netbird-docs/src/pages/how-to/control-center.mdx

import {Note} from "@/components/mdx"

export const description =
    'Control Center provides a topological view of your NetBird network, visualizing access relationships between peers, groups, and networks through an interactive graph interface.'

# Visualize Remote Access with Control Center

Control Center is a topological view in the NetBird dashboard that visualizes who can access what across your environment. It maps **Peers**, **Groups**, and **Networks** to the resources they can reach and shows the access control policies that permit those connections.

<Note>
    **Availability**: NetBird Cloud (all plans) and self-hosted.
</Note>
<Note>
    **Permissions:** The Admin and Network Admin user roles can edit policies from Control Center. Learn more about
    [user roles](/how-to/add-users-to-your-network#manage-user-roles).
</Note>

## How it helps

- **Faster audits:** Confirm a device, group, or network's effective access at a glance.
- **Quicker troubleshooting:** Follow the policy path that grants access to a resource.
- **Safer changes:** Click through to the exact policy to refine sources, destinations, or ports without hunting across pages.

## Views

### Peers view

Use this to understand what a specific machine can reach.

<p>
    <img src="/docs-static/img/how-to-guides/control-center/control-center-peer-view.png" alt="Control Center Peer View"
         className="imagewrapper-big"/>
</p>

- Click the peer node, then search or choose another peer from the dropdown to switch focus.
- The graph shows the peer's access control policy nodes and the reachable resources.
- Click a policy chip to open the standard policy editor. Changes you save are reflected in the graph immediately.

### Groups view

Use this to validate team-level access.

<p>
    <img src="/docs-static/img/how-to-guides/control-center/control-center-groups-view.png"
         alt="Control Center Groups View" className="imagewrapper-big"/>
</p>

- Click a group node, then search or choose from the dropdown to switch groups.
- The layout shows which resources that group can reach and via which policies.
- View-only for topology here; create or delete groups in the Groups section outside Control Center. Group-based access is the recommended way to manage permissions.

Common checks:

- Confirm that "DevOps" can reach RDS on TCP 5432, or that "Support" only reaches SSH on TCP 22.

### Networks view

Use this to see who can access resources in your routed [networks](/how-to/networks).

<p>
    <img src="/docs-static/img/how-to-guides/control-center/control-center-network-view.png"
         alt="Control Center Network View" className="imagewrapper-big"/>
</p>

- Toggle **All Networks** or select a specific network.
- The network node shows its resources. Connecting lines display the port allowed by the policy and which groups have access.
- Click any policy chip to edit it in the standard editor. NetBird Networks and routing peers enable access to private subnets and IP resources.

## Editing policies from the graph

- **Open editor:** Click an access control policy chip in any view to open the standard policy editor.
- **What you can change:** Use the editor to modify the usual policy fields as documented in [Access Control](/how-to/manage-network-access), including sources, destinations, protocols, ports, and posture checks.
- **Create vs edit:** You can edit existing policies from Control Center. Creating a new policy still happens in the Access Control section.

## Quick start

1. Open **Control Center** in the NetBird dashboard.
2. Pick a tab: **Peers**, **Groups**, or **Networks**.
3. Click a node to focus, then follow the policy chips to the target resource.
4. Click a policy chip to edit it, then save. The graph updates right away.

## Use cases

- **Sanity-check a team:** In **Groups** view, select a group and verify the resources and ports granted by its policies match your intent. Adjust policies in place if needed.
- **Prepare a change:** In **Networks** view, review which groups reach a sensitive subnet before tightening ports or destinations.
- **Investigate access:** In **Peers** view, confirm why a host can reach a database by following the policy path and port labels, then narrow the rule if required.
- **MSPs:** Switch tenants in the MSP portal to repeat the same checks per customer environment.

## Related docs

- [Manage network access with Groups and Access Policies](/how-to/manage-network-access)
- [Apply posture checks to policies](/how-to/manage-posture-checks)
- [Networks and routing peers](/how-to/networks)
- [MSP portal overview](/how-to/msp-portal)