Update docs screenshots - p1 (#168)
|
Before Width: | Height: | Size: 33 KiB After Width: | Height: | Size: 70 KiB |
|
Before Width: | Height: | Size: 110 KiB After Width: | Height: | Size: 164 KiB |
|
Before Width: | Height: | Size: 34 KiB After Width: | Height: | Size: 486 KiB |
|
Before Width: | Height: | Size: 67 KiB After Width: | Height: | Size: 72 KiB |
|
Before Width: | Height: | Size: 44 KiB After Width: | Height: | Size: 486 KiB |
|
Before Width: | Height: | Size: 165 KiB After Width: | Height: | Size: 224 KiB |
|
Before Width: | Height: | Size: 84 KiB After Width: | Height: | Size: 159 KiB |
BIN
public/docs-static/img/how-to-guides/create-rule.png
Normal file
|
After Width: | Height: | Size: 201 KiB |
|
Before Width: | Height: | Size: 118 KiB After Width: | Height: | Size: 247 KiB |
|
Before Width: | Height: | Size: 203 KiB After Width: | Height: | Size: 61 KiB |
|
Before Width: | Height: | Size: 268 KiB After Width: | Height: | Size: 60 KiB |
|
Before Width: | Height: | Size: 148 KiB After Width: | Height: | Size: 98 KiB |
|
Before Width: | Height: | Size: 148 KiB After Width: | Height: | Size: 98 KiB |
|
Before Width: | Height: | Size: 132 KiB After Width: | Height: | Size: 230 KiB |
|
Before Width: | Height: | Size: 54 KiB After Width: | Height: | Size: 68 KiB |
|
Before Width: | Height: | Size: 68 KiB After Width: | Height: | Size: 40 KiB |
BIN
public/docs-static/img/how-to-guides/setup-key-create2d.png
Normal file
|
After Width: | Height: | Size: 62 KiB |
|
Before Width: | Height: | Size: 62 KiB After Width: | Height: | Size: 121 KiB |
|
Before Width: | Height: | Size: 57 KiB After Width: | Height: | Size: 216 KiB |
|
Before Width: | Height: | Size: 73 KiB After Width: | Height: | Size: 109 KiB |
|
Before Width: | Height: | Size: 56 KiB After Width: | Height: | Size: 201 KiB |
|
Before Width: | Height: | Size: 64 KiB After Width: | Height: | Size: 124 KiB |
BIN
public/docs-static/img/overview/disable-rule.png
Normal file
|
After Width: | Height: | Size: 33 KiB |
|
Before Width: | Height: | Size: 57 KiB After Width: | Height: | Size: 190 KiB |
@@ -1,5 +1,5 @@
|
|||||||
|
|
||||||
# Add machines to your NetBird network
|
# Add peers to your NetBird network
|
||||||
|
|
||||||
Whether you have a network for personal use or manage your company's corporate network, you'd probably want to add machines
|
Whether you have a network for personal use or manage your company's corporate network, you'd probably want to add machines
|
||||||
(or peers in NetBird's terms) to your network.
|
(or peers in NetBird's terms) to your network.
|
||||||
@@ -11,8 +11,8 @@ an Android or iOS device, a personal laptop, a single-board computer like Raspbe
|
|||||||
## Use NetBird web UI to add new peers
|
## Use NetBird web UI to add new peers
|
||||||
|
|
||||||
To add a new peer to your network follow these steps:
|
To add a new peer to your network follow these steps:
|
||||||
1. Sign-in you NetBird account at https://app.netbird.io/ and go to the Peers tab.
|
1. Sign-in to your NetBird account at https://app.netbird.io/ and go to the Peers tab.
|
||||||
2. Hit `Add new peer` button
|
2. Hit `Add Peer` button
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
<img src="/docs-static/img/how-to-guides/add-new-peer-empty.png" alt="high-level-dia" className="imagewrapper"/>
|
<img src="/docs-static/img/how-to-guides/add-new-peer-empty.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
|||||||
@@ -19,11 +19,11 @@ To enable peer approval, navigate to [Settings » Authentication](https://a
|
|||||||
</p>
|
</p>
|
||||||
|
|
||||||
<Note>
|
<Note>
|
||||||
When disabling peer approval, all pending approval requests will be automatically approved.
|
When disabling the peer approval, all pending approval requests will automatically be approved.
|
||||||
</Note>
|
</Note>
|
||||||
|
|
||||||
## Approve peer
|
## Approve peer
|
||||||
To approve a peer, navigate to the [peers tab](https://app.netbird.io/peers) and click the 'needs approval' button under the peer's name.
