From 44a4580afac1db6128998c44dc525fdcb0b7bc06 Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Wed, 25 Feb 2026 14:02:32 +0100
Subject: [PATCH 01/15] disable external mfa when there are no business license

---
 .../AddLocationPage/steps/AddLocationMfaStep.tsx  | 15 ++++++++++++++-
 web/src/shared/defguard-ui                        |  2 +-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/web/src/pages/AddLocationPage/steps/AddLocationMfaStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationMfaStep.tsx
index 24907b56fe..89df7d1e24 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationMfaStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationMfaStep.tsx
@@ -1,7 +1,9 @@
-import { useEffect, useState } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import { useEffect, useMemo, useState } from 'react';
 import z from 'zod';
 import { m } from '../../../paraglide/messages';
 import { LocationMfaMode, type NetworkLocation } from '../../../shared/api/types';
+import { businessBadgeProps } from '../../../shared/components/badges/BusinessBadge';
 import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
 import { Button } from '../../../shared/defguard-ui/components/Button/Button';
 import { Input } from '../../../shared/defguard-ui/components/Input/Input';
@@ -10,6 +12,8 @@ import { Radio } from '../../../shared/defguard-ui/components/Radio/Radio';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
+import { getLicenseInfoQueryOptions } from '../../../shared/query';
+import { canUseBusinessFeature } from '../../../shared/utils/license';
 import { AddLocationPageStep } from '../types';
 import { useAddLocationStore } from '../useAddLocationStore';
 
@@ -20,6 +24,11 @@ const schema = z
 export const AddLocationMfaStep = () => {
   const [error, setError] = useState<string | null>(null);
   const [disconnect, setDisconnect] = useState<number | null>(300);
+  const { data: licenseInfo } = useQuery(getLicenseInfoQueryOptions);
+  const canUseFeature = useMemo(() => {
+    if (licenseInfo === undefined) return undefined;
+    return canUseBusinessFeature(licenseInfo).result;
+  }, [licenseInfo]);
 
   const [choice, setChoice] = useState<NetworkLocation['location_mfa_mode']>(
     LocationMfaMode.Disabled,
@@ -67,7 +76,11 @@ export const AddLocationMfaStep = () => {
         active={choice === LocationMfaMode.External}
         onClick={() => setChoice(LocationMfaMode.External)}
         text="External MFA"
+        disabled={isPresent(canUseFeature) && !canUseFeature}
         testId="enforce-external-mfa"
+        badgeProps={
+          isPresent(canUseFeature) && !canUseFeature ? businessBadgeProps : undefined
+        }
       />
       {choice !== LocationMfaMode.Disabled && (
         <>
diff --git a/web/src/shared/defguard-ui b/web/src/shared/defguard-ui
index 49862aabd9..9a6f90c697 160000
--- a/web/src/shared/defguard-ui
+++ b/web/src/shared/defguard-ui
@@ -1 +1 @@
-Subproject commit 49862aabd9b8b2d3e675a50ff56b4e3a544cd254
+Subproject commit 9a6f90c697503560ff6e7002b7c2f722babd777b

From 8027aa7deca655f7dd7e8127ce30e1acf379a46c Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Wed, 25 Feb 2026 14:17:08 +0100
Subject: [PATCH 02/15] block firewall in wizard without business license

---
 web/messages/en/location.json                 |   1 +
 .../assets/business-feature-icon.png          | Bin 0 -> 20535 bytes
 .../steps/AddLocationFirewallStep.tsx         |  41 +++++++++++++++++-
 3 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 web/src/pages/AddLocationPage/assets/business-feature-icon.png

