netmaker

Netmaker v1.6.0 Release Notes 🚀

🚀 What’s New

🔁 Site-to-Site ACLs (Beta)

Using Netmaker's Egress function at local sites, paired with local routing rules, you can bridge entire networks (site-to-site). Now, Netmaker allows you to define ACL policies that control what traffic is allowed between these sites.

• Build site-to-site rules between egress resources on different networks.
• Combine egress resources, nodes, and specific IPs in a single policy.

🛡️ Egress ACLs with IP Restriction

Netmaker's Egress function forwards traffic to external networks like offices and data centres. Netmaker's Access Controls can now target individual IPs inside of an egress range using the ip ACL target type. This enables you to limit access to specific IPs within an external network.

• Restrict access to specific endpoints within a larger egress CIDR.
• Combine egress resources, nodes, tags, and individual IPs in the same policy.

📦 Egress Applications Catalogue (Beta)

Simplified application-aware egress routing with a built-in catalogue of popular SaaS and cloud services.

• Select from a catalogue of applications, including AWS, Google Cloud, Microsoft 365, Salesforce, GitHub, etc.
• Create egress resources directly from predefined application templates without manually managing domain lists.
• Automatically resolve and maintain application domains, ensuring routing policies stay up to date as services evolve.
• Reduce administrative overhead and improve policy consistency across environments.

⏱️ JIT Group Memberships

Just-In-Time (JIT) access is a workflow within Netmaker where users request temporary access to the network, which is approved by administrators for a predefined time period. JIT access within Netmaker can now be scoped to user groups per network.

• Enable JIT for all non-admin users, or limit it to selected user groups.
• Users request access; admins approve or deny with email notifications.
• Expired grants are cleaned up automatically, and users are notified.

🔗 SIEM Integration

Netmaker provides audit logs of actions and events on the platform. Netmaker can now be integrated with certain providers to forward audit events to your security stack.

• Supported providers: Splunk, Datadog, Elastic, and Microsoft Sentinel.
• Events are exported through the SIEM exporter service.

🔑 Default Enrollment Keys

Enrollment keys are how devices join the network via Netclient. Administrators can now designate a default enrollment key for any network in order to simplify device onboarding.

• Set default enrollment keys per network.
• Regenerate key tokens without recreating the key.

---

🗄️ Database Schema Migration

This release introduces schema changes to the following core entities:

• Nodes
• Pending Users
• User Invites
• Posture Check Violations

Impact:

• The database structure will be updated automatically during the upgrade.
• Downgrades may not be supported after migration.

👉 Action Required:

• Ensure the application starts successfully and migrations are complete.
• Validate core functionality post-upgrade.

For detailed upgrade steps, refer to the official upgrade documentation:

Server Upgrades v1.5.1+

---

🧰 Improvements & Fixes

• Netclient registration UX — Host registration over OAuth/basic auth now returns clear websocket close reasons on failure (auth errors, missing access, posture violations, and server errors).

• User group management — Streamlined user role permissions and group updates, role-downgrade handling.

• Orphan reference cleanup — Removes stale network references left behind after resource deletion.

• Scalability & reliability — Optimised node status calculation, offline-status hooks, zom

Netmaker v1.5.1 Release Notes 🚀

⚠️ Migration Notes (Important)

These changes may impact existing deployments. Please review carefully before upgrading.

❗Legacy ACLs Removal

Legacy ACLs have been fully removed as part of the transition to the new access control model.

Impact:

• Existing configurations using legacy ACLs will no longer function
• Access behaviour may change after the upgrade

👉 Action Required:

• Review existing access policies
• Reconfigure them using the new access control model before upgrading

🗄️ Database Schema Migration

This release introduces schema changes to the following core entities:

• Users
• Groups
• Roles
• Networks
• Hosts

Impact:

• The database structure will be updated automatically during the upgrade
• Downgrades may not be supported after migration.

👉 Action Required:

• Ensure the application starts successfully and migrations are complete
• Validate core functionality post-upgrade

For detailed upgrade steps, refer to the official upgrade documentation:

Server Upgrades v1.5.1+

---

🚀 What’s New

🔁 Traffic Logs (Beta)

Traffic Logs have now moved into Beta.

• Traffic Logs are now enriched with relevant domain tagging, making network activity easier to audit and investigate.

---

🧰 Improvements & Fixes

• Scalability & Reliability Improvements Introduced a peer update debouncer that coalesces rapid-fire PublishPeerUpdate calls into a single broadcast — a 500ms resettable debounce window capped by a 3s max-wait deadline ensures back-to-back operations (bulk node updates, gateway changes, host deletions) produce one peer update instead of dozens, drastically reducing CPU and MQTT pressure on the control plane

  Pre-warms peer update caches after each debounced broadcast so pull requests from hosts are served instantly from cache instead of triggering expensive on-demand computation

  Batched metrics export to netmaker exporter via periodic ticker instead of publishing on every individual MQTT metrics message, reducing continuous CPU pressure from Prometheus scraping

• Database Schema Migration
  Added schema migrations for the Users, Groups, Roles, Networks, and Hosts tables.

• Deprecated Legacy ACLs
  Legacy ACLs have been fully removed as part of the platform’s transition to the updated access control model.

