Netrinos Client v1.3.3 Release Notes

Overview

Version 1.3.3 is a reliability release. Devices reconnect faster after restarts and network changes, work around stale router state on their own, keep relayed connections quiet, and take software updates pushed from the portal on every platform. Service buttons open cameras and any application your account defines, 64-bit Raspberry Pi OS gets the desktop app, and Linux updates are verified before they are installed. Gateway routes cover networks that also offer IPv6, and Linux devices work alongside Docker, ufw and firewalld without manual rules. macOS 13 or later is required.

Connection reliability

Improved reliability on cellular hotspots, mobile carriers and other networks with smaller packet limits. Tunnel packets are now sized to pass through them without fragmentation. Devices on a phone hotspot, a cellular modem or a second VPN benefit immediately; nothing changes on a wired connection. A device with a known clean path can keep the larger size with netrinos mtu 1420.

Works around stale NAT mappings on a few consumer routers. Certain residential gateway models age out one direction of a long-lived connection. The client now recognizes that condition and re-establishes its connection on its own; other devices follow automatically, with no restart and no operator action.

Restarted devices are reachable in seconds. Other devices learn a restarted device’s new address as soon as it is back, on the same LAN or across the internet.

Back on the mesh within seconds of waking. A laptop that wakes from sleep, or any device whose network comes up a moment after the client, retries its connection in seconds instead of waiting for the next scheduled check, and reconnects the moment the server is reachable again.

Other devices are reachable the moment the client starts. A connection opened right after a restart works at once.

Quiet relayed connections. A device reached through the relay is left alone until a direct path is confirmed. Less load on relays, less battery on mobile devices.

Coordinated hole punching. Two devices behind home routers now open their firewalls for each other within one round trip, so more pairs connect directly instead of through the relay. Both devices need 1.3.3; older peers keep their current behavior.

Verified same-LAN detection. A peer is treated as local only after it answers on the LAN, so a remote site that uses the same private address range as yours is never mistaken for local.

Faster direct connections. Addresses that cannot be reached from the internet are no longer tried.

Steadier status. A device stays marked reachable through a single lost packet on a poor connection.

Routes through a gateway

Gateway routes cover IPv6 networks. A website routed through a gateway now goes through the gateway on networks that also offer IPv6: the device directs browsers and other applications to the site’s IPv4 addresses, which the route carries. Applies on Linux, macOS and Windows; deleting the route restores normal IPv6 access at once. netrinos routes ipv6 shows the IPv6 addresses held back and confirms it.

Refined route handling keeps gateway routes in place through every connection check.

Software updates

Updates pushed from the portal, on every platform. The desktop app restarts into the new version on its own once the update is in place, and stays running if anything goes wrong.

netrinos upgrade says when a restart is still needed to finish an update.

Linux updates are verified and installed by the package manager. The download is checked before anything is installed, then installed by apt, dnf or yum, which also handles a downgrade (netrinos upgrade 1.3.2).

Linux with NetworkManager shows no notification when the Netrinos service restarts.

Diagnostics

netrinos doctor gained prerequisite checks on Linux: a host firewall that blocks inbound mesh traffic, one that blocks traffic this device forwards for virtual devices and routes, firewalld’s zones, and the local loopback path that Kubernetes hosts manage. Each names the firewall and the commands that fix it, for the firewall the device actually runs (Docker, ufw, firewalld or a ruleset of your own).

netrinos doctor reports the route IPv6 block on every platform: blocked, not blocked, or cannot be confirmed because the device has no IPv6 path.

Peer checks explain themselves. netrinos id and related commands report why a check cannot run, and name netrinos login when that is the reason.

Log timestamps are UTC with milliseconds on every platform, so logs from different devices line up.