diff --git a/web/messages/en/location.json b/web/messages/en/location.json
index 7b7bd2fd01..afdc64d6f1 100644
--- a/web/messages/en/location.json
+++ b/web/messages/en/location.json
@@ -1,5 +1,6 @@
 {
   "$schema": "https://inlang.com/schema/inlang-message-format",
+  "add_location_firewall_no_license_subtitle": "Firewall is available only in Business and Enterprise plans. You can still create location now and activate Firewall later by upgrading your plan.",
   "location_delete_success": "Location deleted",
   "location_delete_failed": "Failed to delete location",
   "location_edit_failed": "Failed to update location",
diff --git a/web/src/pages/AddLocationPage/assets/business-feature-icon.png b/web/src/pages/AddLocationPage/assets/business-feature-icon.png
new file mode 100644
index 0000000000000000000000000000000000000000..bbd9ef43378ee13d7b2d950f65990e8f6acf57db
GIT binary patch
literal 20535
zcmV)|KzzT6P)<h;3K|Lk000e1NJLTq005`}006iM1^@s6cb%s%00009a7bBm000&x
z000&x0ZCFM@Bjb+0drDELIAGL9O(c600d`2O+f$vv5yP<VFdsHPs~X~K~#7F?Y(J~
zT-S9Ty7#T>Mg!;uF%Sem%m7J@1Ob8sXA;mrO12nEib%%!5h=2q<@Z(+%cQ5gy!8ay
z>m^pA$+43kvTSE?vSLV<O-ZE8K_WPV;Dmty2@u3QkeGo68tCq-dvd;W&OYbd>Y=K-
zsv6y3Z;9xtTeoiAy7k>Xe0w-dBXZfu>a}V-wHH^XoZiEV#_LUUh}3Dtyf-0!eEqkY
z*3&Q(rV$zTvif(rS1XnNmeLRP)A9Z6x>qTF?8Wai|5q9&G6K+HEUW+E!W`9|`zu9i
zwQO5DJE1vKiRMmC=&CD-&R-<j^O2(GHWlgU8M_ZNZQ^|Th4p_tdM^!e83E`p6qxe#
zY~i<v)358N<HxoTeeRZ={x6}iEq(u_&uvQSZ=Np%pc4OAZYn-Dlz}<|&|xO4AGz?A
zl#}n0Gv#Y;Na(Bg<@yC?EJsgkZMqpiEy^Zs_SK)f_??#T(GZjofDRL}ex~|{m~)u&
zhwn*f$()1+A^<8t3a~mElK$xkK!><kKQqz5q_5yP{K|*#$<vzU0|REM40W?V0?;8U
z1NAcpDnHv$q@TSO0x43-+N8Pg-!3&!M*unm#nDDOItPzQv}%F%Gp`!o*q>`Cn*9-g
z4k20nyXTgxwE4UB@-qi20O~jYreNqPCwr5obj_vErVRn;+O;Y<e3)`?UQJCGj~+|L
zw@x0p5&Dr)O*F39+5LMu2>RD}4s-tSJvn32FNK`HsA%tpivIGcVhmE_pQfb#W14F|
z(A)b?pF5@|Up2Wf`UI(;|0#D;9i(o+`Ru<^qq@hOYH80kx8w_aX|C)r6fPvc!IV6r
z$@6h|4j&WXY=oa#PPXkuz?9OyV~Pqzg&T(wcN(e2X=gXlg-$xFZ=@fj`Qo?B9j~ca
z?CQ?7bvBJze_{RFH3b@g)N~b~DWB<}u@}2KT3eb&+=Xf+QTf|ARhoO`8F&tJ{x2VB
zyr0>d2rxhRFr~4h^qn$>Xxc=g39U>`dAm<nLD9kEL}$(uoorXs-a*@nT>N#Fr~{RJ
z2Ef|h*4FXnTJE4KWWZNr_5XdewY_<4+XyhL6Ha+%qH-YGZ^LuYM*r%8{Gj`p5cryZ
z_IQzY97@fNafJrv!kJ79^(_NnDuuKtt5ioy<ShN3k4SCZtN6e%1Jna47ayz?q>w^h
z6>m5`_T=}!&)t>mUp2T^uYE30?JLK3=W@+7A{9$hF0cJe^&9#Je+18kHi9`HY=MvY
zv)593^7T}om%T~!4WbrKS1cM+L&E@5i#G2Xo#Kk>=jS>U{c?+<fr1orkvq@7`OS%E
z%I#MbK;dT|&2>y1(VErCQ1UY+%?a%}MQhFF^O=^-WojLzC<=!(Bo+QKqEvJMht-Zw
zQoq<da7_w<HXYsk`icJh(~7Uq{cF{jlN}x7X+$a(>u1uV<jnb{qKzQpXTGz~a-1`-
zB>K!v3C)-k_E9B&?PFHvA3-VOxdm@m0f1N9cWoR<D+1^UII9!*nVcq%Y4dm=p2LKG
z^}al<S~&Q?ggO5!O&9&rk?$=!GGD!n=?1Me$7nZ$oS&)SXUboK%ZZ0%OgtWBw5SoY
zFLf6f$L2<Xv@AeZ{tMOAGQMLnjYwG$KT}`Uufd!*Iz8E+h@Xl7@EE{cc@5Kz^EL0<
z%rv?gfsi>T13ds!xhHG^8bE2Zrr8PqXF%APdK*PimkxK<YoBz#HuoQ$9ymxp+dTHz
z+O?d<+w=Xs2?5cCuJaSAFyeBSlRP!umv*Ips5OqEjRq?{*_*(e|LISxp9z_z&G~0<
zvh<NiQ$7L2aB>!I8fXT6<Unh;2zoizpt7Bl#Aw`Rr<DOxy>;eCr*l6{)9OG9?tFb`
zyC%2jc)Y#et9R!goSvZ4rqMJaeacYsGxvOG&AIrQS81p0Q#T}P#w2UD#f0Z|<UV?o
zfG@n?KD64?BG8+B^H(S*15kNAwVIdRrj0ukZ{2G(Dd*I$7pS<6s*thim@`j*i_gpR
zJ^{K?`<*Q#erKNobFRA7qgv5?4bLxSdJ-la0T8N@ATZ~5E@orWMJ!WfAvmTbp&U+A
zc@0Sd1w|?wB=r)>hsV}G_3u-5+v__OIgp;!ApKG`AZ^l+Up;p0Q8D#>n)rOz`L>Z-
zlHMgL<Q^>+Nc)*=Xd?^E<dV=vKiyEIbuU;y6LRylY`{6Hi8H>XQJ`AiBXyZeB9kpa
zlHHlTi6^8tRnITvqIkQLig0b>Df9T|1xCkm^C2F0_&EJ2pX4eAX*aXUPU?s4?zDT#
zi1zGVhFW^^FP|<NvksZ9!`M&WkkFI~MyXi<*&s$Nwn2?H@7&^2EPa`HiUKEiqG{@1
zu?D`xCw1|X`%Je*e=f}Z&O=0pkE^q3Qn@CLwP>#zw5`2;Om}Xi-a{mtp5!5so)kZG
zyw)|JyE&m*lSu;Y2q<jAANN+{N47M_=bYt^EZt<^1c(LmPvT@UWhp1|QQ1>fCb~+r
zYnt-S*Ri%L#(glFR67>mNR#3^DkHHL?Ez3k?%f?DX-vpaOi#wN(JBo9m~>Pf84)!}
z!KZX?BGALR#3)3s<0A7eZ{z4NHn2CWk`0tBNCo-!=mKix%)a4GgDzH!XR+)%?$8PP
zE~PoD1f+%hd2kLr0oqQhn_H-=f|JWqke<|j<|E=~Uh4EDYBR;pTsDX4-W3*@K8P_V
z9UfS4IWuj@Bc^5tWHH@LqV)nO-MfA8LpJZ}SSaJ8+T>D5&wK5uBI48@(|-2iS#~RK
z5P-C+SRSOHogQ4Lay<Y#{#g6yi(@~&=H1gqJoM6&bF>-1YiUBWuL_k$@%}0bY9uhX
zq`Q@Tj)m@Y5q#L6t*@%Tx_i+FLq1CPpbG((eUN5i87}#2!Mtc@@NqSvUy&v~vyobQ
z0QACW&V3wX_mG~XOP-#DpSkY&ke-B}dG`{g<?|A80a-Mfic^&tcQFv{c%JCsC~@ZA
zrZ1xpbg_HtY`i!Kk}>k24!ir4a37?Ci4Or2XFg9EkQOx)w)Z1*<9s()NUkX6(?9R)
zI&`&CQxAaZ>_ETSrOQo*dV2B}P1)eTQF-zIJcKM&?p;lz@4Q1PCSH8d=6vL$lH-LO
zDbExDX5V7n(~SEdVo$-JfZHbiY@oGBLjG_BJh^VV=0{Hvy}1h;lC?>J$Msd6U+g@W
z1?YnhZfibFA0J85+(T(mJu2x*OzD81ITX^93#V&Uek0QrV_ng3DgY8q>9Rvg2??oU
z)g|G))nNKYY!c>4vGU|4iJCKoBF?*XXB1$`{?k}FLY|}THZ7Vs2Ecl$@<taxS@5E+
zROjv0jq~mM0a65@npdXYK-#5`ngQs!shZ*a7z9W|IXyX7`<M4zpHp+Dkikf5gO8vm
zy-!%mOS*kHqYX_)U8mgzoh-iL(bGiR_osC3BGJTFqMNQ|<kXc7kTO1{sSS;MRu!3U
zgVxl(s9)39Po)&6RmD%X?g*P+C%m>|zI9LD`k-%+B2fC+nRA<-B%hxA>b>=w(ov1{
zNKa~FZ}s&$GFxEIg<X{Fy-McZ%y5=4_b-um2aKU_ZgSYwz&LVJ@#fu%K0F=XaOxb<
z$#W@vdIgIs5Hd_+r#;UZnf~Ad%Z8YCwf{NS)Koon`TNT3apN_1&wfEl9}|hwlb6!Z
zgp{TyZ__>|+>22;l?ghSnR>^cWii>(lja{G(cK<O2+l;~9XXe-Zbh5+5O3eFdOatA
z^qIGn25F)r6CW9g=2q5cjbbA~V!)=TRp$n0uB%}LI=g$OPBlnX>uBN^-f<vJa|hz+
zKJx~&betXCF^MiC8EWat*w2JH|HAD#MCno0I%k3#=h%5NUGn2X6-AoO?Mj&f4`|PK
z4=MsMyDDh>ozQAE`Iu28NEgm3GW8Uz_snBc+)VZhxPQ&Ny9<ijJCsyGg(4I8#%=qE
zHtaAD&nC@uOLwtw7Edl)4LX$5lK{aNZ%t^<6c(Uawdkuh$VbNZp{sKDVX@O_iOG|*
z&_r<^5&&@EIMX)mXP&QOghJ4ysJM^mE9E0A&m$0(R5=A`diK=08UE&wv_Oe0o=vpx
zDAAEqG%oGpuThS^gYB0cK!;ix94I51#R)(2_JvHJSY~e$75&PtKG<`NArzvZvckXY
zRVD|Qlij8>I?jFKbw$U{Dw;m2dP{-8>1hqpPc0{I9qk(EJi8j7hQQ5!5gQP(vjh&T
zjwI+Vq~V=rKXGA{2mK1|lOB29>~y>S=kf#SP)bjh`k8kCnA*>5X%0oc;ly1Rh1G^W
zx=|GSdF)Ue%q>%_aN*+-y}py^#qCy8PpQF;!RYX3H(8L{-X(#kIkjNwg?_T<&f*`t
zd&s<@vr9+%Y1rR>WsViD`NmVnE0d1ZRMc&-fT+m7EC32WGfC+&eTkOfIsD9jeqWB}
zPQ5gKW}Kd!H^r90!JNC~xCy{nqG9D#3Q|3e@ANcd$P#6P6X9;W&xs=8m$oaq7>z?f
z)qE`yK$@sAqs&dkHr^o@q(x*sOJO~E%__lOA&u1~W!MLC2PD9nHbF5=JyUX<qT=ud
zXzXX=OI~U}6MW`tJA$A2xtkK5-iy+T0<egWgjjM$O5G$%XBW>~N-6c`JPM&Tp!a^1
z@{8LP?K_q|pRuEnd#9Skf;8n%E@v7$O1_5sG9fzhY1Qymt@ecG)EbdJ?d9Ial=Vb~
zHk;VSYTr@C2_=hDDh^K*AEzg2sHG>hpLyq^gzj9Ns8LPIQ9Yp~%|%1ryJR8SUFuO{
zA)$>_gk<Rt(hvFcdH9J%-q}a$Z`|nmT?c^l7h02k@&=|>9XO>F=P;#BnZg$DlaeYF
z1MB5R=w!kqPuIHpv~{#EO1T1mhaEtXp45KkW8!C4yNEzNW#bN81}C)9;+YBEe={5H
z8Nj4Cl`=K^t10rCm&l29KeBW6tVWgSJOcJb%_Y9JL(#^aS#ur>64<zD>nR4Ln*mZ{
z96OucB4J1=f}TlpUF-^$KXJt+sZu>Os6SpwfIn;inn_Rc&?tk$G`NDMPv&c1_fy&g
z&YO}b74-lK(Jki7yg6I&>-li@#?ph9gEq1+?l`RI>9<lkeZK$m8{MFCa{=imma(}3
zB#nvcdE$_*B6s7VRiu~(wm}9!WWX84_V~9|dWe<ft%p27Vb0SodQ3lj2+xN?dh*HF
zi==%enlqW{+N;@^b62p-&SYo&G0})w(<mv)z*|eOK$&zQ(Ow-iJpWE=c*07gZA{~=
z2|)VPTZ+~!Gk&&Db*faN9{etrZqTfP>!ee@$|+Ro$JT;8z|UQj<EVr9Gh_iOex^-N
z(j`w%g3E-Ti7NIvS25kOi0S&-+4Jz6q|*j2lnvl@yLrwsfV2m0@!(>C)$>~wZ`hGi
zr2_Nbmj(sxbn0AX8KwRN@Bif%(wbD!_*Pq)kJGk3X3D}dVWy}fAPivf$R-v<iAr!7
zvSa5ixDR1ALm!4DKw-|)F7-VrgBuFz$@U9&8r)n>7u~lar`ohLf3Zvd9I3#{;?Dbv
z@)MM_?uM9vC{D+SOX|o?UcXi8)L+UME1IGi1m$_9GIave^0|zTPdceHMNhq1J4m}d
zNJ)cKs5AD-hhm|$nAs7ZV$xN}j@ctxm;FS$eWr=kgV;2r09u-!oIAx<wGV~it_Xlo
zpE>hNYtB&_uEFVIm{3$fE)cTekq?Hv1m2H=PYS;+weG?0j}-m=hVp)9U(y;`7gQ##
zn4hRcGlS1CQJdxaRwf#xX`Mg{bI+(J@Kyj{2}uKr+!f`%Cr1r-F1mMajoo?3YEWc>
z5>D3Q@lZ%l{_w@3zUWK~rYHJGMv5|#iXEdWO<f~7#xfK?h%d#N;aeiku7}hmdm<iy
z{JRY)?>(w$paNoExX&fC&>~_6IOrQGC7*L7Q~#;%y^;Cpx9X!waU67*&b~@XFA9o7
zC{8$t#6h3=8_^iu+NC+!ZqG60!mIdu$pPxMrfX6g3h7Dsaqu&5x|R(v(QZ*nf27XU
za-@-OcZm0keNeN(v)C-17MdzzhN*n@y~_Q}z69LoG;PN3UW&|*B@Yl`OW9s%5hk9f
zeaCxmwBV{0q!7?v5H$347L<fOE-^tAr8r|yQt(EJj-U0G=oNYSk^<C%Gx?EzIO9@g
zfnwSS(fM^cGQWLMcDSn%cU@D*<tdjM@n)JNJ|NFLlP~IZuBMF(%yC|Q4<@om)%uye
z2^#Ajx+_svPa^rj9lMjb9${l$B?V~&-}P5l5j~?piUN^ZW#dk0aYbXAoiCj__KX92
z=A(TlF2FJl>n@jc(C_sVNG=&b12}mGe9hl~xM|RXAW2WY^+8Hkj<bFy{HbfFi6WGW
z^3c9ua?8$qxiPQ7V!Oap9*Vyi+Jmiz*z=L%C$$fF<RsNiW@*an>Pgw4!**o&-b}Zr
zJ@?dUu{NC<LM8n(Z>MzuDTaovoF8XHeMo54cM|tk*^^Q37C&;zZcJG{CC9rY0FA+U
zDKbH&iwIn!HRh^oF%8a{b9<H!lyR2BW{0%@8FB9_6O<E6YZ*CHE^QKuPMufux38$o
z;#l<(l-PB4*;$=(Hogu;h%a$LI11ME`6IAGC4D_Wx=(+%rL$~+7J5M_<L1PDO72zu
z@T8}h4v7B=8FYY_f)i$aFh$anNWo2Nv-HcIOLA)5=%9I&Gl^33CW40mr_Z2}lAuVb
zV9IS_yXC9RdvtnIy|g{$SKiY;XBX97;4|aD_jRUeNzBa#M<b$gJniFqMX<TGMb!nQ
zhJ7%%B*%Wcb1gC&UaX4w_kF1;Q0ZU9#~W01n5<Ayd9yy4;4Jksm(EJ)j>Sx~t_*2N
zcUzMb)G8I5XM4vNi_&&0RxCTFP?fY~yuF*$vzv>IO7%vG5cB(wS%7jx@F;&;*)l%=
zvL`PAQld}an5bvoN_ik4?Q}OEMn6hztF$t^K+XB!aXBn2ojqa!Xqu>hh>tm_07a!c
zz=?neKIdRaX?k-0R1M5UL^o@5E{u<KS~ys;Dg|70Ig6=`kCDD}->-oNHS-ky-JTDL
zp52^+*KD}&az(5C2>5WA7vF4WHc17h|9pSm7~P$^8dFo067v3Ib@czK6->{*U47tm
zrbE%yHn5c8P~r-)&&RV+@?IhETf5{0X<g~q@IeD8s*uoz0gm$zzdSerQE7To(=QsB
zOf5~(z}9$$i;`JID)gG0t68+28<93r6#BodXK<lY(NDE+`{oDr_cMDFnD$Z8uLv{0
zbhcv?T#8Y-B!Hu89XNe+o0Rn#G=U=8eS`)?JzeOujeyRli1-TkZxnEfhHt+Z%zH}3
z@01>MPylM?9w}3aG$@lhO4F0`rZRo*ChcdAasFeBolF2ku}yUL&;eIJ>n_HO9=V4$
zNYcRM7q=^V>D{z0ekN$62X0O1y@QHSUe}jQY|UOvW9Dax8CAYgUxg|vCW;&YUpl3u
z6aC&db`6Yjy3l27VHcR>G^vscWhI_z@9yaSv?pXx0IG?2%-1wQQ6sZMFy}~5f;N)$
z<o&A>HS<ccRqUMYAJ2-LgIO|&OMXX_b5F&UVhSaV%<ya1y_`}#{7kcs(e-v7lhly*
z2hh^C4w(59`aBQ-3L&n1WkB?8qW};?9JcH+Gv#TZ(%ylUO+wp;t#C5q$h;Mj#09wv
zh^W0k?Fnf(K=WzSefk1DB<agWN!)Xe;)n+{FmJln%yWy@{~>buUsYPfLB35WYu07I
zLQ#l!_PLKkCy9T$5rJ2I%()rhuq;uUqG89c@|?-6G-!J*8i`YzvFtwzfR=o}D0q{M
z5>kts_b7h%KyBwQ1v3k#lkmbWSH|84W{R5RoX7v>E`P1p^|fS8!vU&w`XAy9pg9|5
z+L5CCtEa7lh%C^*_)K11IgZ?HbsN<JR<by%N_!7nWH5odYAU4RY;lPEurTLOZ&JQ{
zvQ~lL_L-H5xv|8*^*$rp33t!G(-TB}wRLRUuV}@58J8n5oX^=9*}PZLyZccRM>Pv9
z*Ui_Ohu(z>U8fR$#-tak_KqlW??Zb+8VXPZMiR9*N_!#@lD_j#F3YKh?=quXSPI*{
ziS`;qW%w7fOEiN>`O5Fmh={@v<(zvos6Dl*etzZ`Zc8*kZBQc_7I!m|gc=C&p3hon
zGt#E7whn;q!&9WDjHjrVQfH6!|MYfxdAs6zWQ{~{cr4+qq6VXEou}uHJ!s4Mo+1qe
zXb6lN^D!|v(LssD1fsPcB=~X3izsbLK2OP|XDlqT=k4_4Vv*^CBZ?n?tq8MTv&aC4
z+fazoWMP<^EMRC+3aKhK1sHR#vX%8B;4G7V$`;TWsWq}!pl3T$e)(Nx09sE$%ggn1
