sendnrw/netbird-docs
2
0
Fork 0
mirror of https://github.com/netbirdio/docs.git synced 2026-04-16 15:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add networks documentation (#264)

Browse Source
This commit is contained in:
Maycon Santos
2024-12-23 15:52:50 +01:00
committed by GitHub
parent 3a82125af5
commit 8ef3f4a37c
39 changed files with 408 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/components/NavigationDocs.jsx
View File

@@ -106,6 +106,16 @@ export const docsNavigation = [
]
},
{
title: 'Networks (new)',
isOpen: false,
links: [
{ title: 'Concept', href: '/how-to/networks-concept' },
{ title: 'Routing traffic to multiple IP resources', href: '/how-to/routing-traffic-to-multiple-resources' },
{ title: 'Accessing restricted website domain resources', href: '/how-to/accessing-restricted-websites' },
{ title: 'Accessing entire domains within networks', href: '/how-to/accessing-entire-domains-within-networks' },
]
},
{
title: 'Network Routes',
isOpen: false,

119
src/pages/how-to/accessing-entire-domains-within-networks.mdx Normal file
View File

@@ -0,0 +1,119 @@
# Accessing entire domains within networks
Companies often run entire development and internal environments using assigned domains that are not publicly accessible due to security reasons. Creating routing resources for these environments can quickly become a problem for
DevOps and Platform teams because development teams may issue requests for new resources frequently. Taking that with the fact that some resources won't be within the same network, this can become a challenge to manage.
NetBird can help you configure access to these resources by routing your traffic through a routing peer configured with [Networks](/how-to/networks-concept) using [Wildcard domain resources](/how-to/networks-concept#resources).
## Example
In the following scenario, we will create a new development network and add a wildcard domain resource for the entire `dev.example.com`
to be routed using [Routing peers](/how-to/networks-concept#routing-peers) running in the network. All developers will be able to access the development environment using the `Network` configuration.
### Pre-requisites
#### Configure Nameservers
In order for the the following steps to work, you need to configure Nameservers to resolve all domain queries in your NetBird account. See the [Manage DNS in your network](/how-to/manage-dns-in-your-network) guide for more information.
#### Enable DNS wildcard routing
When you configure wildcard domains as resources, you need to enable DNS wildcard routing. Which has an additional effect in comparison to the previous DNS routes behavior from Network routes; it switches the DNS resolution to the routing peer instead of the local client system.
This is also useful for regular DNS routes when you want to resolve the domain names using the routing peer's IP infrastructure, which will allow for more restricted access control rules in newer versions of the clients(**1**) and for the traffic to go to a near routing peer service.
<Note>
(1) Support for more restricted rules will be available in future releases.
</Note>
You can enable DNS resolution on the routing peer by accessing your account `Settings` > `Networks` > Enable DNS wildcard routing. See example below:
<p>
<img src="/docs-static/img/how-to-guides/networks/settings-1.png" alt="settings-acl" className="imagewrapper-big"/>
</p>
<Note>
The `Enable DNS wildcard routing` is supported by routing peers and routing clients running version 0.35.0 or later.
Once the feature is enabled, you may need to restart your routing peers and clients to apply the changes.
</Note>
### Create a Network
To create a Network, navigate to the `Networks` > `Networks` section in the NetBird dashboard:
<p>
<img src="/docs-static/img/how-to-guides/networks/new-network.png" alt="new-net" className="imagewrapper-big"/>
</p>
Click on `Add Network` to follow a Wizard that will guide you through the steps to create a network and add resources to it.
First, we fill out the network Name and Description as shown in the image below and click `Continue`:
