https://www.firezone.dev/changelog Release notes for every Firezone component: Gateway and the macOS, iOS, Windows, Linux, and Android Clients. en-us https://www.firezone.dev/changelog firezone-changelog:Gateway:1.6.5 Tue, 10 Nov 2026 00:00:00 GMT

#16103 Improves fail-over time in the edge-case that a Client or Gateway exits abnormally.

#16159 Restricts how many concurrent DNS resources a Client can access on a Gateway to 4096 to prevent resource exhaustion.

#16346 Includes firezone-archive-keyring as a "recommended" package to keep the APT keyring current.

#16263 Strips IPv4 options from all packets going through Firezone as a defense-in-depth measure against CVE-2026-98432.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.21 Tue, 10 Nov 2026 00:00:00 GMT

#16103 Improves fail-over time in the edge-case that a Client or Gateway exits abnormally.

#16242 Adds a visual indicator when a settings field gets saved.

#16252 Adds support for a managed config to auto-start the Client when a user signs in to Windows.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.21 Tue, 10 Nov 2026 00:00:00 GMT

#16103 Improves fail-over time in the edge-case that a Client or Gateway exits abnormally.

#16242 Adds a visual indicator when a settings field gets saved.

#16346 Includes firezone-archive-keyring as a "recommended" package to keep the APT keyring current.

#16263 Strips IPv4 options from all packets going through Firezone as a defense-in-depth measure against CVE-2026-98432.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.16 Tue, 10 Nov 2026 00:00:00 GMT

#16103 Improves fail-over time in the edge-case that a Client or Gateway exits abnormally.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.16 Tue, 10 Nov 2026 00:00:00 GMT

#16103 Improves fail-over time in the edge-case that a Client or Gateway exits abnormally.

#16263 Strips IPv4 options from all packets going through Firezone as a defense-in-depth measure against CVE-2026-98432.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.24 Wed, 04 Nov 2026 00:00:00 GMT

#15736 Greatly improves tunnel throughput by parallelizing WireGuard encryption and decryption across worker threads.

#15949 Re-designs the Settings screen to allow selecting between the Firezone US or EU control plane.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.18 Wed, 04 Nov 2026 00:00:00 GMT

#15736 Greatly improves tunnel throughput by parallelizing WireGuard encryption and decryption across worker threads.

#15950 Re-designs the Settings screen to allow selecting between the Firezone US or EU control plane.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.6.4 Thu, 29 Oct 2026 00:00:00 GMT

#15683 Improves gateway performance when translating packets for DNS resources.

#15736 Greatly improves tunnel throughput by parallelizing WireGuard encryption and decryption across worker threads.

#15745 Fixes an issue where traffic matching multiple resources was routed through a less specific resource instead of the most specific allowed resource.

#15842 Fixes an issue where a Gateway could stop receiving network traffic after accumulating ICMP errors.

#16009 Fixes an issue where connections to DNS resources could stop working after a Client exited abnormally.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.20 Thu, 29 Oct 2026 00:00:00 GMT

#15553 Improves packet-routing performance by caching route resolution for established flows.

#15736 Greatly improves tunnel throughput by parallelizing WireGuard encryption and decryption across worker threads.

#15745 Fixes an issue where traffic matching multiple resources was routed through a less specific resource instead of the most specific allowed resource.

#15947 Re-designs the Settings screen to allow selecting between the Firezone US or EU control plane.

#16036 Fixes an issue where managed settings might not be shown in the UI.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.20 Thu, 29 Oct 2026 00:00:00 GMT

#15553 Improves packet-routing performance by caching route resolution for established flows.

#15736 Greatly improves tunnel throughput by parallelizing WireGuard encryption and decryption across worker threads.

#15745 Fixes an issue where traffic matching multiple resources was routed through a less specific resource instead of the most specific allowed resource.

#15947 Re-designs the Settings screen to allow selecting between the Firezone US or EU control plane.

#16036 Fixes an issue where managed settings might not be shown in the UI.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.15 Thu, 29 Oct 2026 00:00:00 GMT

#15553 Improves packet-routing performance by caching route resolution for established flows.

#15681 Fixes an issue where the token file may fail to parse if it was saved with UTF-16 or a byte-order mark.

#15736 Greatly improves tunnel throughput by parallelizing WireGuard encryption and decryption across worker threads.

#15745 Fixes an issue where traffic matching multiple resources was routed through a less specific resource instead of the most specific allowed resource.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.15 Thu, 29 Oct 2026 00:00:00 GMT

#15553 Improves packet-routing performance by caching route resolution for established flows.