|
To approve a peer, navigate to the [peers tab](https://app.netbird.io/peers) and click the `Approve` button on the right side of the peers table.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
<img src="/docs-static/img/how-to-guides/peer-needs-approval.png" alt="peer-needs-approval" className="imagewrapper"/>
|
<img src="/docs-static/img/how-to-guides/peer-needs-approval.png" alt="peer-needs-approval" className="imagewrapper"/>
|
||||||
|
|||||||
@@ -1,90 +1,79 @@
|
|||||||
|
|
||||||
# Manage network access
|
# Manage network access
|
||||||
NetBird allows administrators to restrict access to resources (peers) by creating access rules and
|
NetBird enables administrators to oversee and manage access between resources (peers) through access policies. These policies specify which peers and peer groups are permitted to connect to each other, detail the protocols and ports for these connections, and offer the option to include posture checks to apply zero trust principles, helping to adapt access control to specific contexts.
|
||||||
defining what peer groups are permitted to establish connections with one another. Rule can allow connections
|
|
||||||
by specific protocol and ports.
|
|
||||||
|
|
||||||
## Introduction
|
## Introduction
|
||||||
A NetBird account comes with a `Default` rule that allows all peers of the account to connect to each other by all protocols,
|
Initially, a NetBird account is configured with a `Default` policy which allows peers to connect via any protocol, resulting in the formation of a full mesh network. This setup often suits small networks or those requiring minimal security. In scenarios where higher security is needed or access to specific resources must be restricted for certain users or services, policies can be set up to determine access permissions.
|
||||||
forming a full mesh network. In most cases, this is the desired state for a small network or network that has low-security requirements.
|
|
||||||
When you need to restrict access to certain resources that belong to specific users or services within your organization,
|
|
||||||
you can create rules that dictate who can access what.
|
|
||||||
|
|
||||||
Access control rules make use of groups to control connections between peers; these groups can be added as `Source` or `Destination` of a rule and will be evaluated when the Management service distributes the list of peers across your network.
|
|
||||||
|
|
||||||
|
Access control policies make use of groups to control connections between peers. These groups, which are sets of peers (meaning different machines with the NetBird client installed), can be added as Source or Destination of a policy. They are evaluated when the Management service distributes the list of peers across your network.
|
||||||
|
|
||||||
## Concepts
|
## Concepts
|
||||||
### Groups
|
### Groups
|
||||||
A NetBird group works and follows a similar concept to tags in other platforms; they are easily created and can be associated with peers and used in rules to control traffic within your network.
|
A NetBird group works and follows a similar concept to tags in other platforms; they are easily created and can be associated with peers and used in policies to control traffic within your network.
|
||||||
|
|
||||||
Some characteristics of groups:
|
Here are some key attributes of groups:
|
||||||
- They are unique.
|
- Each group is unique.
|
||||||
- One group can have multiple peers.
|
- A single group can have multiple peers.
|
||||||
- Peers can belong to multiple groups.
|
- Peers can be part of multiple groups simultaneously.
|
||||||
- Rules can have multiple groups in their `Source` and `Destination` lists.
|
- Groups can be included in the 'Source' and 'Destination' lists of policies.
|
||||||
- They are created in the `Access Control` or `Peers` tabs.
|
- Groups are generated within the 'Access Control' or 'Peers' tabs.
|
||||||
- They can only be deleted via API.
|
- Groups can be deleted only via the API.
|
||||||
- There is a default group called `All`.
|
- There exists a default group called 'All'.
|
||||||
|
|
||||||
<Note>
|
<Note>
|
||||||
You can assign groups automatically with the [peer auto-grouping feature](/how-to/register-machines-using-setup-keys#peer-auto-grouping).
|
You can assign groups automatically with the [peer auto-grouping feature](/how-to/register-machines-using-setup-keys#peer-auto-grouping).
|
||||||
</Note>
|
</Note>
|
||||||
|
|
||||||
### The All Group
|
### The All Group
|
||||||
The `All` group is a default group to which every peer in your network is automatically added to. This group cannot be modified or deleted.
|
The 'All' group serves as a default group that automatically includes every peer in your network. This group cannot be modified or removed.
|
||||||
|
|
||||||
### Rules
|
### Policies
|
||||||
Rules are defined as sets of Source and Destination peer groups, which specify the allowable communication between them.
