https://www.firezone.dev/changelog Release notes for every Firezone component: Gateway and the macOS, iOS, Windows, Linux, and Android Clients. en-us https://www.firezone.dev/changelog firezone-changelog:Android:1.5.14 Fri, 11 Sep 2026 00:00:00 GMT

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14741 Adds support for device trust backed by X.509 certificates.

#14826 Updates the app icon and other in-app logos to the new "F" mark.

#14834 Fixes a memory leak when repeated attempts to start the tunnel failed.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.6.1 Mon, 07 Sep 2026 00:00:00 GMT

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14635 Fixes an issue on Linux where attaching to a TUN device already held by another process could split traffic between both processes and corrupt packets; the Client or Gateway now fails to start in that situation instead.

#14827 Auto-creates the /var/lib/firezone directory to ensure that flow logs can be persisted.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14895 Now reports the device serial and UUID.

#14900 Removes the FIREZONE_NAME / -n Gateway option; the Gateway's name is now configured in the Admin Portal instead.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.17 Mon, 07 Sep 2026 00:00:00 GMT

Adds a native ARM64 installer for Windows on ARM devices.

#14622 Improves update notifications to appear once per Client launch instead of only once per new version. On Linux, update notifications now also trigger the download of the new package right away.

#14738 Adds support for device trust backed by X.509 certificates.

#14826 Updates the app icon, tray icons, and other in-app logos to the new "F" mark.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14881 Fixes an issue where connectivity was not restored after waking from sleep.

#14980 Fixes an issue where DNS queries could not resolve when the Internet Resource was turned on.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#15028 Reduces the time until connectivity is full restored after a network roam.

#15031 Fixes an issue where upgrading from very old installs could prevent the Client's settings from being applied to the Tunnel service.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.17 Mon, 07 Sep 2026 00:00:00 GMT

#14622 Improves update notifications to appear once per Client launch instead of only once per new version. On Linux, update notifications now also trigger the download of the new package right away.

#14635 Fixes an issue on Linux where attaching to a TUN device already held by another process could split traffic between both processes and corrupt packets; the Client or Gateway now fails to start in that situation instead.

#14739 Adds support for device trust backed by X.509 certificates.

#14826 Updates the app icon, tray icons, and other in-app logos to the new "F" mark.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14881 Fixes an issue where connectivity was not restored after waking from sleep.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#15031 Fixes an issue where upgrading from very old installs could prevent the Client's settings from being applied to the Tunnel service.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.12 Mon, 07 Sep 2026 00:00:00 GMT

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14738 Adds support for device trust backed by X.509 certificates.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14881 Fixes an issue where connectivity was not restored after waking from sleep.

#14980 Fixes an issue where DNS queries could not resolve when the Internet Resource was turned on.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

#15028 Reduces the time until connectivity is full restored after a network roam.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.12 Mon, 07 Sep 2026 00:00:00 GMT

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

#14635 Fixes an issue on Linux where attaching to a TUN device already held by another process could split traffic between both processes and corrupt packets; the Client or Gateway now fails to start in that situation instead.

#14739 Adds support for device trust backed by X.509 certificates.

#14869 Shows a more user-friendly message when Firezone fails to connect.

#14881 Fixes an issue where connectivity was not restored after waking from sleep.

#14992 Fixes an issue where DNS-over-HTTPS with the Quad9 resolver could lead to repeated DNS query resolution errors.

#15006 Reduces memory usage of flow-log reporting.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.19 Sat, 15 Aug 2026 00:00:00 GMT

#11820 Adds firezone-cli, a command line interface to the macOS Client for Macs that run unattended or are managed remotely.

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14054 Reduces memory usage by lowering the size of the UDP socket send and receive queues.

#14283 Fixes an issue where packets could get silently dropped instead of being backpressured on high-throughput links (> 2GBit/s).

