diff --git a/public/docs-static/img/how-to-guides/networks/add-domain-resource-1.png b/public/docs-static/img/how-to-guides/networks/add-domain-resource-1.png new file mode 100644 index 00000000..ef1b16b0 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-domain-resource-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-domain-resource-acl-1.png b/public/docs-static/img/how-to-guides/networks/add-domain-resource-acl-1.png new file mode 100644 index 00000000..b3508d92 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-domain-resource-acl-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-domain-resource-acl-2.png b/public/docs-static/img/how-to-guides/networks/add-domain-resource-acl-2.png new file mode 100644 index 00000000..df78a6f4 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-domain-resource-acl-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-example-resource-1.png b/public/docs-static/img/how-to-guides/networks/add-example-resource-1.png new file mode 100644 index 00000000..9debd2d2 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-example-resource-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-example-resource-2.png b/public/docs-static/img/how-to-guides/networks/add-example-resource-2.png new file mode 100644 index 00000000..579a08b2 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-example-resource-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-example-resource-3.png b/public/docs-static/img/how-to-guides/networks/add-example-resource-3.png new file mode 100644 index 00000000..797243d4 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-example-resource-3.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-1.png b/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-1.png new file mode 100644 index 00000000..b5a655bc Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-2.png b/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-2.png new file mode 100644 index 00000000..2fcd18ba Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-3.png b/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-3.png new file mode 100644 index 00000000..282dcf9e Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-3.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-4.png b/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-4.png new file mode 100644 index 00000000..4fe866b5 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-example-resource-acl-4.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-example-routing-peer-1.png b/public/docs-static/img/how-to-guides/networks/add-example-routing-peer-1.png new file mode 100644 index 00000000..d57c5489 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-example-routing-peer-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-example-routing-peer-2.png b/public/docs-static/img/how-to-guides/networks/add-example-routing-peer-2.png new file mode 100644 index 00000000..2fb71ebb Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-example-routing-peer-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-routing-peer-1.png b/public/docs-static/img/how-to-guides/networks/add-routing-peer-1.png new file mode 100644 index 00000000..93d91b4e Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-routing-peer-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-routing-peer-2.png b/public/docs-static/img/how-to-guides/networks/add-routing-peer-2.png new file mode 100644 index 00000000..f3e50d33 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-routing-peer-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-1.png b/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-1.png new file mode 100644 index 00000000..07e73932 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-2.png b/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-2.png new file mode 100644 index 00000000..f5e4e84d Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-acl-1.png b/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-acl-1.png new file mode 100644 index 00000000..f72e5da1 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-acl-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-acl-2.png b/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-acl-2.png new file mode 100644 index 00000000..34baf673 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-wild-domain-resource-acl-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/add-wild-routing-peer-1.png b/public/docs-static/img/how-to-guides/networks/add-wild-routing-peer-1.png new file mode 100644 index 00000000..5ae0a299 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/add-wild-routing-peer-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/new-dev-network-1.png b/public/docs-static/img/how-to-guides/networks/new-dev-network-1.png new file mode 100644 index 00000000..b1d8a3e7 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/new-dev-network-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/new-example-network-2.png b/public/docs-static/img/how-to-guides/networks/new-example-network-2.png new file mode 100644 index 00000000..1d975759 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/new-example-network-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/new-network-2.png b/public/docs-static/img/how-to-guides/networks/new-network-2.png new file mode 100644 index 00000000..8ea6d162 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/new-network-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/new-network.png b/public/docs-static/img/how-to-guides/networks/new-network.png new file mode 100644 index 00000000..eb817fbd Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/new-network.png differ diff --git a/public/docs-static/img/how-to-guides/networks/resource-acl-1.png b/public/docs-static/img/how-to-guides/networks/resource-acl-1.png new file mode 100644 index 