<p>
<img src="/docs-static/img/how-to-guides/networks/new-dev-network-1.png" alt="new-dev-net1" className="imagewrapper"/>
</p>
### Add a routing peer
Next we are asked to add a routing peer to the network. Let's click on `Add routing peer` and select a node from that VPC:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-wild-routing-peer-1.png" alt="new-wild-routing-peer-1" className="imagewrapper"/>
</p>
Click on `Continue` and then accept the defaults to add a routing peer by clicking on `Add Routing Peer`:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-routing-peer-2.png" alt="new-routing-peer-2" className="imagewrapper"/>
</p>
### Add a resource
Following the guide, we are asked to add a new resource.
Click on `Add Resource` and enter the domain name of the `Development domain` in this case, `*.dev.example.com`:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-wild-domain-resource-1.png" alt="new-wild-resource-1" className="imagewrapper"/>
</p>
We can also assign a group to this resource; in this example, we will assign the group `development-domains` to it. This way, we can create a policy that allows the development team to access the domains in the environment.
### Add an access control policy
Next, in the guide, we will be asked to create an access control policy. Here, we will create a policy that allows access to the `development-domains` group of the `*.dev.example.com`
resource to peers in the `Developers` group. They will be granted all traffic to domains in the development environment.
Click on `Create Policy` and fill out the fields as shown in the image below:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-wild-domain-resource-acl-1.png" alt="new-resource-acl-1" className="imagewrapper-big"/>
</p>
Click on `Continue` 2 times and then click on `Add Policy` to save the policy:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-wild-domain-resource-acl-2.png" alt="new-resource-acl-2" className="imagewrapper-big"/>
</p>
### View the network
After completing the wizard, you will be able to see the network you just created in the Networks list:
<p>
<img src="/docs-static/img/how-to-guides/networks/view-wild-network-1.png" alt="view-wild-network-1" className="imagewrapper-big"/>
</p>
To access a detailed view of the network, click on the network name:
<p>
<img src="/docs-static/img/how-to-guides/networks/view-wild-network-2.png" alt="view-wild-network-2" className="imagewrapper-big"/>
</p>
You can edit or add more resources or routing peers to the network by clicking on the `Edit` buttons of each section in the detailed view.
### Add a regular domain resource
A wildcard domain won't cover the entire domain by itself because the wildcard character `*` only covers subdomains after the `.`. If you need to cover the entire domain, you can additionally add a regular domain resource to the network.
This time, let's add a domain from the main Networks list view. Click on the `Add Resource` button:
<p>
<img src="/docs-static/img/how-to-guides/networks/view-wild-network-3.png" alt="view-wild-network-3" className="imagewrapper-big"/>
</p>
Then, enter the domain name of the `Regular domain` in this case, `dev.example.com`:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-wild-domain-resource-2.png" alt="new-wild-resource-2" className="imagewrapper"/>
</p>
We can also assign the same group to this resource, allowing us to reuse the previous access control policy for the `development-domains` group.
With the steps above, we created resources that allow the development team to access the entire `dev.example.com` domain and the `*.dev.example.com` subdomains using the same policy.
## Get started
<p float="center" >
<Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
</p>
- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
- Follow us [on Twitter](https://twitter.com/netbird)
- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-2utg2ncdz-W7LEB6toRBLE1Jca37dYpg)
- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub

81
src/pages/how-to/accessing-restricted-websites.mdx Normal file
View File

@@ -0,0 +1,81 @@
# Accessing restricted website domain resources
It is very common to find scenarios where you need to access restricted websites or services. This can be due to company policies, geographical restrictions, or even to avoid tracking.
Very often these resources are located behind a cloud load balancer, which changes IP addresses frequently, making it hard to whitelist them.
NetBird can help you to access these resources by routing your traffic through a routing peer configured with [Networks](/how-to/networks-concept) using [Domain resources](/how-to/networks-concept#resources).
## Example
In the following scenario, we will configure access to an accounting website which should accessible only by users from finance team.
The server is running in the company's AWS account in the EU Central region behind a load balancer, so we will create a new Network and add a `domain resource`
to be routed using [Routing peers](/how-to/networks-concept#routing-peers) running in the AWS VPC.
### Create a Network
To create a Network, navigate to the `Networks` > `Networks` section in the NetBird dashboard:
<p>
<img src="/docs-static/img/how-to-guides/networks/new-network.png" alt="new-net" className="imagewrapper-big"/>
</p>
Click on `Add Network` to follow a Wizard that will guide you through the steps to create a network and add resources to it.
First, we fill out the network Name and Description as shown in the image below and click `Continue`:
<p>
<img src="/docs-static/img/how-to-guides/networks/new-network-2.png" alt="new-net2" className="imagewrapper"/>
</p>
### Add a routing peer
Next we are asked to add a routing peer to the network. Let's click on `Add routing peer` and select a node from that VPC:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-routing-peer-1.png" alt="new-routing-peer-1" className="imagewrapper"/>
</p>
Click on `Continue` and then accept the defaults to add a routing peer by clicking on `Add Routing Peer`:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-routing-peer-2.png" alt="new-routing-peer-2" className="imagewrapper"/>
</p>
### Add a resource
Following the guide, we are asked to add a new resource.
Click on `Add Resource` and enter the domain name of the `accounting website` in this case, `accounting.example.com`:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-domain-resource-1.png" alt="new-resource-1" className="imagewrapper"/>
</p>
We can also assign a group to this resource; in this case, we will assign the group `accounting-server` to it. This way, we can create a policy that allows only the finance team to access this resource.
### Add an access control policy
Next, in the guide, we will be asked to create an access control policy. Here, we will create a policy that allows access to the `accounting-server` group of the `accounting.example.com`
resource to peers in the `Finance team` group. They will be able to access the service ports `TCP/80` and `TCP/443`.
Click on `Create Policy` and fill out the fields as shown in the image below:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-domain-resource-acl-1.png" alt="new-resource-acl-1" className="imagewrapper-big"/>
</p>
Click on `Continue` 2 times and then click on `Add Policy` to save the policy:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-domain-resource-acl-2.png" alt="new-resource-acl-2" className="imagewrapper-big"/>
</p>
### View the network
After completing the wizard, you will be able to see the network you just created in the Networks list:
<p>
<img src="/docs-static/img/how-to-guides/networks/view-network-1.png" alt="view-network-1" className="imagewrapper-big"/>
</p>
To access a detailed view of the network, click on the network name:
<p>
<img src="/docs-static/img/how-to-guides/networks/view-network-2.png" alt="view-network-2" className="imagewrapper-big"/>
</p>
You can edit or add more resources or routing peers to the network by clicking on the `Edit` buttons of each section in the detailed view.
## Get started
<p float="center" >
<Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
</p>
- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
- Follow us [on Twitter](https://twitter.com/netbird)
- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-2utg2ncdz-W7LEB6toRBLE1Jca37dYpg)
- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub

87
src/pages/how-to/networks-concept.mdx Normal file
View File

@@ -0,0 +1,87 @@
# Networks
With the `0.35.0` release, we are introducing a new concept in NetBird called `Networks`. This concept improves the administration of routed resources and provides greater visibility into what is shared with peers.
Below, we will review the essential concepts of Networks.
## Concepts
#### Networks
Networks are configuration containers that map your on-premise or cloud networks in a logical set of configurations, making it easier to manage and share routes with your peers based on your infrastructure.
#### Routing peers
One or more peers selected to route traffic from your NetBird peers to your Network resources. You can add as many routing peers as you need using single peers or groups to ensure high availability and load balancing.
You can define masquerading and priority for each routing peer.
<Note>
Only Linux OS machines can be assigned as routing peers.
</Note>
#### Resources
Remote network resources that are routed via routing peers. They can be configured as single IP addresses, IP ranges, domain names, or wildcard domains (e.g., *.netbird.io) when enabling [DNS wildcard routing](#enable-dns-wildcard-routing).
See examples of resources below:
<p>
<img src="/docs-static/img/how-to-guides/networks/resources-1.png" alt="resources" className="imagewrapper-big"/>
</p>
<Note>
Support to exit nodes and site-2-site VPNs may become available in future releases. In the meantime you can use [Network routes](/how-to/routing-traffic-to-private-networks) add your exit-node routes and site2site routes.
</Note>
You can assign a Group to a resource that allows you to manage access control policies for the resources. See the image below with an example of the resource *.netbird.io:
<p>
<img src="/docs-static/img/how-to-guides/networks/resources-2.png" alt="resource-group" className="imagewrapper"/>
</p>
#### Access control policies
Access control policies are rules that define which peers can access the resources in your network. You can create policies based on the source and destination groups, and the type of traffic allowed (e.g., TCP, UDP, ICMP).
The groups assigned to resources should always be placed in the destination input field of the policy.
The peers belonging to the source groups will receive the resources linked to the policy and the firewall rules will be applied according to what is defined.
See the example below with a policy that allows the group `berlin-office` to access the resource `*.netbird.io`:
<p>
<img src="/docs-static/img/how-to-guides/networks/resource-acl-1.png" alt="resource-acl" className="imagewrapper-big"/>
</p>
<Note>
Policies that for `domains` or `wildcard domains` that are applied to the peers of `IP ranges` might influence the access control for those peers since they have as destination ranges any IPs.
Due to this, we recommend to create networks with routing peers dedicated to domain and wildcard domains to prevent unwanted access to take place. In the coming releases, we will provide a fix for that behavior.
</Note>
#### Enable DNS wildcard routing
When you configure wildcard domains as resources, you need to enable DNS wildcard routing. Which has an additional effect in comparison to the previous DNS routes behavior from Network routes; it switches the DNS resolution to the routing peer instead of the local client system.
This is also useful for regular DNS routes when you want to resolve the domain names using the routing peer's IP infrastructure, which will allow for more restricted access control rules in newer versions of the clients(**1**) and for the traffic to go to a near routing peer service.
<Note>
(1) Support for more restricted rules will be available in future releases.
</Note>
You can enable DNS resolution on the routing peer by accessing your account `Settings` > `Networks` > Enable DNS wildcard routing. See example below:
<p>
<img src="/docs-static/img/how-to-guides/networks/settings-1.png" alt="settings-acl" className="imagewrapper-big"/>
</p>
<Note>
The `Enable DNS wildcard routing` is supported by routing peers and routing clients running version 0.35.0 or later.
Once the feature is enabled, you may need to restart your routing peers and clients to apply the changes.
</Note>
## Differences between Networks and Network Routes
| | Networks | Network routes |
|---------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
| **Requires extra policy connecting routing peers to distribution peers?** | No, the connection is implied when a policy is added to control access to resources | Yes, the routing peers need to have a policy that connects them to peers in the distribution groups |
| **Needs distribution groups?** | No, the source groups in the policies define the distribution groups | Yes, they need to be explicitly defined per network route configured |
| **Requires adding full sets of configurations per routed resource?** | No, the routing peers in a Network are used to route all resources in that network | Yes, every network route needs to have a routing peer, distribution group, access control group, and the network range or DNS route |
| **Allows edit routed resources?** | Yes, you can edit ranges or domains | No, you can't edit IP ranges or DNS routes once created |
| **Allows edit names?** | Yes, names are editable | No, names are defined once while creating the route |
| **Support to wildcard domains?** | Yes, wildcard domains are supported | No, network routes are limited to individual domains |
| **Support for exit-nodes?** | No, even though that exit-nodes can be linked to on-premises or cloud networks, they invalidate other resources | Yes, but the same note is valid when using an exit-node to route other traffic to the same resources |
| **Support for site-2-site IP ranges routing?** | No, but support is planned | Yes, when you create a network route without access control groups |
## Get started
<p float="center" >
<Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
</p>
- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
- Follow us [on Twitter](https://twitter.com/netbird)
- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-2utg2ncdz-W7LEB6toRBLE1Jca37dYpg)
- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub

111
src/pages/how-to/routing-traffic-to-multiple-resources.mdx Normal file
View File