z{2&G&p?haD^eG8*z~?To+IiUS)t~l+Gz_39Iwn^H(unp9m~{c?m)9ib$0o7~94m?<
z|J)bQ#5wiY7nPQbD2g{5Po87-S5FssSDpOK8|NkTD>t*!)R3i7Ns63<ccD~7Uz$t+
zs)U&0QoM3)9iW?F=26YGeLvBr-Ss*DQfV25S*AWM#2h*_gEFP;b*{ws6loYh8>v0b
zOikx=-hVTQ_nflry*}_I=?V%gO8CJeAcO%3<jj)G0AdoGzL2zjYmq_S)GElFVdM=e
z^4({X)i1WlC{@`4is;16t)%@>_53?Uvrm6*9U?IE8+It(f3!a3bbZP7b0q%EelH@D
zz9XW@g0){Dvvv}soc4q?1fY4!Ezu`-8?@(=IrR;U5T$=}oxS1!=lwV5Jmr(mi=7ER
zP^2ZJKwjd^*u;nFZSU+)`ME8rDTBj&qgn*!9PY=B^DXA=4H4ZiHl<oZ0kKcJx?XZ5
z7rdFTv}<$M;l^l95e&Y)YMc$cd`U_Gs!M+O>u#RE`mXn)zFo;;vkd{LD%!zasO_wG
z<PM$_AYC!nf|JN6LHyhz;rQ6M!MH_GCEeqS7GjkJpd2`+0|-sDA2@Eez`wds#bmfx
z+yDo4`$FQ;qmmE+k^GSEvqh7#&)++SCh<3zya@~i%sf)ILqV>c?venhjKv|3&+MdT
z`@0-Iq1gG+s95@8C7)4ufFf%|u0^=skvn`&%sjfXO@F|hiJexF+T?iR`Co|`{pcW$
zJh~7XN5?(eVS%}IUsmIsK0h!Ggn3L4-eKl`hH>o<WG+DSEJ9S}Zq6_2pJ#un?#{bm
zexhD`zsUK<(aA;-fR&5#;j&C>L;6?w)SQaHEQup(Hkf~X<W9V<(xtlV4p5ghG7~@Q
zsXd`JB`CUoRZd;m#=Z|77sd=T=lITbz1OZ_g0m5_0Rl|;>)OwJb647HRr~oWshF!L
z!tKZ@{o~o>KoppHTjzSnJz!nyM=$pcQLyv|#VtCpf)+hBz=pbV0$|>@i0PGg%iov_
zW|-Ne{`L`;)s`yCps5fG96CXK*fJm$YfngB0oq9Ixz2$TJwp0F`Q}1ha+26^A}Zzb
zmF?z_f6dZ2`;QYn@kY@U`t~NsEq52GB7r&ov}P(WVv&3ln_WP_oKTcNRbGSI!XxLC
z*n}$yi{QNwpSwmY$`fzYCqW>B;^KufnHJ4JF2DSZId>}FqtLl2!KK-5E0&TH-`~FW
z{8k_I{h(6q38^bU8>Kyw#>AplFzpX$?dg~oABpGl><fjRWFldqJh1OaI`8}o9RQV!
z%-btm?Bp)3aRAOyvVw4FAAGhV$|@E15v~xG_+cHr6n<ovk@0WFN^#@HP+evIG@_fX
zVOeNFZQYxe{o$6(V%62{3c6GGHOY6k28-a@uXh|W(L3ZoAy@bTRUvf)sMVgBjLQx1
zJ?&MveNm1kjSHzt`OQICdq!G1Ux`SVcD#ZL`j@ondj0*%v`;0O7DUtcqxi+SV5!#}
za&Go{8nFnrkXOumAQs{R7N_mK!|HZr%$nc2cVK>TsZ7-hWZ68TDVQPW{EZKeP}vL<
zv?n-R1dyTzh^)B^XXZIwb1B|<-+eDuWoe~SsT)9ZoV!n-&5WgU>aRT|FaoV)f4o2=
z0i0r0%^b~uN+lL@<Ia@raM#LyTnzh9E5Py96CLhc{yE7Gpfw^Sygfq|WeqscNp4q)
z>NXPt?9})O`;HQ$#<U*MJIpzj$-ZV9t8C3R)0VyEzcj}EbarRXx|ETSC+6GkJgBdy
z^cq#L%5kaG4WRmJ{)W+>ch@&-B--;+%agzyTGMBqBDE>3k&2Pws*_&amU6X49hK&(
zmtYm&=v-84qw+M<cca|7kPqVAz2s;m3ve4#u>X<4PN2W%@z<20mTEQa0OsOZX37YN
ze&brWst$8*AADFr<UW;61=ZQOtT6r_6xa&!zu$0Kqk(8oNL>IL7lqWbuN{%QXixB-
zUcBOBm1y5W1>#$AG{NhI0e};xtJ3J*Xi#?1STrQe?+}6o?;txLBnGkkD}J2P0UB?3
zPiL{B3Z_~n)}c!3t|e@SIe0C{cAX{V8vnNJsX%+qA?ogq5+3#og-BHi>0oCu?a(es
zE!q=O7l1Y@ttpW^#?PQ{-ABI8`$<?ad2f{b1N;bQI<)rOo>u*<Ug)aK4S@eSZ)%At
z7b3yCzyjE)x}5^o8Dh848nIyq`7D-5C8^Ec1eu;&7bfbeE5z?rqS;ueFUSXnQ>w)G
z#0c=S=T#;W%}BOlsV3i3q-I3L+OwWTA<&+(9Q8k1<&NvebJ*Cyn0N1iT9K-d7q%4#
zq;e`9+6B(ja;~L6lkz@Cw2i%{l?@Kf;+DXSKet6uZ?l;OIxYE=`uAux@8vjq6(tYs
z`ES`<{#eWAu);9fRAmzlCE{n%*XnzU)C|x@YtK6tTJ1@3Om206SaZtElhGFk0}{6E
ztv=dq(lpMR>sd{o$ov=2_D_N?nU#3Tz%6j#D|RT-njE)~M6-%y9?9u*ihus5GONM$
zB^Y8>tw4KPa0(wB2R80}3EH!K<USADvxT+m<1LcYl-9deD!3?eAG}@%?Fp#~RgEgC
zi?!ziw<JE7j^}cj4KYvI8`)`AdT9Wa?khDHh*o4!s{iYS^6#HMkusnRd}nYq<LyFy
ziHm%(3xgbpUwJp}cQ#XBZ5`!g+Qg`$-X#H|^s1}m;)-tMrE~08i@OR86HV;1ML|O=
z+EFL%38@L74cDHFTuPII^C?v`xx{ZGA0z1(v_>-R43!E7H(-FnO#Sy_m!*jgoh<);
z<9~XRJ(zlSe5mKDDFjJwKehdU;wN=BsFIZBKv(OSbycV@4Rlse<M_M#Ncj#<1V+%r
zn3imNkHmKkd02{*3;MHOf8TvtjoK43U}QC_q|Qd}_6t6+Dv1hV?Nm9oNf#mK?Th4z
z`ilF6t{4->c;hgd)iL121mZ&{`UmLz5FEMOza!*rzqt<*VhRd^;k3WloN_g@nFg{L
z7bqo+VT@`4M0@-DNHZ0tVXnX90GRWqS>SaSNciXYW^`npX}&kF?l_?8rad78256&7
z>b7Zc0;CJ4GokU#d!7`$e5Cv+<c?U<fv7$zr#(?udGocbZko^0pe<9CV-8mioDleA
zqMVd3LqgIZfK*<FKdMc*dUli2CcQdVVW5j~O`9N;8-?*bA!su<)2<_mE8#t{!W=ZG
z9Y{+q&mJ)kPATJeINPCu@0rkVQypYL0Bv+h9pnL*LhKDL%)!RQx$2GYmj@S?CA@wX
zW&BzEU`01jppsPLHB&iiY;z~1!YUsjXtK+;ysUvakS4oQ^A6q>T5V^ULgZO?x`!(m
z#sFL64@vQcYQLcPgCqSP!)j0S<#286x1^{8kL0V{;w+;*4~h2VS5oeNmFge^0%)U(
zLY~us5ws^XCp4%SZ-2L%OpM}0N|P<mY+gH~{kfe7`@iTg>(|dF4}4)u;QUJ@dgw%X
zEvL<%d%y3a_sIcqOm}~%_=hhS2RzInUW}`4wBa*NyU6-2<x8xL26dx+tVvEep6a7>
z?o>W<w`(Ec+IMz|yBS?LlDT8{GtOSn!I7&`Qc3N;r%2TR9SrUH`CIZHKfXlCxjnf&
zhgu99H5u~){_u21{{X#nG5ZXZFU`Y1S{I$3Xh(q5?;*VZX@Vh7BZXk(qz=-4_>vhK
zMzsit`B9ouSULxRiXG;F?|kGG^?L)gwa8*vDoXUTGsDd1G?29K+20|I_Pl<sz5K8S
zur3j?<PIr)`}Uf?rz7{Xb=IDcssTC}+VhTuo~!YfM5^R<^e)A~%#j|{Irn~#Z?z{|
z)9WjWY($ExaO`vNczI9>KvfBi1QU(`?b*%ssnuMjefv+`z*>8{bfiAD6YV5rYkkVp
ziT?atO4SB0!Z?%zCj{UWFTb-Sv*vz}s7Zm0_QW#akdzCLP#vWzfHt<I&iS6Ja)E1e
zg%lKVi4@U^u4u#rMyJcvZ?3v7vGl%*%`s)FmbUJ%!2g`)r{Os&kPR@OsnakAG{$}6
zhMZqIMn#VJ;R@)lS(D>uaV3?V0J7^y|L-@x=Tz$+;60|SPExf|pe6s{Itn<cf;Qr6
zr7D0nvZPM5=Ut0)jzlI3brcXKy*L>M9Zz3;r_k@oKzm*@jUtc-g1tLx$*m}YpF+}}
zr*?lt{LH3eU1l?xp<&CIZoMu+g?{*sc$gS+wW6gET?Fr|iXh^@Z`w^|e>7-M@m(=d
zB^9cS9ZaS2-$nA6APDmgsicj#TB!=4jV`H!_RMf>K1#Pz(uQev+PtU8<+LZXicS}b
zqt9}v)Hf^<b#x*?>Yo=h<{f@!yQ0T8ro3%`?ZAZS^eP5Vs8LOp7Ru$=FOMw2TUUYk
z@X7w&2Y_=_bJS|#Tk$Z>L-DSPB6q36BeRsDd%txT!pL(k8yl!SAr%9(;U#ridoG&c
zzPwCD3)8Ngt#T%x{G>L1ZD)Cq+_l88`q3<Ji*dggm;Uqq5mi>ZAieqY+o>_>7wTZn
zF*NLpx98OrW9&_XfCL<Gu*)t|)_2m83P#r8MvUqK9II|$+q9?r`%PdJn)s9@=fgp~
z|LI&Mw8b=1dqOG(Xrt4b3*(Zy445odoAS!_yE`sNZ``LN_i{5Wm(5{q;zQ67w~L@U
z$6}tS94`oYVY{N<nc3=Oe5(fLt%>nBi8IUGP(B~#<C8s61BgnpPghS${LSk*H2wbb
z(4L1Y(4Hm%VQm(Aj+}$x!T~>h#alJ692%rOAr+x*FiPq^e@pMj#U)6R5ZJ`b$@3MY
zHSb!SkiV=^0~=DC-q*Dnlo~DQ{={1Ax7#^Vq+DHrif+h!LSmjR)?CZ<k&|gzdTC-C
zWr~)hSM==)#*r_Z%RV^8r*?Oz-b%U5hziV!Ee2_{_JmXf&_-*|yB1{&lFesQC~!y;
zXJVr2Aryt|J6c|Q+Exkc8d#-bHCCY*n1KsjTv32ji=ZX>6E`Gg7;WSnh7JiLG4GDU
z37YEonab!T)uW?Szpui`-K1}A^`ObB71FqTkU|%n)9D)rL3={VB5p8B>OOyK&WG4h
z0kG{Y$2s`R9>yELu&un$c=wW=$vnB}$f+gUvRsT3GVdR*Z=ZQA^Rh$3{JF@tR8jAE
zKBppYPm)zgAe7H;N%S5Io5;QVbrS7qPsog$R9N?2yaYcv#Ga5ka{*JC?Ry)kJt1WQ
zIw;z+jWT)hSQBs(_)lkUwDwGSQ<)A#EDfl&r%b&tRJR;AEoKXh8)4ojXg~8ycO)91
z>@g_wnJkej9T=fp(`3m)U%5ogei~eVg6gH<c3K`2ljLOm%f7_>p3zNnu`9Gj2VX;u
zuXwPuCnVqhi;XX-gZ2#Kei#z&jlFqSzSTg{^Y4_`cy}*JsHBSA7dv3BBc(!?YF8Zr
z3O^HNe0MIg!)YB=W_XE^6(f>j4naXKAz!wq+~^oVaXEq>#mPu-dadmKyj_9z#EQ;F
zTtWnaW6@pS0QhihR4fga_Js5c&_<WkEi#ciwy=*F;wTw#G82<++T8qb=ou<kQim3a
zSyzVV%J(E#hQtoMvXkq6{#IHy|8wR1gg&LylZevYH&FgYaN0jAV)cN<xivT2!K4%y
zLF>PjEI2!{wRDT7rB0R~zlbGzW=@u@uf2ggyDd8Xgy|@-R4VYE`t?6=wDyGb3D7|)
z3b{3LzfjL02$CcrUa(6$6K&X8N#xFUh=SKd{v&+e{U0<ipVOLnpyL%|0fGPN<%!aM
zCI=tdRk6sO#Y7QUMLSBTrwiRx;DBAMwD)NFn`h3HKrgXtK-jdqyx)4mT=L))Z4LjE
zZCcaS8~8Ie1Hhd2JW!;<U(g^(p8#!iQOION%qL{QC!oxZ<raF$Rvy{N9W{sj3A87o
zcgf`^Qt56}GwR&~DgXENMV$?zn#GL1S(RwbDak1p21j!TBfye3m>jzvM59ItPT3cs
z$csnHn0HjqPo1Dbe}{f>_!O45?*DxleKTc(yCqx$oems1O;x7r(;U%7@f-bmO}uU}
zv?rujfDTScof|&ud@*~UhJpkWy(b|(iC<r96D~Ki6TGLd(-hW@?X1rqy<Fs1->co6
z1DHBHrS4qB+|n$}gB!@;*1)vHVF-pK!621M63=sj*``@gN|WHZi>!{HrGB-;)e{p@
z!eWeg<Bsy*@%ANt!3akkDe|e!=wzhg>!5an4xTXEsv4hItMm%c!O)(TKv%wWPWF+0
zf<*8eUgPJtRiZuJ1$S8xOzA)q7t)hQYgkE51m+w|-AouO8c%uMnD(;%QdT2U+^TD>
z1gq#qBp)CG?1w8To}M*XaY!C9?bMXniT3`#r_Q%i>!_gJZJwQ7;Y^rB9Va$ke8+!<
zLDQa)9snJTlDaS4>I;&IGL$rV9@KVi2Iq0p9#wYYF>>y4#EGF{FGfSdYV|jfi~qkq
zo0HRI?_)X*Bod!x>5Nd7dC~VAu`2m$%A_}`tW2Aj#qiq|tmXmV(|l+W3PTD-r`;(8
zlLFT5`%^l0*1Y9FG1uMj$UT-G0Bv+hooG)Lxnm*hvGB4J>-=&%=2u-`hFXI5oITkd
z1G7J0*p|}1Xa*>1AuAn7+n1o)9;J0!i?Xzvkh{_13B&PCqM`(W|B56L5pg~d>l||3
zsf&`z`Ja<yID`8@XwP$HGEPQ&wuIl+oA>TaEJ>0i!K2r9IL*##P{9f50nkR5)M@RB
zKP-hG$~*T#kD6i0QOiOl+7sXe4A2L(qZfMRY=r}9%Lyv?=S?yB{Ycw*w?c)4cDB6F
zy<NEx;AZ4alP2alp}^$(>OZE#+UM&mvwY07NgV21^*?X#F3)f*pBI5s5*JFi&p^t{
z8E@O4vb%P5X(O&yG622Mbn(|TJnCLjx93AU<I_a$Gkv|HiXz`=+8f2IaT(dLqq0=w
zpFdOVbxKDy6YI*!JNw}>V9j}zHRa^iI`VqQh2+d`%}}?S5)avojtt+KtPd)CR#H9h
zEQZ;!GVSTd;Rxkylz>?%*WV;A#I&!I)}Hnamq2?$GEmUB^EdFf-f7JzUb6sOI0I=-
zPhQx2KM6||;yKcNaZN0Ezz-`3Zb07mHA1G+iFK8V?SHakU&vW`M{QC_c}eA<qHK(A
z|CrQfVokldB90fAT@P14&`)y(BKWTo-*fpqUq!`2%;Th^z9Y$&7;k0!0Y#TmdqO-w
zS3h#$EBe&tG_oiJHISZ+Hlpk}Z|BhAvLq~Zh<5Y(cWN)>ID3KWDqsYB-5CkRB(a5X
z>?+odia8SpfnAd1mW5_iG=esYO46I6JyA<gPJ3Q6jZOQqJz+^#*(Kc_Gv?U?_xtdM
zORPO19*J6eK7hZCDhj!Kv7b`sbIy2dBT2byRTv7Ux1BmyStg}FDYqEcE!QQcgR&Yy
zHNAFOTufn+YQGavhNb85P(UmL9k6JDqQL93PaY{cUcu^i*1X%#eCvZsv?n`ghHH=K
zZZQNUx?MD~_B}7T_JkNTuKt4ybJA}5JRaA(C?sglT*##`hZx@9%=&+cqKKQ*k$dfn
zO!gIAU8^<9XIJLvnyFR;RWc(p7SLBqX8H7DmYNB(nY^ucQK3O6>I)JU-Rn9$JS(7R
zZx!?sri_%;o>#kK5=G*E2z9{SMMWV@C0Ev>hJ^NnSasP&t8sSqrj}yuIr$2!D%`K<
zu^JN_xrBXm4`3mBuT@HeqcNkbt8vSMoX?WL`~k4ll-+@D!d!PZ<t{5skxn9?hj*`$
zj@~K2f-+^shM=#YdLFC1;bOi0K?RZf-0V4u5-1jwnX4bdHd`EmeEU$)o)802G4E@Z
z)w>zaUWhN=mh)EJSwMCL3cd)$+`CE8M9*z4)O@GJi*W&%tCuFUW~piG^{|ivqouRC
z>bg*vK~PRv&XXv(EF{S$$5&V#n<SyHpCo{H+V<EPRknKG&i>R{qeCf`+xOb5jqfRm
zRtH22#;&5Tfgp-nu_YaRskJA>PL<NX9sbtSyl>oLiFtHtP9EnrvLmD&{Sxbr#3ik;
z{q*^i>!CemF)nDwfAgg#^(!kAGtSVb=-G^EHii|xXti_T-`J&$Kgtp9;Qc%E!~>6A
zFoZ?NIN_4-rj++lk5oc0UB%k0D^<?-1f>Mu(>cl*BIa)iRC*P%9+dG-(Mmm3v?nB4
z{kvVu_22P`-s@@Jf99yAe|#H|7jc6S*Mwys+vj%Pr@hag+ghI%3=|B1{r((%{U7CN
zVr#e=luUk;;uPfuCoHW#Si<698T09iSKX7qH@TZ4@oN~^{T(tDJKD68^d{!xYu}SA
z(Vlir6S*Xa&sJgHye|iIH>o<)F?4)Sk))WaIe0K<YW>W+6ot&5%%Ruah&P5D(<%uI
z6-YXA_e(YpSTF+=!w??(Cwa4kHOI;RC?K$Z<(|>L^3v+B!5h0$Z_9ndl<>OlL!^Qp
zf3a*MMM_sRD^9Spn<}E0y0qrod8oYhymmT=;ndQoU_LYDF6r7NS@A>hcCS78m7$<L
zA==>3a-8MdsrA#IQWWx;8*R%k#HZv`sQL7j3dX$Kpx#WW8{jh7kX6^QZTCp+<Pb<)
z7%VJ;zf~gaj%l_5Q#CCh7_VsZ^HW&LlF8427pBzx&FB1SL`5UPL9N8Rqn93$dpYfS
z-Sk9_9Yx%8j=nAAE(%NL1dHl!+waaO85-IX0uO%<9@NXc$0c=lFV2zAxfA&cZ57%Y
z%oWP{f=E{DYcTH*-jUF~%X4OIp?7apFu`JXEs5@1YU4ldrm9XbIE*OczEIc@9^{2$
zj&K<Jtd)#x#I(D2_V&MDTZ^4V#nLF~FTTC(C=7|n6LSvR_fycGT&Ual#99T!&TKq@
z4_Xfq?Frx0ho|h>xA5aRzAcw?-3I!lJs+iJ37LV)Gn*6!*_w&KRy+50EVdDe<pd>b
z;<YQLCr_VL-OajNYf#JuHIAjdGcuVYd|r~c=$*v(bLKWU2xT=WGC{B~<%&p_&&Q0=
z5=9VY4GKl~$xhCkSANb^y~iikDs?ScLQzQ2p5f5mjD~7?`Eg9&kz7dadk!3(WJ&oy
zeWJk6ZH^CPf1D`NHdQL(ngxC`XtGt;a@FSnU(|nuHSab{?~ab43{II#L2$SWlud7z
zOUWYODd&5FBSmoJSOI6Sl)oKJaOCHB+e-mj$!O0(Xd|vxJc{a3?IXZgG}AS+`>u39
z`HMt(NotTem|D<FRHJn2$ohZ2P^2Hd5)b%_e^fz<*JNIs%WkW#%W<`o)64Iw>_D+l
zBw{pazNEW4rlzo8C7q>}ba<|qAL|^csrLMdo4G`uX+Y#IzUN@H5mzf%V`Lv5oUcQ7
