# Netrinos Edge v1.3.3 Release Notes

**Release Date**: 2026-10-03\
**Build**: b261003.1043

## Overview

Version 1.3.3 lets a technician log an Edge device in to its network
account from the browser, so a box can be commissioned without shell
access. It also carries the mesh reliability work of the 1.3.3
client: faster reconnection after restarts, a workaround for stale
router state, quiet relayed connections, and software updates pushed
from the portal. Route handling through an Edge is refined, and an
Edge works alongside other firewalls on its host without manual
rules.

## Web UI: device login from the browser

- **Settings > Network Account** logs the device in or out of its
  Netrinos account, the same operation as `netrinos login` on the
  command line. The technician's own web UI session is separate and
  stays open. Logging out asks for confirmation because it stops the
  tunnel.
- **Clearer login error messages.** Both the technician login and
  the device login now distinguish wrong credentials, no internet,
  server unreachable, and a server error.

## Connection reliability

- **Improved reliability on cellular modems and other links with
  smaller packet limits.** Tunnel packets are now sized to pass
  through them without fragmentation, so an Edge on a cellular
  connection carries camera and device traffic whole. The size can
  be adjusted per device from the portal or with `netrinos mtu`.
- **Works around stale NAT mappings on a few consumer routers.**
  Certain residential gateway models age out one direction of a
  long-lived connection. An Edge device now recognizes that
  condition and re-establishes its connection on its own; other
  devices follow automatically. Port forwards and virtual devices
  are unaffected.
- **Restarted devices are reachable in seconds.** Other devices
  learn a restarted Edge device's new address as soon as it is back,
  and the device accepts connections the moment its tunnel is up.
- **Back on the mesh within seconds of a network outage.** A device
  whose connection comes back retries in seconds instead of waiting
  for the next scheduled check.
- **Quiet relayed connections**, **coordinated hole punching**
  between 1.3.3 peers, and **verified same-LAN detection**, as in the
  1.3.3 client.

## Portal integration

- **Virtual device LAN addresses** are reported to the portal, so an
  inventory can show the LAN device behind each virtual device.
- **Account service ports** defined on the portal's Service Ports
  page are recognized when a virtual device is added, so a device
  running an application your account uses gets the right quick
  access service. Devices also advertise only the services peers can
  reach.
- **A virtual device whose target does not answer** is marked in
  `netrinos vdev`, and `netrinos vdev add` says so at once.
- **Pushed commands** from the portal now include `log send`,
  `wgport` and `retest`, so support can retrieve a device's log,
  change its public port, or clear its connection back-off without
  logging in.

## Alerts

- **Webhooks support multiple destinations**, each with its own
  device-type filter and API key:
  `netrinos alerts-webhook add <url> <types> [apikey]` and
  `netrinos alerts-webhook remove <n>` replace the single-URL
  commands. Existing configuration migrates automatically. Device
  types accept "Edge" and are matched case-insensitively.
- **Offline alerts cover powered-off devices.**

## Software updates

- **Updates pushed from the portal complete in one step.**
  `netrinos upgrade` says when a restart is still needed to finish
  an update.
- **Updates are verified before they are installed.** The download
  is checked, then installed by the package manager, which also
  handles a downgrade (`netrinos upgrade 1.3.2`).
- **Web UI Upgrade button** works as in 1.3.2.

## Diagnostics

- **`netrinos doctor`** checks for a host firewall that blocks
  inbound mesh traffic or the traffic the Edge forwards, and
  firewalld's zones, and prints the commands that fix each for the
  firewall in use. It also checks the loopback path that Kubernetes
  hosts manage, every minute, and restores the Kubernetes exception
  on its own.
- **Log timestamps are UTC with milliseconds**, so device logs line
  up with each other and with support captures.

## Platform support

- **Kubernetes hosts** (Calico, MicroK8s, kubeadm): the firewall
  exception Netrinos needs is re-checked every minute and survives a
  Kubernetes restart.
- **Linux without the WireGuard kernel module** uses the bundled
  userspace implementation automatically.
- **Works alongside other firewalls on the host** (Docker, ufw,
  firewalld, or a ruleset of your own). Where one would block the
  Edge's port forwards, virtual devices or routes, the Edge adds an
  exception for Netrinos' own tunnel and port only, logs it, and keeps
  it in place.

## Security

- Local web UI session handling hardened.

## Fixes

- Refined route handling for devices that route traffic through an
  Edge.
- Setting a static IP address in the web UI keeps the Edge's network
  identity, so a DHCP reservation or port forward pointing at it
  continues to match.
- Web UI login messages name the server entered.

- Port forwards and virtual device rules are preserved through the
  device's automatic port change.
- A virtual device deleted and re-added within the same minute is
  kept.
- Switching the device to another server logs it out of the previous
  one.
- `netrinos doctor` run without `sudo` no longer reports a warning
  for the firewall check it cannot make; it names the command that
  can.

## Compatibility

- Works with v1.2.4 through v1.3.2 clients. Nothing changed on the
  wire.
- Coordinated hole punching improvements need both peers on v1.3.3.
- No configuration changes required.

## Updating

Use the **Upgrade** button on the Settings page, or:

```bash
netrinos upgrade
```