May brought Client-to-Client connections closer to production readiness, made connected devices visible from the desktop clients, hardened local IPC on Windows and Linux, and opened audit logs through the REST API.

## Client-to-Client Traffic Enforcement

Static device pools let a client act as a Resource, which means the receiving client—not a Gateway—has to enforce the policy. Connlib now compiles each pool's traffic filters on the receiving peer and keeps conntrack-style state so return traffic is allowed without accidentally granting the destination device access back to the initiator.[1](/content/devlog/2026-05#user-content-fn-1/index.html)

Filter changes also propagate to already-connected pool members.[2](/content/devlog/2026-05#user-content-fn-2/index.html) If an administrator tightens a pool's filters, newly forbidden traffic is rejected immediately instead of continuing until the connection is rebuilt.

## See Connected Devices from the Client

The Windows and Linux system trays now include a Devices submenu that shows peers connected through device-pool Resources.[3](/content/devlog/2026-05#user-content-fn-3/index.html) Each entry includes the client ID and its pools, while large lists are capped in the menu with a total count so the tray remains usable.

This makes Client-to-Client activity visible without requiring an administrator to inspect the portal and provides a quick way to copy the tunnel address or peer identifier while troubleshooting.

## Stronger Local IPC Boundaries

On Windows, Firezone now ships a signed sparse MSIX inside the existing MSI.[4](/content/devlog/2026-05#user-content-fn-4/index.html) The package gives the GUI a kernel-tracked identity that can be used to restrict access to its named pipes to the installed, signed Firezone binary. Follow-up changes applied that identity to the pipe ACLs and rejected cross-user GUI connections.[5](/content/devlog/2026-05#user-content-fn-5/index.html)

Linux received a similar defense using `SO_PEERPIDFD`.[6](/content/devlog/2026-05#user-content-fn-6/index.html) On kernels 6.5 and newer, the tunnel daemon resolves the executable on the other end of its Unix socket without a PID-reuse race and only accepts the installed Firezone GUI.

## Audit Logs via REST API

Change logs are now available from the REST API with filters for time range, actor ID, and actor email.[7](/content/devlog/2026-05#user-content-fn-7/index.html) Client and Gateway sessions were added to the audit trail as well,[8](/content/devlog/2026-05#user-content-fn-8/index.html) preserving a record even when the underlying token and session rows are later cleaned up.

## More Resilient Portal DNS

Some networks block UDP/53 or run DNS forwarders that return unusable responses. When a portal lookup fails over UDP, connlib now retries it over TCP unless the resolver returned a definitive NXDOMAIN.[9](/content/devlog/2026-05#user-content-fn-9/index.html) That gives clients another path to reach the portal on networks with broken UDP DNS handling.

* * *

## Footnotes

1. [feat(connlib): enforce filters and conntrack on clients](https://github.com/firezone/firezone/pull/13118)  [↩](/content/devlog/2026-05#user-content-fnref-1/index.html)

2. [fix(connlib): apply device-pool filter changes to members](https://github.com/firezone/firezone/pull/13418)  [↩](/content/devlog/2026-05#user-content-fnref-2/index.html)

3. [feat(client): show connected devices in tray](https://github.com/firezone/firezone/pull/13126)  [↩](/content/devlog/2026-05#user-content-fnref-3/index.html)

4. [feat(windows): build and register sparse MSIX from MSI installer](https://github.com/firezone/firezone/pull/13274)  [↩](/content/devlog/2026-05#user-content-fnref-4/index.html)

5. [feat(windows): pin pipe DACLs to MSIX package SID](https://github.com/firezone/firezone/pull/13275)  [↩](/content/devlog/2026-05#user-content-fnref-5/index.html)

6. [feat(gui/linux): allowlist tunnel IPC peers via SO_PEERPIDFD](https://github.com/firezone/firezone/pull/13323)  [↩](/content/devlog/2026-05#user-content-fnref-6/index.html)

7. [feat(portal): change logs REST API](https://github.com/firezone/firezone/pull/13432)  [↩](/content/devlog/2026-05#user-content-fnref-7/index.html)

8. [feat(portal): add client and Gateway sessions to audit log](https://github.com/firezone/firezone/pull/13146)  [↩](/content/devlog/2026-05#user-content-fnref-8/index.html)

9. [feat(connlib): retry portal DNS lookups over TCP](https://github.com/firezone/firezone/pull/13354)  [↩](/content/devlog/2026-05#user-content-fnref-9/index.html)