Nebula

No entries match these filters. Clear filters

1. v1.12.0 Oct 29, 2026 · issue 125

   Nebula adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. offloads, a local control API with nebula ctl, FIPS 140-3FIPS 140-3A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. mode, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. thread pinning, and experimental split-DNS support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.12.0 https://github.com/slackhq/nebula.git
   # already have the repo? check out this version:
   $ git checkout v1.12.0

   └──▷ USE IT
   Opt into Linux kernel offloads to reduce CPU overhead on high-throughput Nebula nodes.
   /etc/nebula/config.yaml copy

   tun:
     use_offloads: true
   
   listen:
     udp_offloads: true

   Spread I/O routines across physical performance cores to reduce latency jitter on multi-core Linux hosts.
   /etc/nebula/config.yaml copy

   routines: 4
   
   tun:
     pin_threads: true
     pin_threads_key: pid

   Inspect the certificate and VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. identity of a peer from the local host without an SSH session.
   copy

   $ nebula ctl print-cert

   • Enable Linux TUN offloads (TSO/USO) and UDP GSO/GRO for higher throughput with tun.use_offloads and listen.udp_offloads in config (off by default; will be on by default in a future release).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Pin each I/O routine's thread to a CPU on Linux when routines is above 1, controlled by tun.pin_threads (default true), tun.pin_threads_key (pid or port), and tun.cpu_affinity.
   • Access every SSH debug command through a new local control socket via nebula ctl <command>, with access restricted to the running user, root, or a group named in local_api.control.group; set a per-instance path with local_api.control.socket.
   • Query node identity over HTTP through the new opt-in info socket: GET /v1/identity for the local node, GET /v1/identity/<vpn addr> for another host, and /pem under either path for the certificate.
   • Build CGO-free FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 binaries with make fips140 or make release-fips140; these restrict operation to P256 certificates and AES, and nebula-cert ca and keygen default to -curve P256 in those builds.

   +2 more show less

   • Configure split DNS or full DNS override with the experimental dns stanza, pointing the host resolver at dns.nameservers for dns.match_domains or all lookups (macOS and Windows only, off by default).
   • Nebula now batches outbound UDP sends on Linux, up to 128 packets per sendmmsg call.
   • Enable Linux TUN offloads (TSO/USO) and UDP GSO/GRO for higher throughput with tun.use_offloads and listen.udp_offloads in config (off by default; will be on by default in a future release).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Pin each I/O routine's thread to a CPU on Linux when routines is above 1, controlled by tun.pin_threads (default true), tun.pin_threads_key (pid or port), and tun.cpu_affinity.
   • Access every SSH debug command through a new local control socket via nebula ctl <command>, with access restricted to the running user, root, or a group named in local_api.control.group; set a per-instance path with local_api.control.socket.
   • Query node identity over HTTP through the new opt-in info socket: GET /v1/identity for the local node, GET /v1/identity/<vpn addr> for another host, and /pem under either path for the certificate.
   • Build CGO-free FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 binaries with make fips140 or make release-fips140; these restrict operation to P256 certificates and AES, and nebula-cert ca and keygen default to -curve P256 in those builds.

   +1 more show less

   • Configure split DNS or full DNS override with the experimental dns stanza, pointing the host resolver at dns.nameservers for dns.match_domains or all lookups (macOS and Windows only, off by default).

