Netrinos Edge v1.3.3 Release Notes

Overview

Version 1.3.3 lets a technician log an Edge device in to its network account from the browser, so a box can be commissioned without shell access. It also carries the mesh reliability work of the 1.3.3 client: faster reconnection after restarts, a workaround for stale router state, quiet relayed connections, and software updates pushed from the portal. Route handling through an Edge is refined, and an Edge works alongside other firewalls on its host without manual rules.

Web UI: device login from the browser

Settings > Network Account logs the device in or out of its Netrinos account, the same operation as netrinos login on the command line. The technician’s own web UI session is separate and stays open. Logging out asks for confirmation because it stops the tunnel.

Clearer login error messages. Both the technician login and the device login now distinguish wrong credentials, no internet, server unreachable, and a server error.

Connection reliability

Improved reliability on cellular modems and other links with smaller packet limits. Tunnel packets are now sized to pass through them without fragmentation, so an Edge on a cellular connection carries camera and device traffic whole. The size can be adjusted per device from the portal or with netrinos mtu.

Works around stale NAT mappings on a few consumer routers. Certain residential gateway models age out one direction of a long-lived connection. An Edge device now recognizes that condition and re-establishes its connection on its own; other devices follow automatically. Port forwards and virtual devices are unaffected.

Restarted devices are reachable in seconds. Other devices learn a restarted Edge device’s new address as soon as it is back, and the device accepts connections the moment its tunnel is up.

Back on the mesh within seconds of a network outage. A device whose connection comes back retries in seconds instead of waiting for the next scheduled check.

Quiet relayed connections, coordinated hole punching between 1.3.3 peers, and verified same-LAN detection, as in the 1.3.3 client.

Portal integration

Virtual device LAN addresses are reported to the portal, so an inventory can show the LAN device behind each virtual device.

Account service ports defined on the portal’s Service Ports page are recognized when a virtual device is added, so a device running an application your account uses gets the right quick access service. Devices also advertise only the services peers can reach.

A virtual device whose target does not answer is marked in netrinos vdev, and netrinos vdev add says so at once.

Pushed commands from the portal now include log send, wgport and retest, so support can retrieve a device’s log, change its public port, or clear its connection back-off without logging in.

Alerts

Webhooks support multiple destinations, each with its own device-type filter and API key: netrinos alerts-webhook add <url> <types> [apikey] and netrinos alerts-webhook remove <n> replace the single-URL commands. Existing configuration migrates automatically. Device types accept “Edge” and are matched case-insensitively.

Offline alerts cover powered-off devices.

Software updates

Updates pushed from the portal complete in one step. netrinos upgrade says when a restart is still needed to finish an update.

Updates are verified before they are installed. The download is checked, then installed by the package manager, which also handles a downgrade (netrinos upgrade 1.3.2).

Web UI Upgrade button works as in 1.3.2.

Diagnostics

netrinos doctor checks for a host firewall that blocks inbound mesh traffic or the traffic the Edge forwards, and firewalld’s zones, and prints the commands that fix each for the firewall in use. It also checks the loopback path that Kubernetes hosts manage, every minute, and restores the Kubernetes exception on its own.

Log timestamps are UTC with milliseconds, so device logs line up with each other and with support captures.

Platform support

Kubernetes hosts (Calico, MicroK8s, kubeadm): the firewall exception Netrinos needs is re-checked every minute and survives a Kubernetes restart.

Linux without the WireGuard kernel module uses the bundled userspace implementation automatically.

Works alongside other firewalls on the host (Docker, ufw, firewalld, or a ruleset of your own). Where one would block the Edge’s port forwards, virtual devices or routes, the Edge adds an exception for Netrinos’ own tunnel and port only, logs it, and keeps it in place.

Fixes

Refined route handling for devices that route traffic through an Edge.

Setting a static IP address in the web UI keeps the Edge’s network identity, so a DHCP reservation or port forward pointing at it continues to match.

Web UI login messages name the server entered.

Port forwards and virtual device rules are preserved through the device’s automatic port change.

A virtual device deleted and re-added within the same minute is kept.

Switching the device to another server logs it out of the previous one.

netrinos doctor run without sudo no longer reports a warning for the firewall check it cannot make; it names the command that can.

netrinos upgrade