00000000..cc38320d Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/resource-acl-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/resources-1.png b/public/docs-static/img/how-to-guides/networks/resources-1.png new file mode 100644 index 00000000..fb0e2701 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/resources-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/resources-2.png b/public/docs-static/img/how-to-guides/networks/resources-2.png new file mode 100644 index 00000000..2d76b36b Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/resources-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/settings-1.png b/public/docs-static/img/how-to-guides/networks/settings-1.png new file mode 100644 index 00000000..8fae2558 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/settings-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/view-example-network-1.png b/public/docs-static/img/how-to-guides/networks/view-example-network-1.png new file mode 100644 index 00000000..904993a1 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/view-example-network-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/view-example-network-2.png b/public/docs-static/img/how-to-guides/networks/view-example-network-2.png new file mode 100644 index 00000000..472187f6 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/view-example-network-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/view-network-1.png b/public/docs-static/img/how-to-guides/networks/view-network-1.png new file mode 100644 index 00000000..88ae9177 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/view-network-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/view-network-2.png b/public/docs-static/img/how-to-guides/networks/view-network-2.png new file mode 100644 index 00000000..a999503b Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/view-network-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/view-wild-network-1.png b/public/docs-static/img/how-to-guides/networks/view-wild-network-1.png new file mode 100644 index 00000000..165ca3e7 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/view-wild-network-1.png differ diff --git a/public/docs-static/img/how-to-guides/networks/view-wild-network-2.png b/public/docs-static/img/how-to-guides/networks/view-wild-network-2.png new file mode 100644 index 00000000..4e9f4523 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/view-wild-network-2.png differ diff --git a/public/docs-static/img/how-to-guides/networks/view-wild-network-3.png b/public/docs-static/img/how-to-guides/networks/view-wild-network-3.png new file mode 100644 index 00000000..3c8266c3 Binary files /dev/null and b/public/docs-static/img/how-to-guides/networks/view-wild-network-3.png differ diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx index f1fadb4f..d03d5dfe 100644 --- a/src/components/NavigationDocs.jsx +++ b/src/components/NavigationDocs.jsx @@ -106,6 +106,16 @@ export const docsNavigation = [ ] }, + { + title: 'Networks (new)', + isOpen: false, + links: [ + { title: 'Concept', href: '/how-to/networks-concept' }, + { title: 'Routing traffic to multiple IP resources', href: '/how-to/routing-traffic-to-multiple-resources' }, + { title: 'Accessing restricted website domain resources', href: '/how-to/accessing-restricted-websites' }, + { title: 'Accessing entire domains within networks', href: '/how-to/accessing-entire-domains-within-networks' }, + ] + }, { title: 'Network Routes', isOpen: false, diff --git a/src/pages/how-to/accessing-entire-domains-within-networks.mdx b/src/pages/how-to/accessing-entire-domains-within-networks.mdx new file mode 100644 index 00000000..063594bc --- /dev/null +++ b/src/pages/how-to/accessing-entire-domains-within-networks.mdx @@ -0,0 +1,119 @@ +# Accessing entire domains within networks +Companies often run entire development and internal environments using assigned domains that are not publicly accessible due to security reasons. Creating routing resources for these environments can quickly become a problem for +DevOps and Platform teams because development teams may issue requests for new resources frequently. Taking that with the fact that some resources won't be within the same network, this can become a challenge to manage. + +NetBird can help you configure access to these resources by routing your traffic through a routing peer configured with [Networks](/how-to/networks-concept) using [Wildcard domain resources](/how-to/networks-concept#resources). + +## Example +In the following scenario, we will create a new development network and add a wildcard domain resource for the entire `dev.example.com` +to be routed using [Routing peers](/how-to/networks-concept#routing-peers) running in the network. All developers will be able to access the development environment using the `Network` configuration. + +### Pre-requisites + +#### Configure Nameservers +In order for the the following steps to work, you need to configure Nameservers to resolve all domain queries in your NetBird account. See the [Manage DNS in your network](/how-to/manage-dns-in-your-network) guide for more information. + +#### Enable DNS wildcard routing +When you configure wildcard domains as resources, you need to enable DNS wildcard routing. Which has an additional effect in comparison to the previous DNS routes behavior from Network routes; it switches the DNS resolution to the routing peer instead of the local client system. +This is also useful for regular DNS routes when you want to resolve the domain names using the routing peer's IP infrastructure, which will allow for more restricted access control rules in newer versions of the clients(**1**) and for the traffic to go to a near routing peer service. + + (1) Support for more restricted rules will be available in future releases. + +You can enable DNS resolution on the routing peer by accessing your account `Settings` > `Networks` > Enable DNS wildcard routing. See example below: +

