Product Changelog & Release Notes | Firezone
Changelog
A list of the most recent updates to Firezone, organized by component.
GatewaymacOS / iOSWindows GUIWindows HeadlessAndroidLinux GUILinux Headless
Latest Gateway version
Version: 1.6.0
Released:August 10, 2026
Compatible with:Clients >= 1.5.0
#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.
#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.
#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.
#14011 Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.
#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.
#14153 Lowers the system-wide net.core.wmem_max andnet.core.rmem_max values the Gateway sets to 2 MB and 16 MB respectively, reducing the UDP send and receive socket buffer sizes.
#14301 Improves reconnection speed after a network change.
#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.
#14429 Fixes an issue where traffic to private, link-local, CGNAT, or other non-Internet address ranges could be routed through an Internet Resource Gateway.
Previous Gateway versions
| Version | Date | Description |
|---|---|---|
| 1.5.2 | April 27, 2026 | - #12506 Fixes an issue where the Gateway would disconnect from a relay under high-load. |
| 1.5.1 | March 16, 2026 | - #12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time. - #12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error. - #12134 Fixes an issue where outdated and thus irrelevant candidates were sent to Clients, causing connectivity issues in rare situations. - #12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive. - #12322 Fixes an issue where the WebSocket connection to the control plane was lost under load. - #12504 Greatly improves performance for cases where many Clients (100+) are connected to a single Gateway. |
| 1.5.0 | February 2, 2026 | - #11771 BREAKING: Remove support for Firezone 1.3.x Clients and lower. - #11770 Enables detailed flow logs for tunneled TCP and UDP connections. Set FIREZONE_FLOW_LOGS=true or --flow-logs to enable.- #11664 Adds a FIREZONE_MAX_PARTITION_TIME environment variable to configure how long the Gateway will retry connecting to the portal before exiting. Accepts human-readable durations like 5m,1h, or 30d. Defaults to 24 hours.- #11625 Fails faster when the initial connection to the control plane cannot be established, allowing faster restarts by the process manager. - #11584 Improves connection reliability on systems where certain UDP socket features are unavailable. - #11627 Fixes an issue where reconnections would fail if the portal host is an IP address. - #11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case. - #11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs. - #11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal. - #11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts. |
| 1.4.19 | December 23, 2025 | - #10972 Fixes an issue where IPv6-only DNS resources could not be reached. - #11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable. - #11208 Fixes an issue where the Gateway could reboot when the WebSocket connection to the portal got cut. |
| 1.4.18 | November 10, 2025 | - #10620 Adds a --log-format CLI option to output logs as JSON.- #10796 Fixes an issue where packets for DNS resources would be routed to stale IPs after DNS record changes. |
| 1.4.17 | October 16, 2025 | - #10367 Fixes a rare CPU-spike issue in case a Client connected with many possible IPv6 addresses. - #10349 Attempts to increase the system-wide parameters core.rmem_max to 128 MB and core.wmem_max to 16 MB for improved performance. See the Performance tuning section for details.- #10373 Switches to user-space DNS resolution, allowing for accurate caching based on the TTL in the DNS response. |
| 1.4.16 | September 10, 2025 | - #10231 Remove the FIREZONE_NUM_TUN_THREADS env variable. The Gateway will now always default to a single TUN thread. Using multiple threads can cause packet reordering which hurts TCP throughput performance. - #10076 Introduces graceful shutdown, allowing Clients to immediately switch over a new Gateway instead of waiting for the ICE timeout (~15s). - #10310 Fixes an issue where packets for DNS resources could get routed to the wrong address. |
| 1.4.15 | August 5, 2025 | - #10109 Fixes an issue where connections would fail to establish in environments with a limited number of ports on the NAT. |
| 1.4.14 | July 28, 2025 | - #9986 Fixes an issue where a Client could not establish a connection unless their first attempt succeeded. - #9979 Fixes an issue where connections in low-latency networks (between Client and Gateway) would fail to establish reliably. |
| 1.4.13 | July 22, 2025 | - #9834 Excludes ICMP errors from the ICMP traffic filter. Those are now always routed back to the client. - #9816 Responds with ICMP errors for filtered packets. - #9812 Adds support for translating Time-Exceeded ICMP errors in the DNS resource NAT, allowing tracepath to work through a Firezone tunnel.- #9891 Fixes an issue where connections would sometimes take up to 90s to establish. - #9896 Fixes a potential security issue where prior resource authorizations would not get revoked if the Gateway was disconnected from the portal while access was removed. - #9894 Shuts down the Gateway after 15m of being disconnected from the portal. |
| 1.4.12 | June 30, 2025 | - #9657 Fixes an issue where connections would fail to establish if the Gateway was under high load. - #9725 Fixes an issue where Firezone failed to sign-in on systems with non-ASCII characters in their kernel build name. - #9655 Allows long-lived TCP connections to remain open by increasing the NAT TTL to 2h. |
| 1.4.11 | June 19, 2025 | - #9564 Fixes an issue where connections would fail to establish if both Client and Gateway were behind symmetric NAT. |
| 1.4.10 | June 5, 2025 | - #9147 Fixes an issue where connections failed to establish on machines with multiple valid egress IPs. - #9366 Fixes an issue where Firezone could not start if the operating system refused our request to increase the UDP socket buffer sizes. |
| 1.4.9 | May 14, 2025 | - #9059 Fixes an issue where ICMP unreachable errors for large packets would not be sent. - #9060 Fixes an issue where service discovery for DNS resources would fail in case the Gateway's started up with no network connectivity. - #9088 Fixes an issue where large batches of packets to the same Client got dropped under high load. |
| 1.4.8 | May 2, 2025 | - #9009 Fixes an issue where ECN bits got erroneously cleared without updating the packet checksum. This caused packet loss on recent MacOS versions which attempt to use ECN. |
| 1.4.7 | April 30, 2025 | - #8798 Improves performance of relayed connections on IPv4-only systems. - #8731 Improves throughput performance by requesting socket receive buffers of 10MB. The actual size of the buffers is capped by the operating system. You may need to adjust net.core.rmem_max for this to take full effect.- #8920 Improves connection reliability by maintaining the order of IP packets across GSO batches. - #8937 Fixes an issue where connections to DNS resources which utilise round-robin DNS may be interrupted whenever the Client re-queried the DNS name. |
| 1.4.6 | April 15, 2025 | - #8383 Deprecates the NAT64 functionality in favor of sending ICMP errors to hint to the calling application about which IP version to use. - #8754 Fixes a performance regression that could lead to packet drops under high load. - #8765 Improves performance on single-core systems by defaulting to only 1 TUN thread if we have less than 4 cores. - #7590 Improves performance by moving UDP sockets to a dedicated thread. |
| 1.4.5 | March 10, 2025 | - #8124 Fixes a bug in the routing of DNS resources that would lead to "Source not allowed" errors in the Client logs. - #8225 Caches successful DNS queries for DNS resource domains for 30 seconds. |
| 1.4.4 | February 11, 2025 | - #7944 Fixes an edge case where a busy Gateway could experience a deadlock due to a busy or unresponsive TUN device. - #8070 Only write logs using ANSI-escape codes if the underlying output stream supports it. |
