mirror of
https://github.com/netbirdio/docs.git
synced 2026-08-25 09:11:26 +02:00
a9b5c3f99b
* docs: add clientless RDP for third parties use case guide Covers publishing an internal RDP host as a TCP reverse proxy service as an RDP gateway replacement for third parties that cannot install the NetBird client: single-host resource, TCP service with auto-assigned listen port, mandatory IP allowlist/CrowdSec restrictions, .rdp file handover, and the L4 security boundaries (no SSO/PIN on TCP, port re-rolls on service re-create, service publishing bypasses access policies). * docs: make CrowdSec conditional on broad allow rules, add UDP transport note Review feedback: CrowdSec Enforce is redundant behind a strict single-IP allowlist, so it is now recommended only when allow rules are broader. Adds a note that RDP's optional UDP transport cannot be used through the shared proxy cluster (independent auto-assigned listen ports) and that clients fall back to TCP-only automatically. * docs: update access control screenshot to match single-IP recommendation * docs: scope the UDP transport limitation to the shared proxy cluster Auto-assigned listen ports apply to the NetBird-hosted cluster only; a BYOP cluster can bind a TCP and a UDP service to the same custom port. * docs: UDP transport through a BYOP same-port service pair is verified working Tested with mstsc against a BYOP cluster binding TCP and UDP services on one custom port: the client negotiates the UDP transport through the proxy, and removing the UDP service degrades cleanly to TCP-only. Also notes the macOS client does not support the RDP UDP transport. * docs: scope the macOS UDP claim to what was observed * docs: macOS UDP claim holds with the app's UDP setting enabled * docs: split into shared-proxy and BYOP use cases, drop client-specific UDP note Adds a comparison of the two proxy deployments (auto-assigned port and TCP-only vs custom ports and RDP UDP transport), a BYOP walkthrough with the same-port TCP+UDP service pair, and keeps resource setup, access restrictions, and verification shared between both paths. * docs: clarify BYOP TLS requirement and service-domain resolution, grammar fixes