# Netrinos Edge v1.3.4 Release Notes

**Release Date**: 2026-10-29\
**Build**: b261029.1725

## Overview

Version 1.3.4 keeps an Edge connected on networks that block VPN
traffic, and brings virtual devices to Edges on the older iptables
firewall, such as NVIDIA Jetson boards. Support can now collect a
diagnostic report from an Edge with no shell access. The Edge also
carries the performance and reliability work of the 1.3.4 client.

## Networks that block VPN traffic

- **TLS fallback.** On a network that blocks UDP, the Edge carries its
  connection over TLS on port 443 to a Netrinos relay server, and
  returns to UDP once UDP works again. The fallback connection opens
  only while UDP is blocked.

## Edges on the iptables firewall

- **Virtual devices work** on Edges whose system uses the older
  iptables firewall instead of nftables.
- **Cleaner firewall rules.** Rules no longer pile up each time the
  firewall is set up, and they are removed when Netrinos stops. The old
  rules are cleared at the first start after the update.

## Port forwards and virtual devices

- **Port forwards on an Edge that is also a gateway** catch only
  connections addressed to the Edge itself, and leave traffic it routes
  for other devices alone.
- **`netrinos doctor` reports another firewall's port redirect** on the
  host that would capture traffic passing through the Edge.
- **A new target address** for a virtual device takes effect
  immediately.
- **`netrinos vdev add`** returns once the new name works, and prints
  it.
- **Short names.** A port forward converted to a virtual device is
  named after the target's hostname when that is 10 characters or
  fewer, otherwise `dev-` and the last number of its address. Existing
  names are unchanged.

## Performance and reliability

- **Higher throughput and lower CPU use,** with larger network buffers
  and batched packet handling.
- **Faster relay failover** when a direct path or a relay host goes
  down.
- **Faster recovery** after the Edge restarts or changes networks.
- **The Edge still reaches the Netrinos server** if local DNS fails.
- **The tunnel repairs itself** if other software removes its routes
  or firewall rules.
- **Large transfers to LAN devices** behind the Edge no longer stall on
  networks that filter ICMP (nftables firewall).
- **An Edge with a wrong clock still sees its peers.** Netrinos logs
  an error when the clock runs fast.

## Platform support

- **Kubernetes hosts.** The firewall exception Netrinos adds for
  kubeadm now covers outgoing traffic as well, so the tunnel survives
  a site reboot.
- **Userspace WireGuard** now runs on older distributions such as
  Ubuntu 18.04.

## Diagnostics and support

- **`netrinos doctor send`** uploads a diagnostic report to Netrinos
  support, as `netrinos log send` does for the log. Both can be pushed
  from the portal, for Edges without shell access.
- **More `netrinos doctor` checks** for relay hosts, NAT and firewall
  settings, and the network socket's queue and drops.

## Software updates

- **Updates are verified** before they are installed, from the web UI
  as well as the command line.
- **`netrinos upgrade`** completes when run over ssh.

## Compatibility

- Works with v1.2.4 and later clients.
- TLS fallback needs v1.3.4 on the Edge, and a relay host that offers
  it.
- No configuration changes required.

## Updating

Use the **Upgrade** button on the Settings page, or:

```bash
netrinos upgrade
```