@@ -0,0 +1,111 @@
# Routing traffic to multiple IP resources
Adding routes to resources within on-premises or cloud is a common scenario for DevOps and Platform teams. In this guide, we will show you how to route traffic to multiple IP resources using NetBird's [Networks](/how-to/networks-concept) using [IP resources](/how-to/networks-concept#resources).
## Example
In the following scenario, we will cover the case where all users have restricted access to internal DNS servers in the internal network, and the DevOps team has full access to the entire network.
The network address is `172.16.0.0/15` and DNS servers has the IPs `172.16.30.2` and `172.17.100.2`.
These IP ranges will routed using [Routing peers](/how-to/networks-concept#routing-peers) running in the network.
### Create a Network
To create a Network, navigate to the `Networks` > `Networks` section in the NetBird dashboard:
<p>
<img src="/docs-static/img/how-to-guides/networks/view-wild-network-1.png" alt="new-net-1" className="imagewrapper-big"/>
</p>
Click on `Add Network` to follow a Wizard that will guide you through the steps to create a network and add resources to it.
First, we fill out the network Name and Description as shown in the image below and click `Continue`:
<p>
<img src="/docs-static/img/how-to-guides/networks/new-example-network-2.png" alt="new-net2" className="imagewrapper"/>
</p>
### Add a routing peer
Next we are asked to add a routing peer to the network. Let's click on `Add routing peer` and select a node from that VPC:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-example-routing-peer-1.png" alt="new-example-routing-peer-1" className="imagewrapper"/>
</p>
Click on `Continue` and then accept the defaults to add a routing peer by clicking on `Add Routing Peer`:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-example-routing-peer-2.png" alt="new-routing-peer-2" className="imagewrapper"/>
</p>
### Add the network resource
Following the guide, we are asked to add a new resource.
Click on `Add Resource` and enter the `Office network` name and use the IP range `172.16.0.0/15` as the address:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-example-resource-1.png" alt="new-example-resource-1" className="imagewrapper"/>
</p>
We can also assign a group to this resource; in this example, we will assign the group `office-network` to it. This way, we can create a policy that allows the DevOps team to access the entire IP range.
### Add an access control policy for the network resource
Next, in the guide, we will be asked to create an access control policy. Here, we will create a policy that allows all access to the `office-network` group of the IP range `172.16.0.0/15`
resource to peers in the `DevOps` group.
Click on `Create Policy` and fill out the fields as shown in the image below:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-example-resource-acl-1.png" alt="new-resource-acl-1" className="imagewrapper-big"/>
</p>
Click on `Continue` 2 times and then click on `Add Policy` to save the policy:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-example-resource-acl-2.png" alt="new-resource-acl-2" className="imagewrapper-big"/>
</p>
### Add the DNS server resources
Now, let's add the DNS servers resources to the network. Click on `Add Resource` and enter the IP address of the first DNS server:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-example-resource-2.png" alt="new-example-resource-2" className="imagewrapper"/>
</p>
We will use the same group, `office-dns-servers`, for both resources, allowing all users to access the DNS servers.
This time, when asked to create a policy, we will click on Later to skip it since we will create one more resource for this configuration.
Now, let's add another resource for the second DNS server:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-example-resource-3.png" alt="new-example-resource-3" className="imagewrapper"/>
</p>
### Add an access control policy for the DNS server resource
This time, we will create a policy that allows access to the `office-dns-servers` group of DNS IP resources to peers in
the `All users` group. They will be granted access only to the `UDP` port `53` of these servers.
Click on `Create Policy` and fill out the fields as shown in the image below:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-example-resource-acl-3.png" alt="new-resource-acl-3" className="imagewrapper-big"/>
</p>
Click on `Continue` 2 times and then click on `Add Policy` to save the policy:
<p>
<img src="/docs-static/img/how-to-guides/networks/add-example-resource-acl-4.png" alt="new-resource-acl-4" className="imagewrapper-big"/>
</p>
This time, we made the Policy name a bit more generic to cover both DNS server addresses.
### View the network
After completing the wizard, you will be able to see the network you just created in the Networks list:
<p>
<img src="/docs-static/img/how-to-guides/networks/view-example-network-1.png" alt="view-example-network-1" className="imagewrapper-big"/>
</p>
To access a detailed view of the network, click on the network name:
<p>
<img src="/docs-static/img/how-to-guides/networks/view-example-network-2.png" alt="view-example-network-2" className="imagewrapper-big"/>
</p>
You can edit or add more resources or routing peers to the network by clicking on the `Edit` buttons of each section in the detailed view.
With the steps above, we created resources that allow different levels of access to multiple user groups within a single organization network.
## Get started
<p float="center" >
<Button name="button" className="button-5" onClick={() => window.open("https://netbird.io/pricing")}>Use NetBird</Button>
</p>
- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird)
- Follow us [on Twitter](https://twitter.com/netbird)
- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-2utg2ncdz-W7LEB6toRBLE1Jca37dYpg)
- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub