netbirdio · lixmal · Aug 14, 2026
diff --git a/src/app/(dashboard)/peer/page.tsx b/src/app/(dashboard)/peer/page.tsx
@@ -70,6 +70,7 @@ import ReverseProxiesProvider, {
 import { ReverseProxyFlatTargetsTabContent } from "@/modules/reverse-proxy/targets/flat/ReverseProxyFlatTargetsTabContent";
 import { PeerEditIPModal } from "@/modules/peer/PeerEditIPModal";
 import { PeerSSHToggle } from "@/modules/peer/PeerSSHToggle";
+import { isSSHSupportedOnOS } from "@/modules/remote-access/osSupport";
 import { RDPButton } from "@/modules/remote-access/rdp/RDPButton";
 import { SSHButton } from "@/modules/remote-access/ssh/SSHButton";
 import { PeerExpirationSettings } from "@/modules/peer/PeerExpirationSettings";
@@ -430,6 +431,7 @@ const PeerOverviewTabContent = () => {
   const { peer } = usePeer();
   const { permission } = usePermissions();
   const { selectedGroups, setSelectedGroups } = usePeerSettings();
+  const isSSHSupported = isSSHSupportedOnOS(peer?.os);
 
   return (
     <div className={"px-8"}>
@@ -458,11 +460,14 @@ const PeerOverviewTabContent = () => {
             </div>
           )}
 
-          <PeerSSHToggle />
+          {isSSHSupported && <PeerSSHToggle />}
 
           <div>
             <Label>Remote Access</Label>
-            <HelpText>Connect directly to this peer via SSH or RDP.</HelpText>
+            <HelpText>
+              Connect directly to this peer via{" "}
+              {isSSHSupported ? "SSH or RDP" : "RDP"}.
+            </HelpText>
             <div className="flex gap-3">
               <SSHButton peer={peer} />
               <RDPButton peer={peer} />

diff --git a/src/app/(remote-access)/peer/ssh/page.tsx b/src/app/(remote-access)/peer/ssh/page.tsx
@@ -13,7 +13,7 @@ import {
   useNetBirdClient,
 } from "@/modules/remote-access/useNetBirdClient";
 import {
-  isNativeSSHSupported,
+  usesStandardSSHPort,
   isNetbirdSSHProtocolSupported,
 } from "@utils/version";
 
@@ -95,7 +95,7 @@ function SSHTerminal({ username, port, peer, ipVersion }: Props) {
     if (isSSHConnected || isSSHConnecting) return;
     connected.current = false;
     try {
-      const aclPort = isNativeSSHSupported(peer.version) ? "22022" : port;
+      const aclPort = usesStandardSSHPort(peer.version) ? "22022" : port;
       const protocol = isNetbirdSSHProtocolSupported(peer.version)
         ? "netbird-ssh"
         : "tcp";
@@ -122,7 +122,7 @@ function SSHTerminal({ username, port, peer, ipVersion }: Props) {
       connected.current = true;
 
       try {
-        const aclPort = isNativeSSHSupported(peer.version) ? "22022" : port;
+        const aclPort = usesStandardSSHPort(peer.version) ? "22022" : port;
         const protocol = isNetbirdSSHProtocolSupported(peer.version)
           ? "netbird-ssh"
           : "tcp";

diff --git a/src/assets/ssh/ssh-client.png b/src/assets/ssh/ssh-client.png
diff --git a/src/modules/peer/PeerSSHInstructions.tsx b/src/modules/peer/PeerSSHInstructions.tsx
@@ -11,19 +11,19 @@ import ModalHeader from "@components/modal/ModalHeader";
 import Paragraph from "@components/Paragraph";
 import Separator from "@components/Separator";
 import Steps from "@components/Steps";
-import { Lightbox } from "@components/ui/Lightbox";
 import { Mark } from "@components/ui/Mark";
 import { cn } from "@utils/helpers";
 import { ExternalLinkIcon, PlusCircle, TerminalSquare } from "lucide-react";
 import * as React from "react";
 import { useState } from "react";
-import sshImage from "@/assets/ssh/ssh-client.png";
 import { SegmentedTabs } from "@components/SegmentedTabs";
+import AndroidIcon from "@/assets/icons/AndroidIcon";
 import NetBirdIcon from "@/assets/icons/NetBirdIcon";
-import { Peer } from "@/interfaces/Peer";
-import { PeerSSHPolicyModal } from "@/modules/peer/PeerSSHPolicyModal";
 import { getOperatingSystem } from "@hooks/useOperatingSystem";
+import { isNetbirdSSHProtocolSupported } from "@utils/version";
 import { OperatingSystem } from "@/interfaces/OperatingSystem";
+import { Peer } from "@/interfaces/Peer";
+import { PeerSSHPolicyModal } from "@/modules/peer/PeerSSHPolicyModal";
 
 type Props = {
   open?: boolean;
@@ -39,6 +39,11 @@ export const PeerSSHInstructions = ({
   peer,
 }: Props) => {
   const [client, setClient] = useState("cli");
+  // Peers already on v0.61.0+ don't need to be told which release started
+  // requiring a policy.
+  const peerRequiresSSHPolicy = isNetbirdSSHProtocolSupported(
+    peer?.version ?? "",
+  );
   const [policyModal, setPolicyModal] = useState(false);
 
   // Enabling the SSH server and root login require root, or an administrator on
@@ -75,46 +80,60 @@ export const PeerSSHInstructions = ({
                 <NetBirdIcon size={16} />
                 Desktop Client
               </SegmentedTabs.Trigger>
+              <SegmentedTabs.Trigger value={"android"}>
+                <AndroidIcon size={16} className={"fill-nb-gray-400"} />
+                Android
+              </SegmentedTabs.Trigger>
             </SegmentedTabs.List>
           </SegmentedTabs>
 
           <Steps>
-            {client === "cli" ? (
-              <Steps.Step step={1}>
+            <Steps.Step step={1}>
+              {client === "cli" && (
+                <>
+                  <p className={"font-normal"}>
+                    If you are using NetBird via CLI, you can enable SSH by
+                    running{" "}
+                    {isWindows
+                      ? "these commands in an elevated prompt"
+                      : "these commands as root"}
+                    . Run the first one only if NetBird is already running. On a
+                    machine where you do not have those rights, an administrator
+                    has to run them.
+                  </p>
+                  <Code codeToCopy={`${prefix}netbird down`}>
+                    <Code.Line>{`${prefix}netbird down`}</Code.Line>
+                  </Code>
+                  <Code>
+                    <Code.Line>{`${prefix}netbird up --allow-server-ssh --enable-ssh-root`}</Code.Line>
+                  </Code>
+                </>
+              )}
+
+              {client === "gui" && (
                 <p className={"font-normal"}>
-                  If you are using NetBird via CLI, you can enable SSH by
-                  running{" "}
-                  {isWindows
-                    ? "these commands in an elevated prompt"
-                    : "these commands as root"}
-                  . Run the first one only if NetBird is already running. On a
-                  machine where you do not have those rights, an administrator
-                  has to run them.
+                  If you are using NetBird via the Desktop Client, click on the
+                  NetBird tray icon, open <Mark>Settings</Mark> and turn on{" "}
+                  <Mark>Enable SSH Server</Mark> on the <Mark>SSH</Mark> tab. To
+                  log in as {isWindows ? "an administrator" : "root"}, enable{" "}
+                  <Mark>Allow Root Login</Mark> on the same tab.
                 </p>
-                <Code codeToCopy={`${prefix}netbird down`}>
-                  <Code.Line>{`${prefix}netbird down`}</Code.Line>
-                </Code>
-                <Code>
-                  <Code.Line>{`${prefix}netbird up --allow-server-ssh --enable-ssh-root`}</Code.Line>
-                </Code>
-              </Steps.Step>
-            ) : (
-              <Steps.Step step={1}>
+              )}
+
+              {client === "android" && (
                 <p className={"font-normal"}>
-                  If you are using NetBird via the Desktop Client, click on the
-                  NetBird tray icon, go to <Mark>Settings</Mark> and click{" "}
-                  <Mark>Allow SSH</Mark>. If you want to enable Root Login go to{" "}
-                  <Mark>Settings &gt; Advanced Settings</Mark> and enable SSH
-                  Root Login under the SSH tab.
+                  If you are using NetBird on Android, open the app, tap{" "}
+                  <Mark>Settings</Mark>, then <Mark>Advanced</Mark> and turn on{" "}
+                  <Mark>Enable SSH Server</Mark>.
                 </p>
-                <Lightbox image={sshImage} />
-              </Steps.Step>
-            )}
+              )}
+            </Steps.Step>
 