#15736 Greatly improves tunnel throughput by parallelizing WireGuard encryption and decryption across worker threads.

#15745 Fixes an issue where traffic matching multiple resources was routed through a less specific resource instead of the most specific allowed resource.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.23 Wed, 21 Oct 2026 00:00:00 GMT

#15553 Improves packet-routing performance by caching route resolution for established flows.

#15745 Fixes an issue where traffic matching multiple resources was routed through a less specific resource instead of the most specific allowed resource.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.17 Wed, 21 Oct 2026 00:00:00 GMT

#15553 Improves packet-routing performance by caching route resolution for established flows.

#15745 Fixes an issue where traffic matching multiple resources was routed through a less specific resource instead of the most specific allowed resource.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.16 Mon, 19 Oct 2026 00:00:00 GMT

#14871 Improves Android app navigation with a faster startup flow, corrected back behavior, and a unified Compose-based settings experience.

#15428 Fixes an issue where connections could fail to connect after a relay rejected an allocation.

#15436 Fixes an issue where failing to initialize the tunnel could leave background threads and file descriptors behind.

#15511 Shows device pools in the resource list instead of all connected device in one view.

#15556 Improves packet-processing performance when flow logging is enabled.

#15557 Improves packet-processing performance by speeding up peer and route lookups.

#15601 Improves packet processing performance by reducing allocations and packet moves during network writes.

#15610 Fixes an issue where wall-clock changes could interrupt connectivity by expiring allocations early.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.6.3 Wed, 14 Oct 2026 00:00:00 GMT

#15428 Fixes an issue where connections could fail to connect after a relay rejected an allocation.

#15556 Improves packet-processing performance when flow logging is enabled.

#15557 Improves packet-processing performance by speeding up peer and route lookups.

#15560 Fixes an issue where the Gateway authentication token file could be readable by other users.

#15601 Improves packet processing performance by reducing allocations and packet moves during network writes.

#15610 Fixes an issue where wall-clock changes could interrupt connectivity by expiring allocations early.

#15614 Fixes an issue where edits to a Resource in the portal were not immediately reflected on the Gateway.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.22 Wed, 14 Oct 2026 00:00:00 GMT

#15428 Fixes an issue where connections could fail to connect after a relay rejected an allocation.

#15436 Fixes an issue where failing to initialize the tunnel could leave background threads and file descriptors behind.

#15480 Fixes an issue where exporting logs on iOS could show a blank share sheet and leave the Export Logs button spinning.

#15481 Fixes an issue where exporting diagnostic logs failed after clearing them until the app was relaunched.

#15507 Stops showing alerts for internal tunnel errors.

#15510 Sends a notification instead of displaying an alert when the session ends.

#15511 Shows device pools in the resource list instead of all connected device in one view.

#15556 Improves packet-processing performance when flow logging is enabled.

#15557 Improves packet-processing performance by speeding up peer and route lookups.

#15561 Improves Apple client tunnel throughput by coalescing consecutive TCP segments before writing them to the system tunnel.

#15601 Improves packet processing performance by reducing allocations and packet moves during network writes.

#15610 Fixes an issue where wall-clock changes could interrupt connectivity by expiring allocations early.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.19 Wed, 14 Oct 2026 00:00:00 GMT

#15428 Fixes an issue where connections could fail to connect after a relay rejected an allocation.

#15508 Replaces the "Firezone disconnected" alert with a notification.

#15511 Shows device pools in the resource list instead of all connected device in one view.

#15556 Improves packet-processing performance when flow logging is enabled.

#15557 Improves packet-processing performance by speeding up peer and route lookups.

#15601 Improves packet processing performance by reducing allocations and packet moves during network writes.

#15610 Fixes an issue where wall-clock changes could interrupt connectivity by expiring allocations early.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.19 Wed, 14 Oct 2026 00:00:00 GMT

#15428 Fixes an issue where connections could fail to connect after a relay rejected an allocation.

#15508 Replaces the "Firezone disconnected" alert with a notification.

#15511 Shows device pools in the resource list instead of all connected device in one view.

#15556 Improves packet-processing performance when flow logging is enabled.

#15557 Improves packet-processing performance by speeding up peer and route lookups.

#15601 Improves packet processing performance by reducing allocations and packet moves during network writes.

#15610 Fixes an issue where wall-clock changes could interrupt connectivity by expiring allocations early.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.14 Wed, 14 Oct 2026 00:00:00 GMT

#15428 Fixes an issue where connections could fail to connect after a relay rejected an allocation.