+ settings-acl +

+ + + The `Enable DNS wildcard routing` is supported by routing peers and routing clients running version 0.35.0 or later. + Once the feature is enabled, you may need to restart your routing peers and clients to apply the changes. + + +### Create a Network +To create a Network, navigate to the `Networks` > `Networks` section in the NetBird dashboard: + +

+ new-net +

+ +Click on `Add Network` to follow a Wizard that will guide you through the steps to create a network and add resources to it. + +First, we fill out the network Name and Description as shown in the image below and click `Continue`: + +

+ new-dev-net1 +

+ +### Add a routing peer +Next we are asked to add a routing peer to the network. Let's click on `Add routing peer` and select a node from that VPC: + +

+ new-wild-routing-peer-1 +

+Click on `Continue` and then accept the defaults to add a routing peer by clicking on `Add Routing Peer`: +

+ new-routing-peer-2 +

+ +### Add a resource +Following the guide, we are asked to add a new resource. + +Click on `Add Resource` and enter the domain name of the `Development domain` in this case, `*.dev.example.com`: +

+ new-wild-resource-1 +

+ +We can also assign a group to this resource; in this example, we will assign the group `development-domains` to it. This way, we can create a policy that allows the development team to access the domains in the environment. + +### Add an access control policy +Next, in the guide, we will be asked to create an access control policy. Here, we will create a policy that allows access to the `development-domains` group of the `*.dev.example.com` +resource to peers in the `Developers` group. They will be granted all traffic to domains in the development environment. + +Click on `Create Policy` and fill out the fields as shown in the image below: +

+ new-resource-acl-1 +

+ +Click on `Continue` 2 times and then click on `Add Policy` to save the policy: +

+ new-resource-acl-2 +

+ +### View the network +After completing the wizard, you will be able to see the network you just created in the Networks list: +

+ view-wild-network-1 +

+ +To access a detailed view of the network, click on the network name: +

+ view-wild-network-2 +

+ +You can edit or add more resources or routing peers to the network by clicking on the `Edit` buttons of each section in the detailed view. + +### Add a regular domain resource +A wildcard domain won't cover the entire domain by itself because the wildcard character `*` only covers subdomains after the `.`. If you need to cover the entire domain, you can additionally add a regular domain resource to the network. + +This time, let's add a domain from the main Networks list view. Click on the `Add Resource` button: +

+ view-wild-network-3 +

+Then, enter the domain name of the `Regular domain` in this case, `dev.example.com`: +

+ new-wild-resource-2 +

+ +We can also assign the same group to this resource, allowing us to reuse the previous access control policy for the `development-domains` group. + +With the steps above, we created resources that allow the development team to access the entire `dev.example.com` domain and the `*.dev.example.com` subdomains using the same policy. + +## Get started +