| 1.4.3 | January 28, 2025 | - #7567 Fixes an issue where ICMPv6's 'PacketTooBig' errors were not correctly translated by the NAT64 module. - #7565 Fails early in case the binary is not started as root or with theCAP_NET_ADMIN capability. The check can be skipped with--no-check. |
| 1.4.2 | December 13, 2024 | - #7210 Adds support for GSO (Generic Segmentation Offload), delivering throughput improvements of up to 60%. - #7398 Fixes cases where client applications such as ssh would fail to automatically determine the correct IP protocol version to use (4/6). - #7449 Uses multiple threads to read & write to the TUN device, greatly improving performance. The number of threads can be controlled with FIREZONE_NUM_TUN_THREADS and defaults to 2.- #7479 Fixes an issue where SSH connections involving NAT64 failed to establish. |
| 1.4.1 | November 15, 2024 | - #7263 Mitigates a crash in case the maximum packet size is not respected. - #7334 Fixes an issue where symmetric NATs would generate unnecessary candidate for hole-punching. - #7120 Silences several unnecessary warnings from the WireGuard library. - #7341 Disconnects from non-compliant TURN servers. - #7342 Fixes a packet drop issue under high-load. |
| 1.4.0 | November 4, 2024 | - #6960 Separates traffic restrictions between DNS Resources CIDR Resources, preventing them from interfering with each other. - #6941 Implements support for the new control protocol, delivering faster and more robust connection establishment. - #7103 Adds on-by-default error reporting using sentry.io. Disable by setting FIREZONE_NO_TELEMETRY=true.- #7164 Fixes an issue where the Gateway would fail to accept connections and had to be restarted. |
| 1.3.2 | October 2, 2024 | - #6733 Reduces log level of the "Couldn't find connection by IP" message so that it doesn't log each time a client disconnects. - #6845 Fixes connectivity issues on idle connections by entering an always-on, low-power mode instead of closing them. |
| 1.3.1 | September 5, 2024 | - #6563 Removes unnecessary packet buffers for a minor performance increase. |
| 1.3.0 | August 30, 2024 | - #6434 Adds support for routing the Internet Resource for Clients. |
| 1.2.0 | August 21, 2024 | - #5901 Implements glob-like matching of domains for DNS resources. |
| 1.1.5 | August 13, 2024 | - #6276 Fixes a bug where relayed connections failed to establish after an idle period. - #6277 Fixes a bug where restrictive NATs caused connectivity problems. |
| 1.1.4 | August 8, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.3 | August 2, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.2 | June 29, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.1 | June 27, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.0 | June 19, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.8 | June 17, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.7 | June 12, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.6 | June 11, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.5 | May 22, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.4 | May 14, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.3 | May 8, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.2 | April 30, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.1 | April 29, 224 | - This is a maintenance release with no user-facing changes. |
| 1.0.0 | April 24, 2024 | - This is a maintenance release with no user-facing changes. |
Latest macOS / iOS version
Version: 1.5.19
Released:August 15, 2026
Compatible with:Gateways <= 1.6.x
- Download on App Store for macOS and iOS
- Download standalone DMG file for macOS
- Download standalone installer PKG file for macOS
#11820 Adds firezone-cli, a command line interface to the macOS Client for Macs that run unattended or are managed remotely.
#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.
#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.
#14054 Reduces memory usage by lowering the size of the UDP socket send and receive queues.
#14283 Fixes an issue where packets could get silently dropped instead of being backpressured on high-throughput links (> 2GBit/s).
#14301 Improves reconnection speed after a network change.
#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.
Previous macOS / iOS versions
| Version | Date | Description |
|---|---|---|
| 1.5.18 | June 24, 2026 | - #13822 Fixes a regression introduced in 1.5.16 where the VPN configuration could go undetected after a first install, prompting the user to install and grant permission again, and where stale errors from a previous attempt could remain on screen after the configuration completed successfully. - #13816 Fixes a crash on iOS where opening a resource detail screen and then having the resource list refresh underneath it — often after a long time in the background — could terminate the app. - #13757 Evaluates a resource's traffic filters on the client and drops disallowed packets locally, preventing a feedback loop of repeated flow-creation requests for traffic the resource's filters never permit. - #13739 Batches reads and writes to the macOS and iOS TUN device into a single syscall per batch, improving throughput and reducing CPU usage on high-traffic connections. - #13725 Adds a per-destination UDP socket pool on macOS and iOS that unlocks Darwin's UDP fast path, enabling send batching and kernel congestion (flow advisory) signals for better throughput. - #13723 Fixes an issue on macOS where checking or registering the login helper could freeze the user interface for several seconds, by moving those calls off the main thread. - #13719 Significantly reduces the memory used by the UDP socket pool by right-sizing receive buffers instead of allocating a fixed 64 KiB per buffer. - #13667 Increases the macOS and iOS TUN read buffer so the kernel can queue more outbound packets between reads, improving upload throughput. - #13666 Retries writes to the TUN device when its queue is momentarily full instead of immediately dropping the packet, reducing packet loss under bursty load on macOS and iOS. - #13648 Fixes an issue on macOS and iOS where the UDP receive buffer size could fail to apply, leaving the client with a much smaller buffer than intended and causing packet drops under load. - #13831 Fixes an issue on a fresh install where the app could get stuck instead of showing the sign-in screen while the system finished registering the VPN configuration. |
| 1.5.17 | June 11, 2026 | - #13649 Fixes an issue where exporting logs could fail with an error if the log directory contained dangling symlinks. - #13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections. |
| 1.5.16 | June 3, 2026 | - #13038 Surfaces non-authentication disconnect errors (e.g. failure to reach the portal) to the user via a modal alert instead of silently cancelling the tunnel. - #13282 Moves user-editable settings from UserDefaults into the VPN provider configuration so they can only be modified by Firezone, not by other processes running as the user. MDM-pushed values continue to override these settings. - #13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders. |
| 1.5.15 | April 27, 2026 | - #12849 Fixes an issue on macOS where the app could be silently terminated by the system under memory pressure, leaving the tunnel running without a menu bar icon or session expiry notifications. - #12853 Adds a macOS LaunchAgent helper that relaunches Firezone after unexpected exits. - #12657 Falls back to public DNS resolvers when the system provides only non-routable addresses (loopback, link-local), preventing tunnel bootstrap failures. - #12684 Takes into account traffic filters when routing packets to resources. |
| 1.5.14 | March 17, 2026 | - #12407 Fixes update notification dismissal on macOS where dismissing one version could be ignored due to reading from the wrong UserDefaults key. - #12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time. - #12236 Fixes an issue on macOS where the app could get stuck on the loading spinner if the system extension was not ready at startup. - #12279 Bumps minimum iOS version from 15.6 to 16.0 to enable SwiftUI NavigationStack and NavigationSplitView API. - #12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error. - #12016 Uses the system's DNS resolver ordering on macOS for more accurate DNS resolution behavior. - #11988 Fixes a crash if the currently active log file gets deleted. - #11779 Notifies the user when a connection to a resource cannot be established. - #12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive. - #12322 Fixes an issue where the WebSocket connection to the control plane was lost under load. |