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14478 Fixes an issue on macOS and iOS where "Resource unreachable" notifications could reappear after roaming or other transient network events.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.6.0 Mon, 10 Aug 2026 00:00:00 GMT

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14011 Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14153 Lowers the system-wide net.core.wmem_max and net.core.rmem_max values the Gateway sets to 2 MB and 16 MB respectively, reducing the UDP send and receive socket buffer sizes.

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14429 Fixes an issue where traffic to private, link-local, CGNAT, or other non-Internet address ranges could be routed through an Internet Resource Gateway.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.16 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14048 Fixes an issue where the Client could appear to hang when quitting if the tunnel service did not confirm disconnection; it now exits after a short timeout.

#14230 Fixes an issue where a failed log export (e.g. a bad destination path, a full disk, or a vanished log file) could terminate the app instead of showing a notification.

#14231 Fixes an issue where exporting logs could fail if a log file could not be opened.

#14301 Improves reconnection speed after a network change.

#14396 Fixes an issue where a brief scheduling delay on the TUN worker thread could overflow the WinTUN ring buffer and drop packets under high throughput.

#14404 Improves download throughput on Windows by coalescing TCP packets before writing them to the WinTUN adapter.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.16 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14011 Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14048 Fixes an issue where the Client could appear to hang when quitting if the tunnel service did not confirm disconnection; it now exits after a short timeout.

#14230 Fixes an issue where a failed log export (e.g. a bad destination path, a full disk, or a vanished log file) could terminate the app instead of showing a notification.

#14231 Fixes an issue where exporting logs could fail if a log file could not be opened.

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

#14545 Fixes an issue where a stale cached DNS resource association could persist across reconnects, causing connections for the resource's domain to be rejected.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.11 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14301 Improves reconnection speed after a network change.

#14396 Fixes an issue where a brief scheduling delay on the TUN worker thread could overflow the WinTUN ring buffer and drop packets under high throughput.

#14404 Improves download throughput on Windows by coalescing TCP packets before writing them to the WinTUN adapter.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.11 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14011 Enables GRO and GSO on the TUN device on Linux kernels 6.2 and later, roughly doubling single-stream TCP throughput through the tunnel.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.13 Mon, 10 Aug 2026 00:00:00 GMT

#13857 Fixes an issue where valid incoming packets could be dropped when one of the UDP sockets reported an error at the same time.

#14026 Speeds up recovery after all relays are lost by immediately requesting a fresh set from the portal.

#14054 Reduces memory usage by lowering the size of the UDP socket send and receive queues.

#14301 Improves reconnection speed after a network change.

#14409 Fixes an issue where a Client could reach another Client through the Internet Resource if both were connected to the same Gateway.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.15 Thu, 25 Jun 2026 00:00:00 GMT

#13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts.

#13835 Fixes an issue where the Client could hang on shutdown if a desktop notification had not been dismissed.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.15 Thu, 25 Jun 2026 00:00:00 GMT

#13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts.

#13835 Fixes an issue where the Client could hang on shutdown if a desktop notification had not been dismissed.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.10 Thu, 25 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

#13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts.

#13647 Fixes an issue where a full WinTUN ring buffer could stall the send thread far longer than intended, reducing throughput under high load.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.10 Thu, 25 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

#13757 Evaluates a resource's traffic filters on the Client, dropping packets that the filters don't permit locally instead of forwarding them to the Gateway. This fixes a feedback loop where disallowed traffic would trigger repeated connection setup attempts.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.18 Wed, 24 Jun 2026 00:00:00 GMT

#13822 Fixes a regression introduced in 1.5.16 where the VPN configuration could go undetected after a first install, prompting the user to install and grant permission again, and where stale errors from a previous attempt could remain on screen after the configuration completed successfully.

#13816 Fixes a crash on iOS where opening a resource detail screen and then having the resource list refresh underneath it — often after a long time in the background — could terminate the app.

#13757 Evaluates a resource's traffic filters on the client and drops disallowed packets locally, preventing a feedback loop of repeated flow-creation requests for traffic the resource's filters never permit.