+ +

+ +- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird) +- Follow us [on Twitter](https://twitter.com/netbird) +- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-2utg2ncdz-W7LEB6toRBLE1Jca37dYpg) +- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub \ No newline at end of file diff --git a/src/pages/how-to/accessing-restricted-websites.mdx b/src/pages/how-to/accessing-restricted-websites.mdx new file mode 100644 index 00000000..d398d16c --- /dev/null +++ b/src/pages/how-to/accessing-restricted-websites.mdx @@ -0,0 +1,81 @@ +# Accessing restricted website domain resources +It is very common to find scenarios where you need to access restricted websites or services. This can be due to company policies, geographical restrictions, or even to avoid tracking. +Very often these resources are located behind a cloud load balancer, which changes IP addresses frequently, making it hard to whitelist them. +NetBird can help you to access these resources by routing your traffic through a routing peer configured with [Networks](/how-to/networks-concept) using [Domain resources](/how-to/networks-concept#resources). + +## Example +In the following scenario, we will configure access to an accounting website which should accessible only by users from finance team. +The server is running in the company's AWS account in the EU Central region behind a load balancer, so we will create a new Network and add a `domain resource` +to be routed using [Routing peers](/how-to/networks-concept#routing-peers) running in the AWS VPC. + +### Create a Network +To create a Network, navigate to the `Networks` > `Networks` section in the NetBird dashboard: + +

+ new-net +

+ +Click on `Add Network` to follow a Wizard that will guide you through the steps to create a network and add resources to it. + +First, we fill out the network Name and Description as shown in the image below and click `Continue`: + +

+ new-net2 +

+ +### Add a routing peer +Next we are asked to add a routing peer to the network. Let's click on `Add routing peer` and select a node from that VPC: + +

+ new-routing-peer-1 +

+Click on `Continue` and then accept the defaults to add a routing peer by clicking on `Add Routing Peer`: +

+ new-routing-peer-2 +

+### Add a resource +Following the guide, we are asked to add a new resource. + +Click on `Add Resource` and enter the domain name of the `accounting website` in this case, `accounting.example.com`: +

+ new-resource-1 +

+ +We can also assign a group to this resource; in this case, we will assign the group `accounting-server` to it. This way, we can create a policy that allows only the finance team to access this resource. + +### Add an access control policy +Next, in the guide, we will be asked to create an access control policy. Here, we will create a policy that allows access to the `accounting-server` group of the `accounting.example.com` +resource to peers in the `Finance team` group. They will be able to access the service ports `TCP/80` and `TCP/443`. + +Click on `Create Policy` and fill out the fields as shown in the image below: +

+ new-resource-acl-1 +

+ +Click on `Continue` 2 times and then click on `Add Policy` to save the policy: +

+ new-resource-acl-2 +

+ +### View the network +After completing the wizard, you will be able to see the network you just created in the Networks list: +

+ view-network-1 +

+ +To access a detailed view of the network, click on the network name: +

+ view-network-2 +

+ +You can edit or add more resources or routing peers to the network by clicking on the `Edit` buttons of each section in the detailed view. + +## Get started +

+ +

+ +- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird) +- Follow us [on Twitter](https://twitter.com/netbird) +- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-2utg2ncdz-W7LEB6toRBLE1Jca37dYpg) +- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub \ No newline at end of file diff --git a/src/pages/how-to/networks-concept.mdx b/src/pages/how-to/networks-concept.mdx new file mode 100644 index 00000000..f9add7a2 --- /dev/null +++ b/src/pages/how-to/networks-concept.mdx @@ -0,0 +1,87 @@ +# Networks + +With the `0.35.0` release, we are introducing a new concept in NetBird called `Networks`. This concept improves the administration of routed resources and provides greater visibility into what is shared with peers. + +Below, we will review the essential concepts of Networks. + +## Concepts +#### Networks +Networks are configuration containers that map your on-premise or cloud networks in a logical set of configurations, making it easier to manage and share routes with your peers based on your infrastructure. + +#### Routing peers +One or more peers selected to route traffic from your NetBird peers to your Network resources. You can add as many routing peers as you need using single peers or groups to ensure high availability and load balancing. +You can define masquerading and priority for each routing peer. + + + Only Linux OS machines can be assigned as routing peers. + + +#### Resources +Remote network resources that are routed via routing peers. They can be configured as single IP addresses, IP ranges, domain names, or wildcard domains (e.g., *.netbird.io) when enabling [DNS wildcard routing](#enable-dns-wildcard-routing). + +See examples of resources below: +

