f *DNSForwarder) handleDNSQuery(w dns.ResponseWriter, query *dns.Msg) *dns
 
 	ctx, cancel := context.WithTimeout(context.Background(), upstreamTimeout)
 	defer cancel()
+	start := time.Now()
 	ips, err := f.resolver.LookupNetIP(ctx, network, domain)
+	elapsed := time.Since(start)
 	if err != nil {
 		f.handleDNSError(ctx, w, question, resp, domain, err)
+		// record error stats for routed domains
+		f.recordErrorStats(strings.TrimSuffix(domain, "."), err)
 		return nil
 	}
 
+	// record success timing
+	f.recordSuccessStats(strings.TrimSuffix(domain, "."), elapsed)
+
 	f.updateInternalState(ips, mostSpecificResId, matchingEntries)
 	f.addIPsToResponse(resp, domain, ips)
 
@@ -306,6 +341,91 @@ func (f *DNSForwarder) handleDNSError(ctx context.Context, w dns.ResponseWriter,
 	if err := w.WriteMsg(resp); err != nil {
 		log.Errorf("failed to write failure DNS response: %v", err)
 	}
+
+	// Track failure rate for routed domains only
+	if resID, _ := f.getMatchingEntries(strings.TrimSuffix(domain, ".")); resID != "" {
+		f.recordDomainFailure(strings.TrimSuffix(domain, "."))
+	}
+}
+
+// recordErrorStats updates per-domain counters and emits rate-limited logs
+func (f *DNSForwarder) recordErrorStats(domain string, err error) {
+	domain = strings.ToLower(domain)
+	f.statsMu.Lock()
+	s := f.ensureStats(domain)
+	s.total++
+
+	var dnsErr *net.DNSError
+	if errors.As(err, &dnsErr) {
+		if dnsErr.IsNotFound {
+			s.notfound++
+		} else if dnsErr.Timeout() {
+			s.timeouts++
+		} else {
+			s.failures++
+		}
+	} else {
+		s.failures++
+	}
+
+	f.maybeLogDomainStats(domain, s)
+	f.statsMu.Unlock()
+}
+
+// recordSuccessStats updates per-domain latency stats and slow counters, logs if needed (rate-limited)
+func (f *DNSForwarder) recordSuccessStats(domain string, elapsed time.Duration) {
+	domain = strings.ToLower(domain)
+	f.statsMu.Lock()
+	s := f.ensureStats(domain)
+	s.total++
+	s.success++
+	if elapsed >= f.slowT {
+		s.slow++
+	}
+	f.maybeLogDomainStats(domain, s)
+	f.statsMu.Unlock()
+}
+
+func (f *DNSForwarder) ensureStats(domain string) *domainStats {
+	if ds, ok := f.stats[domain]; ok {
+		return ds
+	}
+	ds := &domainStats{}
+	f.stats[domain] = ds
+	return ds
+}
+
+// maybeLogDomainStats logs a compact summary per routed domain at most once per window
+func (f *DNSForwarder) maybeLogDomainStats(domain string, s *domainStats) {
+	now := time.Now()
+	if !s.lastLog.IsZero() && now.Sub(s.lastLog) < f.winSize {
+		return
+	}
+
+	// check if routed (avoid logging for non-routed domains)
+	if resID, _ := f.getMatchingEntries(domain); resID == "" {
+		return
+	}
+
+	// only log if something noteworthy happened in the window
+	noteworthy := s.timeouts > 0 || s.notfound > 0 || s.failures > 0 || s.slow > 0
+	if !noteworthy {
+		s.lastLog = now
+		return
+	}
+
+	// warn on persistent problems, info otherwise
+	levelWarn := s.timeouts >= 3 || s.failures >= 3
+	if levelWarn {
+		log.Warnf("[d] DNS stats: domain=%s total=%d ok=%d timeout=%d nxdomain=%d fail=%d slow=%d(>=%s)",
+			domain, s.total, s.success, s.timeouts, s.notfound, s.failures, s.slow, f.slowT)
+	} else {
+		log.Infof("[d] DNS stats: domain=%s total=%d ok=%d timeout=%d nxdomain=%d fail=%d slow=%d(>=%s)",
+			domain, s.total, s.success, s.timeouts, s.notfound, s.failures, s.slow, f.slowT)
+	}
+
+	// reset counters for next window
+	*s = domainStats{lastLog: now}
 }
 
 // addIPsToResponse adds IP addresses to the DNS response as appropriate A or AAAA records
@@ -341,6 +461,27 @@ func (f *DNSForwarder) addIPsToResponse(resp *dns.Msg, domain string, ips []neti
 	}
 }
 
+// recordDomainFailure increments failure count for the domain and logs at info/warn with throttling.
+func (f *DNSForwarder) recordDomainFailure(domain string) {
+	domain = strings.ToLower(domain)
+
+	f.failureMu.Lock()
+	defer f.failureMu.Unlock()
+
+	f.failureCounts[domain]++
+	count := f.failureCounts[domain]
+
+	now := time.Now()
+	last, ok := f.lastLogPerHost[domain]
+	if ok && now.Sub(last) < f.failureWindow {
+		return
+	}
+	f.lastLogPerHost[domain] = now
+
+	log.Warnf("[d] DNS failures observed for routed domain: domain=%s failures=%d/%s", domain, count, f.failureWindow)
+
+}
+
 // getMatchingEntries retrieves the resource IDs for a given domain.
 // It returns the most specific match and all matching resource IDs.
 func (f *DNSForwarder) getMatchingEntries(domain string) (route.ResID, []*ForwarderEntry) {

client/internal/engine.go

@@ -29,9 +29,9 @@ import (
 	"github.com/netbirdio/netbird/client/firewall"
 	firewallManager "github.com/netbirdio/netbird/client/firewall/manager"
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/device"
 	nbnetstack "github.com/netbirdio/netbird/client/iface/netstack"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/internal/acl"
 	"github.com/netbirdio/netbird/client/internal/dns"
 	dnsconfig "github.com/netbirdio/netbird/client/internal/dns/config"
@@ -166,7 +166,7 @@ type Engine struct {
 
 	wgInterface WGIface
 
-	udpMux *udpmux.UniversalUDPMuxDefault
+	udpMux *bind.UniversalUDPMuxDefault
 
 	// networkSerial is the latest CurrentSerial (state ID) of the network sent by the Management service
 	networkSerial uint64
@@ -446,8 +446,6 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		return fmt.Errorf("up wg interface: %w", err)
 	}
 
-
-
 	// if inbound conns are blocked there is no need to create the ACL manager
 	if e.firewall != nil && !e.config.BlockInbound {
 		e.acl = acl.NewDefaultManager(e.firewall)
@@ -463,7 +461,7 @@ func (e *Engine) Start(netbirdConfig *mgmProto.NetbirdConfig, mgmtURL *url.URL)
 		StunTurn:             &e.stunTurn,
 		InterfaceBlackList:   e.config.IFaceBlackList,
 		DisableIPv6Discovery: e.config.DisableIPv6Discovery,
-		UDPMux:               e.udpMux.SingleSocketUDPMux,
+		UDPMux:               e.udpMux.UDPMuxDefault,
 		UDPMuxSrflx:          e.udpMux,
 		NATExternalIPs:       e.parseNATExternalIPMappings(),
 	}
@@ -1328,7 +1326,7 @@ func (e *Engine) createPeerConn(pubKey string, allowedIPs []netip.Prefix, agentV
 			StunTurn:             &e.stunTurn,
 			InterfaceBlackList:   e.config.IFaceBlackList,
 			DisableIPv6Discovery: e.config.DisableIPv6Discovery,
-			UDPMux:               e.udpMux.SingleSocketUDPMux,
+			UDPMux:               e.udpMux.UDPMuxDefault,
 			UDPMuxSrflx:          e.udpMux,
 			NATExternalIPs:       e.parseNATExternalIPMappings(),
 		},

client/internal/engine_test.go

@@ -26,11 +26,10 @@ import (
 	"google.golang.org/grpc/keepalive"
 
 	"github.com/netbirdio/management-integrations/integrations"
-
 	"github.com/netbirdio/netbird/client/iface"
+	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 	"github.com/netbirdio/netbird/client/internal/dns"
@@ -85,7 +84,7 @@ type MockWGIface struct {
 	NameFunc                   func() string
 	AddressFunc                func() wgaddr.Address
 	ToInterfaceFunc            func() *net.Interface
-	UpFunc                     func() (*udpmux.UniversalUDPMuxDefault, error)
+	UpFunc                     func() (*bind.UniversalUDPMuxDefault, error)
 	UpdateAddrFunc             func(newAddr string) error
 	UpdatePeerFunc             func(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error
 	RemovePeerFunc             func(peerKey string) error
@@ -135,7 +134,7 @@ func (m *MockWGIface) ToInterface() *net.Interface {
 	return m.ToInterfaceFunc()
 }
 
-func (m *MockWGIface) Up() (*udpmux.UniversalUDPMuxDefault, error) {
+func (m *MockWGIface) Up() (*bind.UniversalUDPMuxDefault, error) {
 	return m.UpFunc()
 }
 
@@ -414,7 +413,7 @@ func TestEngine_UpdateNetworkMap(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	engine.udpMux = udpmux.NewUniversalUDPMuxDefault(udpmux.UniversalUDPMuxParams{UDPConn: conn, MTU: 1280})
+	engine.udpMux = bind.NewUniversalUDPMuxDefault(bind.UniversalUDPMuxParams{UDPConn: conn, MTU: 1280})
 	engine.ctx = ctx
 	engine.srWatcher = guard.NewSRWatcher(nil, nil, nil, icemaker.Config{})
 	engine.connMgr = NewConnMgr(engine.config, engine.statusRecorder, engine.peerStore, wgIface)

client/internal/iface_common.go

@@ -9,9 +9,9 @@ import (
 	"golang.zx2c4.com/wireguard/tun/netstack"
 	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
 
+	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/iface/configurer"
 	"github.com/netbirdio/netbird/client/iface/device"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
 	"github.com/netbirdio/netbird/client/iface/wgaddr"
 	"github.com/netbirdio/netbird/client/iface/wgproxy"
 	"github.com/netbirdio/netbird/monotime"
@@ -24,7 +24,7 @@ type wgIfaceBase interface {
 	Name() string
 	Address() wgaddr.Address
 	ToInterface() *net.Interface
-	Up() (*udpmux.UniversalUDPMuxDefault, error)
+	Up() (*bind.UniversalUDPMuxDefault, error)
 	UpdateAddr(newAddr string) error
 	GetProxy() wgproxy.Proxy
 	UpdatePeer(peerKey string, allowedIps []netip.Prefix, keepAlive time.Duration, endpoint *net.UDPAddr, preSharedKey *wgtypes.Key) error

client/internal/netflow/conntrack/conntrack.go

@@ -14,7 +14,7 @@ import (
 	"github.com/ti-mo/netfilter"
 
 	nftypes "github.com/netbirdio/netbird/client/internal/netflow/types"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 const defaultChannelSize = 100

client/internal/peer/status.go

@@ -21,9 +21,9 @@ import (
 	"github.com/netbirdio/netbird/client/internal/ingressgw"
 	"github.com/netbirdio/netbird/client/internal/relay"
 	"github.com/netbirdio/netbird/client/proto"
+	"github.com/netbirdio/netbird/route"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
-	"github.com/netbirdio/netbird/route"
 )
 
 const eventQueueSize = 10
@@ -201,6 +201,8 @@ type Status struct {
 	resolvedDomainsStates map[domain.Domain]ResolvedDomainInfo
 	lazyConnectionEnabled bool
 
+	lastDisconnectLog map[string]time.Time
+
 	// To reduce the number of notification invocation this bool will be true when need to call the notification
 	// Some Peer actions mostly used by in a batch when the network map has been synchronized. In these type of events
 	// set to true this variable and at the end of the processing we will reset it by the FinishPeerListModifications()
@@ -229,6 +231,7 @@ func NewRecorder(mgmAddress string) *Status {
 		notifier:              newNotifier(),
 		mgmAddress:            mgmAddress,
 		resolvedDomainsStates: map[domain.Domain]ResolvedDomainInfo{},
+		lastDisconnectLog:     make(map[string]time.Time),
 	}
 }
 
@@ -487,6 +490,9 @@ func (d *Status) UpdatePeerRelayedStateToDisconnected(receivedState State) error
 
 	d.peers[receivedState.PubKey] = peerState
 
+	// info log about disconnect with impacted routes (throttled)
+	d.logPeerDisconnectIfNeeded(receivedState.PubKey, peerState)
+
 	if hasConnStatusChanged(oldState, receivedState.ConnStatus) {
 		d.notifyPeerListChanged()
 	}
@@ -519,6 +525,9 @@ func (d *Status) UpdatePeerICEStateToDisconnected(receivedState State) error {
 
 	d.peers[receivedState.PubKey] = peerState
 
+	// info log about disconnect with impacted routes (throttled)
+	d.logPeerDisconnectIfNeeded(receivedState.PubKey, peerState)
+
 	if hasConnStatusChanged(oldState, receivedState.ConnStatus) {
 		d.notifyPeerListChanged()
 	}
@@ -529,6 +538,49 @@ func (d *Status) UpdatePeerICEStateToDisconnected(receivedState State) error {
 	return nil
 }
 
+// logPeerDisconnectIfNeeded logs an info message when a routing peer transitions to disconnected
+// with the number of impacted routes. Throttled to once per peer per 30 seconds.
+func (d *Status) logPeerDisconnectIfNeeded(pubKey string, state State) {
+	if state.ConnStatus != StatusIdle {
+		return
+	}
+
+	now := time.Now()
+	last, ok := d.lastDisconnectLog[pubKey]
+	if ok && now.Sub(last) < 10*time.Second {
+		return
+	}
+	d.lastDisconnectLog[pubKey] = now
+
+	routes := state.GetRoutes()
+	numRoutes := len(routes)
+
+	fqdn := state.FQDN
+	if fqdn == "" {
+		fqdn = pubKey
+	}
+
+	// prepare a bounded list of impacted routes to avoid huge log lines
+	maxList := 20
+	list := make([]string, 0, maxList)
+	for r := range routes {
+		if len(list) >= maxList {
+			break
+		}
+		list = append(list, r)
+	}
+	more := ""
+	if numRoutes > len(list) {
+		more = ", more=" + fmt.Sprintf("%d", numRoutes-len(list))
+	}
+
+	if len(list) > 0 {
+		log.Warnf("[d] Routing peer disconnected: peer=%s impacted_routes=%d routes=%v%s", fqdn, numRoutes, list, more)
+	} else {
+		log.Warnf("[d] Routing peer disconnected: peer=%s impacted_routes=%d", fqdn, numRoutes)
+	}
+}
+
 // UpdateWireGuardPeerState updates the WireGuard bits of the peer state
 func (d *Status) UpdateWireGuardPeerState(pubKey string, wgStats configurer.WGStats) error {
 	d.mux.Lock()

client/internal/peer/worker_ice.go

@@ -9,10 +9,11 @@ import (
 	"time"
 
 	"github.com/pion/ice/v4"
+	"github.com/pion/stun/v2"
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/iface"
-	"github.com/netbirdio/netbird/client/iface/udpmux"
+	"github.com/netbirdio/netbird/client/iface/bind"
 	"github.com/netbirdio/netbird/client/internal/peer/conntype"
 	icemaker "github.com/netbirdio/netbird/client/internal/peer/ice"
 	"github.com/netbirdio/netbird/client/internal/stdnet"
@@ -54,6 +55,10 @@ type WorkerICE struct {
 	sessionID ICESessionID
 	muxAgent  sync.Mutex
 
+	StunTurn []*stun.URI
+
+	sentExtraSrflx bool
+
 	localUfrag string
 	localPwd   string
 
@@ -134,6 +139,7 @@ func (w *WorkerICE) OnNewOffer(remoteOfferAnswer *OfferAnswer) {
 		w.muxAgent.Unlock()
 		return
 	}
+	w.sentExtraSrflx = false
 	w.agent = agent
 	w.agentDialerCancel = dialerCancel
 	w.agentConnecting = true
@@ -160,21 +166,6 @@ func (w *WorkerICE) OnRemoteCandidate(candidate ice.Candidate, haRoutes route.HA
 		w.log.Errorf("error while handling remote candidate")
 		return
 	}
-
-	if shouldAddExtraCandidate(candidate) {
-		// sends an extra server reflexive candidate to the remote peer with our related port (usually the wireguard port)
-		// this is useful when network has an existing port forwarding rule for the wireguard port and this peer
-		extraSrflx, err := extraSrflxCandidate(candidate)
-		if err != nil {
-			w.log.Errorf("failed creating extra server reflexive candidate %s", err)
-			return
-		}
-
-		if err := w.agent.AddRemoteCandidate(extraSrflx); err != nil {
-			w.log.Errorf("error while handling remote candidate")
-			return
-		}
-	}
 }
 
 func (w *WorkerICE) GetLocalUserCredentials() (frag string, pwd string) {
@@ -218,9 +209,7 @@ func (w *WorkerICE) reCreateAgent(dialerCancel context.CancelFunc, candidates []
 		return nil, err
 	}
 
-	if err := agent.OnSelectedCandidatePairChange(func(c1, c2 ice.Candidate) {
-		w.onICESelectedCandidatePair(agent, c1, c2)
-	}); err != nil {
+	if err := agent.OnSelectedCandidatePairChange(w.onICESelectedCandidatePair); err != nil {
 		return nil, err
 	}
 
