netstack mode: SOCKS5 proxy is not closed when the engine stops; after down/up it serves through a dead stack

[Wombat164]

Before posting

• I searched existing discussions and issues, including closed ones, and checked the relevant docs.
• I believe this is a product bug rather than a configuration or setup question.
• I can reproduce this issue.
• I removed or anonymized sensitive data from logs, screenshots, and configuration.

Affected area: Client / Agent
Deployment type: Self-hosted - advanced/custom deployment
Operating system or environment: Linux, Windows, Docker

Did this work before?

Not that I know of; same code on v0.80.0, v0.81.0-rc.1 and main.

Summary

In netstack mode the SOCKS5 proxy is not closed when the engine stops. After netbird down + netbird up in the same process, the new proxy cannot bind and the old one keeps dialing through the closed netstack, so every connect fails until the daemon restarts.

Current behavior

ERRO client/iface/netstack/proxy.go:36: failed to create listener for socks5 proxy: listen tcp 0.0.0.0:1080: bind: address already in use
ERRO client/iface/netstack/proxy.go:52: failed to serve a connection: connect to <peer-ip>:443 failed, connect tcp <peer-ip>:443: network is unreachable

Expected behavior

The stopped engine's proxy is closed; the new engine's proxy binds and serves.

Steps to reproduce

docker run -d --name nbrepro --entrypoint /usr/local/bin/netbird \
  -e NB_USE_NETSTACK_MODE=true -e NB_SOCKS5_LISTENER_ADDRESS=0.0.0.0 \
  -p 127.0.0.1:11082:1080 netbirdio/netbird:0.80.0 service run --log-level debug --log-file console
docker exec nbrepro netbird up --management-url https://<mgmt> --setup-key <key>
curl --socks5 127.0.0.1:11082 https://<peer>/   # works
docker exec nbrepro netbird down && docker exec nbrepro netbird up
curl --socks5 127.0.0.1:11082 https://<peer>/   # fails: network is unreachable
docker restart nbrepro
curl --socks5 127.0.0.1:11082 https://<peer>/   # works again

Same on Windows 11 with the client as a service.

Environment and topology

Self-hosted combined server and client 0.80.0, one peer behind the relay.

Logs, status output, or debug evidence

client/iface/netstack/tun.go: Create() starts the proxy; only NetStackTun.Close() closes it. client/iface/device/device_netstack.go: TunNetstackDevice.Close() closes the configurer, the wireguard-go device and the UDP mux, but never calls t.nsTun.Close().

Related issues or discussions

#6812 and #7572 touch the same proxy; neither is this bug.

Impact

Any engine restart without a process restart (down/up, profile switch, config change) silently breaks the proxy. Workaround: restart the daemon after any down/up.

Additional context

Likely fix: call t.nsTun.Close() in TunNetstackDevice.Close(), plus a test that restarts the engine and dials through the proxy. Happy to open a PR once validated.