#13739 Batches reads and writes to the macOS and iOS TUN device into a single syscall per batch, improving throughput and reducing CPU usage on high-traffic connections.

#13725 Adds a per-destination UDP socket pool on macOS and iOS that unlocks Darwin's UDP fast path, enabling send batching and kernel congestion (flow advisory) signals for better throughput.

#13723 Fixes an issue on macOS where checking or registering the login helper could freeze the user interface for several seconds, by moving those calls off the main thread.

#13719 Significantly reduces the memory used by the UDP socket pool by right-sizing receive buffers instead of allocating a fixed 64 KiB per buffer.

#13667 Increases the macOS and iOS TUN read buffer so the kernel can queue more outbound packets between reads, improving upload throughput.

#13666 Retries writes to the TUN device when its queue is momentarily full instead of immediately dropping the packet, reducing packet loss under bursty load on macOS and iOS.

#13648 Fixes an issue on macOS and iOS where the UDP receive buffer size could fail to apply, leaving the client with a much smaller buffer than intended and causing packet drops under load.

#13831 Fixes an issue on a fresh install where the app could get stuck instead of showing the sign-in screen while the system finished registering the VPN configuration.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.12 Wed, 24 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.14 Wed, 17 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

#13726 Fixes an issue where the client failed to launch on Windows 10, and lowers the minimum supported version to Windows 10 2004 (build 19041).

#13744 Fixes an invalid Authenticode signature on the installer and bundled executables caused by the binary being patched after it was signed.

#13647 Fixes an issue where a full WinTUN ring buffer could stall the send thread far longer than intended, reducing throughput under high load.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.14 Wed, 17 Jun 2026 00:00:00 GMT

#13719 Fixes an issue where UDP packets could be dropped under high throughput because the receive buffers were too small to hold a full batch of datagrams.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.11 Fri, 12 Jun 2026 00:00:00 GMT

#13286 Fixes a bug where the app crashed when rotated whilst a resource-detail sheet was open.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.17 Thu, 11 Jun 2026 00:00:00 GMT

#13649 Fixes an issue where exporting logs could fail with an error if the log directory contained dangling symlinks.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.9 Tue, 09 Jun 2026 00:00:00 GMT

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.9 Tue, 09 Jun 2026 00:00:00 GMT

#12993 Fixes a bug where connectivity was lost when moving from Ethernet to WiFi.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.13 Mon, 08 Jun 2026 00:00:00 GMT

#13126 Shows currently connected devices in the system tray menu.

#13153 Restricts access to Firezone's configuration directory.

#13275 Restricts the tunnel and GUI named pipes to processes carrying the Firezone MSIX package SID, so other processes running as the same user can no longer drive the tunnel or hijack deep links.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.13 Mon, 08 Jun 2026 00:00:00 GMT

#12993 Fixes a bug where connectivity was lost when moving from Ethernet to WiFi.

#13126 Shows currently connected devices in the system tray menu.

#13323 Restricts the tunnel service IPC socket to the packaged GUI binary using SO_PEERPIDFD, so other processes running as the same user can no longer drive the tunnel.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

#13623 Fixes an issue where packets written to the TUN device could be reordered under backpressure, reducing throughput on sustained, high-latency connections.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.16 Wed, 03 Jun 2026 00:00:00 GMT

#13038 Surfaces non-authentication disconnect errors (e.g. failure to reach the portal) to the user via a modal alert instead of silently cancelling the tunnel.

#13282 Moves user-editable settings from UserDefaults into the VPN provider configuration so they can only be modified by Firezone, not by other processes running as the user. MDM-pushed values continue to override these settings.

#13354 Retries portal DNS lookups over TCP when the configured resolvers return no usable IPs over UDP, improving connectivity on networks with broken UDP DNS forwarders.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.10 Tue, 28 Apr 2026 00:00:00 GMT

#12416 Does not send a notification in case the user explicitly signs out.

