Netmaker v1.6.0 Release Notes 🚀
🚀 What’s New
🔁 Site-to-Site ACLs (Beta)
Define ACL policies that permit traffic between egress endpoints across networks.
- Build site-to-site rules between egress resources on different networks.
- Combine egress resources, nodes, and specific IPs in a single policy.
- Site-to-site rules are emitted alongside device-mesh rules without key collisions.
🛡️ Egress ACLs with IP Restriction
ACL policies can now target individual IPs inside an egress range using the ip ACL target type.
- Restrict access to specific hosts within a larger egress CIDR.
- Validate that selected IPs fall within the referenced egress range at policy create/update time.
- Mix egress resources, nodes, tags, and individual IPs in the same policy.
📦 Egress Preset Catalog (Pro)
A built-in catalog simplifies domain-based egress for common SaaS and cloud providers.
- Browse presets via
GET /api/v1/egress/presets(AWS, Azure, Google, Salesforce, and more). - Create egress resources from a
preset_id; the server can resolve AWS IP ranges automatically. - Support for multiple domains per egress resource.
⏱️ JIT Group Memberships
Just-In-Time (JIT) access can now be scoped to user groups per network.
- Enable JIT for all non-admin users, or limit it to selected user groups.
- Users request access; admins approve or deny with email notifications.
- Expired grants are cleaned up automatically and users are notified.
🔗 SIEM Integration
Forward Netmaker audit events to your security stack from Integrations.
- Supported providers: Splunk, Datadog, Elastic, and Microsoft Sentinel.
- Configure, test, and manage integrations via the REST API (
/api/v1/integrations/siem/{provider}). - Events are exported through the SIEM exporter service.
🔑 Default Enrollment Keys
Networks can designate a default enrollment key for simplified device onboarding.
- Fetch the default key per network via the API or CLI.
- Regenerate enrollment key tokens without recreating the key.
🗄️ Database Schema Migration
This release introduces schema changes to the following core entities:
- Nodes
- Pending Users
- User Invites
- Posture Check Violations
Impact:
- The database structure will be updated automatically during the upgrade.
- Downgrades may not be supported after migration.
👉 Action Required:
- Ensure the application starts successfully and migrations are complete.
- Validate core functionality post-upgrade.
For detailed upgrade steps, refer to the official upgrade documentation:
🧰 Improvements & Fixes
-
Netclient registration UX — Host registration over OAuth/basic auth now returns clear websocket close reasons on failure (auth errors, missing access, posture violations, and server errors).
-
User group management — Streamlined user role permissions and group updates, role-downgrade handling.
-
Orphan reference cleanup — Removes stale network references left behind after resource deletion.
-
Scalability & reliability — Optimized node status calculation, offline-status hooks, zombie/orphan node cleanup, and ACL cache race fixes.
-
API hardening — Auth rate limiting on REST endpoints and activity-log permission fixes.
-
Egress improvements — CIDR validation for ACL egress IPs, multi-domain egress routing, and domain-answer handling for preset-based egress.
-
Failover removed — Legacy per-node failover APIs and CLI commands have been removed in favor of gateway-based patterns.
🐞 Known Issues
-
IPv6-only machines
Netclients cannot currently auto-upgrade on IPv6-only systems. -
Multi-network join performance
Multi-network netclient joins using an enrollment key still require optimization. -
systemd-resolved DNS limitation
On systems using systemd-resolved in uplink mode, only the first 3 entries inresolv.confare honored; additional entries are ignored. This may cause DNS resolution issues. Stub mode is recommended. -
Windows Desktop App + mixed gateway modes
When the Windows Desktop App is connected to both:- a Full Tunnel Gateway, and
- a Split Tunnel Gateway
the gateway monitoring component may disconnect from the Split Tunnel Gateway.