June focused on data-plane performance and correctness: packet I/O got faster, backpressure stopped reordering traffic, and flow logs became incremental and structured. We also shipped first-party Nix packages and brought connected-device visibility to Apple clients.

## [Faster Packet I/O](/content/devlog/2026-06#faster-packet-io/index.html)

On macOS and iOS, Firezone previously exchanged packets with the `utun` device one syscall at a time.  
The Apple TUN implementation now batches reads and writes with `recvmsg_x` and `sendmsg_x`, moving a group of datagrams under one socket lock and substantially reducing syscall overhead.[1](/content/devlog/2026-06#user-content-fn-1/index.html)

The main connlib event loop also drains several inbound UDP batches per poll.[2](/content/devlog/2026-06#user-content-fn-2/index.html)  
In local testing at 1.6 Gbit/s, this reduced receive-path wakeups by about 68% and whole-run context switches by 23%, without increasing per-byte compute.

## [Correct Packet Ordering Under Backpressure](/content/devlog/2026-06#correct-packet-ordering-under-backpressure/index.html)

A full TUN channel could cause newer packets to overtake packets already waiting in connlib's outbound buffer.  
At high latency, TCP interpreted that reordering as loss, triggering retransmits and repeatedly collapsing the congestion window.

TUN writes now stay in order: the fast path is only used when no earlier packet is buffered or being flushed.[3](/content/devlog/2026-06#user-content-fn-3/index.html)  
Related fixes retry TUN writes when Linux or Apple reports a full device queue and track drops when backpressure cannot be recovered.[4](/content/devlog/2026-06#user-content-fn-4/index.html)

## [Structured, Incremental Flow Logs](/content/devlog/2026-06#structured-incremental-flow-logs/index.html)

Flow logging now records typed rows instead of opaque payloads and reports both the opening and closing of a flow.[5](/content/devlog/2026-06#user-content-fn-5/index.html)  
Each record carries a portal-signed, per-flow token that supplies its attribution, and repeat reports complete or no-op against the same flow instead of creating duplicates.

This lays the groundwork for searchable flow history and reliable delivery to external logging systems while tolerating clock skew between endpoints.

## [First-Party Nix Packages](/content/devlog/2026-06#first-party-nix-packages/index.html)

Firezone now publishes a first-party Nix flake and NixOS modules for the Gateway, headless client, and GUI client.[6](/content/devlog/2026-06#user-content-fn-6/index.html)  
Users can pin a Firezone release and consume signed binary closures from `artifacts.firezone.dev`, avoiding the delay of waiting for community packages to catch up.
Versions and the Rust toolchain come from the repository's existing release files, so the Nix definitions stay aligned automatically.

## [Connected Devices on macOS and iOS](/content/devlog/2026-06#connected-devices-on-macos-and-ios/index.html)

The Apple clients now show the device peers with active connections, matching the Windows and Linux clients.[7](/content/devlog/2026-06#user-content-fn-7/index.html)  
macOS exposes a Devices submenu in the menu bar, while iOS shows the same information in the app; tunnel IPs, client IDs, and device pools are all copyable.

## [Other Notable Changes](/content/devlog/2026-06#other-notable-changes/index.html)

- Windows and Linux tray menus replaced text markers with clear online, offline, and unknown status icons.[8](/content/devlog/2026-06#user-content-fn-8/index.html)  
- Concurrent TCP DNS requests now get unique upstream query IDs, fixing failures caused by Windows using ID 1 for every TCP query.[9](/content/devlog/2026-06#user-content-fn-9/index.html)  
- The PostHog and Sentry clients now resolve lazily through bootstrap DNS and reconnect after DNS or network changes instead of pinning a startup address forever.[10](/content/devlog/2026-06#user-content-fn-10/index.html)

* * *

## [Footnotes](/content/devlog/2026-06#footnote-label/index.html)

01. [feat(tun): batch Apple TUN I/O](https://github.com/firezone/firezone/pull/13739) [↩](/content/devlog/2026-06#user-content-fnref-1/index.html)

02. [perf(connlib): batch-read and chain UDP datagram batches](https://github.com/firezone/firezone/pull/13858) [↩](/content/devlog/2026-06#user-content-fnref-2/index.html)

03. [fix(connlib): keep TUN writes in order under backpressure](https://github.com/firezone/firezone/pull/13623) [↩](/content/devlog/2026-06#user-content-fnref-3/index.html)

04. [fix(connlib): retry TUN writes on ENOSPC and track drops](https://github.com/firezone/firezone/pull/13666) [↩](/content/devlog/2026-06#user-content-fnref-4/index.html)

05. [feat(portal): per-flow ingest tokens and incremental flow logs](https://github.com/firezone/firezone/pull/13759) [↩](/content/devlog/2026-06#user-content-fnref-5/index.html)

06. [feat: add first-party Nix packages and NixOS modules](https://github.com/firezone/firezone/pull/13675) [↩](/content/devlog/2026-06#user-content-fnref-6/index.html)

07. [feat(apple): show connected devices in macOS and iOS clients](https://github.com/firezone/firezone/pull/13439) [↩](/content/devlog/2026-06#user-content-fnref-7/index.html)

08. [feat(gui-client): add status icons to site menu](https://github.com/firezone/firezone/pull/13542) [↩](/content/devlog/2026-06#user-content-fnref-8/index.html)

09. [fix(connlib): rewrite query IDs of upstream TCP DNS queries](https://github.com/firezone/firezone/pull/13664) [↩](/content/devlog/2026-06#user-content-fnref-9/index.html)

10. [feat(telemetry): self-healing PostHog and Sentry ingest client](https://github.com/firezone/firezone/pull/13808) [↩](/content/devlog/2026-06#user-content-fnref-10/index.html)