z<3?8&w|Ys=TQ~L|5OGvDZ$CUL8o>ob^j)i*abv)Lxh184_oE`(AJ}`iR%6IVa`c>q
z55-@U(%pP*^_0__yHrV`wRQbW)lyj3Ny!Cq=VAV>gkCBq(4N;^EzjcMD46;}RJ4uP
zUwzl}T|-WLLeL|z7Y|^bYmwNzFPve2ohVZEewMR22DwQR6)tF5IJ0(u#)Tp1&H3I>
z3-l^(9G{3*5#{3CQP+QC$yu8azva5>&jo&5Fx^2THsyn#D}OW9Q2ITU)PI(f<@2Kv
zHm;B)5~b-WU+Rg^Y`+L%-o7{#wI@VtP}+nCduzOd<^9NVczqQzDH)X^);~%7IBi2z
z&(*x?!WjbxX`I>=Inhq^Kh_uNi8oW9gLZ#eyy5tV6h9G5zFbo!^@b?iMB+h<I&$6@
zXV}l>pw;l<hfYx0z^9x*dxG<gecL!0fDi4qy;*W{^vb)b{8U3ydqR?2v3WfnKm($0
zXP~n2J*$Clz9tv+roUMJk29${bCeThCKXNg*8Zn==hd3)2Nt`v_tVz#qz338|82G(
z-i7kYGf^tI9XO%;20%GIyV*zb<}mO*lgzS>K?JpXYAh*)teEeMrd8$x+-3~N_0hYs
zuFyOC>~2F<dqR@+-{aF7B<m3*NqTZ1a`cS-J9{!op?2{1s7LPI)P+PkMeMHuHBye~
zo3Cb-Uo3`DuI~uF-GB14BAVYaIKin2FnwpE-i`$mstuMvIhkO|9ZiBG$6P4?SNcG?
zvi6St#6<4Xlb|n41TSFRq^U=>C4s&mWGHJ-h->aGK8C+Pd#yNNEh;|j?8&xcGoo2k
zCif20E=42usbSTfHgo<V(~5ZsedQBL#UQQpyy2Jr@!u90Gnu^F_8Bh9MA+D7vQkyb
z%kQS95E~1Q<#Lk5ai+tiHpyYOy#ocxRFfcb&t{7x5)1oub&>P4k;7*-9JD9IT>bUm
z8oge$=r`9@-<vA~5hjllm&R*~DA(-FIoaUI?#L=b-pk6s?yVDA6NO?Atb9>Us%`6l
z$^Yx;Q@+rhod-p7(yoXC0IgPwqJZQ=Cz25Uy9FQA!Bf=dp$e#@{>1X0J@ux)+i>kM
zu}(f*nHy-x`<^2Hm*+z9pX;;U`_A5!e)B(dS2cy>m;m&OK!%rGF%!~DU?7t;NM+XE
z@#fXBrBX9$(vSV6Aj`FN^d+zDOzE3H?lvnNXL(7~shS_r@S)XGPFODq!BRfwX*LPT
z?4#(??x}G_x*M<QV|2Q?$*kGe0hnj_a3c>F?FsSUZvFR0@8z`l)B39&1UUb{|6cIC
zX62%Sv!zNv>Hv_GT+eJX8J7%-As>p~dR>mbet%x|X7X$4+C<RwAAVe*^;?Tl7H55B
zaT4_(6f;*V8+IsJGMp(|7#QL~t6w}^!|2CJZS1l}Jw-BDhWji8CGg4+=RHd$1DDYS
z42DX-q;I#U0MbAHn}W}+S0Q02l?p$G(~2_ATZm(d8|cg?XAL>#_1)0`&M&XY(SqsO
zAEnkwbqH#HydkB(+feM8zE?IsUoGW?nu4&jVl;vz5}5Z|=q0SJ<eC0nUdILO#;|#J
z<J&F=^U{Igpgkcy>;vwqG*|qpM$)(O8~}wj?a$;-c9l@a&cv3CqFx+ZdX})CnC!b7
z+2uNY46lT%E6LltUheT@Nj-dLj_z^63sRf4j<gZMaI!yIS0HWjRVhE}ClOaD7%zi}
zUcRSLuu&YQYKh)a7iz{X+Axz!S$UD}V&F!f+v@eeu+W~6KAo!~cYjAE^d*>l_@w}8
zU)iRyZr0EFPQj9sDEu+k(U0?X#S~7vx~U>!V2J{k?71oqX&Ce9o~4QUXIh&k^_|dT
zwDF%kQDC=jr~5*RuAg0bu!Ob}&`a+gL=kc(qa)0Px#14i5Fojkq~@5`+VlWB`n}9z
zW!MYzs`ei<+Xr=gVy)8e&x^W1n0);Ow?TtG`u*NbKGqdSJ!wZL_|RxDi0DAq51yEm
z3I{%i$W@<9P$X{*tqFdMxC_cZXH@L}=6yMuS!H=#IYH3$m(LdIskc*0Nazo4X?82t
zRUqR=+w(z%yv$1ymsY+IUK{A>ab%2a+i|#tk<;nbq#0>ryEcRGIgGR?r0f;Pmnq~5
z_r@mw&mJ%I;2oE^K*F>@kXMC@Wgu2!Qhv5*#HSpyZdt}mDaxenTp?u`nay_S6#|9-
z_u)L<e{+3DMM5wp{J%Vz(&=+H?z?MoWdI%95+2L)*Cif9P2{}Mo}t=Q`HRD$V*wx7
zT`=}XZQDm)dnV252Q-YNVgqSRKC9o>*WoONF+iKfe(5a>?4ev;q-%c*tEicXHVTf6
z*vy8r?Li}mxOzPESkjU4UVbTUz2S2=B|3mgOnY%XWta9N|MQbY#zM3D*lK>6U<nI{
z#cl^QC4wc6IbR+)y>#95%!(eaV%`U1vXP-UUF8zL^sc>7XoTx77HUij46an=!J&~#
zCB=J%ihA_>-KNC@f@yfr9NV?u_4@m1RD;Mu+)IhKa;Z-x86-<J8TfgJjU^uvlTh}L
zWwG=Ti*_oTfBm+FIr_H`=FL!pdJ3xLzw@{@`ER9sZ<)DOZDV=@c;owS29*jv=s@Wu
zqdk2Awyk{*nJ@B;h%8iw_K-8@&BGzlMqI6A?Bcbztj%{eb&u)y9ZYBQDz{Ewicwt!
zS}9!V3QZU{>!V>^$jv&ax_v<o+RSN8#ilsK>OYp$qN`$Z7F(=$FkQ;CP8^ClT`tC~
zW3Je@lvq*vGg;lXAjgR8YbC);C9Dh2y*8~i<;l;ViUs@5o5nad^ZeLZMQ`n{{@mbu
zE|_k~RdcayW-g5KCick=oyjs5>&LI!Zc(iY*6RPZ(J+(h0ZP!MX{QdJ*5^1mtFOWu
zta}8YVr2Ny(<r@DF!j862G$HRJ?{ZS((aJqKtl_1q&p+4&sl$!$t;(GxtnqT^86}e
zNkLvR(`vf+57!r@h`jsis6?yp*p}X102D3Hc54!0>2K!~RwehYu#1BUmnSY$bm>gQ
zsa+rLDll!`t9a`^^9rcL-=<+GHIXz0F8m<n;;k_Gdp@+;r%x=m>rz5X{F}cnfc)kt
zdJp-|$f<XSb9|}uNQK&F(YmsiRkB#HAgEmjcK1}w+^=fC^pE~&{Y`#faz$(3{^@%M
zO|zQ`5(iQ}f8Eu7d}4;(Fyb;^Lf>g>%Uq9_-WBq7=(G`6D+AJ?8PO(R|NE4FFtg(#
zUGvhml<vDJX9kf$v!cWeg9fn3RX(w$$|Te6g2SmY^E3sxOwv_Dc3!A8XK4I_mWX`<
z&;%+QLz&}^X=b`Xp9`v(J~~YelTpoB@vU!wV#K!g(HYsW=LazJ^xhkDT6@ZZ4FRD&
zU36OuptUCrckKzO9iR{mQcXuao?rrlqT2yXWK!;2n$ST_5br*!==~!)keY?%s1-+<
zV$T}&IAVaByzYJ-8=XcbKez<u0WonDp6M-`VCR*tnXFOk!e6QBE@OWC5e!SfvW3v5
z)d(W@1-947vmhZi%yuabCm2ZE)jj-uPm%fn)QKiHUd>TXUktVK&<Prc)aSo^AWyIF
zNR7$grgIog`bQLEoujJeXn_ohf~Rn7_luaJS4Hydl+an`U*ppzs-%+NP0cgYHcZbu
z)|t<AVAerU$yF|^1>Y6JX*;T{yfWI;u07$mxfovjcONNgP@2JOTlbpXhPC#D)HzY8
z{nDiSDP*7Gs;D)~b9CpD9KC-?(N8v{^yHhC11T-FiwjH4Uk-Jp0@pP4#m~%9Xs?8G
zp#V-Lxf|t)er@iV{`KeT>z7Juvl6McI2qcrZL|_!T&x21lGrrguS@%%FKr+GzNbjt
z0SZC(shBI?q5<>gc#iB7F6$TX%+Y>LTI&=deOvR2r#oEWL@tPOZmH|CB<pU)81$>T
z`3j7Z#J^I$X3lD8=g<1g0R(1t?LW!W>g((C^(D302w8beNuRs4$COlpNlP)Rm4-9#
zSt@lk@uebEl+FjQ+<8cig313qO{Am24nYgn-W)%cSer**G$H}C4@>aeUYt{w<LN+y
z)71HvENaxM6=(D1eQb-(*uOt)C-2o_@*cDw#>o^0SP=!YK6OH40J`!T#!xqZr;?{N
zoK<k6#-*JEE9(95<@B=fJw+M{P>2TUTl#YSL|@F$oWDrp5J17?BcR{1Cp9H$;7R99
zVV0CK-Y3zjJB)d%$#)+pk^iME$uHwwg2rW^y)p*~!w};ioaSh5@<ts%ZQYj+$S(!;
z(--$yi(p9D?TZk2u}i$UoO>`2N=5uJc!6i%*1_mu^WrOMuCSIa18InfFBO=4jloar
zYq<`7DNH`bJ%0Z7oT=z}@{N@K*9%26$}qesK7w5&OQnIJb_0f71fMcTGnic7+wAK2
ztauQT{J<nLJYn*G?+bZabzSwBqqo#%J!HXj3;s+&w_AiE%OBg9PU@7&)_rcbAv8X*
zR%y5f6+!k%NBK|1R20DU;N3aevfHk!x$l@=L*C4g&;0KAMcAdYiL>cVqKsxyzGQ;!
zZ)*c5A@sdOp%?zuL5^BxE3&xK`JjEJHft4V&pQ?;syQF1GiJ{)NzR=@dYI^icT(PQ
z$n5e;niNI=I#2->rGfL5)>UhCT67%JqF=o)PrD8)1JX^qZ7&b9QIX%MjCoH34@h3e
zvNP?rNz7%G*ai}zn8dwNxzI^P!I!HwwR@no13gIZ9V$;np>j#`>-CgnbJ-*|>?yNb
zZ9;`F&7O8MU*x3r=bw1P@tz6&w!X#(=`xW)2dI%mArt+S2GkPmm(G;z6L?DG^g+dR
z6%@_5l38mhqcDnvl0b(7!7t7zkpxSYA_eXec3|{oksYO#)j&i(PpY(OWmM3k;^^eL
zzP|>7qk32L!>pr&HI#b>MuOs!hUn!dUU!8t+J(~Eb6C}TmXk{ZPzbV5oUV&a{*>`d
z_gtUDI`2lC!qhIDo-nGUigtO-5CrweMth>r9^EQlmH;DDm|~G=^{#t8Q?f=zGpd_y
z9}<TurXWadPH3&a_SAf_n$#vnz^`LU@~u>f^MkpfKYk@O#oH+tf8C{?FB`dZ0CfVB
zuYZ7p`l>J8^AU|h(DcX`CHrLOu@{R>vnI2okGPbjRw_yXhM>X~kC+M-&IA_DWmS<+
zM*`{)dYEk(e>1U-7}_*8`IV$Ls}=a3pIGK@ENjPofTZGOz5NYF{L9U5bhy!;>9FTL
zOXZRS6yo^0r-X`vnTN?Arz7My-dFUNTTN}@^u)u+1ws^oDin>l)TfwqCs}nDicO<U
zp29KzI&z<<PfTdZY!tr)DyovyX0>vsU(eKiK6&3Hd!o)(814CLO5KIaQ+q-Ng=VTm
z;_MSf@PLX!!O4Sn*?Z_G8&g{Qzq|SP8Jl}%l0jJ6>LnFtM>FaCP@+~+u2$+S_!StW
zlp0$mj#cz;AIcN@lE#j%JhfS=Kzm*{oy19D@@=oBMx8uUv2mxHj6F<-FbqV7ga(Zz
zE`-KBc4VJ^Ujt*?-jt4<B6?es`!jX$gmvd5e^eq|t6MTbk*AkflKmW&QN@MO!ixre
zl_=x_>?RD2nApmEu!e~sy$Q7Eq;dXCl=D5<pI3?ReNJo7pTChBfL^ZJ6Eb8pXe@Cd
zG>H8_`$>^LcS~N=KZzMg`>nq(&`)0XOI2hQrE)f3xI>l!pf<m65v&4|qY2Nh(1fKc
zGILZXFzcA;@wHFq=!!a#^w6FFe&lj++)7MdlS}Oa(ObLSz_iO)dqOfAbj9q4a_tkw
zUs4U~rKAuVtNN~4p7=s&1WyN#D+XT*E>cNZIVn#^c?D>WS4z^Cd>Z)!gc86gm@;p}
zvN@W!LTVNP()?+OI@_W6)H$k2tnb;&3!&J>TMFD`=d{-R#U?wp@p9IlkPJYVto_f_
zez?1phKlr22#o;h(DBqPhmG3D<#Q853z6`iuGKj@jt8Y|kF;k@DT<b|`$To7a;WC!
z#7ADuO~f)M>fi|)kU)EW(yuZdC|PUb;}JkY(~^31htgRi(?W7tM(!d>F73{k_#ZyR
z#iWbs>s-}A;xRn0=?EW#c2Nk8#m7(;_5b{JH~nHu(XveB(}0d0W!F0rVOE@glIU2X
zcC!n|!#XTr%xoz~S;elwtqT(R$G0bjb*NUrwTkv9U+*cSC&|?j$Y(LNUnJhX&#r4U
zTn2y*RB~NP_3%N9`Ls@>xaupVV|Y*q{kdCn+BdaEVBO0pt$V5H=q39e*TUr0lK)52
zgcSDkdnk$vsb$!Lp`7x07evY0pV49oI_qUXI=PD6{Pc--(TD){P*umS!O)&(n4^jj
zHt5sWo4<WI`<{?|zR=x+EV=5g-_7SKU*$~UK@x59wMqLQV)D_0zhFjUdh(IehuM2|
zN6I(MwG&37(mjf~nru`RUUadDxUL)se5=|}yb-;XRf&7h(!}ce*_K{CRL0~ZrTHs2
z<rLfm%8UR~o@sFB;mtc1@&Z6VI*kEf#kH5S?+M{C<IeQ}=<*xCMx9M<LnBb?LnQm8
zAKWg5(8xZ4ibCM9d9R|0I@2?CJV(J%TznETO)<^nz+mlv$=oO`c-xe>?`4i+sOY`q
z06Sw68*_i?xUwnQ5<!h8W=V~2?JbMIX7MV=<SIvr8N5FKjxss-&Tjrenkzm<m$`hh
zsp(9w_UNv!pP!aCQ++s;1`4M<Gf~Np^rIOVyYuipc{3tX#_^yp{#REf8H?`bjG8Tx
zv#soQ%50CHqvbc3NbnU10!0~@z?10MfF-Vx={egGJ_(xh3%BLWkOv}nFSwf_&A9(j
zu&3-&-GBG0=|X_^eDHEN@2%a1i%)&`ij%$OLuTIn|LY6ZUFR`e4G=emN5kVPo$gx#
zD(aSnfr`RZk)1~rU3Yatqen6O(NNTrX)^It!eMR8$P>VujP{Jpdoce!90nl`Kt(N|
z$7<XdLnAR}-D8AfOLI2+WrCutt8D)=`>Ly_H(?sd$47g%wzZ$zx&GVTy#n;s-&$K7
zQgl;4(pw=k+IoNUSM#*<U`hv$6K&BZAG6%YjSgBdgEb|kP$Y4C_yCO#9UPhEWH|7o
z?lqQH)IO~Zjty|4-5Jew)_ZWk=D3(3YUr0Uw6z3k$Dx$B?6JOQF<1C?y3C~|uZsWh
zN0ZE$jb1ZJpqnmo=Xn}N0xBvV!}FI<6^+RUkq;{B-~Xs!mY(q~Ax;D-83`qB210h(
z9A|Dtt438uB~EO3+<V5~f?PR2S1ONX!e5Mc=QCrGTC*PgWza@kiHvDJ>sKA<Gu8R#
z=n3sZkrVAt%zS<H<TJerD(X*vQlM4Z<YTBA1OUalogJOoetZ?pk0H0}i1RBk_)O(w
zDMK5tD4*Sl2kiRUQ+`9%qZDKAUSrQFNm9Vw6w0q2VWNAjJ?T`tSw-)%Xd^Bs(4IeC
zd$nIPu<u;_T26Ca=WAR)WAMdPMJ0tV#S@|TYK;nzB9O9cBNgeyIcHd-K*&LbT`RM+
zKC$1yfXEa1sx*(U>^xo~;;4ADPvLklh5vN%k=+!gkDK<KxP0vK_<6s@BJ2OlRp&VA
zu5t~xp&>B&8UbIG>=Pn;R7FYl>6?FBpbb0IOg)AlM52O^n9s*Yjn{O_T6Dh$$vB#9
zF-lYtAZ&t+H0P{8AcN9~b{tIk=o$5~(Vk<|F=yaj#@otPGriPu#Tk{RH7*u?X{4_)
zJjgzw@c4f|pVH6Y^hBlb`992t_Dr%Ax-S}$?2ho2@}9W4js3onYZ?lvqKM6<V*_zz
zUNYLVojxYov!ng#Z*h;fr+m4cHuck2wVr@)K*Lb_8pHF|d#zuJMP(oRn*y||*jQhs
z*OZU);9OdN5}EhXig$aQOu*z-uL_?L`=8nRJ~mmg4^Lsu&&ywXHjU}(c=<m}?$w>F
zs2&t*7rw!8)ua%uP1kZl-@qaeKYgu8KiinnAO16I^3B>vPZrIB2@qweBsMJ_A)Iny
zy~UOEKG|XvC*eV?CtYQJ2#|;=8<)9%WfN9FhW0#u=JMB`qcvN!e(i)lC%2aI<9o`=
z-#>XpiyAeShN;BaC#>zX=7xkoOUbN#wEW(;A~A)@I!{g#nLEcZlSz_UQa<X>q^3wx
zrv7o1Wl}13XoLHyFkbSxEh)YFUW%6Ibvoc1*5ecV6Zo9Hne|wz1}NnIwTH)abd77f
zSm63EPBaM8RLqY{nI6-?cnHq{RIKwPDbnlp<6pZwrzVc$9_Cxc=9;3kXyy~JT5?!&
z+>PeWyeGJyeoCZ4{d+pO@XXsL=YAF|s$7mK&8A|ptG&JL%$wim?sEGM2%wM$*Qwm$
zH;#{K$&Vg0T!EUTxra0=9)&i=a|{8K1<F>;OX%0`$*H!{nXyhTA~&hYj1L;|O>P@`
zRp~dY=;e}P6zqpC&BtF$&C)T2B7LKfyS#=lAdUeEAM>2$WWWFw0Z=b)KQijXxwcmA
zwB>1-iP5GBe@)x#N8{}nYl9ZxPihz7#(9AXjYb}N8Yy)PIAjL$s@@YxDq@sWI4GIX
zi7%zb-8kKGd6{--OloU8w|*^Otn#h312h%^>+v&M7v++Cu8`!0Lsb;S_@<P5M9e;<
zN!tbF&{r*BG|HKJ&)&>+{5J-$*&g<FzA8ntq?~`NAA(JIb61Lh?Lg8@_YSue;Y12r
zOQI5fOs>20)aZ-d_tUhCYu9r1t425(7T_67S^a3|=QU=&tN)vW=LnW2wvm}^^6;H`
zWtW1<YEW;!Ro3q`oBJ~PD)3NPTJrVxQxt>jO^WH7_1_!4mqx_M2tfOgyB@jt^@RDi
z1gPU%tv1Eja4b*;$pTdMTpFe~Gq18>{iTlBvEb~1W9qa9=ZX<<W@QAR{mAOCUzn5T
zXsy<xU&eDW`FAZ%&?x6{8I46GXX2wm;~t=Ok2?!WXR#E$cfe>)4bE<@Ia@c;h-730
zpcM#!s`9zN)4*E}kY0HO)0`<x_peGYyrE~Cvt{H>`CO)@#A(iBr<F;uVm7|^IY-QT
zKQaQ)DrEH|7rvr6`3B5B{89tbn-iKmK2a2DO()6~gLq(Ki9(q34ez1&7=_imi3`Oq
zjDWLm83E`3<nG_OuvRDezkwlQliQf?T$0c&3pnmCa>a5MuK?zzJw%&#r)D89jFn7N
z^(QZUyXEUNBK^t;KnEz|pEl)^FGHJ7zmjR*RK`?jvnm`0D_|ryhTo!+3S+u4OX*@4
zuV*Sgw*FhA*VBlUl@Wl}C}Q??-hK`WqR}V^Y6|Nv6^mpR(#0$#?E#Dca{w{|&^pQL
z-?^|_r{6!X4gGA*J&o74T_-HlGfAR0QFqJVum2u5aINLbSN;#}Z_0)g9>&7}0000<
KMNUMnLSTZ&a+~!4