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Building Nebula or embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. it as a library now requires Go v1.27.3.
   • !A firewall rule group that YAML reads as a float, a date, a map, or a nested array is now rejected on startup and reload instead of being silently converted to a string (e.g. group: 1.10 used to match group 1.1). A null group or groups is rejected when no host, other group, or cidr limits the rule.
   • !A pki.blocklist entry that is not a hex SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. fingerprint now causes Nebula to refuse to start and fail a reload.
   • !On Linux, Nebula refuses a tun.dev that already exists (including a persistent device created with ip tuntap add or systemd-networkd); remove it and let Nebula create the device.
   • !tun.mtu and any route mtu above 8937 is capped to 8937 with a warning.
   • !SSH debug server commands now exit with status 1 when they refuse; with -json or -pretty they report refusal as {"ok":false,"reason":...}. Every command now accepts -json and -pretty.
   • !nebula and nebula-service refuse to start when given an argument that is not a flag (previously ignored).
   • !Embedders: config.C.RegisterReloadCallback callbacks now take (*config.C, *config.Reload); ReloadConfig and ReloadConfigString return a config.ReloadResult; ReloadConfigString used to return an error, now it is the result's Err.
   • !Embedders: overlay.Device no longer embeds io.ReadWriteCloser; NewMultiQueueReader and SupportsMultiqueue are replaced by Queues; udp.Conn gained WriteBatch, IPv4Only; ListenOut takes a flush callback; ReloadConfig takes a *config.Reload; udp.NewListener and udp.NewGenericListener take a udp.Settings.
   • !Embedders: SSH debug commands moved to the new commands package; sshd.RegisterCommand and sshd.Command are removed; sshd.NewSSHServer takes a *commands.Registry; firewall.ProtoTCP, ProtoUDP, ProtoICMP, and ProtoICMPv6 are now iputil.IPProtocol*.
   • !The SSH debug server's start-cpu-profile, stop-cpu-profile, save-heap-profile, save-mutex-profile, and mutex-profile-fraction commands, and sshd.sandbox_dir, are removed.
2. v1.11.0 Jul 23, 2026 · issue 024

   Nebula v1.11.0 adds macOS network-change rebinding, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. rejects, stdin/stdout cert I/O, and six breaking config changes.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.11.0 https://github.com/slackhq/nebula.git
   # already have the repo? check out this version:
   $ git checkout v1.11.0

   └──▷ USE IT
   Keep macOS laptops connected when they roam between wifi and wired — disable the default rebind behaviour only if your environment requires it.
   yaml copy

   # In config.yml — omit or set to true to enable (the default)
   listen:
     rebind_on_network_change: true

   • Adds automatic listener rebind and lighthouse re-query on macOS when the underlay network changes (wifi↔wired), controlled by listen.rebind_on_network_change (default true).
   • Generates IPv6 reject packets for blocked traffic, matching existing IPv4 reject behavior.
   • Accepts - as a path in nebula-cert subcommands to read from stdin or write to stdout.
   • Searches for both config.yml and config.yaml automatically in service and CLI modes.
   • Adds version labels to Docker/OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. images.

   +8 more show less

   • Signs Windows release binaries.
   • Supports port-free ICMP firewall rules — port is no longer required in ICMP rule definitions.
   • Tracks ICMP traffic per-flow via connection tracking.
   • Returns NODATA instead of NXDOMAIN from the embedded DNS server when a name exists but lacks the requested record type, fixing AAAA-first resolvers (busybox/Alpine).
   • Records the local Nebula host's own details in the DNS server.
   • Reloads the firewall automatically when unsafe networks in the certificate change, without requiring a restart.
   • Triggers an immediate lighthouse update when reconnecting to or adding a lighthouse instead of waiting for the next tick.
   • Adds Control.Wait, a new API method that blocks until Nebula has fully stopped and returns the first fatal reader error.