| 1.5.13 | January 30, 2026 | - #11901 Fixes an issue where the tunnel may not come up after a fresh install of the Firezone client. - #11892 Exports logs in plain text format instead of JSONL for easier reading. - #11834 Fixes an issue where the tunnel might hang or crash on iOS immediately after signing in. - #11659 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files. - #11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts. - #11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed. |
| 1.5.12 | January 20, 2026 | - #11735 Fixes an issue on iOS where the system resolvers could not be reliably read, causing DNS queries to fail system-wide. - #11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner. - #11634 Bumps minimum macOS version from 12.4 to 13.0 (Ventura) to enable SwiftUI MenuBarExtra API. - #11584 Improves connection reliability on systems where certain UDP socket features are unavailable. - #11627 Fixes an issue where reconnections would fail if the portal host is an IP address. - #11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case. - #11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs. - #11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal. - #11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal. |
| 1.5.11 | December 23, 2025 | - #11141 Fixes an issue where spurious resource updates would result in perceived network interruptions resulting in errors likeERR_NETWORK_CHANGED in Google Chrome.- #11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable. |
| 1.5.10 | December 4, 2025 | - #10986 Fixes a minor race condition that could arise on sign out. - #10855 Fixes an issue on macOS where the utun index would auto-increment by itself on configuration updates.- #10752 Fixes an issue where the reported client version was out of date. - #10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected. - #10824 Adds support for hideResourceList managed configuration key to hide the Resource List in the macOS and iOS apps.- #10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped. - #10965 Fixes an issue where some packets would get dropped under high throughput scenarios. |
| 1.5.9 | October 20, 2025 | - #10603 Fixes an issue on macOS where DNS resources might fail to be routed properly after many (150+) Firezone session restarts. - #10509 Fixes an issue where the Internet Resource could be briefly active on startup, despite it being disabled. - #10533 Improves reliability by caching DNS responses as per their TTL. - #10567 Fixes an issue where the Resources menu would not populate when launching the app while already connected. |
| 1.5.8 | September 10, 2025 | - #10313 Fixes an issue where multiple concurrent Firezone macOS clients could run simultaneously. We now enforce a single instance of the client. - #10224 Fixes a minor DNS cache bug where newly-added DNS resources may not resolve for a few seconds after showing up in the Resource List. - #10104 Fixes an issue where DNS resources would resolve to a different IP after signing out and back into Firezone. This would break connectivity for long-running services that don't re-resolve DNS, like SSH sessions or mongoose. |
| 1.5.7 | August 7, 2025 | - #10143 Fixes an issue on iOS 17 and below that caused the tunnel to crash after signing in. This was due to a change in how newer versions of Xcode handle linking against referenced libraries. iOS 18 and higher is unaffected. |
| 1.5.6 | August 2, 2025 | - #10075 Fixes an issue on iOS where the tunnel may never fully come up after signing in due to a network connectivity reset loop. - #10056 Fixes an issue where connectivity could be lost for up to 20 seconds after waking from sleep. |
| 1.5.5 | July 28, 2025 | - #10022 Fixes a bug on iOS where network connectivity changes (such as from WiFi to cellular) may result in the wrong default system DNS resolvers being read, which could prevent DNS resources from working correctly. - #10019 Fixes an issue on recent versions of iOS where the export logs sheet would open and then immediately close. - #9991 Fixes an issue where only the first system DNS resolver was used to forward queries instead of all found ones. - #9985 Fixes an issue where control plane messages could be stuck forever on flaky connections, requiring signing out and back in to recover. - #9993 Fixes an issue where DNS resolvers could be lost upon waking from sleep, leading to broken Internet connectivity. - #9891 Fixes an issue where connections would sometimes take up to 90s to establish. - #9979 Fixes an issue where connections in low-latency networks (between Client and Gateway) would fail to establish reliably. - #9999 Decreases connection setup time on flaky Internet connections in certain edge cases. |
| 1.5.4 | July 11, 2025 | - #9597 Fixes an issue where certain log files would not be recreated after logs were cleared. - #9536 Uses .zip to compress logs instead of Apple Archive.- #9725 Fixes an issue where Firezone failed to sign-in on systems with non-ASCII characters in their kernel build name. |
| 1.5.3 | June 19, 2025 | - #9564 Fixes an issue where connections would fail to establish if both Client and Gateway were behind symmetric NAT. |
| 1.5.2 | June 3, 2025 | - #9300 Uses the new IP stack setting for DNS resources, which allows DNS resources to optionally return only A or AAAA records if configured by the administrator. - #9366 Fixes an issue where Firezone could not start if the operating system refused our request to increase the UDP socket buffer sizes. |
| 1.5.1 | June 1, 2025 | - #9308 Fixes an issue where the network extension could crash when viewing the diagnostic logs pane in app settings. - #9308 Fixes a minor issue where the network extension process could crash when signing out. - #9242 Fixes a rare bug that could prevent certain IPv6 DNS upstream resolvers from being used if they contained an interface scope specifier. |
| 1.5.0 | May 26, 2025 | - #9230 Finalizes the managed configuration support for the macOS client. For details on how to configure this, see the knowledge base article. - #9231 Fixes a minor bug where the app would report a minor error in the backend when quitting while signed out. |
| 1.4.15 | May 23, 2025 | - #9204 Adds a profile manifest for easily generating managed configuration files for the macOS app using the iMazing Profile Editor. - #9196 Adds managed configuration support for the macOS application. This allows applying using your MDM provider to configure the app on managed devices using mobileconfig files.- #9168 Adds a "Connect on start" setting, and another "Start on login" setting specific to just the macOS app. - #9167 Disables update checking and notifications for the App Store variant of the macOS client. - #9119 Automatically saves the account slug after the first sign in, and adds a new General tab in Settings to allow updating it.- #9014 Fixes an issue where idle connections would be slow (~60s) in detecting changes to network connectivity. - #9018 Further improves performance of relayed connections on IPv4-only systems. - #9093 Fixes a rare panic when the DNS servers on the system would change while Firezone is connected. - #9147 Fixes an issue where connections failed to establish on machines with multiple valid egress IPs. |
| 1.4.14 | May 2, 2025 | - #9005 Fixes an issue where the IP checksum was not updated when ECN bits were set. This caused packet loss on recent MacOS versions which default to using ECN. |
| 1.4.13 | April 30, 2025 | - #8731 Improves throughput performance by requesting socket receive buffers of 10MB. The actual size of the buffers is capped by the operating system. You may need to adjust kern.ipc.maxsockbuf for this to take full effect.- #8920 Improves connection reliability by maintaining the order of IP packets across GSO batches. - #8926 Rolls over to a new log-file as soon as logs are cleared. - #8935 Improves reliability for upload-intensive connections with many concurrent DNS queries. |