literal 0
HcmV?d00001

diff --git a/web/src/pages/AddLocationPage/steps/AddLocationFirewallStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationFirewallStep.tsx
index 39323ad6c9..cb1c77817b 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationFirewallStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationFirewallStep.tsx
@@ -1,7 +1,7 @@
-import { useMutation } from '@tanstack/react-query';
+import { useMutation, useQuery } from '@tanstack/react-query';
 import { useNavigate } from '@tanstack/react-router';
 import { cloneDeep, omit } from 'lodash-es';
-import { useCallback, useState } from 'react';
+import { useCallback, useMemo, useState } from 'react';
 import { m } from '../../../paraglide/messages';
 import api from '../../../shared/api/api';
 import { ActionCard } from '../../../shared/components/ActionCard/ActionCard';
@@ -13,8 +13,13 @@ import { ModalControls } from '../../../shared/defguard-ui/components/ModalContr
 import { Radio } from '../../../shared/defguard-ui/components/Radio/Radio';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
+import { externalLink } from '../../../shared/constants';
+import { getLicenseInfoQueryOptions } from '../../../shared/query';
+import { canUseBusinessFeature } from '../../../shared/utils/license';
 import { useGatewayWizardStore } from '../../GatewaySetupPage/useGatewayWizardStore';
 import actionCardImage from '../assets/gateway-setup-action-card.png';
+import businessFeatureCardImage from '../assets/business-feature-icon.png';
 import { AddLocationPageStep } from '../types';
 import { useAddLocationStore } from '../useAddLocationStore';
 
@@ -25,6 +30,13 @@ export const AddLocationFirewallStep = () => {
   const [state, setState] = useState<Choice>('disable');
   const navigate = useNavigate();
 
+  const { data: licenseInfo } = useQuery(getLicenseInfoQueryOptions);
+  const canUseFeature = useMemo(() => {
+    if (licenseInfo === undefined) return undefined;
+    return canUseBusinessFeature(licenseInfo).result;
+  }, [licenseInfo]);
+  const firewallLocked = isPresent(canUseFeature) && !canUseFeature;
+
   const { mutate, isPending } = useMutation({
     mutationFn: api.location.addLocation,
     meta: {
@@ -75,12 +87,35 @@ export const AddLocationFirewallStep = () => {
 
   return (
     <WizardCard>
+      {firewallLocked && (
+        <>
+          <ActionCard
+            imageSrc={businessFeatureCardImage}
+            title=''
+            subtitle={m.add_location_firewall_no_license_subtitle()}
+          >
+            <a
+              href={externalLink.defguard.pricing}
+              target="_blank"
+              rel="noreferrer"
+            >
+              <Button
+                variant="outlined"
+                text="See other plans"
+                iconRight="open-in-new-window"
+              />
+            </a>
+          </ActionCard>
+          <Divider spacing={ThemeSpacing.Xl2} />
+        </>
+      )}
       <Radio
         active={state === 'disable'}
         onClick={() => {
           setState('disable');
         }}
         text="Disable firewall option"
+        disabled={firewallLocked}
       />
       <SizedBox height={ThemeSpacing.Md} />
       <Radio
@@ -89,6 +124,7 @@ export const AddLocationFirewallStep = () => {
           setState('enabled-allowed');
         }}
         text="Users/devices can access all resources unless limited by ACL rules."
+        disabled={firewallLocked}
       />
       <SizedBox height={ThemeSpacing.Md} />
       <Radio
@@ -97,6 +133,7 @@ export const AddLocationFirewallStep = () => {
           setState('enabled-denied');
         }}
         text="All traffic not explicitly allowed by an ACL rule will be blocked."
+        disabled={firewallLocked}
       />
       <Divider spacing={ThemeSpacing.Xl2} />
       <ActionCard

From 8b395a40a3f0aee4d8291ac3f74e5c52663d26bc Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Wed, 25 Feb 2026 16:20:41 +0100
Subject: [PATCH 03/15] block service locations settings in edit location page
 without enterprise license

---
 web/messages/en/common.json                   |  2 ++
 .../EditLocationPage/EditLocationPage.tsx     | 35 ++++++++++++++++---
 .../EditPageFormSection.tsx                   | 14 ++++++--
 .../components/EditPageFormSection/style.scss | 30 +++++++++++++++-
 4 files changed, 72 insertions(+), 9 deletions(-)

diff --git a/web/messages/en/common.json b/web/messages/en/common.json
index 4e9a02a369..bddaf478da 100644
--- a/web/messages/en/common.json
+++ b/web/messages/en/common.json
@@ -10,6 +10,8 @@
   "misc_secret": "Secret",
   "misc_active": "Active",
   "misc_disabled": "Disabled",
+  "license_enterprise_required": "Available in Enterprise plan.",
+  "license_upgrade_to_unlock": "Upgrade to unlock.",
   "controls_connect": "Connect",
   "controls_search": "Search",
   "controls_accept": "Accept",
diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index e1f6440da4..5a361a6e93 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -16,6 +16,7 @@ import { EditPage } from '../../shared/components/EditPage/EditPage';
 import { EditPageControls } from '../../shared/components/EditPageControls/EditPageControls';
 import { EditPageFormSection } from '../../shared/components/EditPageFormSection/EditPageFormSection';
 import type { SelectionOption } from '../../shared/components/SelectionSection/type';
+import { externalLink } from '../../shared/constants';
 import { InfoBanner } from '../../shared/defguard-ui/components/InfoBanner/InfoBanner';
 import { SizedBox } from '../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { Snackbar } from '../../shared/defguard-ui/providers/snackbar/snackbar';
@@ -23,7 +24,8 @@ import { ThemeSpacing } from '../../shared/defguard-ui/types';
 import { isPresent } from '../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../shared/form';
 import { formChangeLogic } from '../../shared/formLogic';
-import { getLocationQueryOptions } from '../../shared/query';
+import { getLicenseInfoQueryOptions, getLocationQueryOptions } from '../../shared/query';
+import { canUseEnterpriseFeature } from '../../shared/utils/license';
 import { validateIpList, validateIpOrDomainList } from '../../shared/validators';
 
 export const EditLocationPage = () => {
@@ -100,6 +102,13 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
 
   const navigate = useNavigate();
 
+  const { data: licenseInfo } = useQuery(getLicenseInfoQueryOptions);
+  const canUseEnterprise = useMemo(() => {
+    if (licenseInfo === undefined) return undefined;
+    return canUseEnterpriseFeature(licenseInfo).result;
+  }, [licenseInfo]);
+  const serviceLocationLocked = isPresent(canUseEnterprise) && !canUseEnterprise;
+
   const { data: groupsOptions } = useQuery({
     queryFn: api.group.getGroups,
     queryKey: ['group'],
@@ -353,23 +362,39 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
                         }
                       />
                     )}
-                    <EditPageFormSection label="Location type (Windows only)">
+                    <EditPageFormSection
+                      label="Location type (Windows only)"
+                      labelContent={
+                        (serviceLocationLocked && (
+                          <>
+                            <p>{m.license_enterprise_required()}</p>
+                            <a
+                              href={externalLink.defguard.pricing}
+                              target="_blank"
+                              rel="noreferrer"
+                            >
+                              {m.license_upgrade_to_unlock()}
+                            </a>
+                          </>
+                        )) || undefined
+                      }
+                    >
                       <field.FormRadio
                         value={LocationServiceMode.Disabled}
                         text="Regular location"
-                        disabled={disabled}
+                        disabled={disabled || serviceLocationLocked}
                       />
                       <SizedBox height={ThemeSpacing.Md} />
                       <field.FormRadio
                         value={LocationServiceMode.Prelogon}
                         text="Service location: Pre-logon"
-                        disabled={disabled}
+                        disabled={disabled || serviceLocationLocked}
                       />
                       <SizedBox height={ThemeSpacing.Md} />
                       <field.FormRadio
                         value={LocationServiceMode.Alwayson}
                         text="Service location: Always on"
-                        disabled={disabled}
+                        disabled={disabled || serviceLocationLocked}
                       />
                     </EditPageFormSection>
                   </>
diff --git a/web/src/shared/components/EditPageFormSection/EditPageFormSection.tsx b/web/src/shared/components/EditPageFormSection/EditPageFormSection.tsx
index e0cf9c1f4a..ab37891867 100644
--- a/web/src/shared/components/EditPageFormSection/EditPageFormSection.tsx
+++ b/web/src/shared/components/EditPageFormSection/EditPageFormSection.tsx
@@ -1,14 +1,22 @@
-import type { PropsWithChildren } from 'react';
+import type { PropsWithChildren, ReactNode } from 'react';
+import { isPresent } from '../../defguard-ui/utils/isPresent';
 import './style.scss';
 
 type Props = {
   label: string;
+  labelContent?: ReactNode;
 } & PropsWithChildren;
 
-export const EditPageFormSection = ({ label, children }: Props) => {
+export const EditPageFormSection = ({ label, children, labelContent }: Props) => {
   return (
     <div className="edit-page-form-section">
-      <p className="label">{label}</p>
+      {isPresent(labelContent) && (
+        <div className="label-area">
+          <p className="label">{label}</p>
+          <p className="label-content">{labelContent}</p>
+        </div>
+      )}
+      {!isPresent(labelContent) && <p className="label">{label}</p>}
       <div className="content">{children}</div>
     </div>
   );
diff --git a/web/src/shared/components/EditPageFormSection/style.scss b/web/src/shared/components/EditPageFormSection/style.scss
index 300bc9cd31..4d05bd6ed5 100644
--- a/web/src/shared/components/EditPageFormSection/style.scss
+++ b/web/src/shared/components/EditPageFormSection/style.scss
@@ -11,15 +11,43 @@
     padding-top: var(--spacing-3xl);
   }
 
-  & > .label {
+  .label {
     font: var(--t-body-sm-500);
     color: var(--fg-neutral);
     text-align: left;
+  }
+
+  & > .label {
     grid-column: 1 / 3;
     grid-row: 1;
     place-self: start start;
   }
 
+  & > .label-area {
+    grid-column: 1 / 3;
+    display: flex;
+    flex-direction: column;
+    gap: var(--spacing-sm);
+
+    & > .label-content {
+      p {
+        font: var(--t-body-xs-400);
+        color: var(--fg-muted);
+      }
+
+      a {
+        font: var(--t-body-xs-400);
+        color: var(--fg-action);
+        text-decoration: none;
+
+        &:hover {
+          text-decoration: underline;
+          text-decoration-color: var(--fg-action);
+        }
+      }
+    }
+  }
+
   & > .content {
     width: 100%;
     grid-column: 3 / 7;

From 3cef777f089ae808b8a548de8addae70cb285c80 Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Wed, 25 Feb 2026 16:22:05 +0100
Subject: [PATCH 04/15] remove unused color