   13 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Logging has switched from logrus to Go's structured slog: log levels are now upper case (level=INFO), trace prints as level=DEBUG-4, timestamps are always RFC3339Nano, logging.timestamp_format is ignored, and some messages were reworded. Embedders must update constructors to accept *slog.Logger.
   • !firewall.inbound_action and firewall.outbound_action were each applied to the opposite direction; this is now corrected. If you set either, you are currently getting the behavior of the other and likely need to swap them before upgrading.
   • !On Windows, Nebula now installs WFP PERMIT filters for the nebula adapter and listener port by default, bypassing Windows Defender Firewall (WDF) inbound rules for those. Set tun.windows_bypass_wdf and listen.windows_bypass_wdf to false to leave WDF in charge.
   • !On Windows, the Nebula device network category is now set to private instead of whatever Windows chose (usually Public). Set tun.network_category to unset to keep the old behavior.
   • !Reject packets for non-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. traffic now use ICMP code 13 (communication administratively prohibited) instead of code 3 (port unreachable). Anything keying off the old code needs updating.
   • !The SSH debug server's profiling commands (start-cpu-profile, save-heap-profile, save-mutex-profile) are now confined to sshd.sandbox_dir (default $TMP/nebula-debug). Absolute paths outside that directory are rejected; the directory is not created automatically. Scripts using paths elsewhere must set sshd.sandbox_dir accordingly.
3. advisory CVE-2026-25793 Feb 6, 2026 · issue 128
   • CVE-2026-25793: Blocklist Bypass possible via ECDSAECDSAThe elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace. Signature Malleability (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.1, affects >= 1.7.0, <= 1.10.2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
4. v1.10.1 Jan 16, 2026 · release notes

   Nebula v1.10.1 adds a config option to control acceptance of recv_error packets.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.10.1 https://github.com/slackhq/nebula.git
   # already have the repo? check out this version:
   $ git checkout v1.10.1

5. v1.10.0 Dec 4, 2025 · release notes

   Nebula v1.10.0 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. overlay support, a new v2 certificate format, packet marking for iptables/nftables, ECMP for unsafe_routes, and PKCS11PKCS11The standard programming interface software uses to ask an HSM, smart card or token to sign or decrypt with a key it holds. Supporting it lets a tool keep its keys in hardware. P256 key support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.10.0 https://github.com/slackhq/nebula.git
   # already have the repo? check out this version:
   $ git checkout v1.10.0

   └──▷ USE IT
   Ensure unsafe_routes firewall rules still match after the default_local_cidr_any change by explicitly declaring local_cidr in each rule.
   yaml copy

   # In nebula config.yml firewall section
   firewall:
     inbound:
       - port: any
         proto: any
         group: trusted
         local_cidr: 10.20.0.0/24

   • Supports IPv6 and multiple IPv4/IPv6 addresses in the overlay network.
   • Introduces a new v2 ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses..1-based certificate format with a unified interface for external implementations.
   • Adds packet marking on Linux to better target Nebula packets in iptables/nftables rules.
   • Adds ECMP (Equal-Cost Multi-Path) support for unsafe_routes.
   • Adds PKCS11 support for P256 keys when built with the pkcs11 tag.

   +4 more show less

   • Accepts encrypted CA passphrase from an environment variable.
   • Allows handshaking with any trusted remote.
   • Allows library users with userspace networking to configure the logger and build version.
   • Logs a warning when a firewall rule contains an any that negates a more restrictive filter.

   9 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !default_local_cidr_any now defaults to false — firewall rules targeting unsafe_routes entries must explicitly declare the destination via the local_cidr field, or traffic that previously matched will no longer match.
6. v1.9.6 Jul 18, 2025 · release notes

   Nebula v1.9.6 adds opt-in inactive tunnel dropping to reclaim resources from stale connections.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.6 https://github.com/slackhq/nebula.git
   # already have the repo? check out this version:
   $ git checkout v1.9.6

   └──▷ USE IT
   Enable inactive tunnel cleanup to reclaim resources from long-lived but idle peers.
   yaml copy

   tunnels:
     drop_inactive: true

   • Adds tunnels.drop_inactive config option to automatically drop inactive tunnels (disabled by default).

   1 detail in Everything

7. v1.9.4 Sep 9, 2024 · release notes

   Nebula v1.9.4 adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. dialing support in gVisorgVisorA user-space kernel written in Go by Google that intercepts and handles system calls on behalf of a container, sandboxing it without needing a full VM. and exposes internal state programmatically via control object.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.4 https://github.com/slackhq/nebula.git
   # already have the repo? check out this version:
   $ git checkout v1.9.4

   • Supports UDP dialing when running under gVisor.
   • Exposes Nebula internal state programmatically via the control object, enabling richer integrations and tooling.

