# Netrinos Edge v1.3.2 Release Notes

**Release Date**: 2026-05-20

## Overview

Version 1.3.2 adds a port-forwards CLI, broader distro coverage
(RPM), Kubernetes-friendly firewall rules, and a working
in-place upgrade from the Settings page.

## Port forwards CLI

New `netrinos forwards` command for full port-forward CRUD from
the Edge CLI. Run `netrinos forwards help` for syntax. Identical
effect to the web UI.

## Web UI upgrade

The **Upgrade** button on the Settings page now works directly:
survives the service restart, auto-reloads with status, and shows
a completion message. The CLI path (`netrinos upgrade`) works
equivalently.

## Platform support

- **RHEL / CentOS / Fedora**: RPM package added (CLI-only on RHEL
  9; GUI requires webkit2gtk 4.1).
- **arm64**: continues to be supported; the v1.3.2 build also
  surfaces a desktop GUI on arm64 client builds.
- **Installer dependencies**: the Edge deb now declares
  `wireguard`, `wireguard-tools`, `nftables`, `traceroute`, and
  `nmap` so apt installs them automatically.

## Web UI

- **Virtual Devices page**: full add / remove + network-scan flow.
- **Devices menu**: new top-nav entry.

## Connection reliability

- **Kubernetes safety**: Calico, MicroK8s, and kubeadm hosts work
  out of the box. Previously a Calico firewall rule could
  silently drop Netrinos traffic, and our own rules could wipe
  kube-proxy rules during install.
- **Better DPI handling**: when cloak is enabled, WireGuard
  traffic is disguised as a real QUIC session. Defeats
  FortiGate-class firewalls that previously blocked new
  connections and killed long-lived ones after 30 to 40 minutes.
- **NAT pinhole auto-recovery**: stuck relay connections behind
  aggressive firewalls now recover automatically.
- **Faster peer discovery**: 1-2 second probe timeouts on
  consumer routers are eliminated.

## CLI

- **`netrinos forwards`**: port-forward CRUD.
- **`netrinos id`/`ida`/`idp`**: cleaner tables plus SecureIP,
  Version, and Caps columns for diagnostics.

Type `netrinos <command> help` for full syntax on any command.

## Fixes

- Fixed: port-forward DNAT rules could be lost when the firewall
  rebuilt mid-session; forwards now repopulate after every
  rebuild.
- Fixed: port forwards now show up in the Netrinos portal.
- Fixed: `netrinos doctor` no longer reports "Firewall: MISSING"
  on Debian / RHEL / Fedora.
- Fixed: relay-host WireGuard routes no longer flap during
  connection testing.
- Fixed: ACL changes from CLI and portal no longer race the
  periodic sync.
- Fixed: large networks (hundreds of peers) no longer drop probe
  results from an undersized internal queue.
- Fixed: `netrinos log clear` is now a real log rotation.
- Fixed: Netrinos runs cleanly on NVIDIA Jetson and similar
  embedded Linux kernels.

## Compatibility

- Works with v1.2.4, v1.2.5, v1.2.6, v1.3.0, and v1.3.1 clients.
- Some features (cloak direct path, faster peer identity check)
  need both peers on v1.3.1 or newer with a recent build. Older
  peers fall back transparently.
- No configuration changes required for non-cloak users.

## Updating

Use the **Upgrade** button on the Settings page, or:

```bash
netrinos upgrade
```