---
 web/src/shared/components/EditPageFormSection/style.scss | 1 -
 1 file changed, 1 deletion(-)

diff --git a/web/src/shared/components/EditPageFormSection/style.scss b/web/src/shared/components/EditPageFormSection/style.scss
index 4d05bd6ed5..7db87700fb 100644
--- a/web/src/shared/components/EditPageFormSection/style.scss
+++ b/web/src/shared/components/EditPageFormSection/style.scss
@@ -42,7 +42,6 @@
 
         &:hover {
           text-decoration: underline;
-          text-decoration-color: var(--fg-action);
         }
       }
     }

From bf7973ef2c486e4d0a4de390787a06f253ca68f3 Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Wed, 25 Feb 2026 16:26:55 +0100
Subject: [PATCH 05/15] block firewall in edit location page without business
 license + tweak

---
 web/messages/en/common.json                   |  1 +
 .../EditLocationPage/EditLocationPage.tsx     | 28 +++++++++++++++++--
 .../EditPageFormSection.tsx                   |  2 +-
 3 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/web/messages/en/common.json b/web/messages/en/common.json
index bddaf478da..f14f546115 100644
--- a/web/messages/en/common.json
+++ b/web/messages/en/common.json
@@ -10,6 +10,7 @@
   "misc_secret": "Secret",
   "misc_active": "Active",
   "misc_disabled": "Disabled",
+  "license_business_required": "Available in Business plan.",
   "license_enterprise_required": "Available in Enterprise plan.",
   "license_upgrade_to_unlock": "Upgrade to unlock.",
   "controls_connect": "Connect",
diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index 5a361a6e93..d9755e7d4d 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -25,7 +25,7 @@ import { isPresent } from '../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../shared/form';
 import { formChangeLogic } from '../../shared/formLogic';
 import { getLicenseInfoQueryOptions, getLocationQueryOptions } from '../../shared/query';
-import { canUseEnterpriseFeature } from '../../shared/utils/license';
+import { canUseBusinessFeature, canUseEnterpriseFeature } from '../../shared/utils/license';
 import { validateIpList, validateIpOrDomainList } from '../../shared/validators';
 
 export const EditLocationPage = () => {
@@ -107,7 +107,12 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
     if (licenseInfo === undefined) return undefined;
     return canUseEnterpriseFeature(licenseInfo).result;
   }, [licenseInfo]);
+  const canUseBusiness = useMemo(() => {
+    if (licenseInfo === undefined) return undefined;
+    return canUseBusinessFeature(licenseInfo).result;
+  }, [licenseInfo]);
   const serviceLocationLocked = isPresent(canUseEnterprise) && !canUseEnterprise;
+  const firewallLocked = isPresent(canUseBusiness) && !canUseBusiness;
 
   const { data: groupsOptions } = useQuery({
     queryFn: api.group.getGroups,
@@ -425,12 +430,29 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
             </form.AppField>
           )}
         </EditPageFormSection>
-        <EditPageFormSection label="Firewall">
+        <EditPageFormSection
+          label="Firewall"
+          labelContent={
+            (firewallLocked && (
+              <>
+                <p>{m.license_business_required()}</p>
+                <a
+                  href={externalLink.defguard.pricing}
+                  target="_blank"
+                  rel="noreferrer"
+                >
+                  {m.license_upgrade_to_unlock()}
+                </a>
+              </>
+            )) || undefined
+          }
+        >
           <form.AppField name="firewall">
             {(field) => (
               <field.FormRadio
                 value={LocationFirewall.Disabled}
                 text="Disable firewall option"
+                disabled={firewallLocked}
               />
             )}
           </form.AppField>
@@ -440,6 +462,7 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
               <field.FormRadio
                 value={LocationFirewall.Allow}
                 text="Users/devices can access all resources unless limited by ACL rules."
+                disabled={firewallLocked}
               />
             )}
           </form.AppField>
@@ -449,6 +472,7 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
               <field.FormRadio
                 value={LocationFirewall.Deny}
                 text="All traffic not explicitly allowed by an ACL rule will be blocked."
+                disabled={firewallLocked}
               />
             )}
           </form.AppField>
diff --git a/web/src/shared/components/EditPageFormSection/EditPageFormSection.tsx b/web/src/shared/components/EditPageFormSection/EditPageFormSection.tsx
index ab37891867..5722cd0a80 100644
--- a/web/src/shared/components/EditPageFormSection/EditPageFormSection.tsx
+++ b/web/src/shared/components/EditPageFormSection/EditPageFormSection.tsx
@@ -13,7 +13,7 @@ export const EditPageFormSection = ({ label, children, labelContent }: Props) =>
       {isPresent(labelContent) && (
         <div className="label-area">
           <p className="label">{label}</p>
-          <p className="label-content">{labelContent}</p>
+          <div className="label-content">{labelContent}</div>
         </div>
       )}
       {!isPresent(labelContent) && <p className="label">{label}</p>}

From 36b678a38b2d2e29e75e2eaf4e7207266998f1d6 Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Thu, 26 Feb 2026 13:12:30 +0100
Subject: [PATCH 06/15] generating allowed ips based on firewall rules tooltip

---
 web/messages/en/common.json                   |  1 +
 web/messages/en/location.json                 |  1 +
 .../steps/AddLocationInternalVpnStep.tsx      | 40 +++++++++++++++++++
 web/src/shared/defguard-ui                    |  2 +-
 4 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/web/messages/en/common.json b/web/messages/en/common.json
index f14f546115..ee9d2ddaac 100644
--- a/web/messages/en/common.json
+++ b/web/messages/en/common.json
@@ -11,6 +11,7 @@
   "misc_active": "Active",
   "misc_disabled": "Disabled",
   "license_business_required": "Available in Business plan.",
+  "license_upgrade_business_tooltip": "This feature is part of a paid plan.\nUpgrade to Business to activate it.",
   "license_enterprise_required": "Available in Enterprise plan.",
   "license_upgrade_to_unlock": "Upgrade to unlock.",
   "controls_connect": "Connect",
diff --git a/web/messages/en/location.json b/web/messages/en/location.json
index afdc64d6f1..cc658cc734 100644
--- a/web/messages/en/location.json
+++ b/web/messages/en/location.json
@@ -1,6 +1,7 @@
 {
   "$schema": "https://inlang.com/schema/inlang-message-format",
   "add_location_firewall_no_license_subtitle": "Firewall is available only in Business and Enterprise plans. You can still create location now and activate Firewall later by upgrading your plan.",
+  "add_location_internal_vpn_allowed_ips_from_firewall_rules": "Allowed IPs are generated automatically from firewall rules",
   "location_delete_success": "Location deleted",
   "location_delete_failed": "Failed to delete location",
   "location_edit_failed": "Failed to update location",
diff --git a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
index 696e25dda5..872efaca4c 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
@@ -1,3 +1,6 @@
+import { useQuery } from '@tanstack/react-query';
+import { autoUpdate, FloatingPortal, offset, useFloating } from '@floating-ui/react';
+import { useMemo, useState } from 'react';
 import z from 'zod';
 import { useShallow } from 'zustand/react/shallow';
 import { m } from '../../../paraglide/messages';
@@ -6,9 +9,14 @@ import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardC
 import { Button } from '../../../shared/defguard-ui/components/Button/Button';
 import { ModalControls } from '../../../shared/defguard-ui/components/ModalControls/ModalControls';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { Toggle } from '../../../shared/defguard-ui/components/Toggle/Toggle';
+import { Tooltip } from '../../../shared/defguard-ui/components/Tooltip/Tooltip';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../../shared/form';
 import { formChangeLogic } from '../../../shared/formLogic';
+import { getLicenseInfoQueryOptions } from '../../../shared/query';
+import { canUseBusinessFeature } from '../../../shared/utils/license';
 import { Validate } from '../../../shared/validate';
 import { AddLocationPageStep } from '../types';
 import { useAddLocationStore } from '../useAddLocationStore';
@@ -29,6 +37,20 @@ const formSchema = z.object({
 type FormFields = z.infer<typeof formSchema>;
 
 export const AddLocationInternalVpnStep = () => {
+  const { data: licenseInfo } = useQuery(getLicenseInfoQueryOptions);
+  const canUseBusiness = useMemo(() => {
+    if (licenseInfo === undefined) return undefined;
+    return canUseBusinessFeature(licenseInfo).result;
+  }, [licenseInfo]);
+  const firewallRulesToggleLocked = isPresent(canUseBusiness) && !canUseBusiness;
+
+  const [tooltipOpen, setTooltipOpen] = useState(false);
+  const { refs, floatingStyles } = useFloating({
+    placement: 'top-start',
+    whileElementsMounted: autoUpdate,
+    middleware: [offset({ mainAxis: 8, crossAxis: -88 })],
+  });
+
   const defaultValues = useAddLocationStore(
     useShallow(
       (s): FormFields => ({
@@ -84,6 +106,24 @@ export const AddLocationInternalVpnStep = () => {
           <form.AppField name="allowed_ips">
             {(field) => <field.FormInput required label={'Allowed IPs'} />}
           </form.AppField>
+          <SizedBox height={ThemeSpacing.Md} />
+          <div
+            onMouseEnter={() => setTooltipOpen(true)}
+            onMouseLeave={() => setTooltipOpen(false)}
+          >
+            <Toggle // Does nothing now #TODO: implement generating allowed ips based on firewall rules
+              active={false}
+              disabled={firewallRulesToggleLocked}
+              label={m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
+            />
+          </div>
+          {firewallRulesToggleLocked && tooltipOpen && (
+            <FloatingPortal>
+              <Tooltip ref={refs.setFloating} style={floatingStyles}>
+                <p>{m.license_upgrade_business_tooltip()}</p>
+              </Tooltip>
+            </FloatingPortal>
+          )}
           <SizedBox height={ThemeSpacing.Xl} />
           <form.AppField name="dns">
             {(field) => <field.FormInput label={'DNS'} />}
diff --git a/web/src/shared/defguard-ui b/web/src/shared/defguard-ui
index 9a6f90c697..0c24df975e 160000
--- a/web/src/shared/defguard-ui
+++ b/web/src/shared/defguard-ui
@@ -1 +1 @@
-Subproject commit 9a6f90c697503560ff6e7002b7c2f722babd777b
+Subproject commit 0c24df975e6389ca6f24b328c90acae27c45f37f

From 514a89a1c7dec8ba49d9aed246e4d900aed5d86e Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Thu, 26 Feb 2026 13:13:47 +0100
Subject: [PATCH 07/15] correct spacing

---
 .../pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
index 872efaca4c..d27966e965 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
@@ -106,7 +106,7 @@ export const AddLocationInternalVpnStep = () => {
           <form.AppField name="allowed_ips">
             {(field) => <field.FormInput required label={'Allowed IPs'} />}
           </form.AppField>
-          <SizedBox height={ThemeSpacing.Md} />
+          <SizedBox height={ThemeSpacing.Lg} />
           <div
             onMouseEnter={() => setTooltipOpen(true)}
             onMouseLeave={() => setTooltipOpen(false)}

From 8efa133f88a1882d66ed563d09ea989103539e58 Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Thu, 26 Feb 2026 13:20:45 +0100
Subject: [PATCH 08/15] add same for edit location

---
 .../steps/AddLocationFirewallStep.tsx         | 12 ++---
 .../steps/AddLocationInternalVpnStep.tsx      |  3 +-
 .../EditLocationPage/EditLocationPage.tsx     | 46 +++++++++++++++----
 3 files changed, 44 insertions(+), 17 deletions(-)

diff --git a/web/src/pages/AddLocationPage/steps/AddLocationFirewallStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationFirewallStep.tsx
index cb1c77817b..53b61ba452 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationFirewallStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationFirewallStep.tsx
@@ -6,6 +6,7 @@ import { m } from '../../../paraglide/messages';
 import api from '../../../shared/api/api';
 import { ActionCard } from '../../../shared/components/ActionCard/ActionCard';
 import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
+import { externalLink } from '../../../shared/constants';
 import { Button } from '../../../shared/defguard-ui/components/Button/Button';
 import { Checkbox } from '../../../shared/defguard-ui/components/Checkbox/Checkbox';
 import { Divider } from '../../../shared/defguard-ui/components/Divider/Divider';
@@ -14,12 +15,11 @@ import { Radio } from '../../../shared/defguard-ui/components/Radio/Radio';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
-import { externalLink } from '../../../shared/constants';
 import { getLicenseInfoQueryOptions } from '../../../shared/query';
 import { canUseBusinessFeature } from '../../../shared/utils/license';
 import { useGatewayWizardStore } from '../../GatewaySetupPage/useGatewayWizardStore';
-import actionCardImage from '../assets/gateway-setup-action-card.png';
 import businessFeatureCardImage from '../assets/business-feature-icon.png';
+import actionCardImage from '../assets/gateway-setup-action-card.png';
 import { AddLocationPageStep } from '../types';
 import { useAddLocationStore } from '../useAddLocationStore';
 
@@ -91,14 +91,10 @@ export const AddLocationFirewallStep = () => {
         <>
           <ActionCard
             imageSrc={businessFeatureCardImage}
-            title=''
+            title=""
             subtitle={m.add_location_firewall_no_license_subtitle()}
           >
-            <a
-              href={externalLink.defguard.pricing}
-              target="_blank"
-              rel="noreferrer"
-            >
+            <a href={externalLink.defguard.pricing} target="_blank" rel="noreferrer">
               <Button
                 variant="outlined"
                 text="See other plans"
diff --git a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
index d27966e965..e48d769c2c 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
@@ -1,5 +1,5 @@
-import { useQuery } from '@tanstack/react-query';
 import { autoUpdate, FloatingPortal, offset, useFloating } from '@floating-ui/react';
+import { useQuery } from '@tanstack/react-query';
 import { useMemo, useState } from 'react';
 import z from 'zod';
 import { useShallow } from 'zustand/react/shallow';
@@ -108,6 +108,7 @@ export const AddLocationInternalVpnStep = () => {
           </form.AppField>
           <SizedBox height={ThemeSpacing.Lg} />
           <div
+            ref={refs.setReference}
             onMouseEnter={() => setTooltipOpen(true)}
             onMouseLeave={() => setTooltipOpen(false)}
           >
diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index d9755e7d4d..0ff5dbae73 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -1,5 +1,6 @@
 import './style.scss';
 
+import { autoUpdate, FloatingPortal, offset, useFloating } from '@floating-ui/react';
 import { useMutation, useQuery, useSuspenseQuery } from '@tanstack/react-query';
 import { useNavigate, useParams } from '@tanstack/react-router';
 import { cloneDeep, omit } from 'lodash-es';
@@ -19,13 +20,18 @@ import type { SelectionOption } from '../../shared/components/SelectionSection/t
 import { externalLink } from '../../shared/constants';
 import { InfoBanner } from '../../shared/defguard-ui/components/InfoBanner/InfoBanner';
 import { SizedBox } from '../../shared/defguard-ui/components/SizedBox/SizedBox';
+import { Toggle } from '../../shared/defguard-ui/components/Toggle/Toggle';
+import { Tooltip } from '../../shared/defguard-ui/components/Tooltip/Tooltip';
 import { Snackbar } from '../../shared/defguard-ui/providers/snackbar/snackbar';
 import { ThemeSpacing } from '../../shared/defguard-ui/types';
 import { isPresent } from '../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../shared/form';
 import { formChangeLogic } from '../../shared/formLogic';
 import { getLicenseInfoQueryOptions, getLocationQueryOptions } from '../../shared/query';
-import { canUseBusinessFeature, canUseEnterpriseFeature } from '../../shared/utils/license';
+import {
+  canUseBusinessFeature,
+  canUseEnterpriseFeature,
+} from '../../shared/utils/license';
 import { validateIpList, validateIpOrDomainList } from '../../shared/validators';
 
 export const EditLocationPage = () => {
@@ -99,6 +105,7 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
   const [allGroupsToggle, setAllGroupsToggle] = useState(
     location.allowed_groups.length === 0,
   );
+  const [tooltipOpen, setTooltipOpen] = useState(false);
 
   const navigate = useNavigate();
 