|
Policies act as rules governing how different resources (peers) can communicate and connect. They specify the source and destination of communication and can allow bidirectional or unidirectional connections.
|
||||||
Depending on the rule configuration, this communication can be either bidirectional or unidirectional.
|
|
||||||
Rules are processed when the Management service distributes a network map to all peers of your account. Because you can only create ALLOW rules, there is no processing
|
|
||||||
order or priority, so the decision to distribute peer information is based on its association with a group belonging to an existing rule.
|
|
||||||
|
|
||||||
Currently, the communication between lists of groups in source and destination lists of a rule for ALL and ICMP protocols,
|
Policies are processed when the Management service shares a network map with all peers of your account. Because you can only create ALLOW policies, there is no processing order or priority. So, the decision to distribute peer information is based on its association with a group belonging to an existing policy.
|
||||||
and for TCP and UDP when you don't define limitation by port, it is bidirectional, meaning that destinations can also
|
|
||||||
initiate connections to a group of peers listed in the source field of the rule.
|
|
||||||
|
|
||||||
The behavior of a network without any rules is to deny traffic. No peers will be able to communicate with each other.
|
For ICMP and ALL protocols, as well as for TCP and UDP protocols **without** specific port restrictions, communication between groups listed in the source and destination fields is bidirectional. This means that both source and destination groups can initiate connections with each other. To establish one-way connections, you must specify a protocol (UDP or TCP), along with a port.
|
||||||
|
|
||||||
<Note>
|
<Note>
|
||||||
If you need to allow peers from the same group to communicate with each other, just add the same group to the `Source` and `Destination` lists.
|
If you need to allow peers from the same group to communicate with each other, you can do so by adding the same group to the `Source` and `Destination` lists.
|
||||||
</Note>
|
</Note>
|
||||||
|
|
||||||
### The Default Rule
|
Without policies, a network operates by denying traffic, meaning peers cannot communicate with each other. That's why the default policy is automatically created upon account creation.
|
||||||
The `Default` rule is created when you first create your account. This rule is very permissive because it allows communication between all peers in your network.
|
|
||||||
It uses the [`All`](#the-all-group) group as a source and destination. If you want to have better
|
|
||||||
control over your network, it is recommended that you delete this rule and create more restricted rules with custom groups.
|
### The Default policy
|
||||||
|
The `Default` policy is created when you first create your account. This policy is very permissive because it allows communication between all peers in your network, utilizing the [`All`](#the-all-group) group as both the source and destination. It's worth noting that the [`All`](#the-all-group) group is also automatically present when the account is being created. If you want to have better control over your network, it is recommended that you delete this policy and create more restricted policies with custom groups.
|
||||||
|
|
||||||
<Note>
|
<Note>
|
||||||
If you need to restrict communication within your network, you can create new rules and use different groups, and then remove the default rule to achieve the desired behavior.
|
If you need to restrict communication within your network, you can create new policies and use different groups. Then, you can remove the default policy to achieve the desired behavior.
|
||||||
</Note>
|
</Note>
|
||||||
|
|
||||||
### Multiple Mesh Networks
|
### Multiple Mesh Networks
|
||||||
As mentioned above, rules by default are bidirectional which is basically the control of how your network will behave as a mesh network.
|
As mentioned above, policies are bidirectional by default, essentially controlling how your network behaves as a mesh network. However, for TCP and UDP protocols, if you specify ports in the policy, it can become unidirectional.
|
||||||
But for TCP and UDP protocols, if you define ports in the rule, rule can be unidirectional.
|
|
||||||
|
|
||||||
There is a `Default` rule, which configures a Default mesh connection between all peers of your network. With rules,
|
There is a `Default` policy, which configures a default mesh connection between all peers of your network. With policies, you can define smaller mesh networks by grouping peers and adding these groups to `Source` and `Destination` lists. Additionally, you can create unidirectional policies to restrict traffic between groups for TCP and UDP protocols if you define ports.
|
||||||
you can define smaller mesh networks by grouping peers and adding these groups to `Source` and `Destination` lists.
|
|
||||||
Also you can create unidierectional rules to restrict traffic between groups for TCP and UDP protocols if you define ports.
|
|
||||||
|
|
||||||
## Managing Rules
|
## Managing Policies
|
||||||
|
|
||||||
### Creating Rules
|
### Creating Policies
|
||||||
After accessing the `Access Control` tab, you can click the `Add Rule` button to create a new rule.