   2 details in Everything

8. v1.9.0 May 8, 2024 · release notes

   Adds official distroless Docker image, loong64 support, inlined SSH host keys, and sshd.trusted_cas for certificate trust.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.0 https://github.com/slackhq/nebula.git
   # already have the repo? check out this version:
   $ git checkout v1.9.0

   └──▷ TRY IT
   Pull the official lightweight image for running Nebula in production environments.
   copy

   $ docker pull nebulaoss/nebula

   • tun.unsafe_routes is now reloadable without restart
   • Adds official nebulaoss/nebula distroless Docker image containing nebula and nebula-cert binaries
   • Provides experimental binaries for the loong64 architecture
   • SSH daemon supports inlined host keys
   • SSH daemon supports certificates with sshd.trusted_cas

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Support for the deprecated local_range option is removed; migrate to preferred_ranges
   • !Windows builds now require at least Windows 10 or Windows Server 2016 due to Go 1.22 toolchain changes
9. v1.8.0 Dec 6, 2023 · release notes

   Nebula v1.8.0 adds systemd readiness, RIO on Windows, and lighthouse requery limits.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.0 https://github.com/slackhq/nebula.git
   # already have the repo? check out this version:
   $ git checkout v1.8.0

   • pki.disconnect_invalid defaults to true, disconnecting tunnels when certificates expire
   • New config option timers.requery_wait_duration (default 60s) limits busy tunnel lighthouse queries
   • Linux: Notify systemd of service readiness via examples/service_scripts/nebula.service
   • Windows: Use Registered IO (RIO) for ~50x throughput improvement

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !pki.disconnect_invalid now defaults to true, causing tunnel disconnection upon certificate expiration
10. v1.7.0 May 17, 2023 · release notes

    Nebula v1.7.0 adds encrypted CA keys, local_cidr firewall rules, SSH mutex profiling, and P256/BoringCrypto support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/slackhq/nebula.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    • nebula-cert ca now accepts the -encrypt flag to encrypt CA private keys with a passphrase using AES-256-GCMAES-256-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. and Argon2idArgon2idA password-hashing algorithm that makes each guess consume memory as well as computation. This makes a stolen password database harder to crack with specialized hardware..
    • New firewall rule type local_cidr allows filtering destinations based on the local interface's CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network., useful when using unsafe_routes.
    • unsafe_route config entries now support an install option to control whether the route is installed in the system routing table.
    • New tun option tun.use_system_route_table (true/false) enables managing unsafe routes directly on the system route table with gateway routes (Linux only).
    • Metric certificate.ttl_seconds is now exposed via stats for monitoring certificate expiration.

    +4 more show less

    • New tun option punchy.respond_delay allows configuring the delay before attempting punchy responds (default 5 seconds).
    • SSH commands added to capture a mutex profile for debugging concurrency issues.
    • Config option lighthouse.calculated_remotes enables handshakes without a lighthouse in certain configurations.
    • Support for P256 curves and BoringCrypto has been added for certificate generation and validation.

    9 details in Everything

11. v1.6.0 Jun 30, 2022 · release notes

    Nebula v1.6.0 adds experimental relay support for NAT traversal, lighthouse IP reporting, hot reloading for punchy/lighthouse, and Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/slackhq/nebula.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    • nebula clients can now be configured to act as relays for other clients behind stubborn NATs
    • Adds configuration option to report manually specified ip:ports to lighthouses
    • Introduces Windows arm64 build support
    • punchy and most lighthouse config options now support hot reloading
    • Promotes routines config from experimental to supported feature

    +1 more show less

    • Adds listen.send_recv_error to control recv_error message conditions

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !x509x509A standard defining the format of public-key certificates, maintained by the ITU-T, used by cyber tools to authenticate identities and establish encrypted connections over TLS and similar protocols. config stanza support has been removed, requiring migration from the old stanza.
12. v1.5.0 Nov 11, 2021 · release notes