@@ -114,6 +121,12 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
   const serviceLocationLocked = isPresent(canUseEnterprise) && !canUseEnterprise;
   const firewallLocked = isPresent(canUseBusiness) && !canUseBusiness;
 
+  const { refs, floatingStyles } = useFloating({
+    placement: 'top-start',
+    whileElementsMounted: autoUpdate,
+    middleware: [offset({ mainAxis: 8, crossAxis: -88 })],
+  });
+
   const { data: groupsOptions } = useQuery({
     queryFn: api.group.getGroups,
     queryKey: ['group'],
@@ -246,6 +259,25 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
           <form.AppField name="allowed_ips">
             {(field) => <field.FormInput label="Allowed IPs" />}
           </form.AppField>
+          <SizedBox height={ThemeSpacing.Lg} />
+          <div
+            ref={refs.setReference}
+            onMouseEnter={() => setTooltipOpen(true)}
+            onMouseLeave={() => setTooltipOpen(false)}
+          >
+            <Toggle
+              active={false}
+              disabled={firewallLocked}
+              label={m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
+            />
+          </div>
+          {firewallLocked && tooltipOpen && (
+            <FloatingPortal>
+              <Tooltip ref={refs.setFloating} style={floatingStyles}>
+                <p>{m.license_upgrade_business_tooltip()}</p>
+              </Tooltip>
+            </FloatingPortal>
+          )}
           <SizedBox height={ThemeSpacing.Xl2} />
           <form.AppField name="dns">
             {(field) => <field.FormInput label="DNS" />}
@@ -381,7 +413,8 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
                               {m.license_upgrade_to_unlock()}
                             </a>
                           </>
-                        )) || undefined
+                        )) ||
+                        undefined
                       }
                     >
                       <field.FormRadio
@@ -436,15 +469,12 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
             (firewallLocked && (
               <>
                 <p>{m.license_business_required()}</p>
-                <a
-                  href={externalLink.defguard.pricing}
-                  target="_blank"
-                  rel="noreferrer"
-                >
+                <a href={externalLink.defguard.pricing} target="_blank" rel="noreferrer">
                   {m.license_upgrade_to_unlock()}
                 </a>
               </>
-            )) || undefined
+            )) ||
+            undefined
           }
         >
           <form.AppField name="firewall">

From 1a2f995f04083bfa2e2398f0c6ace5243d69c767 Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Thu, 26 Feb 2026 14:05:03 +0100
Subject: [PATCH 09/15] another approach

---
 .../EditLocationPage/EditLocationPage.tsx     | 55 ++++++++++---------
 1 file changed, 30 insertions(+), 25 deletions(-)

diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index 0ff5dbae73..f4e8eb3da3 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -1,6 +1,5 @@
 import './style.scss';
 
-import { autoUpdate, FloatingPortal, offset, useFloating } from '@floating-ui/react';
 import { useMutation, useQuery, useSuspenseQuery } from '@tanstack/react-query';
 import { useNavigate, useParams } from '@tanstack/react-router';
 import { cloneDeep, omit } from 'lodash-es';
@@ -18,12 +17,15 @@ import { EditPageControls } from '../../shared/components/EditPageControls/EditP
 import { EditPageFormSection } from '../../shared/components/EditPageFormSection/EditPageFormSection';
 import type { SelectionOption } from '../../shared/components/SelectionSection/type';
 import { externalLink } from '../../shared/constants';
+import { AppText } from '../../shared/defguard-ui/components/AppText/AppText';
 import { InfoBanner } from '../../shared/defguard-ui/components/InfoBanner/InfoBanner';
 import { SizedBox } from '../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { Toggle } from '../../shared/defguard-ui/components/Toggle/Toggle';
-import { Tooltip } from '../../shared/defguard-ui/components/Tooltip/Tooltip';
+import { TooltipContent } from '../../shared/defguard-ui/providers/tooltip/TooltipContent';
 import { Snackbar } from '../../shared/defguard-ui/providers/snackbar/snackbar';
-import { ThemeSpacing } from '../../shared/defguard-ui/types';
+import { TooltipProvider } from '../../shared/defguard-ui/providers/tooltip/TooltipContext';
+import { TooltipTrigger } from '../../shared/defguard-ui/providers/tooltip/TooltipTrigger';
+import { TextStyle, ThemeSpacing, ThemeVariable } from '../../shared/defguard-ui/types';
 import { isPresent } from '../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../shared/form';
 import { formChangeLogic } from '../../shared/formLogic';
@@ -105,7 +107,6 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
   const [allGroupsToggle, setAllGroupsToggle] = useState(
     location.allowed_groups.length === 0,
   );
-  const [tooltipOpen, setTooltipOpen] = useState(false);
 
   const navigate = useNavigate();
 
@@ -121,12 +122,6 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
   const serviceLocationLocked = isPresent(canUseEnterprise) && !canUseEnterprise;
   const firewallLocked = isPresent(canUseBusiness) && !canUseBusiness;
 
-  const { refs, floatingStyles } = useFloating({
-    placement: 'top-start',
-    whileElementsMounted: autoUpdate,
-    middleware: [offset({ mainAxis: 8, crossAxis: -88 })],
-  });
-
   const { data: groupsOptions } = useQuery({
     queryFn: api.group.getGroups,
     queryKey: ['group'],
@@ -261,23 +256,33 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
           </form.AppField>
           <SizedBox height={ThemeSpacing.Lg} />
           <div
-            ref={refs.setReference}
-            onMouseEnter={() => setTooltipOpen(true)}
-            onMouseLeave={() => setTooltipOpen(false)}
+            style={{
+              display: 'inline-flex',
+              alignItems: 'flex-start',
+              columnGap: ThemeSpacing.Md,
+            }}
           >
-            <Toggle
-              active={false}
-              disabled={firewallLocked}
-              label={m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
-            />
-          </div>
-          {firewallLocked && tooltipOpen && (
-            <FloatingPortal>
-              <Tooltip ref={refs.setFloating} style={floatingStyles}>
+            <TooltipProvider disabled={!firewallLocked} placement="top">
+              <TooltipTrigger>
+                <span>
+                  <Toggle // Does nothing now #TODO: implement generating allowed ips based on firewall rules
+                    active={false}
+                    disabled={firewallLocked}
+                  />
+                </span>
+              </TooltipTrigger>
+              <TooltipContent>
                 <p>{m.license_upgrade_business_tooltip()}</p>
-              </Tooltip>
-            </FloatingPortal>
-          )}
+              </TooltipContent>
+            </TooltipProvider>
+            <AppText
+              as="span"
+              font={TextStyle.TBodySm400}
+              color={firewallLocked ? ThemeVariable.FgDisabled : ThemeVariable.FgDefault}
+            >
+              {m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
+            </AppText>
+          </div>
           <SizedBox height={ThemeSpacing.Xl2} />
           <form.AppField name="dns">
             {(field) => <field.FormInput label="DNS" />}

From 6871388e25df80b143b4b16475d598ce5adffa85 Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Thu, 26 Feb 2026 14:24:51 +0100
Subject: [PATCH 10/15] remove inlines

---
 .../pages/EditLocationPage/EditLocationPage.tsx   | 15 +++++----------
 web/src/pages/EditLocationPage/style.scss         |  4 ++++
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index f4e8eb3da3..09619a58f8 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -18,6 +18,7 @@ import { EditPageFormSection } from '../../shared/components/EditPageFormSection
 import type { SelectionOption } from '../../shared/components/SelectionSection/type';
 import { externalLink } from '../../shared/constants';
 import { AppText } from '../../shared/defguard-ui/components/AppText/AppText';
+import { ButtonsGroup } from '../../shared/defguard-ui/components/ButtonsGroup/ButtonsGroup';
 import { InfoBanner } from '../../shared/defguard-ui/components/InfoBanner/InfoBanner';
 import { SizedBox } from '../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { Toggle } from '../../shared/defguard-ui/components/Toggle/Toggle';
@@ -255,21 +256,15 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
             {(field) => <field.FormInput label="Allowed IPs" />}
           </form.AppField>
           <SizedBox height={ThemeSpacing.Lg} />
-          <div
-            style={{
-              display: 'inline-flex',
-              alignItems: 'flex-start',
-              columnGap: ThemeSpacing.Md,
-            }}
-          >
+          <ButtonsGroup>
             <TooltipProvider disabled={!firewallLocked} placement="top">
               <TooltipTrigger>
-                <span>
+                <div>
                   <Toggle // Does nothing now #TODO: implement generating allowed ips based on firewall rules
                     active={false}
                     disabled={firewallLocked}
                   />
-                </span>
+                </div>
               </TooltipTrigger>
               <TooltipContent>
                 <p>{m.license_upgrade_business_tooltip()}</p>
@@ -282,7 +277,7 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
             >
               {m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
             </AppText>
-          </div>
+          </ButtonsGroup>
           <SizedBox height={ThemeSpacing.Xl2} />
           <form.AppField name="dns">
             {(field) => <field.FormInput label="DNS" />}
diff --git a/web/src/pages/EditLocationPage/style.scss b/web/src/pages/EditLocationPage/style.scss
index 583f3ea0ea..3f461a3986 100644
--- a/web/src/pages/EditLocationPage/style.scss
+++ b/web/src/pages/EditLocationPage/style.scss
@@ -3,5 +3,9 @@
     .info-banner {
       padding-top: var(--spacing-3xl);
     }
+
+    .buttons-group {
+      align-items: flex-start;
+    }
   }
 }

From 935224c2680b2a361a5add4d8c7b15a826a16ac0 Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Thu, 26 Feb 2026 14:39:53 +0100
Subject: [PATCH 11/15] apply changes

---
 .../steps/AddLocationInternalVpnStep.tsx      | 60 ++++++++++---------
 1 file changed, 32 insertions(+), 28 deletions(-)

diff --git a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
index e48d769c2c..348e9d2c16 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
@@ -1,17 +1,20 @@
-import { autoUpdate, FloatingPortal, offset, useFloating } from '@floating-ui/react';
 import { useQuery } from '@tanstack/react-query';
-import { useMemo, useState } from 'react';
+import { useMemo } from 'react';
 import z from 'zod';
 import { useShallow } from 'zustand/react/shallow';
 import { m } from '../../../paraglide/messages';
 import { DescriptionBlock } from '../../../shared/components/DescriptionBlock/DescriptionBlock';
 import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
+import { AppText } from '../../../shared/defguard-ui/components/AppText/AppText';
 import { Button } from '../../../shared/defguard-ui/components/Button/Button';
+import { ButtonsGroup } from '../../../shared/defguard-ui/components/ButtonsGroup/ButtonsGroup';
 import { ModalControls } from '../../../shared/defguard-ui/components/ModalControls/ModalControls';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { Toggle } from '../../../shared/defguard-ui/components/Toggle/Toggle';
-import { Tooltip } from '../../../shared/defguard-ui/components/Tooltip/Tooltip';
-import { ThemeSpacing } from '../../../shared/defguard-ui/types';
+import { TooltipContent } from '../../../shared/defguard-ui/providers/tooltip/TooltipContent';
+import { TooltipProvider } from '../../../shared/defguard-ui/providers/tooltip/TooltipContext';
+import { TooltipTrigger } from '../../../shared/defguard-ui/providers/tooltip/TooltipTrigger';
+import { TextStyle, ThemeSpacing, ThemeVariable } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../../shared/form';
 import { formChangeLogic } from '../../../shared/formLogic';
@@ -44,13 +47,6 @@ export const AddLocationInternalVpnStep = () => {
   }, [licenseInfo]);
   const firewallRulesToggleLocked = isPresent(canUseBusiness) && !canUseBusiness;
 
-  const [tooltipOpen, setTooltipOpen] = useState(false);
-  const { refs, floatingStyles } = useFloating({
-    placement: 'top-start',
-    whileElementsMounted: autoUpdate,
-    middleware: [offset({ mainAxis: 8, crossAxis: -88 })],
-  });
-
   const defaultValues = useAddLocationStore(
     useShallow(
       (s): FormFields => ({
@@ -107,24 +103,32 @@ export const AddLocationInternalVpnStep = () => {
             {(field) => <field.FormInput required label={'Allowed IPs'} />}
           </form.AppField>
           <SizedBox height={ThemeSpacing.Lg} />
-          <div
-            ref={refs.setReference}
-            onMouseEnter={() => setTooltipOpen(true)}
-            onMouseLeave={() => setTooltipOpen(false)}
-          >
-            <Toggle // Does nothing now #TODO: implement generating allowed ips based on firewall rules
-              active={false}
-              disabled={firewallRulesToggleLocked}
-              label={m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
-            />
-          </div>
-          {firewallRulesToggleLocked && tooltipOpen && (
-            <FloatingPortal>
-              <Tooltip ref={refs.setFloating} style={floatingStyles}>
+          <ButtonsGroup>
+            <TooltipProvider disabled={!firewallRulesToggleLocked} placement="top">
+              <TooltipTrigger>
+                <div>
+                  <Toggle // Does nothing now #TODO: implement generating allowed ips based on firewall rules
+                    active={false}
+                    disabled={firewallRulesToggleLocked}
+                  />
+                </div>
+              </TooltipTrigger>
+              <TooltipContent>
                 <p>{m.license_upgrade_business_tooltip()}</p>
-              </Tooltip>
-            </FloatingPortal>
-          )}
+              </TooltipContent>
+            </TooltipProvider>
+            <AppText
+              as="span"
+              font={TextStyle.TBodySm400}
+              color={
+                firewallRulesToggleLocked
+                  ? ThemeVariable.FgDisabled
+                  : ThemeVariable.FgDefault
+              }
+            >
+              {m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
+            </AppText>
+          </ButtonsGroup>
           <SizedBox height={ThemeSpacing.Xl} />
           <form.AppField name="dns">
             {(field) => <field.FormInput label={'DNS'} />}

From 8cdeb0e113117b4605231f1947700017c7adb5af Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Thu, 26 Feb 2026 14:56:04 +0100
Subject: [PATCH 12/15] linter

---
 .../AddLocationPage/steps/AddLocationInternalVpnStep.tsx    | 6 +++++-
 web/src/pages/EditLocationPage/EditLocationPage.tsx         | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
index 348e9d2c16..6dd969e5d3 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
@@ -14,7 +14,11 @@ import { Toggle } from '../../../shared/defguard-ui/components/Toggle/Toggle';
 import { TooltipContent } from '../../../shared/defguard-ui/providers/tooltip/TooltipContent';
 import { TooltipProvider } from '../../../shared/defguard-ui/providers/tooltip/TooltipContext';
 import { TooltipTrigger } from '../../../shared/defguard-ui/providers/tooltip/TooltipTrigger';
-import { TextStyle, ThemeSpacing, ThemeVariable } from '../../../shared/defguard-ui/types';
+import {
+  TextStyle,
+  ThemeSpacing,
+  ThemeVariable,
+} from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../../shared/form';
 import { formChangeLogic } from '../../../shared/formLogic';
diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index 09619a58f8..95f8368020 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -22,8 +22,8 @@ import { ButtonsGroup } from '../../shared/defguard-ui/components/ButtonsGroup/B
 import { InfoBanner } from '../../shared/defguard-ui/components/InfoBanner/InfoBanner';
 import { SizedBox } from '../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { Toggle } from '../../shared/defguard-ui/components/Toggle/Toggle';
-import { TooltipContent } from '../../shared/defguard-ui/providers/tooltip/TooltipContent';
 import { Snackbar } from '../../shared/defguard-ui/providers/snackbar/snackbar';
+import { TooltipContent } from '../../shared/defguard-ui/providers/tooltip/TooltipContent';
 import { TooltipProvider } from '../../shared/defguard-ui/providers/tooltip/TooltipContext';
 import { TooltipTrigger } from '../../shared/defguard-ui/providers/tooltip/TooltipTrigger';
 import { TextStyle, ThemeSpacing, ThemeVariable } from '../../shared/defguard-ui/types';

