Netmaker v1.7.0 Release Notes 🚀
🚀 What’s New
🏢 Multi-Tenancy for MSPs (Organizations & Tenants)
Run multiple customer environments from a single Netmaker server.
• Organizations & tenants — Group customers under an organization; each tenant is an isolated Netmaker environment (networks, devices, users).
• MSP license sync — EE/MSP installs create and update orgs/tenants from the MSP license (including teardown when a tenant is removed from the license). CE and normal Pro accounts continues to use a single local default tenant.
• Scoped access — API and nmctl select the target org/tenant via X-Organization-ID / X-Tenant-ID (--org_id / --tenant_id), with nmctl organization list and nmctl tenant list for discovery.
🔌 TCP Proxy / WSS Uplink
Gateways can publish a TCP/WSS uplink so clients can reach the mesh in restrictive environments when UDP is blocked.
• Enable TCP proxy on the gateway/host (tcp_proxy_enabled and related listen/TLS settings).
• Clients can opt into a TCP uplink to the gateway when the proxy is enabled.
• Supports self-signed and externally terminated TLS modes for WSS endpoints.
🛡️ EDR Integration (Pro)
Connect endpoint detection and response platforms for posture checks from Integrations.
• Supported providers：Microsoft Defender, CrowdStrike, SentinelOne, and Wazuh.
• Sync managed endpoints and evaluate EDR compliance (agent health / risk level) as part of device posture.
• Configure, test, and manage integrations via the REST API (/api/v1/integrations/edr/{provider}).
📱 MDM Integration (Pro)
Connect mobile device management platforms for device compliance posture from Integrations.
• Supported providers：Microsoft Intune, Jamf, JumpCloud, and Iru.
• Match devices by Entra device ID, serial number, hardware UUID, or hostname.
• Enforce MDM enrollment/compliance checks alongside existing posture policies.
• Configure, test, and manage integrations via the REST API (/api/v1/integrations/mdm/{provider}).
🗄️ Database Schema Migration
This release completes the SQL schema path and introduces multi-tenancy (org/tenant) bootstrap as part of the v1.7.0 migration.
Upgrade requirement (existing deployments):
• You must run Netmaker v1.6.0 successfully before upgrading to v1.7.0.
• v1.7.0 will refuse to start if migration-v1.6.0 has not completed on a prior v1.6.0 deployment.
• Recommended path：deploy v1.6.0 → confirm the server starts cleanly → then upgrade to v1.7.0.
Impact:
• Schema and data are updated automatically on successful startup.
• Downgrades may not be supported after migration.
👉 Action Required:
• Do not jump from v1.5.x (or earlier) straight to v1.7.0 on an existing database.
• Ensure migrations complete and validate core functionality post-upgrade.
For detailed upgrade steps, refer to the official upgrade documentation:
Server Upgrades v1.5.1+
🧰 Improvements & Fixes
• Auto-relay peer reset — Reset a specific peer-to-peer connection that is using a relay (clear/reassign auto-relay for that peer pair) without resetting the entire network’s auto-relay state.
• Migration reliability — v1.7.0 blocks startup until v1.6.0 migration completed on existing deployments; migration failures exit cleanly instead of panicking.
• Host status — Host filtering uses live check-in status (Online/Offline/Disconnected) rather than a stale DB value.
• MSP installs — nm-quick.sh -s flag to skip nmctl/mesh/netclient on MSP server installs.
🐞 Known Issues
• IPv6-only machines
Netclients cannot currently auto-upgrade on IPv6-only systems.
• Multi-network join performance
Multi-network netclient joins using an enrollment key still require optimization.
• systemd-resolved DNS limitation
On systems using systemd-resolved in uplink mode, only the first 3 entries in resolv.conf are honored; additional entries are ignored. This may cause DNS resolution issues. Stub mode is recommended.
• Windows Desktop App + mixed gateway modes
When the Windows Desktop App is connected to both:
• a Full Tunnel Gateway, and
• a Split Tunnel Gateway
the gateway monitoring component may disconnect from the Split Tunnel Gateway.