|
After accessing the `Access Control` > `Policies` tab, click on the `Add policy` button to create a new policy. In the popup, specify source and destination groups, and add Posture Checks if needed. Make sure to set traffic direction only when TCP or UDP protocols are selected. Finally, provide a name and description for your policy.
|
||||||
In the popup, specify a name for the rule, and define source and destination groups.
|
|
||||||
You can set traffic direction only when you choose TCP or UDP protocols.
|
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
<img src="/docs-static/img/overview/create-rule.png" alt="high-level-dia" className="imagewrapper"/>
|
<img src="/docs-static/img/overview/create-rule.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
If required, you can create new groups by entering new names in the input box for either source or destination lists.
|
|
||||||
|
|
||||||
Once you are done configuring the rule, click the `Create` button to save it. You will then see your new rule in the table.
|
If necessary, you can create new groups simply by entering new names in the input box for either the source or destination lists.
|
||||||
|
|
||||||
|
Once you have finished configuring the policy, click `Add Policy` to save it. You will then see your new policy in the table.
|
||||||
<p>
|
<p>
|
||||||
<img src="/docs-static/img/overview/new-rule-list.png" alt="high-level-dia" className="imagewrapper"/>
|
<img src="/docs-static/img/overview/new-rule-list.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
<Note>
|
<Note>
|
||||||
Because of its permissiveness, new rules will take effect once you remove the `Default` rule.
|
Because of its permissiveness, new policies will take effect once you remove the `Default` policy.
|
||||||
</Note>
|
</Note>
|
||||||
|
|
||||||
<Note>
|
<Note>
|
||||||
@@ -92,8 +81,8 @@ Protocol type All or ICMP must be bi-directional. Also unidirectional traffic fo
|
|||||||
</Note>
|
</Note>
|
||||||
|
|
||||||
### Adding peers to groups
|
### Adding peers to groups
|
||||||
If you create a new group when defining a rule, you will need to add a peer to the group for the rule to take effect.
|
If you create a new group when defining a policy, you will need to add a peer to the group for the policy to take effect.
|
||||||
You can do it by accessing the `Peers` tab and clicking the `Groups` column of any peer you want to associate with the new group.
|
You can assign a peer to a group by accessing the `Peers` section. Then, choose the specific peer you want to assign to a group. Click on the `Assigned Groups` select box and select the group(s) you wish to assign to this peer.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
<img src="/docs-static/img/overview/associate-peer-groups.png" alt="high-level-dia" className="imagewrapper"/>
|
<img src="/docs-static/img/overview/associate-peer-groups.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
@@ -103,16 +92,18 @@ You can do it by accessing the `Peers` tab and clicking the `Groups` column of a
|
|||||||
You can assign groups automatically with the [peer auto-grouping feature](/how-to/register-machines-using-setup-keys#peer-auto-grouping).
|
You can assign groups automatically with the [peer auto-grouping feature](/how-to/register-machines-using-setup-keys#peer-auto-grouping).
|
||||||
</Note>
|
</Note>
|
||||||
|
|
||||||
### Updating Rules
|
### Updating Policies
|
||||||
To update a rule, you can click on the rule's `Name` or on either `Sources` and `Destinations` columns. You could also click the menu
|
|
||||||
button of a rule and select `View`. This will open the same screen where you can update rule groups, description, and status or change allowed
|
|
||||||
traffic direction and protocols with ports.
|
|
||||||
|
|
||||||
### Disabling Rules
|
To update a policy, just click on its name and customize it according to your requirements. This action will open the same screen where you can update policy groups, descriptions, and status, or modify allowed traffic direction, protocols with ports, and posture checks, similar to the information described in the "Creating Policies" section above.
|
||||||
To disable a rule, use the switch in the `Enabled` column of the table.
|
|
||||||
|
|
||||||
### Deleting Rules
|
### Disabling Policies
|
||||||
To delete a rule, click `Delete` in the table. A confirmation window will pop up.
|
To disable a policy, use the switch in the `Active` column of the table.
|
||||||
|
<p>
|
||||||
|
<img src="/docs-static/img/overview/disable-rule.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
### Deleting Policies
|
||||||
|
To delete a policy, click on `Delete` in the table, and confirm the message that appears.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
<img src="/docs-static/img/overview/delete-rule-menu.png" alt="high-level-dia" className="imagewrapper"/>
|
<img src="/docs-static/img/overview/delete-rule-menu.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
|||||||
@@ -11,7 +11,7 @@ This makes it possible to run automated deployments with infrastructure-as-code
|
|||||||
sudo netbird up --setup-key <SETUP KEY>
|
sudo netbird up --setup-key <SETUP KEY>
|
||||||
```
|
```
|
||||||
|
|
||||||
## Types of setup seys
|
## Types of setup keys
|
||||||
|
|
||||||
There are 2 types of setup keys:
|
There are 2 types of setup keys:
|
||||||
* **One-off key**. This type of key can be used only once to authenticate a machine.