@@ -338,7 +327,7 @@ func (w *WorkerICE) punchRemoteWGPort(pair *ice.CandidatePair, remoteWgPort int)
 		return
 	}
 
-	mux, ok := w.config.ICEConfig.UDPMuxSrflx.(*udpmux.UniversalUDPMuxDefault)
+	mux, ok := w.config.ICEConfig.UDPMuxSrflx.(*bind.UniversalUDPMuxDefault)
 	if !ok {
 		w.log.Warn("invalid udp mux conversion")
 		return
@@ -365,19 +354,48 @@ func (w *WorkerICE) onICECandidate(candidate ice.Candidate) {
 			w.log.Errorf("failed signaling candidate to the remote peer %s %s", w.config.Key, err)
 		}
 	}()
-}
 
-func (w *WorkerICE) onICESelectedCandidatePair(agent *icemaker.ThreadSafeAgent, c1, c2 ice.Candidate) {
-	w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
-		w.config.Key)
-
-	pairStat, ok := agent.GetSelectedCandidatePairStats()
-	if !ok {
-		w.log.Warnf("failed to get selected candidate pair stats")
+	if !w.shouldSendExtraSrflxCandidate(candidate) {
 		return
 	}
 
-	duration := time.Duration(pairStat.CurrentRoundTripTime * float64(time.Second))
+	// sends an extra server reflexive candidate to the remote peer with our related port (usually the wireguard port)
+	// this is useful when network has an existing port forwarding rule for the wireguard port and this peer
+	extraSrflx, err := extraSrflxCandidate(candidate)
+	if err != nil {
+		w.log.Errorf("failed creating extra server reflexive candidate %s", err)
+		return
+	}
+	w.sentExtraSrflx = true
+
+	go func() {
+		err = w.signaler.SignalICECandidate(extraSrflx, w.config.Key)
+		if err != nil {
+			w.log.Errorf("failed signaling the extra server reflexive candidate: %s", err)
+		}
+	}()
+}
+
+func (w *WorkerICE) onICESelectedCandidatePair(c1 ice.Candidate, c2 ice.Candidate) {
+	w.log.Debugf("selected candidate pair [local <-> remote] -> [%s <-> %s], peer %s", c1.String(), c2.String(),
+		w.config.Key)
+
+	w.muxAgent.Lock()
+
+	pair, err := w.agent.GetSelectedCandidatePair()
+	if err != nil {
+		w.log.Warnf("failed to get selected candidate pair: %s", err)
+		w.muxAgent.Unlock()
+		return
+	}
+	if pair == nil {
+		w.log.Warnf("selected candidate pair is nil, cannot proceed")
+		w.muxAgent.Unlock()
+		return
+	}
+	w.muxAgent.Unlock()
+
+	duration := time.Duration(pair.CurrentRoundTripTime() * float64(time.Second))
 	if err := w.statusRecorder.UpdateLatency(w.config.Key, duration); err != nil {
 		w.log.Debugf("failed to update latency for peer: %s", err)
 		return
@@ -406,31 +424,22 @@ func (w *WorkerICE) onConnectionStateChange(agent *icemaker.ThreadSafeAgent, dia
 	}
 }
 
+func (w *WorkerICE) shouldSendExtraSrflxCandidate(candidate ice.Candidate) bool {
+	if !w.sentExtraSrflx && candidate.Type() == ice.CandidateTypeServerReflexive && candidate.Port() != candidate.RelatedAddress().Port {
+		return true
+	}
+	return false
+}
+
 func (w *WorkerICE) turnAgentDial(ctx context.Context, agent *icemaker.ThreadSafeAgent, remoteOfferAnswer *OfferAnswer) (*ice.Conn, error) {
-	if isController(w.config) {
-		return w.agent.Dial(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
+	isControlling := w.config.LocalKey > w.config.Key
+	if isControlling {
+		return agent.Dial(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
 	} else {
 		return agent.Accept(ctx, remoteOfferAnswer.IceCredentials.UFrag, remoteOfferAnswer.IceCredentials.Pwd)
 	}
 }
 
-func shouldAddExtraCandidate(candidate ice.Candidate) bool {
-	if candidate.Type() != ice.CandidateTypeServerReflexive {
-		return false
-	}
-
-	if candidate.Port() == candidate.RelatedAddress().Port {
-		return false
-	}
-
-	// in the older version when we didn't set candidate ID extension the remote peer sent the extra candidates
-	// in newer version we generate locally the extra candidate
-	if _, ok := candidate.GetExtension(ice.ExtensionKeyCandidateID); !ok {
-		return false
-	}
-	return true
-}
-
 func extraSrflxCandidate(candidate ice.Candidate) (*ice.CandidateServerReflexive, error) {
 	relatedAdd := candidate.RelatedAddress()
 	ec, err := ice.NewCandidateServerReflexive(&ice.CandidateServerReflexiveConfig{
@@ -446,10 +455,6 @@ func extraSrflxCandidate(candidate ice.Candidate) (*ice.CandidateServerReflexive
 	}
 
 	for _, e := range candidate.Extensions() {
-		// overwrite the original candidate ID with the new one to avoid candidate duplication
-		if e.Key == ice.ExtensionKeyCandidateID {
-			e.Value = candidate.ID()
-		}
 		if err := ec.AddExtension(e); err != nil {
 			return nil, err
 		}

client/internal/relay/relay.go

@@ -12,7 +12,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	"github.com/netbirdio/netbird/client/internal/stdnet"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 // ProbeResult holds the info about the result of a relay probe request

client/internal/routemanager/manager.go

@@ -36,9 +36,9 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager/vars"
 	"github.com/netbirdio/netbird/client/internal/routeselector"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
 	"github.com/netbirdio/netbird/route"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
+	nbnet "github.com/netbirdio/netbird/util/net"
 	"github.com/netbirdio/netbird/version"
 )
 
@@ -108,10 +108,6 @@ func NewManager(config ManagerConfig) *DefaultManager {
 	notifier := notifier.NewNotifier()
 	sysOps := systemops.NewSysOps(config.WGInterface, notifier)
 
-	if runtime.GOOS == "windows" && config.WGInterface != nil {
-		nbnet.SetVPNInterfaceName(config.WGInterface.Name())
-	}
-
 	dm := &DefaultManager{
 		ctx:                 mCTX,
 		stop:                cancel,
@@ -212,7 +208,7 @@ func (m *DefaultManager) Init() error {
 		return nil
 	}
 
-	if err := m.sysOps.CleanupRouting(nil, nbnet.AdvancedRouting()); err != nil {
+	if err := m.sysOps.CleanupRouting(nil); err != nil {
 		log.Warnf("Failed cleaning up routing: %v", err)
 	}
 
@@ -223,7 +219,7 @@ func (m *DefaultManager) Init() error {
 
 	ips := resolveURLsToIPs(initialAddresses)
 
-	if err := m.sysOps.SetupRouting(ips, m.stateManager, nbnet.AdvancedRouting()); err != nil {
+	if err := m.sysOps.SetupRouting(ips, m.stateManager); err != nil {
 		return fmt.Errorf("setup routing: %w", err)
 	}
 
@@ -289,15 +285,11 @@ func (m *DefaultManager) Stop(stateManager *statemanager.Manager) {
 	}
 
 	if !nbnet.CustomRoutingDisabled() && !m.disableClientRoutes {
-		if err := m.sysOps.CleanupRouting(stateManager, nbnet.AdvancedRouting()); err != nil {
+		if err := m.sysOps.CleanupRouting(stateManager); err != nil {
 			log.Errorf("Error cleaning up routing: %v", err)
 		} else {
 			log.Info("Routing cleanup complete")
 		}
-
-		if runtime.GOOS == "windows" {
-			nbnet.SetVPNInterfaceName("")
-		}
 	}
 
 	m.mux.Lock()

client/internal/routemanager/systemops/systemops_android.go

@@ -12,11 +12,11 @@ import (
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
 
-func (r *SysOps) SetupRouting([]net.IP, *statemanager.Manager, bool) error {
+func (r *SysOps) SetupRouting([]net.IP, *statemanager.Manager) error {
 	return nil
 }
 
-func (r *SysOps) CleanupRouting(*statemanager.Manager, bool) error {
+func (r *SysOps) CleanupRouting(*statemanager.Manager) error {
 	return nil
 }
 

client/internal/routemanager/systemops/systemops_generic.go

@@ -3,6 +3,7 @@
 package systemops
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"net"
@@ -21,7 +22,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager/util"
 	"github.com/netbirdio/netbird/client/internal/routemanager/vars"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
-	"github.com/netbirdio/netbird/client/net/hooks"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 const localSubnetsCacheTTL = 15 * time.Minute
@@ -95,9 +96,9 @@ func (r *SysOps) cleanupRefCounter(stateManager *statemanager.Manager) error {
 		return nil
 	}
 
-	hooks.RemoveWriteHooks()
-	hooks.RemoveCloseHooks()
-	hooks.RemoveAddressRemoveHooks()
+	// TODO: Remove hooks selectively
+	nbnet.RemoveDialerHooks()
+	nbnet.RemoveListenerHooks()
 
 	if err := r.refCounter.Flush(); err != nil {
 		return fmt.Errorf("flush route manager: %w", err)
@@ -289,7 +290,12 @@ func (r *SysOps) genericRemoveVPNRoute(prefix netip.Prefix, intf *net.Interface)
 }
 
 func (r *SysOps) setupHooks(initAddresses []net.IP, stateManager *statemanager.Manager) error {
-	beforeHook := func(connID hooks.ConnectionID, prefix netip.Prefix) error {
+	beforeHook := func(connID nbnet.ConnectionID, ip net.IP) error {
+		prefix, err := util.GetPrefixFromIP(ip)
+		if err != nil {
+			return fmt.Errorf("convert ip to prefix: %w", err)
+		}
+
 		if _, err := r.refCounter.IncrementWithID(string(connID), prefix, struct{}{}); err != nil {
 			return fmt.Errorf("adding route reference: %v", err)
 		}
@@ -298,7 +304,7 @@ func (r *SysOps) setupHooks(initAddresses []net.IP, stateManager *statemanager.M
 
 		return nil
 	}
-	afterHook := func(connID hooks.ConnectionID) error {
+	afterHook := func(connID nbnet.ConnectionID) error {
 		if err := r.refCounter.DecrementWithID(string(connID)); err != nil {
 			return fmt.Errorf("remove route reference: %w", err)
 		}
@@ -311,20 +317,36 @@ func (r *SysOps) setupHooks(initAddresses []net.IP, stateManager *statemanager.M
 	var merr *multierror.Error
 
 	for _, ip := range initAddresses {
-		prefix, err := util.GetPrefixFromIP(ip)
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("invalid IP address %s: %w", ip, err))
-			continue
-		}
-		if err := beforeHook("init", prefix); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("add initial route for %s: %w", prefix, err))
+		if err := beforeHook("init", ip); err != nil {
+			merr = multierror.Append(merr, fmt.Errorf("add initial route for %s: %w", ip, err))
 		}
 	}
 
-	hooks.AddWriteHook(beforeHook)
-	hooks.AddCloseHook(afterHook)
+	nbnet.AddDialerHook(func(ctx context.Context, connID nbnet.ConnectionID, resolvedIPs []net.IPAddr) error {
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
 
-	hooks.AddAddressRemoveHook(func(connID hooks.ConnectionID, prefix netip.Prefix) error {
+		var merr *multierror.Error
+		for _, ip := range resolvedIPs {
+			merr = multierror.Append(merr, beforeHook(connID, ip.IP))
+		}
+		return nberrors.FormatErrorOrNil(merr)
+	})
+
+	nbnet.AddDialerCloseHook(func(connID nbnet.ConnectionID, conn *net.Conn) error {
+		return afterHook(connID)
+	})
+
+	nbnet.AddListenerWriteHook(func(connID nbnet.ConnectionID, ip *net.IPAddr, data []byte) error {
+		return beforeHook(connID, ip.IP)
+	})
+
+	nbnet.AddListenerCloseHook(func(connID nbnet.ConnectionID, conn net.PacketConn) error {
+		return afterHook(connID)
+	})
+
+	nbnet.AddListenerAddressRemoveHook(func(connID nbnet.ConnectionID, prefix netip.Prefix) error {
 		if _, err := r.refCounter.Decrement(prefix); err != nil {
 			return fmt.Errorf("remove route reference: %w", err)
 		}

client/internal/routemanager/systemops/systemops_generic_test.go

@@ -22,7 +22,6 @@ import (
 
 	"github.com/netbirdio/netbird/client/iface"
 	"github.com/netbirdio/netbird/client/internal/routemanager/vars"
-	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
 type dialer interface {
@@ -144,11 +143,10 @@ func TestAddVPNRoute(t *testing.T) {
 			wgInterface := createWGInterface(t, fmt.Sprintf("utun53%d", n), "100.65.75.2/24", 33100+n)
 
 			r := NewSysOps(wgInterface, nil)
-			advancedRouting := nbnet.AdvancedRouting()
-			err := r.SetupRouting(nil, nil, advancedRouting)
+			err := r.SetupRouting(nil, nil)
 			require.NoError(t, err)
 			t.Cleanup(func() {
-				assert.NoError(t, r.CleanupRouting(nil, advancedRouting))
+				assert.NoError(t, r.CleanupRouting(nil))
 			})
 
 			intf, err := net.InterfaceByName(wgInterface.Name())
@@ -343,11 +341,10 @@ func TestAddRouteToNonVPNIntf(t *testing.T) {
 			wgInterface := createWGInterface(t, fmt.Sprintf("utun54%d", n), "100.65.75.2/24", 33200+n)
 
 			r := NewSysOps(wgInterface, nil)
-			advancedRouting := nbnet.AdvancedRouting()
-			err := r.SetupRouting(nil, nil, advancedRouting)
+			err := r.SetupRouting(nil, nil)
 			require.NoError(t, err)
 			t.Cleanup(func() {
-				assert.NoError(t, r.CleanupRouting(nil, advancedRouting))
+				assert.NoError(t, r.CleanupRouting(nil))
 			})
 
 			initialNextHopV4, err := GetNextHop(netip.IPv4Unspecified())
@@ -487,11 +484,10 @@ func setupTestEnv(t *testing.T) {
 	})
 
 	r := NewSysOps(wgInterface, nil)
-	advancedRouting := nbnet.AdvancedRouting()
-	err := r.SetupRouting(nil, nil, advancedRouting)
+	err := r.SetupRouting(nil, nil)
 	require.NoError(t, err, "setupRouting should not return err")
 	t.Cleanup(func() {
-		assert.NoError(t, r.CleanupRouting(nil, advancedRouting))
+		assert.NoError(t, r.CleanupRouting(nil))
 	})
 
 	index, err := net.InterfaceByName(wgInterface.Name())

client/internal/routemanager/systemops/systemops_ios.go

@@ -12,14 +12,14 @@ import (
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
 
-func (r *SysOps) SetupRouting([]net.IP, *statemanager.Manager, bool) error {
+func (r *SysOps) SetupRouting([]net.IP, *statemanager.Manager) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	r.prefixes = make(map[netip.Prefix]struct{})
 	return nil
 }
 
-func (r *SysOps) CleanupRouting(*statemanager.Manager, bool) error {
+func (r *SysOps) CleanupRouting(*statemanager.Manager) error {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 

client/internal/routemanager/systemops/systemops_linux.go

@@ -20,7 +20,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/routemanager/sysctl"
 	"github.com/netbirdio/netbird/client/internal/routemanager/vars"
 	"github.com/netbirdio/netbird/client/internal/statemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 // IPRule contains IP rule information for debugging
@@ -94,15 +94,15 @@ func getSetupRules() []ruleParams {
 // Rule 2 (VPN Traffic Routing): Directs all remaining traffic to the 'NetbirdVPNTableID' custom routing table.
 // This table is where a default route or other specific routes received from the management server are configured,
 // enabling VPN connectivity.
-func (r *SysOps) SetupRouting(initAddresses []net.IP, stateManager *statemanager.Manager, advancedRouting bool) (err error) {
-	if !advancedRouting {
+func (r *SysOps) SetupRouting(initAddresses []net.IP, stateManager *statemanager.Manager) (err error) {
+	if !nbnet.AdvancedRouting() {
 		log.Infof("Using legacy routing setup")
 		return r.setupRefCounter(initAddresses, stateManager)
 	}
 
 	defer func() {
 		if err != nil {
-			if cleanErr := r.CleanupRouting(stateManager, advancedRouting); cleanErr != nil {
+			if cleanErr := r.CleanupRouting(stateManager); cleanErr != nil {
 				log.Errorf("Error cleaning up routing: %v", cleanErr)
 			}
 		}
@@ -132,8 +132,8 @@ func (r *SysOps) SetupRouting(initAddresses []net.IP, stateManager *statemanager
 // CleanupRouting performs a thorough cleanup of the routing configuration established by 'setupRouting'.
 // It systematically removes the three rules and any associated routing table entries to ensure a clean state.
 // The function uses error aggregation to report any errors encountered during the cleanup process.
-func (r *SysOps) CleanupRouting(stateManager *statemanager.Manager, advancedRouting bool) error {
-	if !advancedRouting {
+func (r *SysOps) CleanupRouting(stateManager *statemanager.Manager) error {
+	if !nbnet.AdvancedRouting() {
 		return r.cleanupRefCounter(stateManager)
 	}
 

client/internal/routemanager/systemops/systemops_unix.go

@@ -20,11 +20,11 @@ import (
 	"github.com/netbirdio/netbird/client/internal/statemanager"
 )
 