#15479 Fixes an issue where the Windows Headless Client token file could be read by other local users.

#15556 Improves packet-processing performance when flow logging is enabled.

#15557 Improves packet-processing performance by speeding up peer and route lookups.

#15601 Improves packet processing performance by reducing allocations and packet moves during network writes.

#15610 Fixes an issue where wall-clock changes could interrupt connectivity by expiring allocations early.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.14 Wed, 14 Oct 2026 00:00:00 GMT

#15428 Fixes an issue where connections could fail to connect after a relay rejected an allocation.

#15556 Improves packet-processing performance when flow logging is enabled.

#15557 Improves packet-processing performance by speeding up peer and route lookups.

#15601 Improves packet processing performance by reducing allocations and packet moves during network writes.

#15610 Fixes an issue where wall-clock changes could interrupt connectivity by expiring allocations early.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.6.2 Thu, 24 Sep 2026 00:00:00 GMT

#15070 Moves the Gateway's authenticate, enable-service, and disable-service commands from the separate firezone CLI into firezone-gateway itself.

#15211 Fixes an issue where flow-log files could fill the device's disk when uploads were unavailable or disabled.

#15213 Prevents auto-restarts of the Gateway via systemd if the token is expired.

#15263 Fixes an issue where concurrent DNS queries could be delivered to the wrong device or dropped.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.21 Thu, 24 Sep 2026 00:00:00 GMT

#15194 Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.

#15211 Fixes an issue where flow-log files could fill the device's disk when uploads were unavailable or disabled.

#15263 Fixes an issue where concurrent DNS queries could be delivered to the wrong device or dropped.

#15268 No longer updates the "Account slug" setting with the most recently use account.

#15275 Detects resume-from-sleep and restores connectivity even for cases where the OS fails to notify us.

#15306 Fixes an issue where returning from suspend would not immediately reconnect the tunnel.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.18 Thu, 24 Sep 2026 00:00:00 GMT

#15071 Fixes an issue where the GUI Client's --help, subcommand output, and console logs were silently discarded when launched from a terminal.

#15194 Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.

#15211 Fixes an issue where flow-log files could fill the device's disk when uploads were unavailable or disabled.

#15263 Fixes an issue where concurrent DNS queries could be delivered to the wrong device or dropped.

#15268 No longer updates the "Account slug" setting with the most recently use account.

#15275 Detects resume-from-sleep and restores connectivity even for cases where the OS fails to notify us.

#15301 Prevents a false-positive roaming detection when configuring the Firezone tunnel adapter.

#15306 Fixes an issue where returning from suspend would not immediately reconnect the tunnel.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.18 Thu, 24 Sep 2026 00:00:00 GMT

#15194 Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.

#15211 Fixes an issue where flow-log files could fill the device's disk when uploads were unavailable or disabled.

#15263 Fixes an issue where concurrent DNS queries could be delivered to the wrong device or dropped.

#15268 No longer updates the "Account slug" setting with the most recently use account.

#15275 Detects resume-from-sleep and restores connectivity even for cases where the OS fails to notify us.

#15306 Fixes an issue where returning from suspend would not immediately reconnect the tunnel.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.13 Thu, 24 Sep 2026 00:00:00 GMT

#15194 Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.

#15211 Fixes an issue where flow-log files could fill the device's disk when uploads were unavailable or disabled.

#15263 Fixes an issue where concurrent DNS queries could be delivered to the wrong device or dropped.

#15275 Detects resume-from-sleep and restores connectivity even for cases where the OS fails to notify us.

#15301 Prevents a false-positive roaming detection when configuring the Firezone tunnel adapter.

#15306 Fixes an issue where returning from suspend would not immediately reconnect the tunnel.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.13 Thu, 24 Sep 2026 00:00:00 GMT

#15194 Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.

#15211 Fixes an issue where flow-log files could fill the device's disk when uploads were unavailable or disabled.

#15263 Fixes an issue where concurrent DNS queries could be delivered to the wrong device or dropped.

#15275 Detects resume-from-sleep and restores connectivity even for cases where the OS fails to notify us.

#15306 Fixes an issue where returning from suspend would not immediately reconnect the tunnel.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.15 Thu, 24 Sep 2026 00:00:00 GMT

#15194 Recognizes iru-id SAN claims in device attestation certificates as an alias for kandji-id.

#15211 Fixes an issue where flow-log files could fill the device's disk when uploads were unavailable or disabled.