             <Steps.Step step={2}>
               <p className={"font-normal"}>
-                Starting from NetBird v0.61.0, SSH requires an explicit access
-                control policy to allow SSH connections to this machine.
+                {peerRequiresSSHPolicy
+                  ? "SSH requires an explicit access control policy to allow SSH connections to this machine."
+                  : "Starting from NetBird v0.61.0, SSH requires an explicit access control policy to allow SSH connections to this machine."}
               </p>
               <div className={"mt-2"}>
                 <Button
@@ -128,8 +147,8 @@ export const PeerSSHInstructions = ({
             </Steps.Step>
             <Steps.Step step={3} line={false}>
               <p className={"font-normal"}>
-                Once the NetBird SSH server is allowed on the client, <br />
-                click <Mark>Confirm & Enable</Mark> below to finish the setup.
+                Once the NetBird SSH server is enabled on the client, <br />
+                click <Mark>Finish Setup</Mark> below to complete the setup.
               </p>
             </Steps.Step>
           </Steps>

diff --git a/src/modules/peer/usePeerSSHPolicyCheck.ts b/src/modules/peer/usePeerSSHPolicyCheck.ts
@@ -1,7 +1,7 @@
 import useFetchApi from "@utils/api";
 import { Peer } from "@/interfaces/Peer";
 import { Policy } from "@/interfaces/Policy";
-import { isNativeSSHSupported } from "@utils/version";
+import { usesStandardSSHPort } from "@utils/version";
 
 export const usePeerSSHPolicyCheck = (peer?: Peer) => {
   const { data: policies, isLoading } = useFetchApi<Policy[]>(
@@ -66,7 +66,7 @@ export const usePeerSSHPolicyCheck = (peer?: Peer) => {
     !hasSSHPolicy &&
     !isLoading &&
     !!peer?.ssh_enabled &&
-    isNativeSSHSupported(peer.version);
+    usesStandardSSHPort(peer.version);
 
   return {
     peerPolicies,

diff --git a/src/modules/peers/PeerActionCell.tsx b/src/modules/peers/PeerActionCell.tsx
@@ -8,7 +8,6 @@ import {
 } from "@components/DropdownMenu";
 import FullTooltip from "@components/FullTooltip";
 import { notify } from "@components/Notification";
-import { getOperatingSystem } from "@hooks/useOperatingSystem";
 import { IconInfoCircle } from "@tabler/icons-react";
 import {
   CheckCircle2,
@@ -27,9 +26,9 @@ import { useSWRConfig } from "swr";
 import { useBypass, useBypassedPeers } from "@/cloud/edr/useBypass";
 import { usePeer } from "@/contexts/PeerProvider";
 import { usePermissions } from "@/contexts/PermissionsProvider";
-import { OperatingSystem } from "@/interfaces/OperatingSystem";
 import { ExitNodeDropdownButton } from "@/modules/exit-node/ExitNodeDropdownButton";
 import { useIntegrations } from "@/modules/integrations/edr/useIntegrations";
+import { isSSHSupportedOnOS } from "@/modules/remote-access/osSupport";
 import { RDPButton } from "@/modules/remote-access/rdp/RDPButton";
 import { SSHButton } from "@/modules/remote-access/ssh/SSHButton";
 import InlineLink from "@components/InlineLink";
@@ -126,21 +125,15 @@ export default function PeerActionCell() {
   const showRevokeBypass = isBypassed && canBypass;
   const showApprovalGroup = showApprove || showBypass || showRevokeBypass;
 
+  const isSSHSupported = isSSHSupportedOnOS(peer?.os);
+
   const showSSHButton = useMemo(() => {
+    if (!isSSHSupported) return false;
     const isClientSSHEnabled = peer?.local_flags?.server_ssh_allowed;
     const isDashboardSSHEnabled = peer?.ssh_enabled;
     if (isDashboardSSHEnabled) return true;
     return !isClientSSHEnabled;
-  }, [peer]);
-
-  // The Connect column previously hosted SSH / RDP entry points. We
-  // fold those into the action menu — gated on a non-mobile, online
-  // peer — so the table loses a column and the connect affordance is
-  // one click away inside the three-dot menu.
-  const peerOs = getOperatingSystem(peer?.os);
-  const isMobile =
-    peerOs === OperatingSystem.ANDROID || peerOs === OperatingSystem.IOS;
-  const showRemoteAccessItems = !isMobile && !!peer.connected;
+  }, [peer, isSSHSupported]);
 
   const toggleLoginExpiration = async () => {
     const text = peer.login_expiration_enabled ? "disabled" : "enabled";
@@ -255,7 +248,7 @@ export default function PeerActionCell() {
             </>
           )}
 
-          {showRemoteAccessItems && (
+          {peer.connected && (
             <>
               <DropdownMenuSeparator />
               <SSHButton peer={peer} isDropdown={true} />

diff --git a/src/modules/peers/PeerConnectButton.tsx b/src/modules/peers/PeerConnectButton.tsx
@@ -4,22 +4,16 @@ import {
   DropdownMenuTrigger,
 } from "@components/DropdownMenu";
 import FullTooltip from "@components/FullTooltip";
-import { getOperatingSystem } from "@hooks/useOperatingSystem";
 import { IconChevronDown } from "@tabler/icons-react";
 import * as React from "react";
 import { usePeer } from "@/contexts/PeerProvider";
-import { OperatingSystem } from "@/interfaces/OperatingSystem";
 import { RDPButton } from "@/modules/remote-access/rdp/RDPButton";
 import { SSHButton } from "@/modules/remote-access/ssh/SSHButton";
 import { cn } from "@utils/helpers";
 
 export const PeerConnectButton = () => {
   const { peer } = usePeer();
   const isConnected = peer.connected;
-  const os = getOperatingSystem(peer?.os);
-  const isMobile = os === OperatingSystem.ANDROID || os === OperatingSystem.IOS;
-
-  if (isMobile) return;
 
   return isConnected ? (
     <>

diff --git a/src/modules/remote-access/osSupport.ts b/src/modules/remote-access/osSupport.ts
@@ -0,0 +1,12 @@
+import { getOperatingSystem } from "@hooks/useOperatingSystem";
+import { OperatingSystem } from "@/interfaces/OperatingSystem";
+
+/**
+ * Check if the NetBird SSH server can run on the peer's operating system.
+ * The client ships it everywhere except iOS.
+ *
+ * There is no equivalent for RDP: the server is not ours, so any operating
+ * system may be running one.
+ */
+export const isSSHSupportedOnOS = (os?: string) =>
+  getOperatingSystem(os ?? "") !== OperatingSystem.IOS;
diff --git a/src/modules/remote-access/rdp/RDPButton.tsx b/src/modules/remote-access/rdp/RDPButton.tsx
@@ -1,10 +1,8 @@
 import Button from "@components/Button";
 import { DropdownMenuItem } from "@components/DropdownMenu";
-import { getOperatingSystem } from "@hooks/useOperatingSystem";
 import { CircleHelpIcon, MonitorIcon } from "lucide-react";
 import * as React from "react";
 import { usePermissions } from "@/contexts/PermissionsProvider";
-import { OperatingSystem } from "@/interfaces/OperatingSystem";
 import { Peer } from "@/interfaces/Peer";
 import { RDPTooltip } from "@/modules/remote-access/rdp/RDPTooltip";
 
@@ -13,18 +11,9 @@ type Props = {
   isDropdown?: boolean;
 };
 
-const RDP_SUPPORTED_OS = new Set([
-  OperatingSystem.WINDOWS,
-  OperatingSystem.LINUX,
-  OperatingSystem.FREEBSD,
-]);
-
 export const RDPButton = ({ peer, isDropdown = false }: Props) => {
   const { permission } = usePermissions();
 
-  const os = getOperatingSystem(peer?.os);
-  if (!RDP_SUPPORTED_OS.has(os)) return null;
-
   const disabled = !peer.connected || !permission.peers.update;
   const hasPermission = permission.peers.update;