-func (r *SysOps) SetupRouting(initAddresses []net.IP, stateManager *statemanager.Manager, advancedRouting bool) error {
+func (r *SysOps) SetupRouting(initAddresses []net.IP, stateManager *statemanager.Manager) error {
 	return r.setupRefCounter(initAddresses, stateManager)
 }
 
-func (r *SysOps) CleanupRouting(stateManager *statemanager.Manager, advancedRouting bool) error {
+func (r *SysOps) CleanupRouting(stateManager *statemanager.Manager) error {
 	return r.cleanupRefCounter(stateManager)
 }
 

client/internal/routemanager/systemops/systemops_unix_test.go

@@ -17,7 +17,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 type PacketExpectation struct {

client/internal/routemanager/systemops/systemops_windows.go

@@ -8,7 +8,6 @@ import (
 	"net/netip"
 	"os"
 	"runtime/debug"
-	"sort"
 	"strconv"
 	"sync"
 	"syscall"
@@ -20,16 +19,9 @@ import (
 	"golang.org/x/sys/windows"
 
 	"github.com/netbirdio/netbird/client/internal/statemanager"
-	nbnet "github.com/netbirdio/netbird/client/net"
 )
 
-func init() {
-	nbnet.GetBestInterfaceFunc = GetBestInterface
-}
-
-const (
-	InfiniteLifetime = 0xffffffff
-)
+const InfiniteLifetime = 0xffffffff
 
 type RouteUpdateType int
 
@@ -85,14 +77,6 @@ type MIB_IPFORWARD_TABLE2 struct {
 	Table      [1]MIB_IPFORWARD_ROW2 // Flexible array member
 }
 
-// candidateRoute represents a potential route for selection during route lookup
-type candidateRoute struct {
-	interfaceIndex  uint32
-	prefixLength    uint8
-	routeMetric     uint32
-	interfaceMetric int
-}
-
 // IP_ADDRESS_PREFIX is defined in https://learn.microsoft.com/en-us/windows/win32/api/netioapi/ns-netioapi-ip_address_prefix
 type IP_ADDRESS_PREFIX struct {
 	Prefix       SOCKADDR_INET
@@ -193,20 +177,11 @@ const (
 	RouteDeleted
 )
 
-func (r *SysOps) SetupRouting(initAddresses []net.IP, stateManager *statemanager.Manager, advancedRouting bool) error {
-	if advancedRouting {
-		return nil
-	}
-
-	log.Infof("Using legacy routing setup with ref counters")
+func (r *SysOps) SetupRouting(initAddresses []net.IP, stateManager *statemanager.Manager) error {
 	return r.setupRefCounter(initAddresses, stateManager)
 }
 
-func (r *SysOps) CleanupRouting(stateManager *statemanager.Manager, advancedRouting bool) error {
-	if advancedRouting {
-		return nil
-	}
-
+func (r *SysOps) CleanupRouting(stateManager *statemanager.Manager) error {
 	return r.cleanupRefCounter(stateManager)
 }
 
@@ -660,7 +635,10 @@ func getWindowsRoutingTable() (*MIB_IPFORWARD_TABLE2, error) {
 
 func freeWindowsRoutingTable(table *MIB_IPFORWARD_TABLE2) {
 	if table != nil {
-		_, _, _ = procFreeMibTable.Call(uintptr(unsafe.Pointer(table)))
+		ret, _, _ := procFreeMibTable.Call(uintptr(unsafe.Pointer(table)))
+		if ret != 0 {
+			log.Warnf("FreeMibTable failed with return code: %d", ret)
+		}
 	}
 }
 
@@ -674,7 +652,8 @@ func parseWindowsRoutingTable(table *MIB_IPFORWARD_TABLE2) []DetailedRoute {
 		entryPtr := basePtr + uintptr(i)*entrySize
 		entry := (*MIB_IPFORWARD_ROW2)(unsafe.Pointer(entryPtr))
 
-		if detailed := buildWindowsDetailedRoute(entry); detailed != nil {
+		detailed := buildWindowsDetailedRoute(entry)
+		if detailed != nil {
 			detailedRoutes = append(detailedRoutes, *detailed)
 		}
 	}
@@ -823,46 +802,6 @@ func addZone(ip netip.Addr, interfaceIndex int) netip.Addr {
 	return ip
 }
 
-// parseCandidatesFromTable extracts all matching candidate routes from the routing table
-func parseCandidatesFromTable(table *MIB_IPFORWARD_TABLE2, dest netip.Addr, skipInterfaceIndex int) []candidateRoute {
-	var candidates []candidateRoute
-	entrySize := unsafe.Sizeof(MIB_IPFORWARD_ROW2{})
-	basePtr := uintptr(unsafe.Pointer(&table.Table[0]))
-
-	for i := uint32(0); i < table.NumEntries; i++ {
-		entryPtr := basePtr + uintptr(i)*entrySize
-		entry := (*MIB_IPFORWARD_ROW2)(unsafe.Pointer(entryPtr))
-
-		if candidate := parseCandidateRoute(entry, dest, skipInterfaceIndex); candidate != nil {
-			candidates = append(candidates, *candidate)
-		}
-	}
-
-	return candidates
-}
-
-// parseCandidateRoute extracts candidate route information from a MIB_IPFORWARD_ROW2 entry
-// Returns nil if the route doesn't match the destination or should be skipped
-func parseCandidateRoute(entry *MIB_IPFORWARD_ROW2, dest netip.Addr, skipInterfaceIndex int) *candidateRoute {
-	if skipInterfaceIndex > 0 && int(entry.InterfaceIndex) == skipInterfaceIndex {
-		return nil
-	}
-
-	destPrefix := parseIPPrefix(entry.DestinationPrefix, int(entry.InterfaceIndex))
-	if !destPrefix.IsValid() || !destPrefix.Contains(dest) {
-		return nil
-	}
-
-	interfaceMetric := getInterfaceMetric(entry.InterfaceIndex, entry.DestinationPrefix.Prefix.sin6_family)
-
-	return &candidateRoute{
-		interfaceIndex:  entry.InterfaceIndex,
-		prefixLength:    entry.DestinationPrefix.PrefixLength,
-		routeMetric:     entry.Metric,
-		interfaceMetric: interfaceMetric,
-	}
-}
-
 // getInterfaceMetric retrieves the interface metric for a given interface and address family
 func getInterfaceMetric(interfaceIndex uint32, family int16) int {
 	if interfaceIndex == 0 {
@@ -882,75 +821,6 @@ func getInterfaceMetric(interfaceIndex uint32, family int16) int {
 	return int(ipInterfaceRow.Metric)
 }
 
-// sortRouteCandidates sorts route candidates by priority: prefix length -> route metric -> interface metric
-func sortRouteCandidates(candidates []candidateRoute) {
-	sort.Slice(candidates, func(i, j int) bool {
-		if candidates[i].prefixLength != candidates[j].prefixLength {
-			return candidates[i].prefixLength > candidates[j].prefixLength
-		}
-		if candidates[i].routeMetric != candidates[j].routeMetric {
-			return candidates[i].routeMetric < candidates[j].routeMetric
-		}
-		return candidates[i].interfaceMetric < candidates[j].interfaceMetric
-	})
-}
-
-// GetBestInterface finds the best interface for reaching a destination,
-// excluding the VPN interface to avoid routing loops.
-//
-// Route selection priority:
-// 1. Longest prefix match (most specific route)
-// 2. Lowest route metric
-// 3. Lowest interface metric
-func GetBestInterface(dest netip.Addr, vpnIntf string) (*net.Interface, error) {
-	var skipInterfaceIndex int
-	if vpnIntf != "" {
-		if iface, err := net.InterfaceByName(vpnIntf); err == nil {
-			skipInterfaceIndex = iface.Index
-		} else {
-			return nil, fmt.Errorf("get VPN interface %s: %w", vpnIntf, err)
-		}
-	}
-
-	table, err := getWindowsRoutingTable()
-	if err != nil {
-		return nil, fmt.Errorf("get routing table: %w", err)
-	}
-	defer freeWindowsRoutingTable(table)
-
-	candidates := parseCandidatesFromTable(table, dest, skipInterfaceIndex)
-
-	if len(candidates) == 0 {
-		return nil, fmt.Errorf("no route to %s", dest)
-	}
-
-	// Sort routes: prefix length -> route metric -> interface metric
-	sortRouteCandidates(candidates)
-
-	for _, candidate := range candidates {
-		iface, err := net.InterfaceByIndex(int(candidate.interfaceIndex))
-		if err != nil {
-			log.Warnf("failed to get interface by index %d: %v", candidate.interfaceIndex, err)
-			continue
-		}
-
-		if iface.Flags&net.FlagLoopback != 0 && !dest.IsLoopback() {
-			continue
-		}
-
-		if iface.Flags&net.FlagUp == 0 {
-			log.Debugf("interface %s is down, trying next route", iface.Name)
-			continue
-		}
-
-		log.Debugf("route lookup for %s: selected interface %s (index %d), route metric %d, interface metric %d",
-			dest, iface.Name, iface.Index, candidate.routeMetric, candidate.interfaceMetric)
-		return iface, nil
-	}
-
-	return nil, fmt.Errorf("no usable interface found for %s", dest)
-}
-
 // formatRouteAge formats the route age in seconds to a human-readable string
 func formatRouteAge(ageSeconds uint32) string {
 	if ageSeconds == 0 {

client/internal/routemanager/systemops/systemops_windows_test.go

@@ -15,7 +15,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 var (

client/internal/routemanager/util/ip.go

@@ -12,8 +12,18 @@ func GetPrefixFromIP(ip net.IP) (netip.Prefix, error) {
 	if !ok {
 		return netip.Prefix{}, fmt.Errorf("parse IP address: %s", ip)
 	}
-
 	addr = addr.Unmap()
-	prefix := netip.PrefixFrom(addr, addr.BitLen())
+
+	var prefixLength int
+	switch {
+	case addr.Is4():
+		prefixLength = 32
+	case addr.Is6():
+		prefixLength = 128
+	default:
+		return netip.Prefix{}, fmt.Errorf("invalid IP address: %s", addr)
+	}
+
+	prefix := netip.PrefixFrom(addr, prefixLength)
 	return prefix, nil
 }

client/internal/stdnet/dialer.go

@@ -5,7 +5,7 @@ import (
 
 	"github.com/pion/transport/v3"
 
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 // Dial connects to the address on the named network.

client/internal/stdnet/listener.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/pion/transport/v3"
 
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 // ListenPacket listens for incoming packets on the given network and address.

client/net/conn.go

@@ -1,49 +0,0 @@
-//go:build !ios
-
-package net
-
-import (
-	"io"
-	"net"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/net/hooks"
-)
-
-// Conn wraps a net.Conn to override the Close method
-type Conn struct {
-	net.Conn
-	ID hooks.ConnectionID
-}
-
-// Close overrides the net.Conn Close method to execute all registered hooks after closing the connection
-// Close overrides the net.Conn Close method to execute all registered hooks before closing the connection.
-func (c *Conn) Close() error {
-	return closeConn(c.ID, c.Conn)
-}
-
-// TCPConn wraps net.TCPConn to override its Close method to include hook functionality.
-type TCPConn struct {
-	*net.TCPConn
-	ID hooks.ConnectionID
-}
-
-// Close overrides the net.TCPConn Close method to execute all registered hooks before closing the connection.
-func (c *TCPConn) Close() error {
-	return closeConn(c.ID, c.TCPConn)
-}
-
-// closeConn is a helper function to close connections and execute close hooks.
-func closeConn(id hooks.ConnectionID, conn io.Closer) error {
-	err := conn.Close()
-
-	closeHooks := hooks.GetCloseHooks()
-	for _, hook := range closeHooks {
-		if err := hook(id); err != nil {
-			log.Errorf("Error executing close hook: %v", err)
-		}
-	}
-
-	return err
-}

client/net/dial.go

@@ -1,82 +0,0 @@
-//go:build !ios
-
-package net
-
-import (
-	"fmt"
-	"net"
-	"sync"
-
-	"github.com/pion/transport/v3"
-	log "github.com/sirupsen/logrus"
-)
-
-func DialUDP(network string, laddr, raddr *net.UDPAddr) (transport.UDPConn, error) {
-	if CustomRoutingDisabled() {
-		return net.DialUDP(network, laddr, raddr)
-	}
-
-	dialer := NewDialer()
-	dialer.LocalAddr = laddr
-
-	conn, err := dialer.Dial(network, raddr.String())
-	if err != nil {
-		return nil, fmt.Errorf("dialing UDP %s: %w", raddr.String(), err)
-	}
-
-	switch c := conn.(type) {
-	case *net.UDPConn:
-		// Advanced routing: plain connection
-		return c, nil
-	case *Conn:
-		// Legacy routing: wrapped connection preserves close hooks
-		udpConn, ok := c.Conn.(*net.UDPConn)
-		if !ok {
-			if err := conn.Close(); err != nil {
-				log.Errorf("Failed to close connection: %v", err)
-			}
-			return nil, fmt.Errorf("expected UDP connection, got %T", c.Conn)
-		}
-		return &UDPConn{UDPConn: udpConn, ID: c.ID, seenAddrs: &sync.Map{}}, nil
-	}
-
-	if err := conn.Close(); err != nil {
-		log.Errorf("failed to close connection: %v", err)
-	}
-	return nil, fmt.Errorf("unexpected connection type: %T", conn)
-}
-
-func DialTCP(network string, laddr, raddr *net.TCPAddr) (transport.TCPConn, error) {
-	if CustomRoutingDisabled() {
-		return net.DialTCP(network, laddr, raddr)
-	}
-
-	dialer := NewDialer()
-	dialer.LocalAddr = laddr
-
-	conn, err := dialer.Dial(network, raddr.String())
-	if err != nil {
-		return nil, fmt.Errorf("dialing TCP %s: %w", raddr.String(), err)
-	}
-
-	switch c := conn.(type) {
-	case *net.TCPConn:
-		// Advanced routing: plain connection
-		return c, nil
-	case *Conn:
-		// Legacy routing: wrapped connection preserves close hooks
-		tcpConn, ok := c.Conn.(*net.TCPConn)
-		if !ok {
-			if err := conn.Close(); err != nil {
-				log.Errorf("Failed to close connection: %v", err)
-			}
-			return nil, fmt.Errorf("expected TCP connection, got %T", c.Conn)
-		}
-		return &TCPConn{TCPConn: tcpConn, ID: c.ID}, nil
-	}
-
-	if err := conn.Close(); err != nil {
-		log.Errorf("failed to close connection: %v", err)
-	}
-	return nil, fmt.Errorf("unexpected connection type: %T", conn)
-}

client/net/dialer_dial.go

@@ -1,87 +0,0 @@
-//go:build !ios
-
-package net
-
-import (
-	"context"
-	"fmt"
-	"net"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/client/internal/routemanager/util"
-	"github.com/netbirdio/netbird/client/net/hooks"
-)
-
-// DialContext wraps the net.Dialer's DialContext method to use the custom connection
-func (d *Dialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
-	log.Debugf("Dialing %s %s", network, address)
-
-	if CustomRoutingDisabled() || AdvancedRouting() {
-		return d.Dialer.DialContext(ctx, network, address)
-	}
-
-	connID := hooks.GenerateConnID()
-	if err := callDialerHooks(ctx, connID, address, d.Resolver); err != nil {
-		log.Errorf("Failed to call dialer hooks: %v", err)
-	}
-
-	conn, err := d.Dialer.DialContext(ctx, network, address)
-	if err != nil {
-		return nil, fmt.Errorf("d.Dialer.DialContext: %w", err)
-	}
-
-	// Wrap the connection in Conn to handle Close with hooks
-	return &Conn{Conn: conn, ID: connID}, nil
-}
-
-// Dial wraps the net.Dialer's Dial method to use the custom connection
-func (d *Dialer) Dial(network, address string) (net.Conn, error) {
-	return d.DialContext(context.Background(), network, address)
-}
-
-func callDialerHooks(ctx context.Context, connID hooks.ConnectionID, address string, customResolver *net.Resolver) error {
-	if ctx.Err() != nil {
-		return ctx.Err()
-	}
-
-	writeHooks := hooks.GetWriteHooks()
-	if len(writeHooks) == 0 {
-		return nil
-	}
-
-	host, _, err := net.SplitHostPort(address)
-	if err != nil {
-		return fmt.Errorf("split host and port: %w", err)
-	}
-
-	resolver := customResolver
-	if resolver == nil {
-		resolver = net.DefaultResolver
-	}
-
-	ips, err := resolver.LookupIPAddr(ctx, host)
-	if err != nil {
-		return fmt.Errorf("failed to resolve address %s: %w", address, err)
-	}
-
-	log.Debugf("Dialer resolved IPs for %s: %v", address, ips)
-
-	var merr *multierror.Error
-	for _, ip := range ips {
-		prefix, err := util.GetPrefixFromIP(ip.IP)
-		if err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("convert IP %s to prefix: %w", ip.IP, err))
-			continue
-		}
-		for _, hook := range writeHooks {
-			if err := hook(connID, prefix); err != nil {
-				merr = multierror.Append(merr, fmt.Errorf("executing dial hook for IP %s: %w", ip.IP, err))
-			}
-		}
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}

client/net/dialer_init_generic.go

@@ -1,7 +0,0 @@
-//go:build !linux && !windows
-
-package net
-
-func (d *Dialer) init() {
-	// implemented on Linux, Android, and Windows only
-}