| 1.4.12 | April 21, 2025 | - #8798 Improves performance of relayed connections on IPv4-only systems. |
| 1.4.11 | April 18, 2025 | - #8814 Fixes an issue where the app would hang on launch if another VPN app was connected. |
| 1.4.10 | April 17, 2025 | - #8795 Publishes an installer package for macOS in addition to the DMG file. |
| 1.4.9 | April 15, 2025 | - #7590 Improves performance by moving UDP sockets to a dedicated thread. |
| 1.4.8 | March 21, 2025 | - #8477 Fixes an issue where the app would not auto-connect on launch. |
| 1.4.7 | March 14, 2025 | - #8421 Applies the search domain configured in the admin portal, if any. |
| 1.4.6 | March 11, 2025 | - #8282 Shows friendlier and more-human alert messages when something goes wrong. - #8286 Fixes a bug that prevented certain Resource fields from being updated when they were updated in the admin portal. |
| 1.4.5 | February 24, 2025 | - #8251 Fixes an issue where the update checker would not properly notify the user about new updates available on macOS. - #8248 Fixes a crash on macOS that could occur when an application update become available. - #8249 Fixes a regression that caused a crash if "Open menu" was clicked in the Welcome screen. |
| 1.4.4 | February 24, 2025 | - #8202 Fixes a crash that occurred if the system reports invalid DNS servers. - #8237 Fixes a minor memory leak that would occur each time you sign in. |
| 1.4.3 | February 16, 2025 | - #8122 Fixes a rare crash that could occur when dismissing the update available notification. |
| 1.4.2 | February 13, 2025 | - #8104 Fixes a minor memory leak that could occur after being unexpectedly disconnected. - #8091 Fixes a bug that prevented exporting logs from the macOS app more than once. - #8090 Improves app launch time by asynchronously loading icons upon app launch. - #8066 Improves MenuBar list responsiveness on macOS. - #8064 Fixes a bug that might cause the UI process to crash when the Resource list is updated. - #7996 No longer shows an error dialog if the sign in process is canceled. |
| 1.4.1 | January 29, 2025 | - Fixes a few minor UI hangs. - #7890 Fixes a minor memory leak that occurred when roaming networks. - #8091 Fixes a bug that prevented exporting logs from the macOS app more than once. - #7891 Substantially reduces the amount of memory usage when sending large amount of data to many different Gateways. - Improves UX around installing the system extension, VPN configuration, and granting notifications by showing the user actionable alerts if errors occur. |
| 1.4.0 | January 16, 2025 | - #7581 Adds download links and CI configuration to publish the macOS app as a standalone package. - #7344 The macOS app now uses a System Extension instead of an App Extension for tunneling. This is needed for the app to be distributed outside of the Mac App Store. - #7594 Fixes a race condition that could cause the app to crash in rare circumstances if the VPN profile is removed from system settings while the app is running. - #7593 Fixes a bug where the VPN status would not properly update upon the first launch of the app. - #7334 Fixes an issue where certain NAT types would cause excessive signaling traffic which led to connectivity issues. - Makes use of the new control protocol, delivering faster and more robust connection establishment. - #7477 Improves connection setup latency by buffering initial packets. - #7551 Fixes an issue where large DNS responses were incorrectly discarded. |
| 1.3.9 | November 8, 2024 | - #7288 Fixes an issue where network roaming would cause Firezone to become unresponsive. |
| 1.3.8 | November 5, 2024 | - #7263 Mitigates a crash in case the maximum packet size is not respected. - #7265 Prevents re-connections to the portal from hanging for longer than 5s. |
| 1.3.7 | October 31, 2024 | - Handles DNS queries over TCP correctly. - #7152 Adds always-on error reporting using sentry.io. - #7164 Fixes an issue where Firezone would fail to establish connections to Gateways and the user had to sign-out and in again. |
| 1.3.6 | October 2, 2024 | - #6831 Ensures Firefox doesn't attempt to use DNS over HTTPS when Firezone is active. - #6845 Fixes connectivity issues on idle connections by entering an always-on, low-power mode instead of closing them. - #6857 MacOS: sends hardware's UUID for device verification. - #6857 iOS: sends Id for vendor for device verification. |
| 1.3.5 | September 26, 2024 | - #6809 Fixes a bug where non-wildcard DNS resources were not prioritised over wildcard ones (e.g. app.example.com vs*.example.com). |
| 1.3.4 | September 25, 2024 | - #6788 Fixes an issue where some browsers may fail to route DNS Resources correctly. |
| 1.3.3 | September 19, 2024 | - #6765 Fixes a bug where DNS PTR queries by the system did not get answered. - #6722 Fixes a routing bug when one of several overlapping CIDR resources gets disabled / removed. - Improves logging for DNS queries when firezone_tunnel=trace log level is used. |
| 1.3.2 | September 18, 2024 | - #6632(macOS) Fixes a bug where the addressDescription wasn't fully displayed in the macOS menu bar if it exceeded a certain length. - #6679(macOS) Displays a notification when a new version is available. |
| 1.3.1 | September 5, 2024 | - #6521 Gracefully handles cases where the device's local interface IPv4/IPv6 address or local network gateway changes while the client is connected. - #6518 Minor improvements to the look of the internet resource and makes the Internet resource off by default. |
| 1.3.0 | August 30, 2024 | - #6434 Adds the Internet Resource feature. |
| 1.2.1 | August 22, 2024 | - #6406 Shows the Git SHA corresponding to the build on the Settings -> Advanced screen. - #6424 Fixes a bug where packets would be lost when a connection is first established to a Gateway due to routes being updated with no actual change. |
| 1.2.0 | August 21, 2024 | - #5901 Implements glob-like matching of domains for DNS resources. - #6186 Adds the ability to mark Resources as favorites. - #6361 Connections to Gateways are now sticky for the duration of the Client's session. This fixes potential issues maintaining long-lived TCP connections to Gateways in a high-availability setup. |
| 1.1.5 | August 13, 2024 | - #6276 Fixes a bug where relayed connections failed to establish after an idle period. - #6277 Fixes a bug where restrictive NATs caused connectivity problems. |
| 1.1.4 | August 10, 2024 | - #6181 Improves reliability of DNS resolution of non-resources. |
| 1.1.3 | August 2, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.2 | July 3, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.1 | June 29, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.0 | June 27, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.5 | June 13, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.4 | May 1, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.3 | April 28, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.2 | April 24, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.1 | April 4, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.0 | April 1, 2024 | - This is a maintenance release with no user-facing changes. |
Latest Windows GUI version
Version: 1.5.16
Released:August 10, 2026
Compatible with:Gateways <= 1.6.x
#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time. #14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal. #14048 Fixes an issue where the Client could appear to hang when quitting if the tunnel service did not confirm disconnection; it now exits after a short timeout. #14230 Fixes an issue where a failed log export (e.g. a bad destination path, a full disk, or a vanished log file) could terminate the app instead of showing a notification. #14231 Fixes an issue where exporting logs could fail if a log file could not be opened. #14301 Improves reconnection speed after a network change. #14396 Fixes an issue where a brief scheduling delay on the TUN worker thread could overflow the WinTUN ring buffer and drop packets under high throughput. #14404 Improves download throughput on Windows by coalescing TCP packets before writing them to the WinTUN adapter. #14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway. #14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.