From 2bd04076ec837054241c8b05d3f07d63ebc7994e Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Thu, 26 Feb 2026 15:13:41 +0100
Subject: [PATCH 13/15] apply suggestions

---
 .../EditLocationPage/EditLocationPage.tsx     | 55 +++++++++----------
 web/src/shared/defguard-ui                    |  2 +-
 2 files changed, 27 insertions(+), 30 deletions(-)

diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index 95f8368020..e31151b8e7 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -123,6 +123,30 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
   const serviceLocationLocked = isPresent(canUseEnterprise) && !canUseEnterprise;
   const firewallLocked = isPresent(canUseBusiness) && !canUseBusiness;
 
+  const serviceLocationLabelContent = useMemo(() => {
+    if (!serviceLocationLocked) return undefined;
+    return (
+      <>
+        <p>{m.license_enterprise_required()}</p>
+        <a href={externalLink.defguard.pricing} target="_blank" rel="noreferrer">
+          {m.license_upgrade_to_unlock()}
+        </a>
+      </>
+    );
+  }, [serviceLocationLocked]);
+
+  const firewallLabelContent = useMemo(() => {
+    if (!firewallLocked) return undefined;
+    return (
+      <>
+        <p>{m.license_business_required()}</p>
+        <a href={externalLink.defguard.pricing} target="_blank" rel="noreferrer">
+          {m.license_upgrade_to_unlock()}
+        </a>
+      </>
+    );
+  }, [firewallLocked]);
+
   const { data: groupsOptions } = useQuery({
     queryFn: api.group.getGroups,
     queryKey: ['group'],
@@ -401,21 +425,7 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
                     )}
                     <EditPageFormSection
                       label="Location type (Windows only)"
-                      labelContent={
-                        (serviceLocationLocked && (
-                          <>
-                            <p>{m.license_enterprise_required()}</p>
-                            <a
-                              href={externalLink.defguard.pricing}
-                              target="_blank"
-                              rel="noreferrer"
-                            >
-                              {m.license_upgrade_to_unlock()}
-                            </a>
-                          </>
-                        )) ||
-                        undefined
-                      }
+                      labelContent={serviceLocationLabelContent}
                     >
                       <field.FormRadio
                         value={LocationServiceMode.Disabled}
@@ -463,20 +473,7 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
             </form.AppField>
           )}
         </EditPageFormSection>
-        <EditPageFormSection
-          label="Firewall"
-          labelContent={
-            (firewallLocked && (
-              <>
-                <p>{m.license_business_required()}</p>
-                <a href={externalLink.defguard.pricing} target="_blank" rel="noreferrer">
-                  {m.license_upgrade_to_unlock()}
-                </a>
-              </>
-            )) ||
-            undefined
-          }
-        >
+        <EditPageFormSection label="Firewall" labelContent={firewallLabelContent}>
           <form.AppField name="firewall">
             {(field) => (
               <field.FormRadio
diff --git a/web/src/shared/defguard-ui b/web/src/shared/defguard-ui
index 0c24df975e..cbad3d7ae3 160000
--- a/web/src/shared/defguard-ui
+++ b/web/src/shared/defguard-ui
@@ -1 +1 @@
-Subproject commit 0c24df975e6389ca6f24b328c90acae27c45f37f
+Subproject commit cbad3d7ae3c7b01e32c969b5f2dba49fa23019b3

From b4c409765421a7b3fbfd31f9d02ce747e335c344 Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Thu, 26 Feb 2026 16:30:47 +0100
Subject: [PATCH 14/15] use interactive block and edit mfa step in location
 wizard

---
 web/messages/en/location.json                 |  7 ++--
 .../steps/AddLocationMfaStep.tsx              | 34 ++++++++++---------
 web/src/shared/defguard-ui                    |  2 +-
 3 files changed, 24 insertions(+), 19 deletions(-)

diff --git a/web/messages/en/location.json b/web/messages/en/location.json
index cc658cc734..cd02cae668 100644
--- a/web/messages/en/location.json
+++ b/web/messages/en/location.json
@@ -1,8 +1,11 @@
 {
   "$schema": "https://inlang.com/schema/inlang-message-format",
   "add_location_firewall_no_license_subtitle": "Firewall is available only in Business and Enterprise plans. You can still create location now and activate Firewall later by upgrading your plan.",
-  "add_location_internal_vpn_allowed_ips_from_firewall_rules": "Allowed IPs are generated automatically from firewall rules",
-  "location_delete_success": "Location deleted",
+  "add_location_internal_vpn_allowed_ips_from_firewall_rules": "Allowed IPs are generated automatically from firewall rules",  "add_location_mfa_disabled_title": "Do not enforce MFA",
+  "add_location_mfa_internal_title": "Internal Defguard Multi-Factor Authentication",
+  "add_location_mfa_internal_content": "Uses the MFA methods configured in your Defguard profile.",
+  "add_location_mfa_external_title": "External Identity Provider Authentication",
+  "add_location_mfa_external_content": "Requires configuring an external identity provider in the settings, such as Google, Microsoft Entra ID, Okta, or JumpCloud.",  "location_delete_success": "Location deleted",
   "location_delete_failed": "Failed to delete location",
   "location_edit_failed": "Failed to update location",
   "location_edit_failed_has_devices": "Gateway VPN IP address and netmask can’t be changed while devices are active on this network. To proceed, remove all devices from the current network first."
diff --git a/web/src/pages/AddLocationPage/steps/AddLocationMfaStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationMfaStep.tsx
index 89df7d1e24..bd2d1e0b83 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationMfaStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationMfaStep.tsx
@@ -7,8 +7,8 @@ import { businessBadgeProps } from '../../../shared/components/badges/BusinessBa
 import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
 import { Button } from '../../../shared/defguard-ui/components/Button/Button';
 import { Input } from '../../../shared/defguard-ui/components/Input/Input';
+import { InteractiveBlock } from '../../../shared/defguard-ui/components/InteractiveBlock/InteractiveBlock';
 import { ModalControls } from '../../../shared/defguard-ui/components/ModalControls/ModalControls';
-import { Radio } from '../../../shared/defguard-ui/components/Radio/Radio';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
@@ -58,29 +58,31 @@ export const AddLocationMfaStep = () => {
 
   return (
     <WizardCard>
-      <Radio
-        active={choice === LocationMfaMode.Disabled}
+      <InteractiveBlock
+        value={choice === LocationMfaMode.Disabled}
         onClick={() => setChoice(LocationMfaMode.Disabled)}
-        text="Do not enforce MFA"
-        testId="do-not-enforce-mfa"
+        title={m.add_location_mfa_disabled_title()}
+        data-testid="do-not-enforce-mfa"
       />
-      <SizedBox height={ThemeSpacing.Md} />
-      <Radio
-        active={choice === LocationMfaMode.Internal}
+      <SizedBox height={ThemeSpacing.Xl} />
+      <InteractiveBlock
+        value={choice === LocationMfaMode.Internal}
         onClick={() => setChoice(LocationMfaMode.Internal)}
-        text="Internal MFA"
-        testId="enforce-internal-mfa"
+        title={m.add_location_mfa_internal_title()}
+        content={m.add_location_mfa_internal_content()}
+        data-testid="enforce-internal-mfa"
       />
-      <SizedBox height={ThemeSpacing.Md} />
-      <Radio
-        active={choice === LocationMfaMode.External}
+      <SizedBox height={ThemeSpacing.Xl} />
+      <InteractiveBlock
+        value={choice === LocationMfaMode.External}
         onClick={() => setChoice(LocationMfaMode.External)}
-        text="External MFA"
+        title={m.add_location_mfa_external_title()}
+        content={m.add_location_mfa_external_content()}
         disabled={isPresent(canUseFeature) && !canUseFeature}
-        testId="enforce-external-mfa"
-        badgeProps={
+        badge={
           isPresent(canUseFeature) && !canUseFeature ? businessBadgeProps : undefined
         }
+        data-testid="enforce-external-mfa"
       />
       {choice !== LocationMfaMode.Disabled && (
         <>
diff --git a/web/src/shared/defguard-ui b/web/src/shared/defguard-ui
index cbad3d7ae3..8146505ffe 160000
--- a/web/src/shared/defguard-ui
+++ b/web/src/shared/defguard-ui
@@ -1 +1 @@
-Subproject commit cbad3d7ae3c7b01e32c969b5f2dba49fa23019b3
+Subproject commit 8146505ffebb737351943f2bcfc017958d7eeadf

From 2bad3f83ff47c2743ec73fa3d1994234171953de Mon Sep 17 00:00:00 2001
From: jakub-tldr <78603704+jakub-tldr@users.noreply.github.com>
Date: Fri, 27 Feb 2026 11:57:41 +0100
Subject: [PATCH 15/15] apply suggestions

---
 .../steps/AddLocationInternalVpnStep.tsx      | 48 ++++++-------------
 .../EditLocationPage/EditLocationPage.tsx     | 41 +++++++---------
 2 files changed, 31 insertions(+), 58 deletions(-)

diff --git a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
index 6dd969e5d3..3e887841de 100644
--- a/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
+++ b/web/src/pages/AddLocationPage/steps/AddLocationInternalVpnStep.tsx
@@ -5,20 +5,14 @@ import { useShallow } from 'zustand/react/shallow';
 import { m } from '../../../paraglide/messages';
 import { DescriptionBlock } from '../../../shared/components/DescriptionBlock/DescriptionBlock';
 import { WizardCard } from '../../../shared/components/wizard/WizardCard/WizardCard';
-import { AppText } from '../../../shared/defguard-ui/components/AppText/AppText';
 import { Button } from '../../../shared/defguard-ui/components/Button/Button';
-import { ButtonsGroup } from '../../../shared/defguard-ui/components/ButtonsGroup/ButtonsGroup';
 import { ModalControls } from '../../../shared/defguard-ui/components/ModalControls/ModalControls';
 import { SizedBox } from '../../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { Toggle } from '../../../shared/defguard-ui/components/Toggle/Toggle';
 import { TooltipContent } from '../../../shared/defguard-ui/providers/tooltip/TooltipContent';
 import { TooltipProvider } from '../../../shared/defguard-ui/providers/tooltip/TooltipContext';
 import { TooltipTrigger } from '../../../shared/defguard-ui/providers/tooltip/TooltipTrigger';
-import {
-  TextStyle,
-  ThemeSpacing,
-  ThemeVariable,
-} from '../../../shared/defguard-ui/types';
+import { ThemeSpacing } from '../../../shared/defguard-ui/types';
 import { isPresent } from '../../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../../shared/form';
 import { formChangeLogic } from '../../../shared/formLogic';
@@ -107,32 +101,20 @@ export const AddLocationInternalVpnStep = () => {
             {(field) => <field.FormInput required label={'Allowed IPs'} />}
           </form.AppField>
           <SizedBox height={ThemeSpacing.Lg} />
-          <ButtonsGroup>
-            <TooltipProvider disabled={!firewallRulesToggleLocked} placement="top">
-              <TooltipTrigger>
-                <div>
-                  <Toggle // Does nothing now #TODO: implement generating allowed ips based on firewall rules
-                    active={false}
-                    disabled={firewallRulesToggleLocked}
-                  />
-                </div>
-              </TooltipTrigger>
-              <TooltipContent>
-                <p>{m.license_upgrade_business_tooltip()}</p>
-              </TooltipContent>
-            </TooltipProvider>
-            <AppText
-              as="span"
-              font={TextStyle.TBodySm400}
-              color={
-                firewallRulesToggleLocked
-                  ? ThemeVariable.FgDisabled
-                  : ThemeVariable.FgDefault
-              }
-            >
-              {m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
-            </AppText>
-          </ButtonsGroup>
+          <TooltipProvider disabled={!firewallRulesToggleLocked} placement="top-start">
+            <TooltipTrigger>
+              <div>
+                <Toggle // Does nothing now #TODO: implement generating allowed ips based on firewall rules
+                  active={false}
+                  disabled={firewallRulesToggleLocked}
+                  label={m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
+                />
+              </div>
+            </TooltipTrigger>
+            <TooltipContent>
+              <p>{m.license_upgrade_business_tooltip()}</p>
+            </TooltipContent>
+          </TooltipProvider>
           <SizedBox height={ThemeSpacing.Xl} />
           <form.AppField name="dns">
             {(field) => <field.FormInput label={'DNS'} />}
diff --git a/web/src/pages/EditLocationPage/EditLocationPage.tsx b/web/src/pages/EditLocationPage/EditLocationPage.tsx
index e31151b8e7..86804963f8 100644
--- a/web/src/pages/EditLocationPage/EditLocationPage.tsx
+++ b/web/src/pages/EditLocationPage/EditLocationPage.tsx
@@ -17,8 +17,7 @@ import { EditPageControls } from '../../shared/components/EditPageControls/EditP
 import { EditPageFormSection } from '../../shared/components/EditPageFormSection/EditPageFormSection';
 import type { SelectionOption } from '../../shared/components/SelectionSection/type';
 import { externalLink } from '../../shared/constants';
-import { AppText } from '../../shared/defguard-ui/components/AppText/AppText';
-import { ButtonsGroup } from '../../shared/defguard-ui/components/ButtonsGroup/ButtonsGroup';
+
 import { InfoBanner } from '../../shared/defguard-ui/components/InfoBanner/InfoBanner';
 import { SizedBox } from '../../shared/defguard-ui/components/SizedBox/SizedBox';
 import { Toggle } from '../../shared/defguard-ui/components/Toggle/Toggle';
@@ -26,7 +25,7 @@ import { Snackbar } from '../../shared/defguard-ui/providers/snackbar/snackbar';
 import { TooltipContent } from '../../shared/defguard-ui/providers/tooltip/TooltipContent';
 import { TooltipProvider } from '../../shared/defguard-ui/providers/tooltip/TooltipContext';
 import { TooltipTrigger } from '../../shared/defguard-ui/providers/tooltip/TooltipTrigger';
-import { TextStyle, ThemeSpacing, ThemeVariable } from '../../shared/defguard-ui/types';
+import { ThemeSpacing } from '../../shared/defguard-ui/types';
 import { isPresent } from '../../shared/defguard-ui/utils/isPresent';
 import { useAppForm } from '../../shared/form';
 import { formChangeLogic } from '../../shared/formLogic';
@@ -280,28 +279,20 @@ const EditLocationForm = ({ location }: { location: NetworkLocation }) => {
             {(field) => <field.FormInput label="Allowed IPs" />}
           </form.AppField>
           <SizedBox height={ThemeSpacing.Lg} />
-          <ButtonsGroup>
-            <TooltipProvider disabled={!firewallLocked} placement="top">
-              <TooltipTrigger>
-                <div>
-                  <Toggle // Does nothing now #TODO: implement generating allowed ips based on firewall rules
-                    active={false}
-                    disabled={firewallLocked}
-                  />
-                </div>
-              </TooltipTrigger>
-              <TooltipContent>
-                <p>{m.license_upgrade_business_tooltip()}</p>
-              </TooltipContent>
-            </TooltipProvider>
-            <AppText
-              as="span"
-              font={TextStyle.TBodySm400}
-              color={firewallLocked ? ThemeVariable.FgDisabled : ThemeVariable.FgDefault}
-            >
-              {m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
-            </AppText>
-          </ButtonsGroup>
+          <TooltipProvider disabled={!firewallLocked} placement="top-start">
+            <TooltipTrigger>
+              <div>
+                <Toggle // Does nothing now #TODO: implement generating allowed ips based on firewall rules
+                  active={false}
+                  disabled={firewallLocked}
+                  label={m.add_location_internal_vpn_allowed_ips_from_firewall_rules()}
+                />
+              </div>
+            </TooltipTrigger>
+            <TooltipContent>
+              <p>{m.license_upgrade_business_tooltip()}</p>
+            </TooltipContent>
+          </TooltipProvider>
           <SizedBox height={ThemeSpacing.Xl2} />
           <form.AppField name="dns">
             {(field) => <field.FormInput label="DNS" />}