client/net/dialer_init_windows.go

@@ -1,5 +0,0 @@
-package net
-
-func (d *Dialer) init() {
-	d.Dialer.Control = applyUnicastIFToSocket
-}

client/net/env_android.go

@@ -1,24 +0,0 @@
-//go:build android
-
-package net
-
-// Init initializes the network environment for Android
-func Init() {
-	// No initialization needed on Android
-}
-
-// AdvancedRouting reports whether routing loops can be avoided without using exclusion routes.
-// Always returns true on Android since we cannot handle routes dynamically.
-func AdvancedRouting() bool {
-	return true
-}
-
-// SetVPNInterfaceName is a no-op on Android
-func SetVPNInterfaceName(name string) {
-	// No-op on Android - not needed for Android VPN service
-}
-
-// GetVPNInterfaceName returns empty string on Android
-func GetVPNInterfaceName() string {
-	return ""
-}

client/net/env_generic.go

@@ -1,23 +0,0 @@
-//go:build !linux && !windows && !android
-
-package net
-
-// Init initializes the network environment (no-op on non-Linux/Windows platforms)
-func Init() {
-	// No-op on non-Linux/Windows platforms
-}
-
-// AdvancedRouting returns false on non-Linux/Windows platforms
-func AdvancedRouting() bool {
-	return false
-}
-
-// SetVPNInterfaceName is a no-op on non-Windows platforms
-func SetVPNInterfaceName(name string) {
-	// No-op on non-Windows platforms
-}
-
-// GetVPNInterfaceName returns empty string on non-Windows platforms
-func GetVPNInterfaceName() string {
-	return ""
-}

client/net/env_windows.go

@@ -1,67 +0,0 @@
-//go:build windows
-
-package net
-
-import (
-	"os"
-	"strconv"
-	"sync"
-
-	log "github.com/sirupsen/logrus"
-
-	"github.com/netbirdio/netbird/client/iface/netstack"
-)
-
-var (
-	vpnInterfaceName string
-	vpnInitMutex     sync.RWMutex
-
-	advancedRoutingSupported bool
-)
-
-func Init() {
-	advancedRoutingSupported = checkAdvancedRoutingSupport()
-}
-
-func checkAdvancedRoutingSupport() bool {
-	var err error
-	var legacyRouting bool
-	if val := os.Getenv(envUseLegacyRouting); val != "" {
-		legacyRouting, err = strconv.ParseBool(val)
-		if err != nil {
-			log.Warnf("failed to parse %s: %v", envUseLegacyRouting, err)
-		}
-	}
-
-	if legacyRouting || netstack.IsEnabled() {
-		log.Info("advanced routing has been requested to be disabled")
-		return false
-	}
-
-	log.Info("system supports advanced routing")
-
-	return true
-}
-
-// AdvancedRouting reports whether routing loops can be avoided without using exclusion routes
-func AdvancedRouting() bool {
-	return advancedRoutingSupported
-}
-
-// GetVPNInterfaceName returns the stored VPN interface name
-func GetVPNInterfaceName() string {
-	vpnInitMutex.RLock()
-	defer vpnInitMutex.RUnlock()
-	return vpnInterfaceName
-}
-
-// SetVPNInterfaceName sets the VPN interface name for lazy initialization
-func SetVPNInterfaceName(name string) {
-	vpnInitMutex.Lock()
-	defer vpnInitMutex.Unlock()
-	vpnInterfaceName = name
-
-	if name != "" {
-		log.Infof("VPN interface name set to %s for route exclusion", name)
-	}
-}

client/net/hooks/hooks.go

@@ -1,93 +0,0 @@
-package hooks
-
-import (
-	"net/netip"
-	"slices"
-	"sync"
-
-	"github.com/google/uuid"
-)
-
-// ConnectionID provides a globally unique identifier for network connections.
-// It's used to track connections throughout their lifecycle so the close hook can correlate with the dial hook.
-type ConnectionID string
-
-// GenerateConnID generates a unique identifier for each connection.
-func GenerateConnID() ConnectionID {
-	return ConnectionID(uuid.NewString())
-}
-
-type WriteHookFunc func(connID ConnectionID, prefix netip.Prefix) error
-type CloseHookFunc func(connID ConnectionID) error
-type AddressRemoveHookFunc func(connID ConnectionID, prefix netip.Prefix) error
-
-var (
-	hooksMutex sync.RWMutex
-
-	writeHooks         []WriteHookFunc
-	closeHooks         []CloseHookFunc
-	addressRemoveHooks []AddressRemoveHookFunc
-)
-
-// AddWriteHook allows adding a new hook to be executed before writing/dialing.
-func AddWriteHook(hook WriteHookFunc) {
-	hooksMutex.Lock()
-	defer hooksMutex.Unlock()
-	writeHooks = append(writeHooks, hook)
-}
-
-// AddCloseHook allows adding a new hook to be executed on connection close.
-func AddCloseHook(hook CloseHookFunc) {
-	hooksMutex.Lock()
-	defer hooksMutex.Unlock()
-	closeHooks = append(closeHooks, hook)
-}
-
-// RemoveWriteHooks removes all write hooks.
-func RemoveWriteHooks() {
-	hooksMutex.Lock()
-	defer hooksMutex.Unlock()
-	writeHooks = nil
-}
-
-// RemoveCloseHooks removes all close hooks.
-func RemoveCloseHooks() {
-	hooksMutex.Lock()
-	defer hooksMutex.Unlock()
-	closeHooks = nil
-}
-
-// AddAddressRemoveHook allows adding a new hook to be executed when an address is removed.
-func AddAddressRemoveHook(hook AddressRemoveHookFunc) {
-	hooksMutex.Lock()
-	defer hooksMutex.Unlock()
-	addressRemoveHooks = append(addressRemoveHooks, hook)
-}
-
-// RemoveAddressRemoveHooks removes all listener address hooks.
-func RemoveAddressRemoveHooks() {
-	hooksMutex.Lock()
-	defer hooksMutex.Unlock()
-	addressRemoveHooks = nil
-}
-
-// GetWriteHooks returns a copy of the current write hooks.
-func GetWriteHooks() []WriteHookFunc {
-	hooksMutex.RLock()
-	defer hooksMutex.RUnlock()
-	return slices.Clone(writeHooks)
-}
-
-// GetCloseHooks returns a copy of the current close hooks.
-func GetCloseHooks() []CloseHookFunc {
-	hooksMutex.RLock()
-	defer hooksMutex.RUnlock()
-	return slices.Clone(closeHooks)
-}
-
-// GetAddressRemoveHooks returns a copy of the current listener address remove hooks.
-func GetAddressRemoveHooks() []AddressRemoveHookFunc {
-	hooksMutex.RLock()
-	defer hooksMutex.RUnlock()
-	return slices.Clone(addressRemoveHooks)
-}

client/net/listen.go

@@ -1,47 +0,0 @@
-//go:build !ios
-
-package net
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"sync"
-
-	"github.com/pion/transport/v3"
-	log "github.com/sirupsen/logrus"
-)
-
-// ListenUDP listens on the network address and returns a transport.UDPConn
-// which includes support for write and close hooks.
-func ListenUDP(network string, laddr *net.UDPAddr) (transport.UDPConn, error) {
-	if CustomRoutingDisabled() {
-		return net.ListenUDP(network, laddr)
-	}
-
-	conn, err := NewListener().ListenPacket(context.Background(), network, laddr.String())
-	if err != nil {
-		return nil, fmt.Errorf("listen UDP: %w", err)
-	}
-
-	switch c := conn.(type) {
-	case *net.UDPConn:
-		// Advanced routing: plain connection
-		return c, nil
-	case *PacketConn:
-		// Legacy routing: wrapped connection for hooks
-		udpConn, ok := c.PacketConn.(*net.UDPConn)
-		if !ok {
-			if err := c.Close(); err != nil {
-				log.Errorf("Failed to close connection: %v", err)
-			}
-			return nil, fmt.Errorf("expected UDPConn, got %T", c.PacketConn)
-		}
-		return &UDPConn{UDPConn: udpConn, ID: c.ID, seenAddrs: &sync.Map{}}, nil
-	}
-
-	if err := conn.Close(); err != nil {
-		log.Errorf("failed to close connection: %v", err)
-	}
-	return nil, fmt.Errorf("unexpected connection type: %T", conn)
-}

client/net/listener_init_generic.go

@@ -1,7 +0,0 @@
-//go:build !linux && !windows
-
-package net
-
-func (l *ListenerConfig) init() {
-	// implemented on Linux, Android, and Windows only
-}

client/net/listener_init_windows.go

@@ -1,8 +0,0 @@
-package net
-
-func (l *ListenerConfig) init() {
-	// TODO: this will select a single source interface, but for UDP we can have various source interfaces and IP addresses.
-	// For now we stick to the one that matches the request IP address, which can be the unspecified IP. In this case
-	// the interface will be selected that serves the default route.
-	l.ListenConfig.Control = applyUnicastIFToSocket
-}

client/net/listener_listen.go

@@ -1,153 +0,0 @@
-//go:build !ios
-
-package net
-
-import (
-	"context"
-	"fmt"
-	"net"
-	"net/netip"
-	"sync"
-
-	"github.com/hashicorp/go-multierror"
-	log "github.com/sirupsen/logrus"
-
-	nberrors "github.com/netbirdio/netbird/client/errors"
-	"github.com/netbirdio/netbird/client/internal/routemanager/util"
-	"github.com/netbirdio/netbird/client/net/hooks"
-)
-
-// ListenPacket listens on the network address and returns a PacketConn
-// which includes support for write hooks.
-func (l *ListenerConfig) ListenPacket(ctx context.Context, network, address string) (net.PacketConn, error) {
-	if CustomRoutingDisabled() || AdvancedRouting() {
-		return l.ListenConfig.ListenPacket(ctx, network, address)
-	}
-
-	pc, err := l.ListenConfig.ListenPacket(ctx, network, address)
-	if err != nil {
-		return nil, fmt.Errorf("listen packet: %w", err)
-	}
-	connID := hooks.GenerateConnID()
-
-	return &PacketConn{PacketConn: pc, ID: connID, seenAddrs: &sync.Map{}}, nil
-}
-
-// PacketConn wraps net.PacketConn to override its WriteTo and Close methods to include hook functionality.
-type PacketConn struct {
-	net.PacketConn
-	ID        hooks.ConnectionID
-	seenAddrs *sync.Map
-}
-
-// WriteTo writes a packet with payload b to addr, executing registered write hooks beforehand.
-func (c *PacketConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
-	if err := callWriteHooks(c.ID, c.seenAddrs, addr); err != nil {
-		log.Errorf("Failed to call write hooks: %v", err)
-	}
-	return c.PacketConn.WriteTo(b, addr)
-}
-
-// Close overrides the net.PacketConn Close method to execute all registered hooks before closing the connection.
-func (c *PacketConn) Close() error {
-	defer c.seenAddrs.Clear()
-	return closeConn(c.ID, c.PacketConn)
-}
-
-// UDPConn wraps net.UDPConn to override its WriteTo and Close methods to include hook functionality.
-type UDPConn struct {
-	*net.UDPConn
-	ID        hooks.ConnectionID
-	seenAddrs *sync.Map
-}
-
-// WriteTo writes a packet with payload b to addr, executing registered write hooks beforehand.
-func (c *UDPConn) WriteTo(b []byte, addr net.Addr) (n int, err error) {
-	if err := callWriteHooks(c.ID, c.seenAddrs, addr); err != nil {
-		log.Errorf("Failed to call write hooks: %v", err)
-	}
-	return c.UDPConn.WriteTo(b, addr)
-}
-
-// Close overrides the net.UDPConn Close method to execute all registered hooks before closing the connection.
-func (c *UDPConn) Close() error {
-	defer c.seenAddrs.Clear()
-	return closeConn(c.ID, c.UDPConn)
-}
-
-// RemoveAddress removes an address from the seen cache and triggers removal hooks.
-func (c *PacketConn) RemoveAddress(addr string) {
-	if _, exists := c.seenAddrs.LoadAndDelete(addr); !exists {
-		return
-	}
-
-	ipStr, _, err := net.SplitHostPort(addr)
-	if err != nil {
-		log.Errorf("Error splitting IP address and port: %v", err)
-		return
-	}
-
-	ipAddr, err := netip.ParseAddr(ipStr)
-	if err != nil {
-		log.Errorf("Error parsing IP address %s: %v", ipStr, err)
-		return
-	}
-
-	prefix := netip.PrefixFrom(ipAddr.Unmap(), ipAddr.BitLen())
-
-	addressRemoveHooks := hooks.GetAddressRemoveHooks()
-	if len(addressRemoveHooks) == 0 {
-		return
-	}
-
-	for _, hook := range addressRemoveHooks {
-		if err := hook(c.ID, prefix); err != nil {
-			log.Errorf("Error executing listener address remove hook: %v", err)
-		}
-	}
-}
-
-// WrapPacketConn wraps an existing net.PacketConn with nbnet hook functionality
-func WrapPacketConn(conn net.PacketConn) net.PacketConn {
-	if AdvancedRouting() {
-		// hooks not required for advanced routing
-		return conn
-	}
-	return &PacketConn{
-		PacketConn: conn,
-		ID:         hooks.GenerateConnID(),
-		seenAddrs:  &sync.Map{},
-	}
-}
-
-func callWriteHooks(id hooks.ConnectionID, seenAddrs *sync.Map, addr net.Addr) error {
-	if _, loaded := seenAddrs.LoadOrStore(addr.String(), true); loaded {
-		return nil
-	}
-
-	writeHooks := hooks.GetWriteHooks()
-	if len(writeHooks) == 0 {
-		return nil
-	}
-
-	udpAddr, ok := addr.(*net.UDPAddr)
-	if !ok {
-		return fmt.Errorf("expected *net.UDPAddr for packet connection, got %T", addr)
-	}
-
-	prefix, err := util.GetPrefixFromIP(udpAddr.IP)
-	if err != nil {
-		return fmt.Errorf("convert UDP IP %s to prefix: %w", udpAddr.IP, err)
-	}
-
-	log.Debugf("Listener resolved IP for %s: %s", addr, prefix)
-
-	var merr *multierror.Error
-	for _, hook := range writeHooks {
-		if err := hook(id, prefix); err != nil {
-			merr = multierror.Append(merr, fmt.Errorf("execute write hook: %w", err))
-		}
-	}
-
-	return nberrors.FormatErrorOrNil(merr)
-}