Previous Windows GUI versions
| Version | Date | Description |
|---|---|---|
| 1.5.15 | June 25, 2026 | - #13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts. - #13835 Fixes an issue where the Client could hang on shutdown if a desktop notification had not been dismissed. |
| 1.5.14 | June 17, 2026 | - #13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams. - #13726 Fixes an issue where the client failed to launch on Windows 10, and lowers the minimum supported version to Windows 10 2004 (build 19041). - #13744 Fixes an invalid Authenticode signature on the installer and bundled executables caused by the binary being patched after it was signed. - #13647 Fixes an issue where a full WinTUN ring buffer could stall the send thread far longer than intended, reducing throughput under high load. |
| 1.5.13 | June 8, 2026 | - #13126 Shows currently connected devices in the system tray menu. - #13153 Restricts access to Firezone's configuration directory. - #13275 Restricts the tunnel and GUI named pipes to processes carrying the Firezone MSIX package SID, so other processes running as the same user can no longer drive the tunnel or hijack deep links. - #13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders. - #13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections. |
| 1.5.12 | April 27, 2026 | - #12684 Takes into account traffic filters when routing packets to resources. |
| 1.5.11 | March 16, 2026 | - #12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time. - #12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error. - #12111 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files. - #11779 Notifies the user when a connection to a resource cannot be established. - #12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive. - #12322 Fixes an issue where the WebSocket connection to the control plane was lost under load. |
| 1.5.10 | February 2, 2026 | - #11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner. - #11584 Improves connection reliability on systems where certain UDP socket features are unavailable. - #11627 Fixes an issue where reconnections would fail if the portal host is an IP address. - #11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case. - #11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs. - #11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal. - #11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal. - #11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts. - #11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed. |
| 1.5.9 | December 23, 2025 | - #10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected. - #10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped. - #11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable. |
| 1.5.8 | October 16, 2025 | - #10509 Fixes an issue where the Internet Resource could be briefly active on startup, despite it being disabled. - #10533 Improves reliability by caching DNS responses as per their TTL. |
| 1.5.7 | September 10, 2025 | - #10104 Fixes an issue where DNS resources would resolve to a different IP after signing out and back into Firezone. This would break connectivity for long-running services that don't re-resolve DNS, like SSH sessions or mongoose. |
| 1.5.6 | July 28, 2025 | - #9985 Fixes an issue where control plane messages could be stuck forever on flaky connections, requiring signing out and back in to recover. - #9891 Fixes an issue where connections would sometimes take up to 90s to establish. - #9979 Fixes an issue where connections in low-latency networks (between Client and Gateway) would fail to establish reliably. - #9999 Decreases connection setup time on flaky Internet connections in certain edge cases. |
| 1.5.5 | July 9, 2025 | - #9779 Fixes a rare crash during sign-in. - #9725 Fixes an issue where Firezone failed to sign-in on systems with non-ASCII characters in their kernel build name. - #9696 Establishes connections quicker by narrowing the set of network changes we react to. |
| 1.5.4 | June 19, 2025 | - #9564 Fixes an issue where connections would fail to establish if both Client and Gateway were behind symmetric NAT. |
| 1.5.3 | June 16, 2025 | - #9537 Fixes an issue that caused increased CPU and memory consumption. |
| 1.5.2 | June 12, 2025 | - #8160 Moves network change listening to the tunnel service for improved reliability. - #9505 Fixes minor visual inconsistencies in the main app window. - #9443 Fixes an issue where log directives applied via MDM would not be applied on startup. - #9445 Fixes an issue where disabling the update checker via MDM would cause the Client to hang upon sign-in. - #9477 Fixes an issue where disabling "connect on start" would incorrectly show the Client as "Signed in" on the next launch. |
| 1.5.1 | June 5, 2025 | - #9418 Fixes an issue where advanced settings were not saved and loaded properly across restarts of the Client. |
| 1.5.0 | June 5, 2025 | - #9300 Uses the new IP stack setting for DNS resources, which allows DNS resources to optionally return only A or AAAA records if configured by the administrator. - #9211 Fixes an issue where changing the Advanced settings would reset the favourited resources. - #9203 Allows managing certain settings via an MDM provider such as Microsoft Intune. For more details on how to do this, see the the knowledge base article. - #9366 Fixes an issue where Firezone could not start if the operating system refused our request to increase the UDP socket buffer sizes. - #9381 Introduces "General" settings, allowing the user to manage autostart behaviour as well as the to-be-used account slug. |
| 1.4.14 | May 21, 2025 | - #9147 Fixes an issue where connections failed to establish on machines with multiple valid egress IPs. - #9136 Launching Firezone while it is already running while now re-activate the "Welcome" screen, allowing the user to sign in and out. - #9154 Renames the background service from FirezoneClientIpcServiceto FirezoneClientTunnelService.- #9213 Adds the Client to the winget repository. You can install it via winget install Firezone.Client.GUI. |
| 1.4.13 | May 14, 2025 | - #9014 Fixes an issue where idle connections would be slow (~60s) in detecting changes to network connectivity. - #9018 Further improves performance of relayed connections on IPv4-only systems. - #9021 Optimizes network change detection. - #9112 Fixes a rare crash that could occur if the tray menu cannot be initialised. - #9093 Fixes a rare panic when the DNS servers on the system would change while Firezone is connected. |
| 1.4.12 | April 30, 2025 | - #8731 Improves throughput performance by requesting socket receive buffers of 10MB. - #8920 Improves connection reliability by maintaining the order of IP packets. - #8926 Rolls over to a new log-file as soon as logs are cleared. - #8935 Improves reliability for upload-intensive connections with many concurrent DNS queries. |
| 1.4.11 | April 21, 2025 | - #8798 Improves performance of relayed connections on IPv4-only systems. |
| 1.4.10 | April 15, 2025 | - #7590 Improves performance by moving UDP sockets to a dedicated thread. |
| 1.4.9 | March 14, 2025 | - #8422 Applies the search domain configured in the admin portal, if any. |
| 1.4.8 | March 10, 2025 | - #8286 Fixes a bug that prevented certain Resource fields from being updated when they were updated in the admin portal. |
| 1.4.7 | February 26, 2025 | - #8268 Fixes a hang that could occur after signing out which could prevent future sign ins and other actions, possibly with anos error 231 code. |
| 1.4.6 | February 20, 2025 | - #8129 Allows signing-in without access to the local keyring. - #8156 Fixes a race condition that attempted to remove the WinTUN adapter twice upon shutdown. |
| 1.4.5 | February 12, 2025 | - #8105 Fixes a visual regression where the Settings and About window lost their styling attributes. |