+ resources +

+ + Support to exit nodes and site-2-site VPNs may become available in future releases. In the meantime you can use [Network routes](/how-to/routing-traffic-to-private-networks) add your exit-node routes and site2site routes. + + +You can assign a Group to a resource that allows you to manage access control policies for the resources. See the image below with an example of the resource *.netbird.io: +

+ resource-group +

+#### Access control policies +Access control policies are rules that define which peers can access the resources in your network. You can create policies based on the source and destination groups, and the type of traffic allowed (e.g., TCP, UDP, ICMP). +The groups assigned to resources should always be placed in the destination input field of the policy. +The peers belonging to the source groups will receive the resources linked to the policy and the firewall rules will be applied according to what is defined. +See the example below with a policy that allows the group `berlin-office` to access the resource `*.netbird.io`: + +

+ resource-acl +

+ + + Policies that for `domains` or `wildcard domains` that are applied to the peers of `IP ranges` might influence the access control for those peers since they have as destination ranges any IPs. + Due to this, we recommend to create networks with routing peers dedicated to domain and wildcard domains to prevent unwanted access to take place. In the coming releases, we will provide a fix for that behavior. + + +#### Enable DNS wildcard routing +When you configure wildcard domains as resources, you need to enable DNS wildcard routing. Which has an additional effect in comparison to the previous DNS routes behavior from Network routes; it switches the DNS resolution to the routing peer instead of the local client system. +This is also useful for regular DNS routes when you want to resolve the domain names using the routing peer's IP infrastructure, which will allow for more restricted access control rules in newer versions of the clients(**1**) and for the traffic to go to a near routing peer service. + + (1) Support for more restricted rules will be available in future releases. + +You can enable DNS resolution on the routing peer by accessing your account `Settings` > `Networks` > Enable DNS wildcard routing. See example below: +

+ settings-acl +

+ + + The `Enable DNS wildcard routing` is supported by routing peers and routing clients running version 0.35.0 or later. + Once the feature is enabled, you may need to restart your routing peers and clients to apply the changes. + + +## Differences between Networks and Network Routes + +| | Networks | Network routes | +|---------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| +| **Requires extra policy connecting routing peers to distribution peers?** | No, the connection is implied when a policy is added to control access to resources | Yes, the routing peers need to have a policy that connects them to peers in the distribution groups | +| **Needs distribution groups?** | No, the source groups in the policies define the distribution groups | Yes, they need to be explicitly defined per network route configured | +| **Requires adding full sets of configurations per routed resource?** | No, the routing peers in a Network are used to route all resources in that network | Yes, every network route needs to have a routing peer, distribution group, access control group, and the network range or DNS route | +| **Allows edit routed resources?** | Yes, you can edit ranges or domains | No, you can't edit IP ranges or DNS routes once created | +| **Allows edit names?** | Yes, names are editable | No, names are defined once while creating the route | +| **Support to wildcard domains?** | Yes, wildcard domains are supported | No, network routes are limited to individual domains | +| **Support for exit-nodes?** | No, even though that exit-nodes can be linked to on-premises or cloud networks, they invalidate other resources | Yes, but the same note is valid when using an exit-node to route other traffic to the same resources | +| **Support for site-2-site IP ranges routing?** | No, but support is planned | Yes, when you create a network route without access control groups | + + +## Get started +

