From 118b693d7373e7a579bfba7d7a7d07f30bf94552 Mon Sep 17 00:00:00 2001 From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com> Date: Mon, 14 Sep 2026 13:38:20 +0200 Subject: [PATCH 1/2] docs: clarify Signal message encryption and Windows PATH after install - how-netbird-works: the Signal candidate message uses NaCl box (Curve25519, XSalsa20, Poly1305): a shared key derived from the local private key and the remote public key, no separate signature. Spell that out so readers with an RSA sign-then-encrypt model do not read the sentence as a mistake. - windows install: both installers add C:\Program Files\NetBird to the system PATH, but terminals opened before the install keep the old PATH. Add a note to open a new terminal, and use the full exe path in the scripted install + setup-key snippets, where the same shell runs both commands. --- src/pages/about-netbird/how-netbird-works.mdx | 2 +- src/pages/get-started/install/windows.mdx | 9 +++++++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/src/pages/about-netbird/how-netbird-works.mdx b/src/pages/about-netbird/how-netbird-works.mdx index da2324e97..26c60c2b5 100644 --- a/src/pages/about-netbird/how-netbird-works.mdx +++ b/src/pages/about-netbird/how-netbird-works.mdx @@ -74,7 +74,7 @@ The client application requests a user to log in with an Identity Provider (IDP) * **Receiving network updates from the Management service.** Each peer receives initial configuration and a list of peers with corresponding public keys and IP addresses so that it can establish a point-to-point connection. * **Establishing point-to-point WireGuard connection.** To establish a connection with a remote peer, the Client first discovers the most suitable connection candidate, or simply address (IP:port) that other peers can use to connect to it. -It then sends it to the remote peer via Signal. This message is encrypted with the peer's private key and a public key of the remote peer. +It then sends it to the remote peer via Signal. The message body is encrypted end to end with a shared key that each peer derives from its own private key and the other peer's public key (NaCl `box`: Curve25519, XSalsa20, Poly1305). Signal sees which two peers are talking, never the contents. The same shared key also authenticates the message, so there is no separate signature step. The remote peer does the same and once the peers can reach each other, they establish an encrypted WireGuard tunnel. * **Applying access control policies.** The client application applies access control rules that are received from the Management service. The client uses a system's available firewall manager like `nftables` to apply the rules. diff --git a/src/pages/get-started/install/windows.mdx b/src/pages/get-started/install/windows.mdx index 00b171702..bafabbbec 100644 --- a/src/pages/get-started/install/windows.mdx +++ b/src/pages/get-started/install/windows.mdx @@ -10,6 +10,9 @@ The NetBird client allows a peer to join a pre-existing NetBird deployment. If a 2. Execute the installer and proceed with the installation steps 3. This will install the UI client in the `C:\Program Files\NetBird` and add the daemon service 4. After installing, you can follow the steps from [Running NetBird with SSO Login](#running-net-bird-with-sso-login). + + Open a new terminal before running `netbird` commands. The installer adds `C:\Program Files\NetBird` to the system `PATH`, but terminals that were already open keep the old `PATH`. + To uninstall the client and service, you can use Add/Remove programs @@ -52,16 +55,18 @@ For fully automated deployments where peers should register without user interac ```bash netbird_installer__windows_amd64.exe /S -netbird up --setup-key +"C:\Program Files\NetBird\netbird.exe" up --setup-key ``` Or with the MSI installer: ```bash msiexec /i netbird_installer__windows_amd64.msi /quiet -netbird up --setup-key +"C:\Program Files\NetBird\netbird.exe" up --setup-key ``` +The second command uses the full path on purpose. The installer adds `C:\Program Files\NetBird` to the system `PATH`, but the shell running the script started before the installation and still has the old `PATH`, so a bare `netbird` is not found. + For MDM-specific deployment guides, see [Deploy with Intune](/manage/peers/mdm-deployment/intune-netbird-integration) or [Deploy with Acronis](/manage/for-partners/acronis-integration). From 3cfc4d4ad63bf3ad5869e988cea994e2000e2583 Mon Sep 17 00:00:00 2001 From: Jack Carter <128555021+SunsetDrifter@users.noreply.github.com> Date: Mon, 14 Sep 2026 13:55:30 +0200 Subject: [PATCH 2/2] docs: state that Signal sees the peers' public keys, not the body --- src/pages/about-netbird/how-netbird-works.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pages/about-netbird/how-netbird-works.mdx b/src/pages/about-netbird/how-netbird-works.mdx index 26c60c2b5..62f325b6d 100644 --- a/src/pages/about-netbird/how-netbird-works.mdx +++ b/src/pages/about-netbird/how-netbird-works.mdx @@ -74,7 +74,7 @@ The client application requests a user to log in with an Identity Provider (IDP) * **Receiving network updates from the Management service.** Each peer receives initial configuration and a list of peers with corresponding public keys and IP addresses so that it can establish a point-to-point connection. * **Establishing point-to-point WireGuard connection.** To establish a connection with a remote peer, the Client first discovers the most suitable connection candidate, or simply address (IP:port) that other peers can use to connect to it. -It then sends it to the remote peer via Signal. The message body is encrypted end to end with a shared key that each peer derives from its own private key and the other peer's public key (NaCl `box`: Curve25519, XSalsa20, Poly1305). Signal sees which two peers are talking, never the contents. The same shared key also authenticates the message, so there is no separate signature step. +It then sends it to the remote peer via Signal. The message body is encrypted end to end with a shared key that each peer derives from its own private key and the other peer's public key (NaCl `box`: Curve25519, XSalsa20, Poly1305). Signal sees the two peers' public keys, so it knows who is talking to whom, but never the contents. The same shared key also authenticates the message, so there is no separate signature step. The remote peer does the same and once the peers can reach each other, they establish an encrypted WireGuard tunnel. * **Applying access control policies.** The client application applies access control rules that are received from the Management service. The client uses a system's available firewall manager like `nftables` to apply the rules.