#12684 Takes into account traffic filters when routing packets to resources.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.5.2 Mon, 27 Apr 2026 00:00:00 GMT

#12506 Fixes an issue where the Gateway would disconnect from a relay under high-load.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.15 Mon, 27 Apr 2026 00:00:00 GMT

#12849 Fixes an issue on macOS where the app could be silently terminated by the system under memory pressure, leaving the tunnel running without a menu bar icon or session expiry notifications.

#12853 Adds a macOS LaunchAgent helper that relaunches Firezone after unexpected exits.

#12657 Falls back to public DNS resolvers when the system provides only non-routable addresses (loopback, link-local), preventing tunnel bootstrap failures.

#12684 Takes into account traffic filters when routing packets to resources.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.12 Mon, 27 Apr 2026 00:00:00 GMT

#12684 Takes into account traffic filters when routing packets to resources.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.12 Mon, 27 Apr 2026 00:00:00 GMT

#12684 Takes into account traffic filters when routing packets to resources.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.8 Mon, 27 Apr 2026 00:00:00 GMT

#12684 Takes into account traffic filters when routing packets to resources.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.8 Mon, 27 Apr 2026 00:00:00 GMT

#12684 Takes into account traffic filters when routing packets to resources.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.9 Tue, 24 Mar 2026 00:00:00 GMT

#12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time.

#12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error.

#12111 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files.

#11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner.

#11584 Improves connection reliability on systems where certain UDP socket features are unavailable.

#11627 Fixes an issue where reconnections would fail if the portal host is an IP address.

#11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case.

#11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs.

#11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal.

#11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal.

#11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts.

#11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed.

#12013 Asks for notification permissions on launch.

#11779 Notifies the user when a connection to a resource cannot be established.

#12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive.

#12322 Fixes an issue where the WebSocket connection to the control plane was lost under load.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.14 Tue, 17 Mar 2026 00:00:00 GMT

#12407 Fixes update notification dismissal on macOS where dismissing one version could be ignored due to reading from the wrong UserDefaults key.

#12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time.

#12236 Fixes an issue on macOS where the app could get stuck on the loading spinner if the system extension was not ready at startup.

#12279 Bumps minimum iOS version from 15.6 to 16.0 to enable SwiftUI NavigationStack and NavigationSplitView API.

#12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error.

#12016 Uses the system's DNS resolver ordering on macOS for more accurate DNS resolution behavior.

#11988 Fixes a crash if the currently active log file gets deleted.

#11779 Notifies the user when a connection to a resource cannot be established.

#12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive.

#12322 Fixes an issue where the WebSocket connection to the control plane was lost under load.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.5.1 Mon, 16 Mar 2026 00:00:00 GMT

#12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time.

#12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error.

#12134 Fixes an issue where outdated and thus irrelevant candidates were sent to Clients, causing connectivity issues in rare situations.

#12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive.

#12322 Fixes an issue where the WebSocket connection to the control plane was lost under load.

#12504 Greatly improves performance for cases where many Clients (100+) are connected to a single Gateway.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.11 Mon, 16 Mar 2026 00:00:00 GMT

#12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time.

#12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error.

#12111 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files.

#11779 Notifies the user when a connection to a resource cannot be established.

#12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive.

#12322 Fixes an issue where the WebSocket connection to the control plane was lost under load.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.11 Mon, 16 Mar 2026 00:00:00 GMT

#12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time.

#12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error.

#12111 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files.

#11779 Notifies the user when a connection to a resource cannot be established.

#12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive.

#12322 Fixes an issue where the WebSocket connection to the control plane was lost under load.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.7 Mon, 16 Mar 2026 00:00:00 GMT

#12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time.

#12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error.

#12111 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files.

#11882 Adds the sign-in and sign-out commands to allow authenticating the Client as a normal user via browser-based authentication.

#11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner.

#11584 Improves connection reliability on systems where certain UDP socket features are unavailable.

#11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal.

#11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed.

#12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive.