client/net/net_windows.go

@@ -1,284 +0,0 @@
-package net
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net"
-	"net/netip"
-	"strconv"
-	"strings"
-	"syscall"
-	"time"
-	"unsafe"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/sys/windows"
-)
-
-const (
-	// https://learn.microsoft.com/en-us/windows/win32/winsock/ipproto-ip-socket-options
-	IpUnicastIf   = 31
-	Ipv6UnicastIf = 31
-
-	// https://learn.microsoft.com/en-us/windows/win32/winsock/ipproto-ipv6-socket-options
-	Ipv6V6only = 27
-)
-
-// GetBestInterfaceFunc is set at runtime to avoid import cycle
-var GetBestInterfaceFunc func(dest netip.Addr, vpnIntf string) (*net.Interface, error)
-
-// nativeToBigEndian converts a uint32 from native byte order to big-endian
-func nativeToBigEndian(v uint32) uint32 {
-	return (v&0xff)<<24 | (v&0xff00)<<8 | (v&0xff0000)>>8 | (v&0xff000000)>>24
-}
-
-// parseDestinationAddress parses the destination address from various formats
-func parseDestinationAddress(network, address string) (netip.Addr, error) {
-	if address == "" {
-		if strings.HasSuffix(network, "6") {
-			return netip.IPv6Unspecified(), nil
-		}
-		return netip.IPv4Unspecified(), nil
-	}
-
-	if addrPort, err := netip.ParseAddrPort(address); err == nil {
-		return addrPort.Addr(), nil
-	}
-
-	if dest, err := netip.ParseAddr(address); err == nil {
-		return dest, nil
-	}
-
-	host, _, err := net.SplitHostPort(address)
-	if err != nil {
-		// No port, treat whole string as host
-		host = address
-	}
-
-	if host == "" {
-		if strings.HasSuffix(network, "6") {
-			return netip.IPv6Unspecified(), nil
-		}
-		return netip.IPv4Unspecified(), nil
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-
-	ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
-	if err != nil || len(ips) == 0 {
-		return netip.Addr{}, fmt.Errorf("resolve destination %s: %w", host, err)
-	}
-
-	dest, ok := netip.AddrFromSlice(ips[0].IP)
-	if !ok {
-		return netip.Addr{}, fmt.Errorf("convert IP %v to netip.Addr", ips[0].IP)
-	}
-
-	if ips[0].Zone != "" {
-		dest = dest.WithZone(ips[0].Zone)
-	}
-
-	return dest, nil
-}
-
-func getInterfaceFromZone(zone string) *net.Interface {
-	if zone == "" {
-		return nil
-	}
-
-	idx, err := strconv.Atoi(zone)
-	if err != nil {
-		log.Debugf("invalid zone format for Windows (expected numeric): %s", zone)
-		return nil
-	}
-
-	iface, err := net.InterfaceByIndex(idx)
-	if err != nil {
-		log.Debugf("failed to get interface by index %d from zone: %v", idx, err)
-		return nil
-	}
-
-	return iface
-}
-
-type interfaceSelection struct {
-	iface4 *net.Interface
-	iface6 *net.Interface
-}
-
-func selectInterfaceForZone(dest netip.Addr, zone string) *interfaceSelection {
-	iface := getInterfaceFromZone(zone)
-	if iface == nil {
-		return nil
-	}
-
-	if dest.Is6() {
-		return &interfaceSelection{iface6: iface}
-	}
-	return &interfaceSelection{iface4: iface}
-}
-
-func selectInterfaceForUnspecified() (*interfaceSelection, error) {
-	if GetBestInterfaceFunc == nil {
-		return nil, errors.New("GetBestInterfaceFunc not initialized")
-	}
-
-	var result interfaceSelection
-	vpnIfaceName := GetVPNInterfaceName()
-
-	if iface4, err := GetBestInterfaceFunc(netip.IPv4Unspecified(), vpnIfaceName); err == nil {
-		result.iface4 = iface4
-	} else {
-		log.Debugf("No IPv4 default route found: %v", err)
-	}
-
-	if iface6, err := GetBestInterfaceFunc(netip.IPv6Unspecified(), vpnIfaceName); err == nil {
-		result.iface6 = iface6
-	} else {
-		log.Debugf("No IPv6 default route found: %v", err)
-	}
-
-	if result.iface4 == nil && result.iface6 == nil {
-		return nil, errors.New("no default routes found")
-	}
-
-	return &result, nil
-}
-
-func selectInterface(dest netip.Addr) (*interfaceSelection, error) {
-	if zone := dest.Zone(); zone != "" {
-		if selection := selectInterfaceForZone(dest, zone); selection != nil {
-			return selection, nil
-		}
-	}
-
-	if dest.IsUnspecified() {
-		return selectInterfaceForUnspecified()
-	}
-
-	if GetBestInterfaceFunc == nil {
-		return nil, errors.New("GetBestInterfaceFunc not initialized")
-	}
-
-	iface, err := GetBestInterfaceFunc(dest, GetVPNInterfaceName())
-	if err != nil {
-		return nil, fmt.Errorf("find route for %s: %w", dest, err)
-	}
-
-	if dest.Is6() {
-		return &interfaceSelection{iface6: iface}, nil
-	}
-	return &interfaceSelection{iface4: iface}, nil
-}
-
-func setIPv4UnicastIF(fd uintptr, iface *net.Interface) error {
-	ifaceIndexBE := nativeToBigEndian(uint32(iface.Index))
-	if err := windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IP, IpUnicastIf, int(ifaceIndexBE)); err != nil {
-		return fmt.Errorf("set IP_UNICAST_IF: %w (interface: %s, index: %d)", err, iface.Name, iface.Index)
-	}
-	return nil
-}
-
-func setIPv6UnicastIF(fd uintptr, iface *net.Interface) error {
-	if err := windows.SetsockoptInt(windows.Handle(fd), windows.IPPROTO_IPV6, Ipv6UnicastIf, iface.Index); err != nil {
-		return fmt.Errorf("set IPV6_UNICAST_IF: %w (interface: %s, index: %d)", err, iface.Name, iface.Index)
-	}
-	return nil
-}
-
-func setUnicastIf(fd uintptr, network string, selection *interfaceSelection, address string) error {
-	// The Go runtime always passes specific network types to Control (udp4, udp6, tcp4, tcp6, etc.)
-	// Never generic ones (udp, tcp, ip)
-
-	switch {
-	case strings.HasSuffix(network, "4"):
-		// IPv4-only socket (udp4, tcp4, ip4)
-		return setUnicastIfIPv4(fd, network, selection, address)
-
-	case strings.HasSuffix(network, "6"):
-		// IPv6 socket (udp6, tcp6, ip6) - could be dual-stack or IPv6-only
-		return setUnicastIfIPv6(fd, network, selection, address)
-	}
-
-	// Shouldn't reach here based on Go's documented behavior
-	return fmt.Errorf("unexpected network type: %s", network)
-}
-
-func setUnicastIfIPv4(fd uintptr, network string, selection *interfaceSelection, address string) error {
-	if selection.iface4 == nil {
-		return nil
-	}
-
-	if err := setIPv4UnicastIF(fd, selection.iface4); err != nil {
-		return err
-	}
-
-	log.Debugf("Set IP_UNICAST_IF=%d on %s for %s to %s", selection.iface4.Index, selection.iface4.Name, network, address)
-	return nil
-}
-
-func setUnicastIfIPv6(fd uintptr, network string, selection *interfaceSelection, address string) error {
-	isDualStack := checkDualStack(fd)
-
-	// For dual-stack sockets, also set the IPv4 option
-	if isDualStack && selection.iface4 != nil {
-		if err := setIPv4UnicastIF(fd, selection.iface4); err != nil {
-			return err
-		}
-		log.Debugf("Set IP_UNICAST_IF=%d on %s for %s to %s (dual-stack)", selection.iface4.Index, selection.iface4.Name, network, address)
-	}
-
-	if selection.iface6 == nil {
-		return nil
-	}
-
-	if err := setIPv6UnicastIF(fd, selection.iface6); err != nil {
-		return err
-	}
-
-	log.Debugf("Set IPV6_UNICAST_IF=%d on %s for %s to %s", selection.iface6.Index, selection.iface6.Name, network, address)
-	return nil
-}
-
-func checkDualStack(fd uintptr) bool {
-	var v6Only int
-	v6OnlyLen := int32(unsafe.Sizeof(v6Only))
-	err := windows.Getsockopt(windows.Handle(fd), windows.IPPROTO_IPV6, Ipv6V6only, (*byte)(unsafe.Pointer(&v6Only)), &v6OnlyLen)
-	return err == nil && v6Only == 0
-}
-
-// applyUnicastIFToSocket applies IpUnicastIf to a socket based on the destination address
-func applyUnicastIFToSocket(network string, address string, c syscall.RawConn) error {
-	if !AdvancedRouting() {
-		return nil
-	}
-
-	dest, err := parseDestinationAddress(network, address)
-	if err != nil {
-		return err
-	}
-
-	dest = dest.Unmap()
-
-	if !dest.IsValid() {
-		return fmt.Errorf("invalid destination address for %s", address)
-	}
-
-	selection, err := selectInterface(dest)
-	if err != nil {
-		return err
-	}
-
-	var controlErr error
-	err = c.Control(func(fd uintptr) {
-		controlErr = setUnicastIf(fd, network, selection, address)
-	})
-
-	if err != nil {
-		return fmt.Errorf("control: %w", err)
-	}
-
-	return controlErr
-}

client/netbird-entrypoint.sh

@@ -2,7 +2,7 @@
 set -eEuo pipefail
 
 : ${NB_ENTRYPOINT_SERVICE_TIMEOUT:="5"}
-: ${NB_ENTRYPOINT_LOGIN_TIMEOUT:="5"}
+: ${NB_ENTRYPOINT_LOGIN_TIMEOUT:="1"}
 NETBIRD_BIN="${NETBIRD_BIN:-"netbird"}"
 export NB_LOG_FILE="${NB_LOG_FILE:-"console,/var/log/netbird/client.log"}"
 service_pids=()
@@ -39,7 +39,7 @@ wait_for_message() {
     info "not waiting for log line ${message@Q} due to zero timeout."
   elif test -n "${log_file_path}"; then
     info "waiting for log line ${message@Q} for ${timeout} seconds..."
-    grep -E -q "${message}" <(timeout "${timeout}" tail -F "${log_file_path}" 2>/dev/null)
+    grep -q "${message}" <(timeout "${timeout}" tail -F "${log_file_path}" 2>/dev/null)
   else
     info "log file unsupported, sleeping for ${timeout} seconds..."
     sleep "${timeout}"
@@ -81,7 +81,7 @@ wait_for_daemon_startup() {
 login_if_needed() {
   local timeout="${1}"
 
-  if test -n "${log_file_path}" && wait_for_message "${timeout}" 'peer has been successfully registered|management connection state READY'; then
+  if test -n "${log_file_path}" && wait_for_message "${timeout}" 'peer has been successfully registered'; then
     info "already logged in, skipping 'netbird up'..."
   else
     info "logging in..."

client/proto/daemon.pb.go

@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.6
-// 	protoc        v6.32.1
+// 	protoc        v5.29.3
 // source: daemon.proto
 
 package proto
@@ -794,10 +794,8 @@ type StatusRequest struct {
 	state             protoimpl.MessageState `protogen:"open.v1"`
 	GetFullPeerStatus bool                   `protobuf:"varint,1,opt,name=getFullPeerStatus,proto3" json:"getFullPeerStatus,omitempty"`
 	ShouldRunProbes   bool                   `protobuf:"varint,2,opt,name=shouldRunProbes,proto3" json:"shouldRunProbes,omitempty"`
-	// the UI do not using this yet, but CLIs could use it to wait until the status is ready
-	WaitForReady  *bool `protobuf:"varint,3,opt,name=waitForReady,proto3,oneof" json:"waitForReady,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
 }
 
 func (x *StatusRequest) Reset() {
@@ -844,13 +842,6 @@ func (x *StatusRequest) GetShouldRunProbes() bool {
 	return false
 }
 
-func (x *StatusRequest) GetWaitForReady() bool {
-	if x != nil && x.WaitForReady != nil {
-		return *x.WaitForReady
-	}
-	return false
-}
-
 type StatusResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// status of the server.
@@ -4682,12 +4673,10 @@ const file_daemon_proto_rawDesc = "" +
 	"\f_profileNameB\v\n" +
 	"\t_username\"\f\n" +
 	"\n" +
-	"UpResponse\"\xa1\x01\n" +
+	"UpResponse\"g\n" +
 	"\rStatusRequest\x12,\n" +
 	"\x11getFullPeerStatus\x18\x01 \x01(\bR\x11getFullPeerStatus\x12(\n" +
-	"\x0fshouldRunProbes\x18\x02 \x01(\bR\x0fshouldRunProbes\x12'\n" +
-	"\fwaitForReady\x18\x03 \x01(\bH\x00R\fwaitForReady\x88\x01\x01B\x0f\n" +
-	"\r_waitForReady\"\x82\x01\n" +
+	"\x0fshouldRunProbes\x18\x02 \x01(\bR\x0fshouldRunProbes\"\x82\x01\n" +
 	"\x0eStatusResponse\x12\x16\n" +
 	"\x06status\x18\x01 \x01(\tR\x06status\x122\n" +
 	"\n" +
@@ -5242,7 +5231,6 @@ func file_daemon_proto_init() {
 	}
 	file_daemon_proto_msgTypes[1].OneofWrappers = []any{}
 	file_daemon_proto_msgTypes[5].OneofWrappers = []any{}
-	file_daemon_proto_msgTypes[7].OneofWrappers = []any{}
 	file_daemon_proto_msgTypes[26].OneofWrappers = []any{
 		(*PortInfo_Port)(nil),
 		(*PortInfo_Range_)(nil),

client/proto/daemon.proto

@@ -186,8 +186,6 @@ message UpResponse {}
 message StatusRequest{
   bool getFullPeerStatus = 1;
   bool shouldRunProbes   = 2;
-  // the UI do not using this yet, but CLIs could use it to wait until the status is ready
-  optional bool waitForReady     = 3;
 }
 
 message StatusResponse{

client/server/server.go

@@ -65,9 +65,6 @@ type Server struct {
 	mutex  sync.Mutex
 	config *profilemanager.Config
 	proto.UnimplementedDaemonServiceServer
-	clientRunning     bool // protected by mutex
-	clientRunningChan chan struct{}
-	clientGiveUpChan  chan struct{}
 
 	connectClient *internal.ConnectClient
 
@@ -106,11 +103,6 @@ func New(ctx context.Context, logFile string, configFile string, profilesDisable
 func (s *Server) Start() error {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
-
-	if s.clientRunning {
-		return nil
-	}
-
 	state := internal.CtxGetState(s.rootCtx)
 
 	if err := handlePanicLog(); err != nil {
@@ -180,10 +172,8 @@ func (s *Server) Start() error {
 		return nil
 	}
 
-	s.clientRunning = true
-	s.clientRunningChan = make(chan struct{})
-	s.clientGiveUpChan = make(chan struct{})
-	go s.connectWithRetryRuns(ctx, config, s.statusRecorder, s.clientRunningChan, s.clientGiveUpChan)
+	go s.connectWithRetryRuns(ctx, config, s.statusRecorder, nil)
+
 	return nil
 }
 
@@ -214,22 +204,12 @@ func (s *Server) setDefaultConfigIfNotExists(ctx context.Context) error {
 // connectWithRetryRuns runs the client connection with a backoff strategy where we retry the operation as additional
 // mechanism to keep the client connected even when the connection is lost.
 // we cancel retry if the client receive a stop or down command, or if disable auto connect is configured.
-func (s *Server) connectWithRetryRuns(ctx context.Context, profileConfig *profilemanager.Config, statusRecorder *peer.Status, runningChan chan struct{}, giveUpChan chan struct{}) {
-	defer func() {
-		s.mutex.Lock()
-		s.clientRunning = false
-		s.mutex.Unlock()
-	}()
-
-	if s.config.DisableAutoConnect {
-		if err := s.connect(ctx, s.config, s.statusRecorder, runningChan); err != nil {
-			log.Debugf("run client connection exited with error: %v", err)
-		}
-		log.Tracef("client connection exited")
-		return
-	}
-
+func (s *Server) connectWithRetryRuns(ctx context.Context, config *profilemanager.Config, statusRecorder *peer.Status,
+	runningChan chan struct{},
+) {
 	backOff := getConnectWithBackoff(ctx)
+	retryStarted := false
+
 	go func() {
 		t := time.NewTicker(24 * time.Hour)
 		for {
@@ -238,36 +218,89 @@ func (s *Server) connectWithRetryRuns(ctx context.Context, profileConfig *profil
 				t.Stop()
 				return
 			case <-t.C:
-				mgmtState := statusRecorder.GetManagementState()
-				signalState := statusRecorder.GetSignalState()
-				if mgmtState.Connected && signalState.Connected {
-					log.Tracef("resetting status")
-					backOff.Reset()
-				} else {
-					log.Tracef("not resetting status: mgmt: %v, signal: %v", mgmtState.Connected, signalState.Connected)
+				if retryStarted {
+
+					mgmtState := statusRecorder.GetManagementState()
+					signalState := statusRecorder.GetSignalState()
+					if mgmtState.Connected && signalState.Connected {
+						log.Tracef("resetting status")
+						retryStarted = false
+					} else {
+						log.Tracef("not resetting status: mgmt: %v, signal: %v", mgmtState.Connected, signalState.Connected)
+					}
 				}
 			}
 		}
 	}()
 
 	runOperation := func() error {
-		err := s.connect(ctx, profileConfig, statusRecorder, runningChan)
+		log.Tracef("running client connection")
+		s.connectClient = internal.NewConnectClient(ctx, config, statusRecorder)
+		s.connectClient.SetSyncResponsePersistence(s.persistSyncResponse)
+
+		err := s.connectClient.Run(runningChan)
 		if err != nil {
 			log.Debugf("run client connection exited with error: %v. Will retry in the background", err)
-			return err
 		}
 
-		log.Tracef("client connection exited gracefully, do not need to retry")
-		return nil
+		if config.DisableAutoConnect {
+			return backoff.Permanent(err)
+		}
+
+		if !retryStarted {
+			retryStarted = true
+			backOff.Reset()
+		}
+
+		log.Tracef("client connection exited")
+		return fmt.Errorf("client connection exited")
 	}
 
-	if err := backoff.Retry(runOperation, backOff); err != nil {
-		log.Errorf("operation failed: %v", err)
+	err := backoff.Retry(runOperation, backOff)
+	if s, ok := gstatus.FromError(err); ok && s.Code() != codes.Canceled {
+		log.Errorf("received an error when trying to connect: %v", err)
+	} else {
+		log.Tracef("retry canceled")
+	}
+}
+
+// getConnectWithBackoff returns a backoff with exponential backoff strategy for connection retries
+func getConnectWithBackoff(ctx context.Context) backoff.BackOff {
+	initialInterval := parseEnvDuration(retryInitialIntervalVar, defaultInitialRetryTime)
+	maxInterval := parseEnvDuration(maxRetryIntervalVar, defaultMaxRetryInterval)
+	maxElapsedTime := parseEnvDuration(maxRetryTimeVar, defaultMaxRetryTime)
+	multiplier := defaultRetryMultiplier
+
+	if envValue := os.Getenv(retryMultiplierVar); envValue != "" {
+		// parse the multiplier from the environment variable string value to float64
+		value, err := strconv.ParseFloat(envValue, 64)
+		if err != nil {
+			log.Warnf("unable to parse environment variable %s: %s. using default: %f", retryMultiplierVar, envValue, multiplier)
+		} else {
+			multiplier = value
+		}
 	}
 
-	if giveUpChan != nil {
-		close(giveUpChan)
+	return backoff.WithContext(&backoff.ExponentialBackOff{
+		InitialInterval:     initialInterval,
+		RandomizationFactor: 1,
+		Multiplier:          multiplier,
+		MaxInterval:         maxInterval,
+		MaxElapsedTime:      maxElapsedTime, // 14 days
+		Stop:                backoff.Stop,
+		Clock:               backoff.SystemClock,
+	}, ctx)
+}
+
+// parseEnvDuration parses the environment variable and returns the duration
+func parseEnvDuration(envVar string, defaultDuration time.Duration) time.Duration {
+	if envValue := os.Getenv(envVar); envValue != "" {
+		if duration, err := time.ParseDuration(envValue); err == nil {
+			return duration
+		}
+		log.Warnf("unable to parse environment variable %s: %s. using default: %s", envVar, envValue, defaultDuration)
 	}
+	return defaultDuration
 }
 