#15217 Fixes an issue where Android devices without kernel IPv6 support could not connect to Firezone.

#15263 Fixes an issue where concurrent DNS queries could be delivered to the wrong device or dropped.

#15267 Fixes an issue where concurrent service starts would fail to bring up the tunnel.

#15268 No longer updates the "Account slug" setting with the most recently use account.

#15275 Detects resume-from-sleep and restores connectivity even for cases where the OS fails to notify us.

#15281 Fixes an issue where the tunnel fails to start after a device reboot unless the App is opened first.

#15306 Fixes an issue where returning from suspend would not immediately reconnect the tunnel.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.20 Tue, 15 Sep 2026 00:00:00 GMT

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14677 Fixes an issue on macOS where an in-place app update could leave an outdated system extension running.

#14707 Fixes an issue where periodic state polling could repeatedly start and stop the tunnel when the app was disconnected, leaving orphaned network interfaces behind.

#14742 Adds support for device trust backed by X.509 certificates.

#14826 Updates the app icon, menu bar/tray icons, and other in-app logos to the new "F" mark, and gives the macOS menu bar icon a new bar-by-bar animation while connecting and disconnecting.

#14834 Fixes a memory leak when repeated attempts to start the tunnel failed.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#15028 Reduces the time until connectivity is full restored after a network roam.

#14530 Fixes an issue where DNS resources with overlapping domains but mutually-exclusive IP stacks (IPv4-only vs. IPv6-only) could fail to resolve.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.14 Fri, 11 Sep 2026 00:00:00 GMT

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14741 Adds support for device trust backed by X.509 certificates.

#14826 Updates the app icon and other in-app logos to the new "F" mark.

#14834 Fixes a memory leak when repeated attempts to start the tunnel failed.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#14530 Fixes an issue where DNS resources with overlapping domains but mutually-exclusive IP stacks (IPv4-only vs. IPv6-only) could fail to resolve.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.6.1 Mon, 07 Sep 2026 00:00:00 GMT

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14635 Fixes an issue on Linux where attaching to a TUN device already held by another process could split traffic between both processes and corrupt packets; the Client or Gateway now fails to start in that situation instead.

#14827 Auto-creates the /var/lib/firezone directory to ensure that flow logs can be persisted.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14895 Now reports the device serial and UUID.

#14900 Removes the FIREZONE_NAME / -n Gateway option; the Gateway's name is now configured in the Admin Portal instead.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#14970 Fixes an issue where a Client could make the Gateway forward traffic to arbitrary hosts by assigning DNS Resource proxy IPs from outside the reserved ranges.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.17 Mon, 07 Sep 2026 00:00:00 GMT

Adds a native ARM64 installer for Windows on ARM devices.

#14622 Improves update notifications to appear once per Client launch instead of only once per new version. On Linux, update notifications now also trigger the download of the new package right away.

#14738 Adds support for device trust backed by X.509 certificates.

#14826 Updates the app icon, tray icons, and other in-app logos to the new "F" mark.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14881 Fixes an issue where connectivity was not restored after waking from sleep.

#14980 Fixes an issue where DNS queries could not resolve when the Internet Resource was turned on.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#15028 Reduces the time until connectivity is full restored after a network roam.

#15031 Fixes an issue where upgrading from very old installs could prevent the Client's settings from being applied to the Tunnel service.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.17 Mon, 07 Sep 2026 00:00:00 GMT

#14622 Improves update notifications to appear once per Client launch instead of only once per new version. On Linux, update notifications now also trigger the download of the new package right away.

#14635 Fixes an issue on Linux where attaching to a TUN device already held by another process could split traffic between both processes and corrupt packets; the Client or Gateway now fails to start in that situation instead.

#14739 Adds support for device trust backed by X.509 certificates.

#14826 Updates the app icon, tray icons, and other in-app logos to the new "F" mark.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14881 Fixes an issue where connectivity was not restored after waking from sleep.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#15031 Fixes an issue where upgrading from very old installs could prevent the Client's settings from being applied to the Tunnel service.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.12 Mon, 07 Sep 2026 00:00:00 GMT

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14738 Adds support for device trust backed by X.509 certificates.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14881 Fixes an issue where connectivity was not restored after waking from sleep.

#14980 Fixes an issue where DNS queries could not resolve when the Internet Resource was turned on.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#15028 Reduces the time until connectivity is full restored after a network roam.

#14530 Fixes an issue where DNS resources with overlapping domains but mutually-exclusive IP stacks (IPv4-only vs. IPv6-only) could fail to resolve.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.12 Mon, 07 Sep 2026 00:00:00 GMT

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14635 Fixes an issue on Linux where attaching to a TUN device already held by another process could split traffic between both processes and corrupt packets; the Client or Gateway now fails to start in that situation instead.

#14739 Adds support for device trust backed by X.509 certificates.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14881 Fixes an issue where connectivity was not restored after waking from sleep.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#14530 Fixes an issue where DNS resources with overlapping domains but mutually-exclusive IP stacks (IPv4-only vs. IPv6-only) could fail to resolve.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.19 Sat, 15 Aug 2026 00:00:00 GMT

#11820 Adds firezone-cli, a command line interface to the macOS Client for Macs that run unattended or are managed remotely.

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14054 Reduces memory usage by lowering the size of the UDP socket send and receive queues.

#14283 Fixes an issue where packets could get silently dropped instead of being backpressured on high-throughput links (> 2GBit/s).

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14478 Fixes an issue on macOS and iOS where "Resource unreachable" notifications could reappear after roaming or other transient network events.

#14060 Fixes an issue where client-to-client device authorizations would not expire.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.6.0 Mon, 10 Aug 2026 00:00:00 GMT

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14011 Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14153 Lowers the system-wide net.core.wmem_max and net.core.rmem_max values the Gateway sets to 2 MB and 16 MB respectively, reducing the UDP send and receive socket buffer sizes.

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14429 Fixes an issue where traffic to private, link-local, CGNAT, or other non-Internet address ranges could be routed through an Internet Resource Gateway.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.16 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14048 Fixes an issue where the Client could appear to hang when quitting if the tunnel service did not confirm disconnection; it now exits after a short timeout.

#14230 Fixes an issue where a failed log export (e.g. a bad destination path, a full disk, or a vanished log file) could terminate the app instead of showing a notification.

#14231 Fixes an issue where exporting logs could fail if a log file could not be opened.

#14301 Improves reconnection speed after a network change.

#14396 Fixes an issue where a brief scheduling delay on the TUN worker thread could overflow the WinTUN ring buffer and drop packets under high throughput.

#14404 Improves download throughput on Windows by coalescing TCP packets before writing them to the WinTUN adapter.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14060 Fixes an issue where client-to-client device authorizations would not expire.

#14530 Fixes an issue where DNS resources with overlapping domains but mutually-exclusive IP stacks (IPv4-only vs. IPv6-only) could fail to resolve.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.16 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14011 Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14048 Fixes an issue where the Client could appear to hang when quitting if the tunnel service did not confirm disconnection; it now exits after a short timeout.

#14230 Fixes an issue where a failed log export (e.g. a bad destination path, a full disk, or a vanished log file) could terminate the app instead of showing a notification.

#14231 Fixes an issue where exporting logs could fail if a log file could not be opened.

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14060 Fixes an issue where client-to-client device authorizations would not expire.

#14530 Fixes an issue where DNS resources with overlapping domains but mutually-exclusive IP stacks (IPv4-only vs. IPv6-only) could fail to resolve.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.11 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14301 Improves reconnection speed after a network change.

#14396 Fixes an issue where a brief scheduling delay on the TUN worker thread could overflow the WinTUN ring buffer and drop packets under high throughput.

#14404 Improves download throughput on Windows by coalescing TCP packets before writing them to the WinTUN adapter.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14060 Fixes an issue where client-to-client device authorizations would not expire.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.11 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14011 Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14060 Fixes an issue where client-to-client device authorizations would not expire.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.13 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14054 Reduces memory usage by lowering the size of the UDP socket send and receive queues.

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14060 Fixes an issue where client-to-client device authorizations would not expire.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.15 Thu, 25 Jun 2026 00:00:00 GMT

#13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts.

#13835 Fixes an issue where the Client could hang on shutdown if a desktop notification had not been dismissed.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.15 Thu, 25 Jun 2026 00:00:00 GMT

#13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts.

#13835 Fixes an issue where the Client could hang on shutdown if a desktop notification had not been dismissed.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.10 Thu, 25 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

#13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts.

#13647 Fixes an issue where a full WinTUN ring buffer could stall the send thread far longer than intended, reducing throughput under high load.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.10 Thu, 25 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

#13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.18 Wed, 24 Jun 2026 00:00:00 GMT

#13822 Fixes a regression introduced in 1.5.16 where the VPN configuration could go undetected after a first install, prompting the user to install and grant permission again, and where stale errors from a previous attempt could remain on screen after the configuration completed successfully.