#12322 Fixes an issue where the WebSocket connection to the control plane was lost under load.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.7 Mon, 16 Mar 2026 00:00:00 GMT

#12355 Reduces CPU overhead by processing up to 16 UDP datagram batches at a time.

#12251 Gracefully handles WebSocket closes from the portal instead of logging a deserialization error.

#12111 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files.

#11882 Adds the sign-in and sign-out commands to allow authenticating the Client as a normal user via browser-based authentication.

#11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner.

#11584 Improves connection reliability on systems where certain UDP socket features are unavailable.

#11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal.

#11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed.

#12248 Re-establishes the WebSocket connection to the control plane if it becomes unresponsive.

#12322 Fixes an issue where the WebSocket connection to the control plane was lost under load.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.5.0 Mon, 02 Feb 2026 00:00:00 GMT

#11771 BREAKING: Remove support for Firezone 1.3.x Clients and lower.

#11770 Enables detailed flow logs for tunneled TCP and UDP connections. SetFIREZONE_FLOW_LOGS=true or --flow-logs to enable.

#11664 Adds a FIREZONE_MAX_PARTITION_TIME environment variable to configure how long the Gateway will retry connecting to the portal before exiting. Accepts human-readable durations like 5m, 1h, or 30d. Defaults to 24 hours.

#11625 Fails faster when the initial connection to the control plane cannot be established, allowing faster restarts by the process manager.

#11584 Improves connection reliability on systems where certain UDP socket features are unavailable.

#11627 Fixes an issue where reconnections would fail if the portal host is an IP address.

#11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case.

#11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs.

#11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal.

#11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.10 Mon, 02 Feb 2026 00:00:00 GMT

#11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner.

#11584 Improves connection reliability on systems where certain UDP socket features are unavailable.

#11627 Fixes an issue where reconnections would fail if the portal host is an IP address.

#11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case.

#11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs.

#11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal.

#11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal.

#11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts.

#11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.10 Mon, 02 Feb 2026 00:00:00 GMT

#11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner.

#11584 Improves connection reliability on systems where certain UDP socket features are unavailable.

#11627 Fixes an issue where reconnections would fail if the portal host is an IP address.

#11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case.

#11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs.

#11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal.

#11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal.

#11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts.

#11813 Fixes an issue where notifications would not always be displayed.

#11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.13 Fri, 30 Jan 2026 00:00:00 GMT

#11901 Fixes an issue where the tunnel may not come up after a fresh install of the Firezone client.

#11892 Exports logs in plain text format instead of JSONL for easier reading.

#11834 Fixes an issue where the tunnel might hang or crash on iOS immediately after signing in.

#11659 Prevents unbounded log growth by enforcing a 100 MB log size cap with automatic cleanup of oldest files.

#11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts.

#11891 Fixes an issue where cached IPv6 addresses for a resource got returned for IPv4-only DNS resources if the setting was only changed after a DNS query had already been processed.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.12 Tue, 20 Jan 2026 00:00:00 GMT

#11735 Fixes an issue on iOS where the system resolvers could not be reliably read, causing DNS queries to fail system-wide.

#11625 Fails faster when the initial connection to the control plane cannot be established, allowing the user to retry sooner.

#11634 Bumps minimum macOS version from 12.4 to 13.0 (Ventura) to enable SwiftUI MenuBarExtra API.

#11584 Improves connection reliability on systems where certain UDP socket features are unavailable.

#11627 Fixes an issue where reconnections would fail if the portal host is an IP address.

#11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case.

#11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs.

#11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal.

#11654 Implements retry with exponential backoff for anything but 401 responses. For example, this allows Firezone to automatically sign-in even if Internet Access is gated by a captive portal.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.6 Tue, 06 Jan 2026 00:00:00 GMT

#11627 Fixes an issue where reconnections would fail if the portal host is an IP address.

#11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case.

#11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs.

#11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal.