 // loginAttempt attempts to login using the provided information. it returns a status in case something fails
@@ -386,7 +419,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	if s.actCancel != nil {
 		s.actCancel()
 	}
-	ctx, cancel := context.WithCancel(callerCtx)
+	ctx, cancel := context.WithCancel(s.rootCtx)
 
 	md, ok := metadata.FromIncomingContext(callerCtx)
 	if ok {
@@ -396,11 +429,11 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 	s.actCancel = cancel
 	s.mutex.Unlock()
 
-	if err := restoreResidualState(s.rootCtx, s.profileManager.GetStatePath()); err != nil {
+	if err := restoreResidualState(ctx, s.profileManager.GetStatePath()); err != nil {
 		log.Warnf(errRestoreResidualState, err)
 	}
 
-	state := internal.CtxGetState(s.rootCtx)
+	state := internal.CtxGetState(ctx)
 	defer func() {
 		status, err := state.Status()
 		if err != nil || (status != internal.StatusNeedsLogin && status != internal.StatusLoginFailed) {
@@ -613,20 +646,6 @@ func (s *Server) WaitSSOLogin(callerCtx context.Context, msg *proto.WaitSSOLogin
 // Up starts engine work in the daemon.
 func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpResponse, error) {
 	s.mutex.Lock()
-	if s.clientRunning {
-		state := internal.CtxGetState(s.rootCtx)
-		status, err := state.Status()
-		if err != nil {
-			s.mutex.Unlock()
-			return nil, err
-		}
-		if status == internal.StatusNeedsLogin {
-			s.actCancel()
-		}
-		s.mutex.Unlock()
-
-		return s.waitForUp(callerCtx)
-	}
 	defer s.mutex.Unlock()
 
 	if err := restoreResidualState(callerCtx, s.profileManager.GetStatePath()); err != nil {
@@ -642,16 +661,16 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 	if err != nil {
 		return nil, err
 	}
-
 	if status != internal.StatusIdle {
 		return nil, fmt.Errorf("up already in progress: current status %s", status)
 	}
 
-	// it should be nil here, but in case it isn't we cancel it.
+	// it should be nil here, but .
 	if s.actCancel != nil {
 		s.actCancel()
 	}
 	ctx, cancel := context.WithCancel(s.rootCtx)
+
 	md, ok := metadata.FromIncomingContext(callerCtx)
 	if ok {
 		ctx = metadata.NewOutgoingContext(ctx, md)
@@ -694,31 +713,23 @@ func (s *Server) Up(callerCtx context.Context, msg *proto.UpRequest) (*proto.UpR
 	s.statusRecorder.UpdateManagementAddress(s.config.ManagementURL.String())
 	s.statusRecorder.UpdateRosenpass(s.config.RosenpassEnabled, s.config.RosenpassPermissive)
 
-	s.clientRunning = true
-	s.clientRunningChan = make(chan struct{})
-	s.clientGiveUpChan = make(chan struct{})
-	go s.connectWithRetryRuns(ctx, s.config, s.statusRecorder, s.clientRunningChan, s.clientGiveUpChan)
-
-	return s.waitForUp(callerCtx)
-}
-
-// todo: handle potential race conditions
-func (s *Server) waitForUp(callerCtx context.Context) (*proto.UpResponse, error) {
 	timeoutCtx, cancel := context.WithTimeout(callerCtx, 50*time.Second)
 	defer cancel()
 
-	select {
-	case <-s.clientGiveUpChan:
-		return nil, fmt.Errorf("client gave up to connect")
-	case <-s.clientRunningChan:
-		s.isSessionActive.Store(true)
-		return &proto.UpResponse{}, nil
-	case <-callerCtx.Done():
-		log.Debug("context done, stopping the wait for engine to become ready")
-		return nil, callerCtx.Err()
-	case <-timeoutCtx.Done():
-		log.Debug("up is timed out, stopping the wait for engine to become ready")
-		return nil, timeoutCtx.Err()
+	runningChan := make(chan struct{}, 1) // buffered channel to do not lose the signal
+	go s.connectWithRetryRuns(ctx, s.config, s.statusRecorder, runningChan)
+	for {
+		select {
+		case <-runningChan:
+			s.isSessionActive.Store(true)
+			return &proto.UpResponse{}, nil
+		case <-callerCtx.Done():
+			log.Debug("context done, stopping the wait for engine to become ready")
+			return nil, callerCtx.Err()
+		case <-timeoutCtx.Done():
+			log.Debug("up is timed out, stopping the wait for engine to become ready")
+			return nil, timeoutCtx.Err()
+		}
 	}
 }
 
@@ -992,47 +1003,13 @@ func (s *Server) Status(
 	ctx context.Context,
 	msg *proto.StatusRequest,
 ) (*proto.StatusResponse, error) {
-	s.mutex.Lock()
-	clientRunning := s.clientRunning
-	s.mutex.Unlock()
-
-	if msg.WaitForReady != nil && *msg.WaitForReady && clientRunning {
-		state := internal.CtxGetState(s.rootCtx)
-		status, err := state.Status()
-		if err != nil {
-			return nil, err
-		}
-
-		if status != internal.StatusIdle && status != internal.StatusConnected && status != internal.StatusConnecting {
-			s.actCancel()
-		}
-
-		ticker := time.NewTicker(1 * time.Second)
-		defer ticker.Stop()
-	loop:
-		for {
-			select {
-			case <-s.clientGiveUpChan:
-				ticker.Stop()
-				break loop
-			case <-s.clientRunningChan:
-				ticker.Stop()
-				break loop
-			case <-ticker.C:
-				status, err := state.Status()
-				if err != nil {
-					continue
-				}
-				if status != internal.StatusIdle && status != internal.StatusConnected && status != internal.StatusConnecting {
-					s.actCancel()
-				}
-				continue
-			case <-ctx.Done():
-				return nil, ctx.Err()
-			}
-		}
+	if ctx.Err() != nil {
+		return nil, ctx.Err()
 	}
 
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
 	status, err := internal.CtxGetState(s.rootCtx).Status()
 	if err != nil {
 		return nil, err
@@ -1150,134 +1127,6 @@ func (s *Server) GetConfig(ctx context.Context, req *proto.GetConfigRequest) (*p
 	}, nil
 }
 
-// AddProfile adds a new profile to the daemon.
-func (s *Server) AddProfile(ctx context.Context, msg *proto.AddProfileRequest) (*proto.AddProfileResponse, error) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-
-	if s.checkProfilesDisabled() {
-		return nil, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
-	}
-
-	if msg.ProfileName == "" || msg.Username == "" {
-		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name and username must be provided")
-	}
-
-	if err := s.profileManager.AddProfile(msg.ProfileName, msg.Username); err != nil {
-		log.Errorf("failed to create profile: %v", err)
-		return nil, fmt.Errorf("failed to create profile: %w", err)
-	}
-
-	return &proto.AddProfileResponse{}, nil
-}
-
-// RemoveProfile removes a profile from the daemon.
-func (s *Server) RemoveProfile(ctx context.Context, msg *proto.RemoveProfileRequest) (*proto.RemoveProfileResponse, error) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-
-	if err := s.validateProfileOperation(msg.ProfileName, false); err != nil {
-		return nil, err
-	}
-
-	if err := s.logoutFromProfile(ctx, msg.ProfileName, msg.Username); err != nil {
-		log.Warnf("failed to logout from profile %s before removal: %v", msg.ProfileName, err)
-	}
-
-	if err := s.profileManager.RemoveProfile(msg.ProfileName, msg.Username); err != nil {
-		log.Errorf("failed to remove profile: %v", err)
-		return nil, fmt.Errorf("failed to remove profile: %w", err)
-	}
-
-	return &proto.RemoveProfileResponse{}, nil
-}
-
-// ListProfiles lists all profiles in the daemon.
-func (s *Server) ListProfiles(ctx context.Context, msg *proto.ListProfilesRequest) (*proto.ListProfilesResponse, error) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-
-	if msg.Username == "" {
-		return nil, gstatus.Errorf(codes.InvalidArgument, "username must be provided")
-	}
-
-	profiles, err := s.profileManager.ListProfiles(msg.Username)
-	if err != nil {
-		log.Errorf("failed to list profiles: %v", err)
-		return nil, fmt.Errorf("failed to list profiles: %w", err)
-	}
-
-	response := &proto.ListProfilesResponse{
-		Profiles: make([]*proto.Profile, len(profiles)),
-	}
-	for i, profile := range profiles {
-		response.Profiles[i] = &proto.Profile{
-			Name:     profile.Name,
-			IsActive: profile.IsActive,
-		}
-	}
-
-	return response, nil
-}
-
-// GetActiveProfile returns the active profile in the daemon.
-func (s *Server) GetActiveProfile(ctx context.Context, msg *proto.GetActiveProfileRequest) (*proto.GetActiveProfileResponse, error) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-
-	activeProfile, err := s.profileManager.GetActiveProfileState()
-	if err != nil {
-		log.Errorf("failed to get active profile state: %v", err)
-		return nil, fmt.Errorf("failed to get active profile state: %w", err)
-	}
-
-	return &proto.GetActiveProfileResponse{
-		ProfileName: activeProfile.Name,
-		Username:    activeProfile.Username,
-	}, nil
-}
-
-// GetFeatures returns the features supported by the daemon.
-func (s *Server) GetFeatures(ctx context.Context, msg *proto.GetFeaturesRequest) (*proto.GetFeaturesResponse, error) {
-	s.mutex.Lock()
-	defer s.mutex.Unlock()
-
-	features := &proto.GetFeaturesResponse{
-		DisableProfiles:       s.checkProfilesDisabled(),
-		DisableUpdateSettings: s.checkUpdateSettingsDisabled(),
-	}
-
-	return features, nil
-}
-
-func (s *Server) connect(ctx context.Context, config *profilemanager.Config, statusRecorder *peer.Status, runningChan chan struct{}) error {
-	log.Tracef("running client connection")
-	s.connectClient = internal.NewConnectClient(ctx, config, statusRecorder)
-	s.connectClient.SetSyncResponsePersistence(s.persistSyncResponse)
-	if err := s.connectClient.Run(runningChan); err != nil {
-		return err
-	}
-	return nil
-}
-
-func (s *Server) checkProfilesDisabled() bool {
-	// Check if the environment variable is set to disable profiles
-	if s.profilesDisabled {
-		return true
-	}
-
-	return false
-}
-
-func (s *Server) checkUpdateSettingsDisabled() bool {
-	// Check if the environment variable is set to disable profiles
-	if s.updateSettingsDisabled {
-		return true
-	}
-
-	return false
-}
-
 func (s *Server) onSessionExpire() {
 	if runtime.GOOS != "windows" {
 		isUIActive := internal.CheckUIApp()
@@ -1289,45 +1138,6 @@ func (s *Server) onSessionExpire() {
 	}
 }
 
-// getConnectWithBackoff returns a backoff with exponential backoff strategy for connection retries
-func getConnectWithBackoff(ctx context.Context) backoff.BackOff {
-	initialInterval := parseEnvDuration(retryInitialIntervalVar, defaultInitialRetryTime)
-	maxInterval := parseEnvDuration(maxRetryIntervalVar, defaultMaxRetryInterval)
-	maxElapsedTime := parseEnvDuration(maxRetryTimeVar, defaultMaxRetryTime)
-	multiplier := defaultRetryMultiplier
-
-	if envValue := os.Getenv(retryMultiplierVar); envValue != "" {
-		// parse the multiplier from the environment variable string value to float64
-		value, err := strconv.ParseFloat(envValue, 64)
-		if err != nil {
-			log.Warnf("unable to parse environment variable %s: %s. using default: %f", retryMultiplierVar, envValue, multiplier)
-		} else {
-			multiplier = value
-		}
-	}
-
-	return backoff.WithContext(&backoff.ExponentialBackOff{
-		InitialInterval:     initialInterval,
-		RandomizationFactor: 1,
-		Multiplier:          multiplier,
-		MaxInterval:         maxInterval,
-		MaxElapsedTime:      maxElapsedTime, // 14 days
-		Stop:                backoff.Stop,
-		Clock:               backoff.SystemClock,
-	}, ctx)
-}
-
-// parseEnvDuration parses the environment variable and returns the duration
-func parseEnvDuration(envVar string, defaultDuration time.Duration) time.Duration {
-	if envValue := os.Getenv(envVar); envValue != "" {
-		if duration, err := time.ParseDuration(envValue); err == nil {
-			return duration
-		}
-		log.Warnf("unable to parse environment variable %s: %s. using default: %s", envVar, envValue, defaultDuration)
-	}
-	return defaultDuration
-}
-
 func toProtoFullStatus(fullStatus peer.FullStatus) *proto.FullStatus {
 	pbFullStatus := proto.FullStatus{
 		ManagementState: &proto.ManagementState{},
@@ -1442,3 +1252,121 @@ func sendTerminalNotification() error {
 
 	return wallCmd.Wait()
 }
+
+// AddProfile adds a new profile to the daemon.
+func (s *Server) AddProfile(ctx context.Context, msg *proto.AddProfileRequest) (*proto.AddProfileResponse, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	if s.checkProfilesDisabled() {
+		return nil, gstatus.Errorf(codes.Unavailable, errProfilesDisabled)
+	}
+
+	if msg.ProfileName == "" || msg.Username == "" {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "profile name and username must be provided")
+	}
+
+	if err := s.profileManager.AddProfile(msg.ProfileName, msg.Username); err != nil {
+		log.Errorf("failed to create profile: %v", err)
+		return nil, fmt.Errorf("failed to create profile: %w", err)
+	}
+
+	return &proto.AddProfileResponse{}, nil
+}
+
+// RemoveProfile removes a profile from the daemon.
+func (s *Server) RemoveProfile(ctx context.Context, msg *proto.RemoveProfileRequest) (*proto.RemoveProfileResponse, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	if err := s.validateProfileOperation(msg.ProfileName, false); err != nil {
+		return nil, err
+	}
+
+	if err := s.logoutFromProfile(ctx, msg.ProfileName, msg.Username); err != nil {
+		log.Warnf("failed to logout from profile %s before removal: %v", msg.ProfileName, err)
+	}
+
+	if err := s.profileManager.RemoveProfile(msg.ProfileName, msg.Username); err != nil {
+		log.Errorf("failed to remove profile: %v", err)
+		return nil, fmt.Errorf("failed to remove profile: %w", err)
+	}
+
+	return &proto.RemoveProfileResponse{}, nil
+}
+
+// ListProfiles lists all profiles in the daemon.
+func (s *Server) ListProfiles(ctx context.Context, msg *proto.ListProfilesRequest) (*proto.ListProfilesResponse, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	if msg.Username == "" {
+		return nil, gstatus.Errorf(codes.InvalidArgument, "username must be provided")
+	}
+
+	profiles, err := s.profileManager.ListProfiles(msg.Username)
+	if err != nil {
+		log.Errorf("failed to list profiles: %v", err)
+		return nil, fmt.Errorf("failed to list profiles: %w", err)
+	}
+
+	response := &proto.ListProfilesResponse{
+		Profiles: make([]*proto.Profile, len(profiles)),
+	}
+	for i, profile := range profiles {
+		response.Profiles[i] = &proto.Profile{
+			Name:     profile.Name,
+			IsActive: profile.IsActive,
+		}
+	}
+
+	return response, nil
+}
+
+// GetActiveProfile returns the active profile in the daemon.
+func (s *Server) GetActiveProfile(ctx context.Context, msg *proto.GetActiveProfileRequest) (*proto.GetActiveProfileResponse, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	activeProfile, err := s.profileManager.GetActiveProfileState()
+	if err != nil {
+		log.Errorf("failed to get active profile state: %v", err)
+		return nil, fmt.Errorf("failed to get active profile state: %w", err)
+	}
+
+	return &proto.GetActiveProfileResponse{
+		ProfileName: activeProfile.Name,
+		Username:    activeProfile.Username,
+	}, nil
+}
+
+// GetFeatures returns the features supported by the daemon.
+func (s *Server) GetFeatures(ctx context.Context, msg *proto.GetFeaturesRequest) (*proto.GetFeaturesResponse, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+
+	features := &proto.GetFeaturesResponse{
+		DisableProfiles:       s.checkProfilesDisabled(),
+		DisableUpdateSettings: s.checkUpdateSettingsDisabled(),
+	}
+
+	return features, nil
+}
+
+func (s *Server) checkProfilesDisabled() bool {
+	// Check if the environment variable is set to disable profiles
+	if s.profilesDisabled {
+		return true
+	}
+
+	return false
+}
+
+func (s *Server) checkUpdateSettingsDisabled() bool {
+	// Check if the environment variable is set to disable profiles
+	if s.updateSettingsDisabled {
+		return true
+	}
+
+	return false
+}

client/server/server_test.go

@@ -18,7 +18,6 @@ import (
 	"google.golang.org/grpc/keepalive"
 
 	"github.com/netbirdio/management-integrations/integrations"
-
 	"github.com/netbirdio/netbird/client/internal"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
@@ -105,7 +104,7 @@ func TestConnectWithRetryRuns(t *testing.T) {
 	t.Setenv(maxRetryTimeVar, "5s")
 	t.Setenv(retryMultiplierVar, "1")
 