• Paginated APIs
  Introduced pagination support for Users and Hosts APIs.

• DNS
  Added native Active Directory support.

• Posture Checks
  Nodes can now skip the auto-update check during join, improving join reliability in controlled environments.

• IDP Sync
  Improved identity provider sync behavior:

  • Synced IDP groups are now denied access by default until explicitly granted.
  • Okta-specific settings are now reset when an IDP integration is removed.

• HA Setup
  Streamlined high availability (HA) setup and operational workflows.

• Install Script
  Added on-demand Monitoring Stack installation support via:
  ./nm-quick.sh -m

• Monitoring Stack
  Updated the monitoring stack to use the official Prometheus and Grafana images.

• HA Gateways Reset Auto Assigned gw when it is disconnected from the network.

---

🐞 Known Issues

• IPv6-only machines
  Netclients cannot currently auto-upgrade on IPv6-only systems.

• Multi-network join performance
  Multi-network netclient joins using an enrollment key still require optimization.

• systemd-resolved DNS limitation
  On systems using systemd-resolved in uplink mode, only the first 3 entries in resolv.conf are honored; additional entries are ignored. This may c

Netmaker v1.5.0 Release Notes 🚀

🚀 What’s New

🔓 Just-In-Time Access (beta)

• Time-limited, on-demand network access: users request access, admins approve or deny, and grants expire automatically.

• Request/approval workflow with configurable grant duration; admins retain full control over who accesses which networks and when.

🔁 Overlapping Egress Ranges (beta)

• Virtual NAT mode enables multiple egress routers to share overlapping IP ranges by assigning each egress a virtual range from a configurable pool.
• Configurable per-network IPv4 pool and site prefix length for virtual range allocation.
• Eliminates routing conflicts when multiple sites need to egress the same destination CIDRs (e.g., multiple offices routing to the same cloud VPC).
• Supports both direct NAT and virtual NAT modes for flexible egress configurations.

🌍 Gateway Monitoring

• Desktop App connections automatically fail over to healthy gateway hubs when the primary becomes unavailable.
• Gateway health is monitored via connectivity checks and last-seen metrics; only online gateways are used for new connections.

🧰 Improvements & Fixes

• IP Detection Interval User can now choose the Device Endpoint IP detection interval based on their requirements.

• User Migration: Optimized user migration logic to reduce server startup time.

• DNS: Use Global Nameservers only if no match-all nameservers are configured, added fallback nameserver configuration.

• Darwin: Netclients on macOS can now use internet gateway.

• GeoLocation: Consolidate IP location API usage with fallbacks

Known Issues 🐞

• netclients cannot auto-upgrade on ipv6-only machines.

• Need to optimize multi-network netclient join with enrollment key

• On systems using systemd-resolved in uplink mode, the first 3 entries in resolv.conf are used and rest are ignored. So it might cause DNS issues. Stub mode is preferred.

• When a Windows desktop app is connected to a Full Tunnel Gateway, and a Split Tunnel Gateway at the same time, the gateway monitoring component would disconnect from the split tunnel gateway.

Netmaker v1.4.0 Release Notes 🚀

🚀 What’s New

🌍 Posture Checks (beta)

• Security feature that validates device compliance against configured policies based on device attributes such as OS, OS version, kernel version, client version, geographic location, and auto-update status.
• Supports tag-based and user group-based assignment of posture checks to specific devices or users.
• Tracks violations with configurable severity levels and provides real-time evaluation of device compliance.
• Helps ensure only compliant devices can access network resources.

🔁 Network Traffic Logging (alpha)

• Comprehensive network flow logging system that captures and stores network traffic metadata.
• Tracks source and destination IPs, ports, protocols, bytes/packets sent/received, and connection timestamps.
• Provides API endpoints for querying flow data with filters by network, node, user, protocol, and time range.
• Enables network administrators to monitor, analyze, and audit network traffic patterns for security and troubleshooting purposes.

🌐 K8s Operator with Cluster Access, Egress and Ingress functionality (beta)

• Cluster Egress: Expose Netmaker network services to Kubernetes workloads using standard Service names.
• Cluster Ingress: Expose Kubernetes services to devices on your Netmaker network.
• API Proxy: Secure access to Kubernetes API servers through Netmaker tunnels with RBAC support.

🔄 Auto Removal of Offline Peers

• Automatically removes nodes that have been offline for a configurable threshold period.
• Configurable per network with customizable timeout thresholds (in minutes).
• Supports tag-based filtering to selectively apply auto-removal to specific device groups.
• Helps maintain clean network topology by removing stale or abandoned peer connections.

🧩 Onboarding Flow

• Streamlined user onboarding experience during signup for workspace setup.

🧰 Improvements & Fixes

• Azure IDP sync: Fixed User sync by group filters.

• User Migration: Optimised User migration logic to reduce server start up time.

• Config Files: Avoid Auto enabling of configs on user login.

• Egress Domain Updates: Fixed domain-related issues in egress configurations to ensure consistent routing behavior.

Known Issues 🐞

• netclients cannot auto-upgrade on ipv6-only machines.

• Need to optimize multi-network netclient join with enrollment key

• On systems using systemd-resolved in uplink mode, the first 3 entries in resolv.conf are used and rest are ignored. So it might cause DNS issues. Stub mode is preferred.