#11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.6 Tue, 06 Jan 2026 00:00:00 GMT

#11627 Fixes an issue where reconnections would fail if the portal host is an IP address.

#11626 Fixes an issue where reconnecting to the portal would fail if the DNS resolver list was empty due to a network reset or other edge case.

#11595 Passes the authentication token in the x-authorization header instead of in the URL, improving rate limiting for users behind shared IPs.

#11594 Implements retry with exponential backoff on 429 (Too Many Requests) responses from the portal.

#11804 Fixes an issue where connections would flap between relayed and direct, causing WireGuard connection timeouts.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.4.19 Tue, 23 Dec 2025 00:00:00 GMT

#10972 Fixes an issue where IPv6-only DNS resources could not be reached.

#11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable.

#11208 Fixes an issue where the Gateway could reboot when the WebSocket connection to the portal got cut.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.11 Tue, 23 Dec 2025 00:00:00 GMT

#11141 Fixes an issue where spurious resource updates would result in perceived network interruptions resulting in errors like ERR_NETWORK_CHANGED in Google Chrome.

#11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable.

]]> https://www.firezone.dev/changelog firezone-changelog:Windows GUI:1.5.9 Tue, 23 Dec 2025 00:00:00 GMT

#10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected.

#10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped.

#11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux GUI:1.5.9 Tue, 23 Dec 2025 00:00:00 GMT

#10742 Fixes an issue where CIDR/IP resources whose routes conflict with the local network were not routable.

#10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected.

#10849 Fixes some rendering issues on Wayland-only systems.

#10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped.

#11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable.

#11243 Fixes an issue where upgrading from version 1.5.8 on Fedora fails due to a bad scriptlet. To uninstall version 1.5.8, use sudo dnf remove firezone-client-gui --setopt=tsflags=noscripts

]]> https://www.firezone.dev/changelog firezone-changelog:Windows Headless:1.5.5 Tue, 23 Dec 2025 00:00:00 GMT

#10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected.

#10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped.

#11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable.

]]> https://www.firezone.dev/changelog firezone-changelog:Linux Headless:1.5.5 Tue, 23 Dec 2025 00:00:00 GMT

#10742 Fixes an issue where CIDR/IP resources whose routes conflict with the local network were not routable.

#10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected.

#10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped.

#11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.8 Tue, 23 Dec 2025 00:00:00 GMT

#11077 Fixes an issue where the authentication link would not open in the correct app.

#11115 Fixes an issue where Firezone would not connect if an IPv6 interface is present but not routable.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.7 Fri, 05 Dec 2025 00:00:00 GMT

#10752 Fixes an issue where the reported client version was out of date.

#10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected.

#10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped.

]]> https://www.firezone.dev/changelog firezone-changelog:macOS / iOS:1.5.10 Thu, 04 Dec 2025 00:00:00 GMT

#10986 Fixes a minor race condition that could arise on sign out.

#10855 Fixes an issue on macOS where the utun index would auto-increment by itself on configuration updates.

#10752 Fixes an issue where the reported client version was out of date.

#10773 Fixes an issue where the order of upstream / system DNS resolvers was not respected.

#10824 Adds support for hideResourceList managed configuration key to hide the Resource List in the macOS and iOS apps.

#10914 Fixes an issue where concurrent DNS queries with the same ID would be dropped.

#10965 Fixes an issue where some packets would get dropped under high throughput scenarios.

]]> https://www.firezone.dev/changelog firezone-changelog:Gateway:1.4.18 Mon, 10 Nov 2025 00:00:00 GMT

#10620 Adds a --log-format CLI option to output logs as JSON.

#10796 Fixes an issue where packets for DNS resources would be routed to stale IPs after DNS record changes.

]]> https://www.firezone.dev/changelog firezone-changelog:Android:1.5.6 Tue, 28 Oct 2025 00:00:00 GMT

#10667 Fixes an issue where the Tunnel service would crash when trying to connect Firezone without an Internet connection.

]]>