+ +

+ +- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird) +- Follow us [on Twitter](https://twitter.com/netbird) +- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-2utg2ncdz-W7LEB6toRBLE1Jca37dYpg) +- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub diff --git a/src/pages/how-to/routing-traffic-to-multiple-resources.mdx b/src/pages/how-to/routing-traffic-to-multiple-resources.mdx new file mode 100644 index 00000000..4c916290 --- /dev/null +++ b/src/pages/how-to/routing-traffic-to-multiple-resources.mdx @@ -0,0 +1,111 @@ +# Routing traffic to multiple IP resources +Adding routes to resources within on-premises or cloud is a common scenario for DevOps and Platform teams. In this guide, we will show you how to route traffic to multiple IP resources using NetBird's [Networks](/how-to/networks-concept) using [IP resources](/how-to/networks-concept#resources). + +## Example +In the following scenario, we will cover the case where all users have restricted access to internal DNS servers in the internal network, and the DevOps team has full access to the entire network. +The network address is `172.16.0.0/15` and DNS servers has the IPs `172.16.30.2` and `172.17.100.2`. +These IP ranges will routed using [Routing peers](/how-to/networks-concept#routing-peers) running in the network. + +### Create a Network +To create a Network, navigate to the `Networks` > `Networks` section in the NetBird dashboard: + +

+ new-net-1 +

+ +Click on `Add Network` to follow a Wizard that will guide you through the steps to create a network and add resources to it. + +First, we fill out the network Name and Description as shown in the image below and click `Continue`: + +

+ new-net2 +

+ +### Add a routing peer +Next we are asked to add a routing peer to the network. Let's click on `Add routing peer` and select a node from that VPC: + +

+ new-example-routing-peer-1 +

+Click on `Continue` and then accept the defaults to add a routing peer by clicking on `Add Routing Peer`: +

+ new-routing-peer-2 +

+ +### Add the network resource +Following the guide, we are asked to add a new resource. + +Click on `Add Resource` and enter the `Office network` name and use the IP range `172.16.0.0/15` as the address: +

+ new-example-resource-1 +

+ +We can also assign a group to this resource; in this example, we will assign the group `office-network` to it. This way, we can create a policy that allows the DevOps team to access the entire IP range. + +### Add an access control policy for the network resource +Next, in the guide, we will be asked to create an access control policy. Here, we will create a policy that allows all access to the `office-network` group of the IP range `172.16.0.0/15` +resource to peers in the `DevOps` group. + +Click on `Create Policy` and fill out the fields as shown in the image below: +

+ new-resource-acl-1 +

+ +Click on `Continue` 2 times and then click on `Add Policy` to save the policy: +

+ new-resource-acl-2 +

+ +### Add the DNS server resources +Now, let's add the DNS servers resources to the network. Click on `Add Resource` and enter the IP address of the first DNS server: +

+ new-example-resource-2 +

+We will use the same group, `office-dns-servers`, for both resources, allowing all users to access the DNS servers. + +This time, when asked to create a policy, we will click on Later to skip it since we will create one more resource for this configuration. + +Now, let's add another resource for the second DNS server: +

+ new-example-resource-3 +

+ +### Add an access control policy for the DNS server resource +This time, we will create a policy that allows access to the `office-dns-servers` group of DNS IP resources to peers in +the `All users` group. They will be granted access only to the `UDP` port `53` of these servers. + +Click on `Create Policy` and fill out the fields as shown in the image below: +

+ new-resource-acl-3 +

+ +Click on `Continue` 2 times and then click on `Add Policy` to save the policy: +

+ new-resource-acl-4 +

+This time, we made the Policy name a bit more generic to cover both DNS server addresses. + +### View the network +After completing the wizard, you will be able to see the network you just created in the Networks list: +

+ view-example-network-1 +

+ +To access a detailed view of the network, click on the network name: +

+ view-example-network-2 +

+ +You can edit or add more resources or routing peers to the network by clicking on the `Edit` buttons of each section in the detailed view. + +With the steps above, we created resources that allow different levels of access to multiple user groups within a single organization network. + +## Get started +

+ +

+ +- Make sure to [star us on GitHub](https://github.com/netbirdio/netbird) +- Follow us [on Twitter](https://twitter.com/netbird) +- Join our [Slack Channel](https://join.slack.com/t/netbirdio/shared_invite/zt-2utg2ncdz-W7LEB6toRBLE1Jca37dYpg) +- NetBird [latest release](https://github.com/netbirdio/netbird/releases) on GitHub \ No newline at end of file