| 1.4.4 | February 11, 2025 | - #8035 Shows a non-disruptive toast notification and quits the GUI client in case the IPC service gets shut down through the service manager. - #8083 Fixes a regression introduced in 1.4.3 where Firezone would not work on systems with a disabled IPv6 stack. |
| 1.4.3 | February 5, 2025 | - #8003 Removes dependency on netsh, making sign-in faster.- #7972 Makes DNS configuration more resilient. |
| 1.4.2 | January 30, 2025 | - #7912 Fixes an issue where the tunnel device could not be created, resulting in an immediate sign-out after signing-in. |
| 1.4.1 | January 28, 2025 | - #7551 Fixes an issue where large DNS responses were incorrectly discarded. - #7556 Disables URO/GRO due to hardware / driver bugs. |
| 1.4.0 | December 13, 2024 | - #7210 Adds support for GSO (Generic Segmentation Offload), delivering throughput improvements of up to 60%. - Makes use of the new control protocol, delivering faster and more robust connection establishment. - #7477 Improves connection setup latency by buffering initial packets. |
| 1.3.13 | November 15, 2024 | - #7334 Fixes an issue where symmetric NATs would generate unnecessary candidate for hole-punching. |
| 1.3.12 | November 8, 2024 | - #7288 Fixes an issue where network roaming would cause Firezone to become unresponsive. |
| 1.3.11 | November 5, 2024 | - #7263 Mitigates a crash in case the maximum packet size is not respected. - #7265 Prevents re-connections to the portal from hanging for longer than 5s. |
| 1.3.10 | October 31, 2024 | - Handles DNS queries over TCP correctly. - #7009 The IPC service firezone-client-ipc.exe is now signed.- #7123 Reports the version to the Portal correctly. - #7164 Fixes an issue where Firezone would fail to establish connections to Gateways and the user had to sign-out and in again. |
| 1.3.9 | October 9, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.3.8 | October 8, 2024 | - #6874 Fixes the GUI shutting down slowly. - #6931 Mitigates an issue where ipconfig and WSL weren't aware of Firezone DNS resolvers. Users may need to restart WSL after signing in to Firezone. |
| 1.3.7 | October 2, 2024 | - #6831 Ensures Firefox doesn't attempt to use DNS over HTTPS when Firezone is active. - #6845 Fixes connectivity issues on idle connections by entering an always-on, low-power mode instead of closing them. - #6782 Adds always-on error reporting using sentry.io. - #6874 Fixes a delay when closing the GUI. - #6857 Tries to send motherboard's hardware ID for device verification. |
| 1.3.6 | September 25, 2024 | - #6809 Fixes a bug where non-wildcard DNS resources were not prioritised over wildcard ones (e.g. app.example.com vs*.example.com). |
| 1.3.5 | September 25, 2024 | - #6788 Fixes an issue where some browsers may fail to route DNS Resources correctly. - #6795 Fixes a bug where auto-sign-in with an expired token would cause a "Couldn't send Disconnect" error message. - #6810 Fixes a bug where roaming from Ethernet to WiFi would cause Firezone to fail to connect to the portal. |
| 1.3.4 | September 19, 2024 | - #6765 Fixes a bug where DNS PTR queries by the system did not get answered. - #6722 Fixes a routing bug when one of several overlapping CIDR resources gets disabled / removed. - Improves logging for DNS queries when firezone_tunnel=trace log level is used. |
| 1.3.3 | September 13, 2024 | - #6681 Fixes a bug where sign-in fails if IPv6 is disabled. |
| 1.3.2 | September 6, 2024 | - #6624 Fixes a bug that took down the tunnel when internet resource was missing. |
| 1.3.1 | September 5, 2024 | - #6518 Minor improvements to the look of the internet resource and makes the Internet resource off by default. - #6584 Prevents routing loops for some Windows installation when the Internet resource was on, taking down network connections. |
| 1.3.0 | August 30, 2024 | - #6434 Adds the Internet Resource feature. |
| 1.2.2 | August 29, 2024 | - #6432 Shows an orange dot on the tray icon when an update is ready to download. - #6449 Checks for updates once a day - #6472 Fixes an issue where Split DNS didn't work for domain-joined Windows machines |
| 1.2.1 | August 27, 2024 | - #6414 Waits for Internet to connect to Firezone if there's no Internet at startup and you're already signed in. - #6455 Fixes a false positive warning log at startup about DNS interception being disabled. - #6458 Fixes a bug where we considered our own startup to be a network change event, which may interfere with access to DNS Resources. |
| 1.2.0 | August 21, 2024 | - #5901 Implements glob-like matching of domains for DNS resources. - #6280 Fixes a bug where the "Clear Logs" button did not clear the IPC service logs. - #6308 Fixes a bug where the GUI could not run if the user is Administrator - #6351 The log filter on the IPC service is now reloaded immediately when you change the setting in the GUI. - #6361 Connections to Gateways are now sticky for the duration of the Client's session to fix issues with long-lived TCP connections. |
| 1.1.12 | August 13, 2024 | - #6226 Fixes a bug where clearing the log files would delete the current logfile, preventing logs from being written. - #6276 Fixes a bug where relayed connections failed to establish after an idle period. - #6277 Fixes a bug where restrictive NATs caused connectivity problems. |
| 1.1.11 | August 9, 2024 | - #6233 Fixes an issue where the IPC service can panic during DNS resolution. |
| 1.1.10 | August 8, 2024 | - #5923 Adds the ability to mark Resources as favorites. - #6181 Improves reliability of DNS resolution of non-resources. - #6163 Supports disabling DNS control - #6184 Mitigates a bug where the IPC service can panic if an internal channel fills up |
| 1.1.9 | August 2, 2024 | - #6143 Fixes an issue where DNS queries could time out on some networks. |
| 1.1.8 | August 1, 2024 | - #6051 Fixes "Element not found" error when setting routes. - #6017 Removes keyboard accelerators, which were not working. - #6071 Puts angle brackets around hyperlinks in the menu. |
| 1.1.7 | July 17, 2024 | - #5375 Improves sign-in speed and fixes a DNS leak |
| 1.1.6 | July 12, 2024 | - #5795 Unexpected IPC service stops are now reported as "IPC connection closed". - #5827 Fixes a bug where DNS could stop working when you sign out. - #5817 Shows different tray icons when signed out, signing in, and signed in. |
| 1.1.5 | July 8, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.4 | July 5, 2024 | - #5700 Fixes an issue where a stale DNS cache could prevent traffic from routing to DNS Resources if they were updated while the Client was signed in. |
| 1.1.3 | July 3, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.2 | June 29, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.1 | June 27, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.0 | June 27, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.9 | June 18, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.8 | June 17, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.7 | June 12, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.6 | June 11, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.5 | May 22, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.4 | May 14, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.3 | May 8, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.2 | April 30, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.1 | April 29, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.0 | April 24, 2024 | - This is a maintenance release with no user-facing changes. |
Latest Windows Headless version
Version: 1.5.11
Released:August 10, 2026
Compatible with:Gateways <= 1.6.x
#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time. #14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal. #14301 Improves reconnection speed after a network change. #14396 Fixes an issue where a brief scheduling delay on the TUN worker thread could overflow the WinTUN ring buffer and drop packets under high throughput. #14404 Improves download throughput on Windows by coalescing TCP packets before writing them to the WinTUN adapter. #14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.