    Nebula v1.5.0 adds remote_allow_ranges, pki.disconnect_invalid config options and SSH -raw flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/slackhq/nebula.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    • Adds the -raw flag to the ssh print-cert command for PEM certificate output
    • Adds support for Linux riscv64 build architecture
    • Adds new experimental config option remote_allow_ranges
    • Adds pki.disconnect_invalid config option to tear down tunnels on cert expiry or trust loss
    • Adds unsafe_routes.<route>.metric config key to set specific route metrics

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The local_range option is deprecated in favor of preferred_ranges
13. v1.4.0 May 11, 2021 · release notes

    Nebula v1.4.0 adds routines config option for multi-core parallelism and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. underlay support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/slackhq/nebula.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds the routines config option to enable parallel work on multiple CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. cores in send and receive paths
    • Adds print, ca, and sign modes of nebula-cert that can output QR code images for mobile client configuration
    • Enables ICMP ping responses when tun.disabled is set to true, allowing pings against lighthouses in tun-less mode
    • Adds IPv6 support for the underlay network

    4 details in Everything

14. v1.3.0 Sep 22, 2020 · release notes

    Nebula v1.3.0 adds per-packet stats, library mode, FreeBSD support, and standalone lighthouse capability

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/slackhq/nebula.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • pki.blocklist replaces pki.blacklist for managing blocked keys
    • Add tun.disabled=true to run a lighthouse without a TUNTUNA virtual network device in Linux (and other OSes) that lets a userspace program read and write raw IP packets, making it the standard building block for VPNs and traffic-manipulation tools. device or root privileges
    • Configure stats.message_metrics to emit statistics about non-message packets
    • Configure stats.lighthouse_metrics to emit detailed statistics about lighthouse packets
    • Set logging.disable_timestamp=true to omit timestamps from log lines for external log systems

    +2 more show less

    • Add experimental support for freebsd/amd64 binaries
    • Add experimental release binary for linux/mips-softfloat with reduced file size

    7 details in Everything

15. v1.2.0 Apr 9, 2020 · release notes

    Nebula v1.2.0 adds lighthouse allow lists, unsafe_routes on Windows and millisecond logging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/slackhq/nebula.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ HOW TO FIND IT
    Run the Wireshark dissector to decode Nebula packets.
    📍# Place dist/wireshark/* in your Wireshark plugins folder (e.g. ~/.wireshark/plugins)
    • unsafe_routes now supported on Windows.
    • Adds lighthouse.local_allow_list config to filter local IPs/interfaces advertised to lighthouses.
    • Adds lighthouse.remote_allow_list config to filter subnets used for handshakes with other hosts.
    • Adds logging.timestamp_format config option for millisecond-precision logging timestamps.
    • Wireshark dissector plugin available at dist/wireshark to decode Nebula packet headers.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !punchy and punch_back config options are replaced by the top-level punchy directive using nested punch and respond fields.
16. v1.1.0 Jan 17, 2020 · release notes

    Nebula v1.1.0 adds self-service binary for macOS/Windows, subnet routing via unsafe_routes, and mips/ppc64le support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/slackhq/nebula.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    └──▷ USE IT
    Build and install the Nebula service on macOS or Windows
    shell copy

    make service
    sudo nebula -service install

    Configure lighthouse DNS settings in the Nebula config file
    yaml copy

    lighthouse:
      dns:
        host: '0.0.0.0'
        port: 53

    Define a gateway route to allow hosts behind Nebula to reach an external subnet
    yaml copy

    unsafe_routes:
      - interface: neb0
        subnet: '192.168.1.0/24'

    • Adds nebula -service subcommand and make service build target to install and manage the Nebula service on macOS and Windows
    • Supports mips, mips64, 386, and ppc64le architectures on Linux
    • Adds lighthouse.dns.host and lighthouse.dns.port config keys to control DNS listen address for lighthouses
    • Adds unsafe_routes config section to enable subnet routing and gateway functionality on Linux and macOS

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The certificate lifespan validation now enforces that the certificate expiration does not exceed the root CA's expiration; existing certificates with longer lifespans must be reissued.