Desktop UI

More services, each opening the right application. A device shows a button for every service it offers, from a built-in list of 23 that now includes FTP, camera streams, Home Assistant, Immich, Plex, Proxmox and media servers, beside Terminal, Files, Web, Remote Desktop and Screen Share. Each button opens the application for that service: a browser, a terminal, the file manager, a remote desktop or screen sharing client, a media player. Applications your account uses that are not in the list are added once, on the portal’s Service Ports page, and every device’s buttons pick them up.

Camera buttons open the stream. Click a camera button, enter the camera’s login, and the client asks the camera for its streams over ONVIF, lets you choose one, and opens it in the media player registered for rtsp:// on your computer. A camera without ONVIF takes a stream path typed in. The password is asked for each session and never stored. On Debian, Ubuntu and Mint the packaged VLC cannot play RTSP; install mpv, or VLC as a flatpak or snap.

Buttons are confirmed from your computer. A button turns blue once its port answers from where you are, so a service blocked by an access rule or firewall in between shows grey with the reason. Devices also advertise only services that peers can reach, so a program listening on the device’s own loopback address no longer appears as a button.

Default Apps in Settings shows which application opens web, FTP, camera, SFTP and VNC buttons, and lets you choose a different one. A button with no application to open it offers the same chooser.

FTP and SFTP buttons ask for the username, as SSH does, and SFTP is offered on macOS and Windows as well as Linux.

Virtual devices show their buttons as soon as they are added, and a virtual device whose target does not answer from its gateway is marked, on the Virtual Devices page and in netrinos vdev.

Status page: relayed peers show a relay arrow, green once the peer is confirmed reachable.

Icons are one shared set across desktop, Android and iOS.

Platform support

macOS 13 Ventura or later is required.

Raspberry Pi and other 64-bit Arm Linux desktops get the desktop app. The arm64 package now carries the tray application; it runs on 64-bit Raspberry Pi OS (Bookworm and Trixie), Debian 12, Ubuntu 24.04 and later. A Pi running 32-bit Raspberry Pi OS gets the command-line client, and the installer says so.

Fedora gets the desktop app in the netrinos-client rpm; the tray enables GNOME’s AppIndicator extension on first login.

Linux without the WireGuard kernel module: the client package ships a userspace WireGuard implementation and selects it automatically.

Kubernetes hosts (Calico, MicroK8s, kubeadm): the firewall exception Netrinos needs is re-checked every minute and survives a Kubernetes restart.

Firewall self-repair runs on every Linux client. Once a minute it checks for changes other software makes to the host firewall that would block Netrinos, such as a container runtime or Kubernetes rewriting the rules, and restores what Netrinos needs.

Works alongside Docker, ufw and firewalld. When one of them would block connections to the device, or traffic it forwards for virtual devices and routes, the client adds an exception for Netrinos’ own tunnel and port only, logs what it did, and keeps it in place. A device hosting virtual devices keeps forwarding through a reboot whichever service starts first.

CLI

netrinos retest: also clears the recovery back-off and tests the hub.

netrinos doctor: inbound-firewall, forward-firewall, firewalld, loopback, route IPv6 block and tunnel MTU rows.

netrinos routes ipv6: the IPv6 addresses blocked for routed sites, and a check that the block holds.

netrinos mtu: show or set the tunnel packet size, 1280 to 1420 or default. Takes effect at once, no restart.

netrinos ports: the service port table in use, account additions marked.

Type netrinos <command> help for full syntax on any command.

Fixes

macOS: runs alongside other WireGuard tunnels on the same Mac through starts and updates.

Windows: refined handling of the device’s own routes.

Messages about saving settings name the specific cause.

macOS: camera video through a virtual device plays with picture as well as sound.

Windows: an installed VLC or FileZilla is found for the camera and SFTP buttons.

Linux: a default application cleared in the desktop’s own settings is respected by the buttons.

netrinos doctor run without sudo no longer reports a warning for the firewall check it cannot make; it names the command that can.

Portal-pushed updates complete on Linux without a follow-up restart.

A virtual device deleted and re-added within the same minute is kept.

netrinos vdevice add checks authentication before scanning the LAN.

netrinos upgrade