Previous Windows Headless versions
| Version | Date | Description |
|---|---|---|
| 1.5.10 | June 25, 2026 | - #13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams. - #13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts. - #13647 Fixes an issue where a full WinTUN ring buffer could stall the send thread far longer than intended, reducing throughput under high load. |
| 1.5.9 | June 9, 2026 | - #13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders. - #13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections. |
| 1.5.8 | April 27, 2026 | - #12684 Takes into account traffic filters when routing packets to resources. |
| 1.5.7 | March 16, 2026 | - #12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time. - #12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error. - #12111 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files. - #11882 Adds the sign-in and sign-out commands to allow authenticating the Client as a normal user via browser-based authentication.- #11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner. - #11584 Improves connection reliability on systems where certain UDP socket features are unavailable. - #11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal. - #11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed. - #12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive. - #12322 Fixes an issue where the WebSocket connection to the control plane was lost under load. |
| 1.5.6 | January 6, 2026 | - #11627 Fixes an issue where reconnections would fail if the portal host is an IP address. - #11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case. - #11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs. - #11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal. - #11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts. |
| 1.5.5 | December 23, 2025 | - #10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected. - #10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped. - #11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable. |
| 1.5.4 | October 16, 2025 | - #10533 Improves reliability by caching DNS responses as per their TTL. - #10553 Adds a CLI switch --activate-internet-resource. By default, the Internet Resource is now off. |
| 1.5.3 | September 10, 2025 | - #10126 Sets FIREZONE_DNS_CONTROL=etc-resolv-conf by default in the headless client Docker image.- #10104 Fixes an issue where DNS resources would resolve to a different IP after signing out and back into Firezone. This would break connectivity for long-running services that don't re-resolve DNS, like SSH sessions or mongoose. |
| 1.5.2 | July 28, 2025 | - #9985 Fixes an issue where control plane messages could be stuck forever on flaky connections, requiring signing out and back in to recover. - #9891 Fixes an issue where connections would sometimes take up to 90s to establish. - #9979 Fixes an issue where connections in low-latency networks (between Client and Gateway) would fail to establish reliably. - #9999 Decreases connection setup time on flaky Internet connections in certain edge cases. |
| 1.5.1 | July 4, 2025 | - #9564 Fixes an issue where connections would fail to establish if both Client and Gateway were behind symmetric NAT. - #9725 Fixes an issue where Firezone failed to sign-in on systems with non-ASCII characters in their kernel build name. - #9696 Establishes connections quicker by narrowing the set of network changes we react to. |
| 1.5.0 | June 5, 2025 | - #9300 Uses the new IP stack setting for DNS resources, which allows DNS resources to optionally return only A or AAAA records if configured by the administrator. - #9147 Fixes an issue where connections failed to establish on machines with multiple valid egress IPs. - #9366 Fixes an issue where Firezone could not start if the operating system refused our request to increase the UDP socket buffer sizes. |
| 1.4.8 | May 14, 2025 | - #9014 Fixes an issue where idle connections would be slow (~60s) in detecting changes to network connectivity. - #9018 Further improves performance of relayed connections on IPv4-only systems. - #9021 Optimizes network change detection. - #9213 Adds the Client to the winget repository. You can install it via winget install Firezone.Client.Headless. |
| 1.4.7 | April 30, 2025 | - #8798 Improves performance of relayed connections on IPv4-only systems. - #8731 Improves throughput performance by requesting socket receive buffers of 10MB. - #8920 Improves connection reliability by maintaining the order of IP packets. - #8935 Improves reliability for upload-intensive connections with many concurrent DNS queries. |
| 1.4.6 | April 15, 2025 | - #7590 Improves performance by moving UDP sockets to a dedicated thread. |
| 1.4.5 | March 14, 2025 | - #8422 Applies the search domain configured in the admin portal, if any. |
| 1.4.4 | March 10, 2025 | - This is a maintenance release with no user-facing changes. |
| 1.4.3 | February 11, 2025 | - #8055 Hides the --check and --exit CLI options from the help output. These are only used internally.- #8083 Fixes a regression introduced in 1.4.2 where Firezone would not work on systems with a disabled IPv6 stack. |
| 1.4.2 | February 10, 2025 | - #8041 Publishes the headless client for Windows. - #8070 Only write logs using ANSI-escape codes if the underlying output stream supports it. |
Latest Android version
Version: 1.5.13
Released:August 10, 2026
Compatible with:Gateways <= 1.6.x
#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time. #14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal. #14054 Reduces memory usage by lowering the size of the UDP socket send and receive queues. #14301 Improves reconnection speed after a network change. #14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.
Previous Android versions
| Version | Date | Description |
|---|---|---|
| 1.5.12 | June 24, 2026 | - #13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams. |
| 1.5.11 | June 12, 2026 | - #13286 Fixes a bug where the app crashed when rotated whilst a resource-detail sheet was open. - #13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders. - #13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections. |
| 1.5.10 | April 28, 2026 | - #12416 Does not send a notification in case the user explicitly signs out. - #12684 Takes into account traffic filters when routing packets to resources. |
| 1.5.9 | March 24, 2026 | - #12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time. - #12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error. - #12111 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files. - #11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner. - #11584 Improves connection reliability on systems where certain UDP socket features are unavailable. - #11627 Fixes an issue where reconnections would fail if the portal host is an IP address. - #11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case. - #11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs. - #11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal. - #11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal. - #11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts. - #11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed. - #12013 Asks for notification permissions on launch. - #11779 Notifies the user when a connection to a resource cannot be established. - #12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive. - #12322 Fixes an issue where the WebSocket connection to the control plane was lost under load. |
| 1.5.8 | December 23, 2025 | - #11077 Fixes an issue where the authentication link would not open in the correct app. - #11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable. |
| 1.5.7 | December 5, 2025 | - #10752 Fixes an issue where the reported client version was out of date. - #10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected. - #10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped. |
| 1.5.6 | October 28, 2025 | - #10667 Fixes an issue where the Tunnel service would crash when trying to connect Firezone without an Internet connection. |
| 1.5.5 | October 18, 2025 | - #10509 Fixes an issue where the Internet Resource could be briefly active on startup, despite it being disabled. - #10533 Improves reliability by caching DNS responses as per their TTL. |
| 1.5.4 | September 18, 2025 | - #10371 Fixes a bug that could prevent sign-ins from completing successfully if Firefox is set as the default browser. - #10104 Fixes an issue where DNS resources would resolve to a different IP after signing out and back into Firezone. This would break connectivity for long-running services that don't re-resolve DNS, like SSH sessions or mongoose. |
| 1.5.3 | August 5, 2025 | - #9985 Fixes an issue where control plane messages could be stuck forever on flaky connections, requiring signing out and back in to recover. - #9725 Fixes an issue where Firezone failed to sign-in on systems with non-ASCII characters in their kernel build name. - #9891 Fixes an issue where connections would sometimes take up to 90s to establish. - #9979 Fixes an issue where connections in low-latency networks (between Client and Gateway) would fail to establish reliably. - #9999 Decreases connection setup time on flaky Internet connections in certain edge cases. |
| 1.5.2 | June 30, 2025 | - #9621 Fixes an issue where the VPN permission screen wouldn't dismiss after granting the VPN permission. - #9564 Fixes an issue where connections would fail to establish if both Client and Gateway were behind symmetric NAT. |
| 1.5.1 | June 4, 2025 | - #9394 Fixes a minor issue that would cause background service panic when signing out. |
| 1.5.0 | June 2, 2025 | - #9300 Uses the new IP stack setting for DNS resources, which allows DNS resources to optionally return only A or AAAA records if configured by the administrator. - #9227 Adds full support for managed configurations to configure the client using your organization's MDM solution. See the knowledge base article for more details. - #9014 Fixes an issue where idle connections would be slow (~60s) in detecting changes to network connectivity. - #9018 Further improves performance of relayed connections on IPv4-only systems. - #9093 Fixes a rare panic when the DNS servers on the system would change while Firezone is connected. - #9147 Fixes an issue where connections failed to establish on machines with multiple valid egress IPs. - #9366 Fixes an issue where Firezone could not start if the operating system refused our request to increase the UDP socket buffer sizes. |
| 1.4.8 | April 30, 2025 | - #8920 Improves connection reliability by maintaining the order of IP packets across GSO batches. - #8926 Rolls over to a new log-file as soon as logs are cleared. - #8935 Improves reliability for upload-intensive connections with many concurrent DNS queries. |
| 1.4.7 | April 21, 2025 | - #8798 Improves performance of relayed connections on IPv4-only systems. |
| 1.4.6 | April 15, 2025 | - #8754 Fixes a performance regression that could lead to packet drops under high load. - #7590 Improves performance by moving UDP sockets to a dedicated thread. |
| 1.4.5 | March 15, 2025 | - #8445 Fixes a bug where search domains changes weren't applied if already signed in. |
| 1.4.4 | March 14, 2025 | - #8436 Applies the search domain configured in the admin portal, if any. |
| 1.4.3 | March 10, 2025 | - #8376 Fixes a bug where UI controls could overlap with system controls on some devices. - #8286 Fixes a bug that prevented certain Resource fields from being updated when they were updated in the admin portal. |
| 1.4.2 | February 16, 2025 | - #8117 Fixes an upload speed performance regression. |
| 1.4.1 | January 28, 2025 | - #7891 Substantially reduces memory usage when sending large amounts of data. |
| 1.4.0 | January 2, 2025 | - #7599 The Android app is now distributed via GitHub Releases in addition to the Google Play Store. - #7334 Fixes an issue where symmetric NATs would generate unnecessary candidate for hole-punching. - #7210 Adds support for GSO (Generic Segmentation Offload), delivering throughput improvements of up to 60%. - Makes use of the new control protocol, delivering faster and more robust connection establishment. - #7477 Improves connection setup latency by buffering initial packets. - #7551 Fixes an issue where large DNS responses were incorrectly discarded. |
| 1.3.7 | November 8, 2024 | - #7263 Mitigates a crash in case the maximum packet size is not respected. - #7265 Prevents re-connections to the portal from hanging for longer than 5s. - #7288 Fixes an issue where network roaming would cause Firezone to become unresponsive. |
| 1.3.6 | October 31, 2024 | - Handles DNS queries over TCP correctly. - #7151 Adds always-on error reporting using sentry.io. - #7160 Fixes an issue where notifications would sometimes not get delivered when Firezone was active. - #7164 Fixes an issue where Firezone would fail to establish connections to Gateways and the user had to sign-out and in again. |
| 1.3.5 | October 3, 2024 | - #6831 Ensures Firefox doesn't attempt to use DNS over HTTPS when Firezone is active. - #6845 Fixes connectivity issues on idle connections by entering an always-on, low-power mode instead of closing them. - #6857 Sends the Firebase Installation ID for device verification. |
| 1.3.4 | September 26, 2024 | - #6809 Fixes a bug where non-wildcard DNS resources were not prioritised over wildcard ones (e.g. app.example.com vs*.example.com). |
| 1.3.3 | September 24, 2024 | - #6707 Resetting the settings now resets the list of favorited Resources, too. - #6765 Fixes a bug where DNS PTR queries by the system did not get answered. - #6722 Fixes a routing bug when one of several overlapping CIDR resources gets disabled / removed. - #6788 Fixes an issue where some browsers may fail to route DNS Resources correctly. |
| 1.3.2 | September 5, 2024 | - #6605 Fixes another bug where the tunnel would immediately disconnect after connecting. - #6518 Minor improvements to the look of the internet resource and makes the Internet resource off by default. |
| 1.3.1 | August 31, 2024 | - #6517 Fixes a bug where the tunnel would immediately disconnect after connecting. |
| 1.3.0 | August 30, 2024 | - #6424 Fixes a bug where packets would be lost when a connection is first established to a gateway, due to routes being updated with no actual change. - #6405 Shows the Git SHA corresponding to the build on the Settings -> Advanced screen. - #6495 Fixes a bug where the Firezone tunnel wasn't shut down properly if you disconnect the VPN in system settings. - #6434 Adds the Internet Resource feature. |
| 1.2.0 | August 21, 2024 | - #5901 Implements glob-like matching of domains for DNS resources. - #6361 Connections to Gateways are now sticky for the duration of the Client's session. This fixes potential issues maintaining long-lived TCP connections to Gateways in a high-availability setup. |
| 1.1.6 | August 13, 2024 | - #6276 Fixes a bug where relayed connections failed to establish after an idle period. - #6277 Fixes a bug where restrictive NATs caused connectivity problems. |
| 1.1.5 | August 10, 2024 | - #6107 Adds the ability to mark Resources as favorites. - #6181 Improves reliability of DNS resolution of non-resources. |
| 1.1.4 | August 2, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.3 | July 6, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.2 | July 3, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.1 | June 29, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.1.0 | June 27, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.4 | June 13, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.3 | June 12, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.2 | April 30, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.1 | April 29, 2024 | - This is a maintenance release with no user-facing changes. |
| 1.0.0 | March 12, 2024 | - This is a maintenance release with no user-facing changes. |
Latest Linux GUI version
Version: 1.5.16
Released:August 10, 2026
Compatible with:Gateways <= 1.6.x
#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time. #14011 Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel. #14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal. #14048 Fixes an issue where the Client could appear to hang when quitting if the tunnel service did not confirm disconnection; it now exits after a short timeout. #14230 Fixes an issue where a failed log export (e.g. a bad destination path, a full disk, or a vanished log file) could terminate the app instead of showing a notification. #14231 Fixes an issue where exporting logs could fail if a log file could not be opened. #14301 Improves reconnection speed after a network change. #14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway. #14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.
Previous Linux GUI versions
Latest Linux Headless version
Version: 1.5.11
Released:August 10, 2026
Compatible with:Gateways <= 1.6.x
Previous Linux Headless versions
Current SHA of Portal and Relays in production: 0cbe7241e264b28ad47cbbd1e4ed45c4408aba88.
Your privacy choices
We use cookieless analytics for basic site measurement. You can also allow persistent analytics and marketing technologies, reject optional tracking, or choose your preferences. See our privacy policy.
Reject optionalChoose preferencesAccept all