-	s.connectWithRetryRuns(ctx, config, s.statusRecorder, nil, nil)
+	s.connectWithRetryRuns(ctx, config, s.statusRecorder, nil)
 	if counter < 3 {
 		t.Fatalf("expected counter > 2, got %d", counter)
 	}
@@ -134,12 +133,8 @@ func TestServer_Up(t *testing.T) {
 
 	profName := "default"
 
-	u, err := url.Parse("http://non-existent-url-for-testing.invalid:12345")
-	require.NoError(t, err)
-
 	ic := profilemanager.ConfigInput{
-		ConfigPath:    filepath.Join(tempDir, profName+".json"),
-		ManagementURL: u.String(),
+		ConfigPath: filepath.Join(tempDir, profName+".json"),
 	}
 
 	_, err = profilemanager.UpdateOrCreateConfig(ic)
@@ -157,9 +152,16 @@ func TestServer_Up(t *testing.T) {
 	}
 
 	s := New(ctx, "console", "", false, false)
+
 	err = s.Start()
 	require.NoError(t, err)
 
+	u, err := url.Parse("http://non-existent-url-for-testing.invalid:12345")
+	require.NoError(t, err)
+	s.config = &profilemanager.Config{
+		ManagementURL: u,
+	}
+
 	upCtx, cancel := context.WithTimeout(ctx, 1*time.Second)
 	defer cancel()
 
@@ -168,7 +170,6 @@ func TestServer_Up(t *testing.T) {
 		Username:    &currUser.Username,
 	}
 	_, err = s.Up(upCtx, upReq)
-	log.Errorf("error from Up: %v", err)
 
 	assert.Contains(t, err.Error(), "context deadline exceeded")
 }

client/ui/client_ui.go

@@ -529,7 +529,7 @@ func (s *serviceClient) getSettingsForm() *widget.Form {
 				var req proto.SetConfigRequest
 				req.ProfileName = activeProf.Name
 				req.Username = currUser.Username
-
+				
 				if iMngURL != "" {
 					req.ManagementUrl = iMngURL
 				}
@@ -563,28 +563,27 @@ func (s *serviceClient) getSettingsForm() *widget.Form {
 					return
 				}
 
-				go func() {
-					status, err := conn.Status(s.ctx, &proto.StatusRequest{})
+				status, err := conn.Status(s.ctx, &proto.StatusRequest{})
+				if err != nil {
+					log.Errorf("get service status: %v", err)
+					dialog.ShowError(fmt.Errorf("Failed to get service status: %v", err), s.wSettings)
+					return
+				}
+				if status.Status == string(internal.StatusConnected) {
+					// run down & up
+					_, err = conn.Down(s.ctx, &proto.DownRequest{})
 					if err != nil {
-						log.Errorf("get service status: %v", err)
-						dialog.ShowError(fmt.Errorf("Failed to get service status: %v", err), s.wSettings)
+						log.Errorf("down service: %v", err)
+					}
+
+					_, err = conn.Up(s.ctx, &proto.UpRequest{})
+					if err != nil {
+						log.Errorf("up service: %v", err)
+						dialog.ShowError(fmt.Errorf("Failed to reconnect: %v", err), s.wSettings)
 						return
 					}
-					if status.Status == string(internal.StatusConnected) {
-						// run down & up
-						_, err = conn.Down(s.ctx, &proto.DownRequest{})
-						if err != nil {
-							log.Errorf("down service: %v", err)
-						}
+				}
 
-						_, err = conn.Up(s.ctx, &proto.UpRequest{})
-						if err != nil {
-							log.Errorf("up service: %v", err)
-							dialog.ShowError(fmt.Errorf("Failed to reconnect: %v", err), s.wSettings)
-							return
-						}
-					}
-				}()
 			}
 		},
 		OnCancel: func() {

flow/client/client.go

@@ -20,9 +20,9 @@ import (
 	"google.golang.org/grpc/keepalive"
 	"google.golang.org/grpc/status"
 
-	nbgrpc "github.com/netbirdio/netbird/client/grpc"
 	"github.com/netbirdio/netbird/flow/proto"
 	"github.com/netbirdio/netbird/util/embeddedroots"
+	nbgrpc "github.com/netbirdio/netbird/util/grpc"
 )
 
 type GRPCClient struct {

go.mod

@@ -261,6 +261,6 @@ replace golang.zx2c4.com/wireguard => github.com/netbirdio/wireguard-go v0.0.0-2
 
 replace github.com/cloudflare/circl => github.com/cunicu/circl v0.0.0-20230801113412-fec58fc7b5f6
 
-replace github.com/pion/ice/v4 => github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51
+replace github.com/pion/ice/v4 => github.com/netbirdio/ice/v4 v4.0.0-20250827161942-426799a23107
 
 replace github.com/libp2p/go-netroute => github.com/netbirdio/go-netroute v0.0.0-20240611143515-f59b0e1d3944

go.sum

@@ -501,8 +501,8 @@ github.com/neelance/astrewrite v0.0.0-20160511093645-99348263ae86/go.mod h1:kHJE
 github.com/neelance/sourcemap v0.0.0-20200213170602-2833bce08e4c/go.mod h1:Qr6/a/Q4r9LP1IltGz7tA7iOK1WonHEYhu1HRBA7ZiM=
 github.com/netbirdio/go-netroute v0.0.0-20240611143515-f59b0e1d3944 h1:TDtJKmM6Sf8uYFx/dMeqNOL90KUoRscdfpFZ3Im89uk=
 github.com/netbirdio/go-netroute v0.0.0-20240611143515-f59b0e1d3944/go.mod h1:sHA6TRxjQ6RLbnI+3R4DZo2Eseg/iKiPRfNmcuNySVQ=
-github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51 h1:Ov4qdafATOgGMB1wbSuh+0aAHcwz9hdvB6VZjh1mVMI=
-github.com/netbirdio/ice/v4 v4.0.0-20250908184934-6202be846b51/go.mod h1:ZSIbPdBn5hePO8CpF1PekH2SfpTxg1PDhEwtbqZS7R8=
+github.com/netbirdio/ice/v4 v4.0.0-20250827161942-426799a23107 h1:ZJwhKexMlK15B/Ld+1T8VYE2Mt1lk1kf2DlXr46EHcw=
+github.com/netbirdio/ice/v4 v4.0.0-20250827161942-426799a23107/go.mod h1:ZSIbPdBn5hePO8CpF1PekH2SfpTxg1PDhEwtbqZS7R8=
 github.com/netbirdio/management-integrations/integrations v0.0.0-20250906095204-f87a07690ba0 h1:9BUqQHPVOGr0edk8EifUBUfTr2Ob0ypAPxtasUApBxQ=
 github.com/netbirdio/management-integrations/integrations v0.0.0-20250906095204-f87a07690ba0/go.mod h1:v0nUbbHbuQnqR7yKIYnKzsLBCswLtp2JctmKYmGgVhc=
 github.com/netbirdio/service v0.0.0-20240911161631-f62744f42502 h1:3tHlFmhTdX9axERMVN63dqyFqnvuD+EMJHzM7mNGON8=

infrastructure_files/getting-started-with-zitadel.sh

@@ -328,45 +328,6 @@ delete_auto_service_user() {
   echo "$PARSED_RESPONSE"
 }
 
-delete_default_zitadel_admin() {
-  INSTANCE_URL=$1
-  PAT=$2
-
-  # Search for the default zitadel-admin user
-  RESPONSE=$(
-    curl -sS -X POST "$INSTANCE_URL/management/v1/users/_search" \
-      -H "Authorization: Bearer $PAT" \
-      -H "Content-Type: application/json" \
-      -d '{
-        "queries": [
-          {
-            "userNameQuery": {
-              "userName": "zitadel-admin@",
-              "method": "TEXT_QUERY_METHOD_STARTS_WITH"
-            }
-          }
-        ]
-      }'
-  )
-  
-  DEFAULT_ADMIN_ID=$(echo "$RESPONSE" | jq -r '.result[0].id // empty')
-  
-  if [ -n "$DEFAULT_ADMIN_ID" ] && [ "$DEFAULT_ADMIN_ID" != "null" ]; then
-    echo "Found default zitadel-admin user with ID: $DEFAULT_ADMIN_ID"
-
-    RESPONSE=$(
-        curl -sS -X DELETE "$INSTANCE_URL/management/v1/users/$DEFAULT_ADMIN_ID" \
-          -H "Authorization: Bearer $PAT" \
-          -H "Content-Type: application/json" \
-    )
-    PARSED_RESPONSE=$(echo "$RESPONSE" | jq -r '.details.changeDate // "deleted"')
-    handle_zitadel_request_response "$PARSED_RESPONSE" "delete_default_zitadel_admin" "$RESPONSE"
-
-  else
-    echo "Default zitadel-admin user not found: $RESPONSE"
-  fi
-}
-
 init_zitadel() {
   echo -e "\nInitializing Zitadel with NetBird's applications\n"
   INSTANCE_URL="$NETBIRD_HTTP_PROTOCOL://$NETBIRD_DOMAIN"
@@ -385,9 +346,6 @@ init_zitadel() {
   echo -n "Waiting for Zitadel to become ready "
   wait_api "$INSTANCE_URL" "$PAT"
 
-  echo "Deleting default zitadel-admin user..."
-  delete_default_zitadel_admin "$INSTANCE_URL" "$PAT"
-
   #  create the zitadel project
   echo "Creating new zitadel project"
   PROJECT_ID=$(create_new_project "$INSTANCE_URL" "$PAT")

management/server/policy.go

@@ -167,22 +167,10 @@ func arePolicyChangesAffectPeers(ctx context.Context, transaction store.Store, a
 // validatePolicy validates the policy and its rules.
 func validatePolicy(ctx context.Context, transaction store.Store, accountID string, policy *types.Policy) error {
 	if policy.ID != "" {
-		existingPolicy, err := transaction.GetPolicyByID(ctx, store.LockingStrengthNone, accountID, policy.ID)
+		_, err := transaction.GetPolicyByID(ctx, store.LockingStrengthNone, accountID, policy.ID)
 		if err != nil {
 			return err
 		}
-
-		// TODO: Refactor to support multiple rules per policy
-		existingRuleIDs := make(map[string]bool)
-		for _, rule := range existingPolicy.Rules {
-			existingRuleIDs[rule.ID] = true
-		}
-
-		for _, rule := range policy.Rules {
-			if rule.ID != "" && !existingRuleIDs[rule.ID] {
-				return status.Errorf(status.InvalidArgument, "invalid rule ID: %s", rule.ID)
-			}
-		}
 	} else {
 		policy.ID = xid.New().String()
 		policy.AccountID = accountID

management/server/types/account.go

@@ -302,11 +302,7 @@ func (a *Account) GetPeerNetworkMap(
 		var zones []nbdns.CustomZone
 
 		if peersCustomZone.Domain != "" {
-			records := filterZoneRecordsForPeers(peer, peersCustomZone, peersToConnect)
-			zones = append(zones, nbdns.CustomZone{
-				Domain:  peersCustomZone.Domain,
-				Records: records,
-			})
+			zones = append(zones, peersCustomZone)
 		}
 		dnsUpdate.CustomZones = zones
 		dnsUpdate.NameServerGroups = getPeerNSGroups(a, peerID)
@@ -1655,24 +1651,3 @@ func peerSupportsPortRanges(peerVer string) bool {
 	meetMinVer, err := posture.MeetsMinVersion(firewallRuleMinPortRangesVer, peerVer)
 	return err == nil && meetMinVer
 }
-
-// filterZoneRecordsForPeers filters DNS records to only include peers to connect.
-func filterZoneRecordsForPeers(peer *nbpeer.Peer, customZone nbdns.CustomZone, peersToConnect []*nbpeer.Peer) []nbdns.SimpleRecord {
-	filteredRecords := make([]nbdns.SimpleRecord, 0, len(customZone.Records))
-	peerIPs := make(map[string]struct{})
-
-	// Add peer's own IP to include its own DNS records
-	peerIPs[peer.IP.String()] = struct{}{}
-
-	for _, peerToConnect := range peersToConnect {
-		peerIPs[peerToConnect.IP.String()] = struct{}{}
-	}
-
-	for _, record := range customZone.Records {
-		if _, exists := peerIPs[record.RData]; exists {
-			filteredRecords = append(filteredRecords, record)
-		}
-	}
-
-	return filteredRecords
-}

management/server/types/account_test.go

@@ -2,17 +2,14 @@ package types
 
 import (
 	"context"
-	"fmt"
 	"net"
 	"net/netip"
 	"slices"
 	"testing"
 
-	"github.com/miekg/dns"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	nbdns "github.com/netbirdio/netbird/dns"
 	resourceTypes "github.com/netbirdio/netbird/management/server/networks/resources/types"
 	routerTypes "github.com/netbirdio/netbird/management/server/networks/routers/types"
 	networkTypes "github.com/netbirdio/netbird/management/server/networks/types"
@@ -838,109 +835,3 @@ func Test_NetworksNetMapGenShouldExcludeOtherRouters(t *testing.T) {
 	assert.Len(t, networkResourcesRoutes, 1, "expected network resource route don't match")
 	assert.Len(t, sourcePeers, 2, "expected source peers don't match")
 }
-
-func Test_FilterZoneRecordsForPeers(t *testing.T) {
-	tests := []struct {
-		name            string
-		peer            *nbpeer.Peer
-		customZone      nbdns.CustomZone
-		peersToConnect  []*nbpeer.Peer
-		expectedRecords []nbdns.SimpleRecord
-	}{
-		{
-			name: "empty peers to connect",
-			customZone: nbdns.CustomZone{
-				Domain: "netbird.cloud.",
-				Records: []nbdns.SimpleRecord{
-					{Name: "peer1.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-					{Name: "router.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.100"},
-				},
-			},
-			peersToConnect: []*nbpeer.Peer{},
-			peer:           &nbpeer.Peer{ID: "router", IP: net.ParseIP("10.0.0.100")},
-			expectedRecords: []nbdns.SimpleRecord{
-				{Name: "router.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.100"},
-			},
-		},
-		{
-			name: "multiple peers multiple records match",
-			customZone: nbdns.CustomZone{
-				Domain: "netbird.cloud.",
-				Records: func() []nbdns.SimpleRecord {
-					var records []nbdns.SimpleRecord
-					for i := 1; i <= 100; i++ {
-						records = append(records, nbdns.SimpleRecord{
-							Name:  fmt.Sprintf("peer%d.netbird.cloud", i),
-							Type:  int(dns.TypeA),
-							Class: nbdns.DefaultClass,
-							TTL:   300,
-							RData: fmt.Sprintf("10.0.%d.%d", i/256, i%256),
-						})
-					}
-					return records
-				}(),
-			},
-			peersToConnect: func() []*nbpeer.Peer {
-				var peers []*nbpeer.Peer
-				for _, i := range []int{1, 5, 10, 25, 50, 75, 100} {
-					peers = append(peers, &nbpeer.Peer{
-						ID: fmt.Sprintf("peer%d", i),
-						IP: net.ParseIP(fmt.Sprintf("10.0.%d.%d", i/256, i%256)),
-					})
-				}
-				return peers
-			}(),
-			peer: &nbpeer.Peer{ID: "router", IP: net.ParseIP("10.0.0.100")},
-			expectedRecords: func() []nbdns.SimpleRecord {
-				var records []nbdns.SimpleRecord
-				for _, i := range []int{1, 5, 10, 25, 50, 75, 100} {
-					records = append(records, nbdns.SimpleRecord{
-						Name:  fmt.Sprintf("peer%d.netbird.cloud", i),
-						Type:  int(dns.TypeA),
-						Class: nbdns.DefaultClass,
-						TTL:   300,
-						RData: fmt.Sprintf("10.0.%d.%d", i/256, i%256),
-					})
-				}
-				return records
-			}(),
-		},
-		{
-			name: "peers with multiple DNS labels",
-			customZone: nbdns.CustomZone{
-				Domain: "netbird.cloud.",
-				Records: []nbdns.SimpleRecord{
-					{Name: "peer1.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-					{Name: "peer1-alt.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-					{Name: "peer1-backup.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-					{Name: "peer2.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.2"},
-					{Name: "peer2-service.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.2"},
-					{Name: "peer3.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.3"},
-					{Name: "peer3-alt.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.3"},
-					{Name: "router.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.100"},
-				},
-			},
-			peersToConnect: []*nbpeer.Peer{
-				{ID: "peer1", IP: net.ParseIP("10.0.0.1"), DNSLabel: "peer1", ExtraDNSLabels: []string{"peer1-alt", "peer1-backup"}},
-				{ID: "peer2", IP: net.ParseIP("10.0.0.2"), DNSLabel: "peer2", ExtraDNSLabels: []string{"peer2-service"}},
-			},
-			peer: &nbpeer.Peer{ID: "router", IP: net.ParseIP("10.0.0.100")},
-			expectedRecords: []nbdns.SimpleRecord{
-				{Name: "peer1.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-				{Name: "peer1-alt.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-				{Name: "peer1-backup.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.1"},
-				{Name: "peer2.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.2"},
-				{Name: "peer2-service.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.2"},
-				{Name: "router.netbird.cloud", Type: int(dns.TypeA), Class: nbdns.DefaultClass, TTL: 300, RData: "10.0.0.100"},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := filterZoneRecordsForPeers(tt.peer, tt.customZone, tt.peersToConnect)
-			assert.Equal(t, len(tt.expectedRecords), len(result))
-			assert.ElementsMatch(t, tt.expectedRecords, result)
-		})
-	}
-}

shared/management/client/grpc.go

@@ -17,11 +17,11 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/connectivity"
 