|
* **One-off key**. This type of key can be used only once to authenticate a machine.
|
||||||
@@ -46,9 +46,6 @@ We recommend limiting the number of times the key can be used, e.g., set it to 3
|
|||||||
|
|
||||||
## Peer Auto-grouping
|
## Peer Auto-grouping
|
||||||
|
|
||||||
<p>
|
|
||||||
<img src="/docs-static/img/architecture/peer-auto-tagging-setupkey.gif" alt="high-level-dia" className="imagewrapper"/>
|
|
||||||
</p>
|
|
||||||
|
|
||||||
NetBird offers a powerful [access control feature](/how-to/manage-network-access) that allows easy access management of your resources.
|
NetBird offers a powerful [access control feature](/how-to/manage-network-access) that allows easy access management of your resources.
|
||||||
In a basic scenario, you would create multiple groups of peers and create access rules to define what groups can access each other.
|
In a basic scenario, you would create multiple groups of peers and create access rules to define what groups can access each other.
|
||||||
@@ -71,7 +68,7 @@ Then use this key to enroll new machine.
|
|||||||
|
|
||||||
## Create setup key
|
## Create setup key
|
||||||
|
|
||||||
Click the `Add Key` button in the `Setup Keys'.
|
Go to the `Setup Keys` tab and click the `Create Setup Key` button
|
||||||
In the opened popup, give your new key an easily identifiable name, choose type, set usage limit, and assign auto groups.
|
In the opened popup, give your new key an easily identifiable name, choose type, set usage limit, and assign auto groups.
|
||||||
The defaults should be suitable for most of the cases. We recommend using one-off keys for security reasons.
|
The defaults should be suitable for most of the cases. We recommend using one-off keys for security reasons.
|
||||||
|
|
||||||
|
|||||||
@@ -74,14 +74,14 @@ In the example below, we are creating a route with the following information:
|
|||||||
- Network identifier: `aws-eu-central-1-vpc`
|
- Network identifier: `aws-eu-central-1-vpc`
|
||||||
- Description: `Production VPC in Frankfurt`
|
- Description: `Production VPC in Frankfurt`
|
||||||
- Network range: `172.31.0.0/16`
|
- Network range: `172.31.0.0/16`
|
||||||
- Routing peer: `aws-nb-europe-router-az-a`
|
- Routing peer: `ec2-demo-node`
|
||||||
- Distribution Groups: `All`
|
- Distribution Groups: `All`
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
<img src="/docs-static/img/how-to-guides/netbird-network-routes-create.png" alt="high-level-dia" className="imagewrapper"/>
|
<img src="/docs-static/img/how-to-guides/netbird-network-routes-create.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
Once you fill in the route information, you can click on the `Save` button to save your new route.
|
Once you fill in the route information, you can click on the `Add route` button to save your new route.
|
||||||
<p>
|
<p>
|
||||||
<img src="/docs-static/img/how-to-guides/netbird-network-routes-saved-new.png" alt="high-level-dia" className="imagewrapper"/>
|
<img src="/docs-static/img/how-to-guides/netbird-network-routes-saved-new.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
</p>
|
</p>
|
||||||
@@ -95,7 +95,7 @@ If groups have more than one peer, you get the [high availability route](#high-a
|
|||||||
<img src="/docs-static/img/how-to-guides/netbird-network-routes-groups-create.png" alt="high-level-dia" className="imagewrapper"/>
|
<img src="/docs-static/img/how-to-guides/netbird-network-routes-groups-create.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
</p>
|
</p>
|
||||||
|
|
||||||
Once you fill in the route information, you can click on the `Save` button to save your new route.
|
Once you fill in the route information, you can click on the `Add route` button to save your new route.
|
||||||
|
|
||||||
<p>
|
<p>
|
||||||
<img src="/docs-static/img/how-to-guides/netbird-network-routes-groups-saved-new.png" alt="high-level-dia" className="imagewrapper"/>
|
<img src="/docs-static/img/how-to-guides/netbird-network-routes-groups-saved-new.png" alt="high-level-dia" className="imagewrapper"/>
|
||||||
|
|||||||