diff --git a/public/docs-static/img/how-to-guides/control-center/control-center-groups-view.png b/public/docs-static/img/how-to-guides/control-center/control-center-groups-view.png new file mode 100644 index 00000000..30c2b7a4 Binary files /dev/null and b/public/docs-static/img/how-to-guides/control-center/control-center-groups-view.png differ diff --git a/public/docs-static/img/how-to-guides/control-center/control-center-network-view.png b/public/docs-static/img/how-to-guides/control-center/control-center-network-view.png new file mode 100644 index 00000000..f2c54fe2 Binary files /dev/null and b/public/docs-static/img/how-to-guides/control-center/control-center-network-view.png differ diff --git a/public/docs-static/img/how-to-guides/control-center/control-center-peer-view.png b/public/docs-static/img/how-to-guides/control-center/control-center-peer-view.png new file mode 100644 index 00000000..0b168e84 Binary files /dev/null and b/public/docs-static/img/how-to-guides/control-center/control-center-peer-view.png differ diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx index 10c3cebb..d5446e2e 100644 --- a/src/components/NavigationDocs.jsx +++ b/src/components/NavigationDocs.jsx @@ -50,6 +50,7 @@ export const docsNavigation = [ { title: 'MANAGE NETBIRD', links: [ + { title: 'Control Center', href: '/how-to/control-center' }, { title: 'Peers', isOpen: false, diff --git a/src/pages/how-to/control-center.mdx b/src/pages/how-to/control-center.mdx new file mode 100644 index 00000000..c3ad9ac2 --- /dev/null +++ b/src/pages/how-to/control-center.mdx @@ -0,0 +1,94 @@ +import {Note} from "@/components/mdx" + +export const description = + 'Control Center provides a topological view of your NetBird network, visualizing access relationships between peers, groups, and networks through an interactive graph interface.' + +# Visualize Remote Access with Control Center + +Control Center is a topological view in the NetBird dashboard that visualizes who can access what across your environment. It maps **Peers**, **Groups**, and **Networks** to the resources they can reach and shows the access control policies that permit those connections. + + + **Availability**: NetBird Cloud (all plans) and self-hosted. + + + **Permissions:** The Admin and Network Admin user roles can edit policies from Control Center. Learn more about + [user roles](/how-to/add-users-to-your-network#manage-user-roles). + + +## How it helps + +- **Faster audits:** Confirm a device, group, or network's effective access at a glance. +- **Quicker troubleshooting:** Follow the policy path that grants access to a resource. +- **Safer changes:** Click through to the exact policy to refine sources, destinations, or ports without hunting across pages. + +## Views + +### Peers view + +Use this to understand what a specific machine can reach. + +

+ Control Center Peer View +

+ +- Click the peer node, then search or choose another peer from the dropdown to switch focus. +- The graph shows the peer's access control policy nodes and the reachable resources. +- Click a policy chip to open the standard policy editor. Changes you save are reflected in the graph immediately. + +### Groups view + +Use this to validate team-level access. + +

+ Control Center Groups View +

+ +- Click a group node, then search or choose from the dropdown to switch groups. +- The layout shows which resources that group can reach and via which policies. +- View-only for topology here; create or delete groups in the Groups section outside Control Center. Group-based access is the recommended way to manage permissions. + +Common checks: + +- Confirm that "DevOps" can reach RDS on TCP 5432, or that "Support" only reaches SSH on TCP 22. + +### Networks view + +Use this to see who can access resources in your routed [networks](/how-to/networks). + +

+ Control Center Network View +

+ +- Toggle **All Networks** or select a specific network. +- The network node shows its resources. Connecting lines display the port allowed by the policy and which groups have access. +- Click any policy chip to edit it in the standard editor. NetBird Networks and routing peers enable access to private subnets and IP resources. + +## Editing policies from the graph + +- **Open editor:** Click an access control policy chip in any view to open the standard policy editor. +- **What you can change:** Use the editor to modify the usual policy fields as documented in [Access Control](/how-to/manage-network-access), including sources, destinations, protocols, ports, and posture checks. +- **Create vs edit:** You can edit existing policies from Control Center. Creating a new policy still happens in the Access Control section. + +## Quick start + +1. Open **Control Center** in the NetBird dashboard. +2. Pick a tab: **Peers**, **Groups**, or **Networks**. +3. Click a node to focus, then follow the policy chips to the target resource. +4. Click a policy chip to edit it, then save. The graph updates right away. + +## Use cases + +- **Sanity-check a team:** In **Groups** view, select a group and verify the resources and ports granted by its policies match your intent. Adjust policies in place if needed. +- **Prepare a change:** In **Networks** view, review which groups reach a sensitive subnet before tightening ports or destinations. +- **Investigate access:** In **Peers** view, confirm why a host can reach a database by following the policy path and port labels, then narrow the rule if required. +- **MSPs:** Switch tenants in the MSP portal to repeat the same checks per customer environment. + +## Related docs + +- [Manage network access with Groups and Access Policies](/how-to/manage-network-access) +- [Apply posture checks to policies](/how-to/manage-posture-checks) +- [Networks and routing peers](/how-to/networks) +- [MSP portal overview](/how-to/msp-portal) diff --git a/src/pages/how-to/getting-started.mdx b/src/pages/how-to/getting-started.mdx index 843420c2..e8cbad86 100644 --- a/src/pages/how-to/getting-started.mdx +++ b/src/pages/how-to/getting-started.mdx @@ -180,6 +180,7 @@ The final step of the onboarding wizard explains the access rule that was automa Click Go to Dashboard to access the main NetBird admin panel. From here, you can: +* [Control Center](https://docs.netbird.io/how-to/control-center): Visualize your network topology and access relationships with an interactive graph. * [Peers](https://docs.netbird.io/how-to/add-machines-to-your-network): View and manage all connected devices and their properties. * [Setup Keys](https://docs.netbird.io/how-to/register-machines-using-setup-keys): Create and manage keys for adding new headless or ephemeral devices. * [Access Control](https://docs.netbird.io/how-to/manage-network-access): Define granular firewall rules to control which peers can access what. diff --git a/src/pages/how-to/manage-network-access.mdx b/src/pages/how-to/manage-network-access.mdx index eaa792b5..29976737 100644 --- a/src/pages/how-to/manage-network-access.mdx +++ b/src/pages/how-to/manage-network-access.mdx @@ -12,6 +12,10 @@ Watch our Access Control video on YouTube: + + For a visual overview of your access policies and network topology, check out the [Control Center](/how-to/control-center), which provides an interactive graph view of peers, groups, and their access relationships. + + ## Introduction Initially, a NetBird account is configured with a `Default` policy which allows peers to connect via any protocol, resulting in the formation of a full mesh network. This setup often suits small networks or those requiring minimal security. In scenarios where higher security is needed or access to specific resources must be restricted for certain users or services, policies can be set up to determine access permissions.