#13816 Fixes a crash on iOS where opening a resource detail screen and then having the resource list refresh underneath it — often after a long time in the background — could terminate the app.

#13757 Evaluates a resource's traffic filters on the client and drops disallowed packets locally, preventing a feedback loop of repeated flow-creation requests for traffic the resource's filters never permit.

#13739 Batches reads and writes to the macOS and iOS TUN device into a single syscall per batch, improving throughput and reducing CPU usage on high-traffic connections.

#13725 Adds a per-destination UDP socket pool on macOS and iOS that unlocks Darwin's UDP fast path, enabling send batching and kernel congestion (flow advisory) signals for better throughput.

#13723 Fixes an issue on macOS where checking or registering the login helper could freeze the user interface for several seconds, by moving those calls off the main thread.

#13719 Significantly reduces the memory used by the UDP socket pool by right-sizing receive buffers instead of allocating a fixed 64 KiB per buffer.

#13667 Increases the macOS and iOS TUN read buffer so the kernel can queue more outbound packets between reads, improving upload throughput.

#13666 Retries writes to the TUN device when its queue is momentarily full instead of immediately dropping the packet, reducing packet loss under bursty load on macOS and iOS.

#13648 Fixes an issue on macOS and iOS where the UDP receive buffer size could fail to apply, leaving the client with a much smaller buffer than intended and causing packet drops under load.

#13831 Fixes an issue on a fresh install where the app could get stuck instead of showing the sign-in screen while the system finished registering the VPN configuration.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.12 Wed, 24 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.14 Wed, 17 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

#13726 Fixes an issue where the client failed to launch on Windows 10, and lowers the minimum supported version to Windows 10 2004 (build 19041).

#13744 Fixes an invalid Authenticode signature on the installer and bundled executables caused by the binary being patched after it was signed.

#13647 Fixes an issue where a full WinTUN ring buffer could stall the send thread far longer than intended, reducing throughput under high load.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.14 Wed, 17 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.11 Fri, 12 Jun 2026 00:00:00 GMT

#13286 Fixes a bug where the app crashed when rotated whilst a resource-detail sheet was open.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.17 Thu, 11 Jun 2026 00:00:00 GMT

#13649 Fixes an issue where exporting logs could fail with an error if the log directory contained dangling symlinks.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.9 Tue, 09 Jun 2026 00:00:00 GMT

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.9 Tue, 09 Jun 2026 00:00:00 GMT

#12993 Fixes a bug where connectivity was lost when moving from Ethernet to WiFi.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.13 Mon, 08 Jun 2026 00:00:00 GMT

#13126 Shows currently connected devices in the system tray menu.

#13153 Restricts access to Firezone's configuration directory.

#13275 Restricts the tunnel and GUI named pipes to processes carrying the Firezone MSIX package SID, so other processes running as the same user can no longer drive the tunnel or hijack deep links.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.13 Mon, 08 Jun 2026 00:00:00 GMT

#12993 Fixes a bug where connectivity was lost when moving from Ethernet to WiFi.

#13126 Shows currently connected devices in the system tray menu.

#13323 Restricts the tunnel service IPC socket to the packaged GUI binary using SO_PEERPIDFD, so other processes running as the same user can no longer drive the tunnel.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.16 Wed, 03 Jun 2026 00:00:00 GMT

#13038 Surfaces non-authentication disconnect errors (e.g. failure to reach the portal) to the user via a modal alert instead of silently cancelling the tunnel.

#13282 Moves user-editable settings from UserDefaults into the VPN provider configuration so they can only be modified by Firezone, not by other processes running as the user. MDM-pushed values continue to override these settings.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.10 Tue, 28 Apr 2026 00:00:00 GMT

#12416 Does not send a notification in case the user explicitly signs out.

#12684 Takes into account traffic filters when routing packets to resources.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.5.2 Mon, 27 Apr 2026 00:00:00 GMT

#12506 Fixes an issue where the Gateway would disconnect from a relay under high-load.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.15 Mon, 27 Apr 2026 00:00:00 GMT

#12849 Fixes an issue on macOS where the app could be silently terminated by the system under memory pressure, leaving the tunnel running without a menu bar icon or session expiry notifications.

#12853 Adds a macOS LaunchAgent helper that relaunches Firezone after unexpected exits.

#12657 Falls back to public DNS resolvers when the system provides only non-routable addresses (loopback, link-local), preventing tunnel bootstrap failures.

#12684 Takes into account traffic filters when routing packets to resources.

]]>