-	nbgrpc "github.com/netbirdio/netbird/client/grpc"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/encryption"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	"github.com/netbirdio/netbird/shared/management/proto"
+	nbgrpc "github.com/netbirdio/netbird/util/grpc"
 )
 
 const ConnectTimeout = 10 * time.Second
@@ -52,7 +52,7 @@ func NewClient(ctx context.Context, addr string, ourPrivateKey wgtypes.Key, tlsE
 
 	operation := func() error {
 		var err error
-		conn, err = nbgrpc.CreateConnection(ctx, addr, tlsEnabled)
+		conn, err = nbgrpc.CreateConnection(addr, tlsEnabled)
 		if err != nil {
 			log.Printf("createConnection error: %v", err)
 			return err

shared/relay/client/dialer/quic/quic.go

@@ -12,7 +12,7 @@ import (
 	log "github.com/sirupsen/logrus"
 
 	quictls "github.com/netbirdio/netbird/shared/relay/tls"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 type Dialer struct {

shared/relay/client/dialer/ws/ws.go

@@ -16,7 +16,7 @@ import (
 
 	"github.com/netbirdio/netbird/shared/relay"
 	"github.com/netbirdio/netbird/util/embeddedroots"
-	nbnet "github.com/netbirdio/netbird/client/net"
+	nbnet "github.com/netbirdio/netbird/util/net"
 )
 
 type Dialer struct {

shared/relay/client/manager.go

@@ -78,10 +78,9 @@ func NewManager(ctx context.Context, serverURLs []string, peerID string, mtu uin
 		tokenStore: tokenStore,
 		mtu:        mtu,
 		serverPicker: &ServerPicker{
-			TokenStore:        tokenStore,
-			PeerID:            peerID,
-			MTU:               mtu,
-			ConnectionTimeout: defaultConnectionTimeout,
+			TokenStore: tokenStore,
+			PeerID:     peerID,
+			MTU:        mtu,
 		},
 		relayClients:            make(map[string]*RelayTrack),
 		onDisconnectedListeners: make(map[string]*list.List),

shared/relay/client/picker.go

@@ -13,8 +13,11 @@ import (
 )
 
 const (
-	maxConcurrentServers     = 7
-	defaultConnectionTimeout = 30 * time.Second
+	maxConcurrentServers = 7
+)
+
+var (
+	connectionTimeout = 30 * time.Second
 )
 
 type connResult struct {
@@ -24,15 +27,14 @@ type connResult struct {
 }
 
 type ServerPicker struct {
-	TokenStore        *auth.TokenStore
-	ServerURLs        atomic.Value
-	PeerID            string
-	MTU               uint16
-	ConnectionTimeout time.Duration
+	TokenStore *auth.TokenStore
+	ServerURLs atomic.Value
+	PeerID     string
+	MTU        uint16
 }
 
 func (sp *ServerPicker) PickServer(parentCtx context.Context) (*Client, error) {
-	ctx, cancel := context.WithTimeout(parentCtx, sp.ConnectionTimeout)
+	ctx, cancel := context.WithTimeout(parentCtx, connectionTimeout)
 	defer cancel()
 
 	totalServers := len(sp.ServerURLs.Load().([]string))

shared/relay/client/picker_test.go

@@ -8,15 +8,15 @@ import (
 )
 
 func TestServerPicker_UnavailableServers(t *testing.T) {
-	timeout := 5 * time.Second
+	connectionTimeout = 5 * time.Second
+
 	sp := ServerPicker{
-		TokenStore:        nil,
-		PeerID:            "test",
-		ConnectionTimeout: timeout,
+		TokenStore: nil,
+		PeerID:     "test",
 	}
 	sp.ServerURLs.Store([]string{"rel://dummy1", "rel://dummy2"})
 
-	ctx, cancel := context.WithTimeout(context.Background(), timeout+1)
+	ctx, cancel := context.WithTimeout(context.Background(), connectionTimeout+1)
 	defer cancel()
 
 	go func() {

shared/relay/healthcheck/env.go

@@ -1,24 +0,0 @@
-package healthcheck
-
-import (
-	"os"
-	"strconv"
-
-	log "github.com/sirupsen/logrus"
-)
-
-const (
-	defaultAttemptThresholdEnv = "NB_RELAY_HC_ATTEMPT_THRESHOLD"
-)
-
-func getAttemptThresholdFromEnv() int {
-	if attemptThreshold := os.Getenv(defaultAttemptThresholdEnv); attemptThreshold != "" {
-		threshold, err := strconv.ParseInt(attemptThreshold, 10, 64)
-		if err != nil {
-			log.Errorf("Failed to parse attempt threshold from environment variable \"%s\" should be an integer. Using default value", attemptThreshold)
-			return defaultAttemptThreshold
-		}
-		return int(threshold)
-	}
-	return defaultAttemptThreshold
-}

shared/relay/healthcheck/env_test.go

@@ -1,36 +0,0 @@
-package healthcheck
-
-import (
-	"os"
-	"testing"
-)
-
-//nolint:tenv
-func TestGetAttemptThresholdFromEnv(t *testing.T) {
-	tests := []struct {
-		name     string
-		envValue string
-		expected int
-	}{
-		{"Default attempt threshold when env is not set", "", defaultAttemptThreshold},
-		{"Custom attempt threshold when env is set to a valid integer", "3", 3},
-		{"Default attempt threshold when env is set to an invalid value", "invalid", defaultAttemptThreshold},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.envValue == "" {
-				os.Unsetenv(defaultAttemptThresholdEnv)
-			} else {
-				os.Setenv(defaultAttemptThresholdEnv, tt.envValue)
-			}
-
-			result := getAttemptThresholdFromEnv()
-			if result != tt.expected {
-				t.Fatalf("Expected %d, got %d", tt.expected, result)
-			}
-
-			os.Unsetenv(defaultAttemptThresholdEnv)
-		})
-	}
-}

shared/relay/healthcheck/receiver.go

@@ -7,15 +7,10 @@ import (
 	log "github.com/sirupsen/logrus"
 )
 
-const (
-	defaultHeartbeatTimeout = defaultHealthCheckInterval + 10*time.Second
+var (
+	heartbeatTimeout = healthCheckInterval + 10*time.Second
 )
 
-type ReceiverOptions struct {
-	HeartbeatTimeout time.Duration
-	AttemptThreshold int
-}
-
 // Receiver is a healthcheck receiver
 // It will listen for heartbeat and check if the heartbeat is not received in a certain time
 // If the heartbeat is not received in a certain time, it will send a timeout signal and stop to work
@@ -32,23 +27,6 @@ type Receiver struct {
 
 // NewReceiver creates a new healthcheck receiver and start the timer in the background
 func NewReceiver(log *log.Entry) *Receiver {
-	opts := ReceiverOptions{
-		HeartbeatTimeout: defaultHeartbeatTimeout,
-		AttemptThreshold: getAttemptThresholdFromEnv(),
-	}
-	return NewReceiverWithOpts(log, opts)
-}
-
-func NewReceiverWithOpts(log *log.Entry, opts ReceiverOptions) *Receiver {
-	heartbeatTimeout := opts.HeartbeatTimeout
-	if heartbeatTimeout <= 0 {
-		heartbeatTimeout = defaultHeartbeatTimeout
-	}
-	attemptThreshold := opts.AttemptThreshold
-	if attemptThreshold <= 0 {
-		attemptThreshold = defaultAttemptThreshold
-	}
-
 	ctx, ctxCancel := context.WithCancel(context.Background())
 
 	r := &Receiver{
@@ -57,10 +35,10 @@ func NewReceiverWithOpts(log *log.Entry, opts ReceiverOptions) *Receiver {
 		ctx:              ctx,
 		ctxCancel:        ctxCancel,
 		heartbeat:        make(chan struct{}, 1),
-		attemptThreshold: attemptThreshold,
+		attemptThreshold: getAttemptThresholdFromEnv(),
 	}
 
-	go r.waitForHealthcheck(heartbeatTimeout)
+	go r.waitForHealthcheck()
 	return r
 }
 
@@ -77,7 +55,7 @@ func (r *Receiver) Stop() {
 	r.ctxCancel()
 }
 
-func (r *Receiver) waitForHealthcheck(heartbeatTimeout time.Duration) {
+func (r *Receiver) waitForHealthcheck() {
 	ticker := time.NewTicker(heartbeatTimeout)
 	defer ticker.Stop()
 	defer r.ctxCancel()

shared/relay/healthcheck/receiver_test.go

@@ -2,18 +2,31 @@ package healthcheck
 
 import (
 	"context"
+	"fmt"
+	"os"
+	"sync"
 	"testing"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 )
 
-func TestNewReceiver(t *testing.T) {
+// Mutex to protect global variable access in tests
+var testMutex sync.Mutex
 
-	opts := ReceiverOptions{
-		HeartbeatTimeout: 5 * time.Second,
-	}
-	r := NewReceiverWithOpts(log.WithContext(context.Background()), opts)
+func TestNewReceiver(t *testing.T) {
+	testMutex.Lock()
+	originalTimeout := heartbeatTimeout
+	heartbeatTimeout = 5 * time.Second
+	testMutex.Unlock()
+
+	defer func() {
+		testMutex.Lock()
+		heartbeatTimeout = originalTimeout
+		testMutex.Unlock()
+	}()
+
+	r := NewReceiver(log.WithContext(context.Background()))
 	defer r.Stop()
 
 	select {
@@ -25,10 +38,18 @@ func TestNewReceiver(t *testing.T) {
 }
 
 func TestNewReceiverNotReceive(t *testing.T) {
-	opts := ReceiverOptions{
-		HeartbeatTimeout: 1 * time.Second,
-	}
-	r := NewReceiverWithOpts(log.WithContext(context.Background()), opts)
+	testMutex.Lock()
+	originalTimeout := heartbeatTimeout
+	heartbeatTimeout = 1 * time.Second
+	testMutex.Unlock()
+
+	defer func() {
+		testMutex.Lock()
+		heartbeatTimeout = originalTimeout
+		testMutex.Unlock()
+	}()
+
+	r := NewReceiver(log.WithContext(context.Background()))
 	defer r.Stop()
 
 	select {
@@ -40,10 +61,18 @@ func TestNewReceiverNotReceive(t *testing.T) {
 }
 
 func TestNewReceiverAck(t *testing.T) {
-	opts := ReceiverOptions{
-		HeartbeatTimeout: 2 * time.Second,
-	}
-	r := NewReceiverWithOpts(log.WithContext(context.Background()), opts)
+	testMutex.Lock()
+	originalTimeout := heartbeatTimeout
+	heartbeatTimeout = 2 * time.Second
+	testMutex.Unlock()
+
+	defer func() {
+		testMutex.Lock()
+		heartbeatTimeout = originalTimeout
+		testMutex.Unlock()
+	}()
+
+	r := NewReceiver(log.WithContext(context.Background()))
 	defer r.Stop()
 
 	r.Heartbeat()
@@ -68,19 +97,30 @@ func TestReceiverHealthCheckAttemptThreshold(t *testing.T) {
 
 	for _, tc := range testsCases {
 		t.Run(tc.name, func(t *testing.T) {
-			healthCheckInterval := 1 * time.Second
+			testMutex.Lock()
+			originalInterval := healthCheckInterval
+			originalTimeout := heartbeatTimeout
+			healthCheckInterval = 1 * time.Second
+			heartbeatTimeout = healthCheckInterval + 500*time.Millisecond
+			testMutex.Unlock()
 
-			opts := ReceiverOptions{
-				HeartbeatTimeout: healthCheckInterval + 500*time.Millisecond,
-				AttemptThreshold: tc.threshold,
-			}
+			defer func() {
+				testMutex.Lock()
+				healthCheckInterval = originalInterval
+				heartbeatTimeout = originalTimeout
+				testMutex.Unlock()
+			}()
+			//nolint:tenv
+			os.Setenv(defaultAttemptThresholdEnv, fmt.Sprintf("%d", tc.threshold))
+			defer os.Unsetenv(defaultAttemptThresholdEnv)
 
-			receiver := NewReceiverWithOpts(log.WithField("test_name", tc.name), opts)
+			receiver := NewReceiver(log.WithField("test_name", tc.name))
 
-			testTimeout := opts.HeartbeatTimeout*time.Duration(tc.threshold) + healthCheckInterval
+			testTimeout := heartbeatTimeout*time.Duration(tc.threshold) + healthCheckInterval
 
 			if tc.resetCounterOnce {
 				receiver.Heartbeat()
+				t.Logf("reset counter once")
 			}
 
 			select {
@@ -94,6 +134,7 @@ func TestReceiverHealthCheckAttemptThreshold(t *testing.T) {
 				}
 				t.Fatalf("should have timed out before %s", testTimeout)
 			}
+
 		})
 	}
 }

shared/relay/healthcheck/sender.go

@@ -2,76 +2,52 @@ package healthcheck
 
 import (
 	"context"
+	"os"
+	"strconv"
 	"time"
 
 	log "github.com/sirupsen/logrus"
 )
 
 const (
-	defaultAttemptThreshold = 1
-
-	defaultHealthCheckInterval = 25 * time.Second
-	defaultHealthCheckTimeout  = 20 * time.Second
+	defaultAttemptThreshold    = 1
+	defaultAttemptThresholdEnv = "NB_RELAY_HC_ATTEMPT_THRESHOLD"
 )
 
-type SenderOptions struct {
-	HealthCheckInterval time.Duration
-	HealthCheckTimeout  time.Duration
-	AttemptThreshold    int
-}
+var (
+	healthCheckInterval = 25 * time.Second
+	healthCheckTimeout  = 20 * time.Second
+)
 
 // Sender is a healthcheck sender
 // It will send healthcheck signal to the receiver
 // If the receiver does not receive the signal in a certain time, it will send a timeout signal and stop to work
 // It will also stop if the context is canceled
 type Sender struct {
+	log *log.Entry
 	// HealthCheck is a channel to send health check signal to the peer
 	HealthCheck chan struct{}
 	// Timeout is a channel to the health check signal is not received in a certain time
 	Timeout chan struct{}
 
-	log                 *log.Entry
-	healthCheckInterval time.Duration
-	timeout             time.Duration
-
 	ack              chan struct{}
 	alive            bool
 	attemptThreshold int
 }
 
-func NewSenderWithOpts(log *log.Entry, opts SenderOptions) *Sender {
-	if opts.HealthCheckInterval <= 0 {
-		opts.HealthCheckInterval = defaultHealthCheckInterval
-	}
-	if opts.HealthCheckTimeout <= 0 {
-		opts.HealthCheckTimeout = defaultHealthCheckTimeout
-	}
-	if opts.AttemptThreshold <= 0 {
-		opts.AttemptThreshold = defaultAttemptThreshold
-	}
+// NewSender creates a new healthcheck sender
+func NewSender(log *log.Entry) *Sender {
 	hc := &Sender{
-		HealthCheck:         make(chan struct{}, 1),
-		Timeout:             make(chan struct{}, 1),
-		log:                 log,
-		healthCheckInterval: opts.HealthCheckInterval,
-		timeout:             opts.HealthCheckInterval + opts.HealthCheckTimeout,
-		ack:                 make(chan struct{}, 1),
-		attemptThreshold:    opts.AttemptThreshold,
+		log:              log,
+		HealthCheck:      make(chan struct{}, 1),
+		Timeout:          make(chan struct{}, 1),
+		ack:              make(chan struct{}, 1),
+		attemptThreshold: getAttemptThresholdFromEnv(),
 	}
 
 	return hc
 }
 
-// NewSender creates a new healthcheck sender
-func NewSender(log *log.Entry) *Sender {
-	opts := SenderOptions{
-		HealthCheckInterval: defaultHealthCheckInterval,
-		HealthCheckTimeout:  defaultHealthCheckTimeout,
-		AttemptThreshold:    getAttemptThresholdFromEnv(),
-	}
-	return NewSenderWithOpts(log, opts)
-}
-
 // OnHCResponse sends an acknowledgment signal to the sender
 func (hc *Sender) OnHCResponse() {
 	select {
@@ -81,10 +57,10 @@ func (hc *Sender) OnHCResponse() {
 }
 
 func (hc *Sender) StartHealthCheck(ctx context.Context) {
-	ticker := time.NewTicker(hc.healthCheckInterval)
+	ticker := time.NewTicker(healthCheckInterval)
 	defer ticker.Stop()
 
-	timeoutTicker := time.NewTicker(hc.timeout)
+	timeoutTicker := time.NewTicker(hc.getTimeoutTime())
 	defer timeoutTicker.Stop()
 
 	defer close(hc.HealthCheck)
@@ -116,3 +92,19 @@ func (hc *Sender) StartHealthCheck(ctx context.Context) {
 		}
 	}
 }
+
+func (hc *Sender) getTimeoutTime() time.Duration {
+	return healthCheckInterval + healthCheckTimeout
+}
+
+func getAttemptThresholdFromEnv() int {
+	if attemptThreshold := os.Getenv(defaultAttemptThresholdEnv); attemptThreshold != "" {
+		threshold, err := strconv.ParseInt(attemptThreshold, 10, 64)
+		if err != nil {
+			log.Errorf("Failed to parse attempt threshold from environment variable \"%s\" should be an integer. Using default value", attemptThreshold)
+			return defaultAttemptThreshold
+		}
+		return int(threshold)
+	}
+	return defaultAttemptThreshold
+}