Expose reverse-proxy access control rules in netbird expose

[constantins2001]

Problem

The NetBird dashboard already lets reverse-proxy services define Access Control Rules that allow or block traffic by:

• IP address
• CIDR block
• country

The netbird expose CLI can create reverse-proxy services from a peer, but today it only exposes authentication-related controls such as password, PIN, and user groups. It does not expose the same IP/CIDR/country filtering controls available in the dashboard.

This makes peer-created expose services harder to lock down in automation or terminal-first workflows, especially when a user wants to quickly expose a local service but restrict access to known source IPs or regions.

Current CLI surface

Current netbird expose --help includes:

--protocol
--with-custom-domain
--with-external-port
--with-name-prefix
--with-password
--with-pin
--with-user-groups

Proposed direction

Add access-control flags to netbird expose, for example:

netbird expose --allow-ip 35.231.147.226 8080
netbird expose --allow-cidr 203.0.113.0/24 --block-country RU 8080
netbird expose --protocol tcp --allow-ip 35.231.147.226 5432

Suggested flags:

• --allow-ip
• --block-ip
• --allow-cidr
• --block-cidr
• --allow-country
• --block-country

Single IP flags can be normalized to CIDRs internally (/32 for IPv4 and /128 for IPv6), matching the existing reverse-proxy access restriction model.

Scope questions

• Should access restrictions be supported for both HTTP(S) and L4/TLS expose services?
• Should the CLI preserve the existing dashboard semantics where block rules take priority over allow rules?
• Are separate IP and CIDR flags preferred, or should the CLI expose only CIDR fields and document single-IP /32 and /128 usage?
• Should this CLI path support only IP/CIDR/country fields, or should it also expose CrowdSec mode later?

Related links

• Issue: Feature Request: Add reverse-proxy access control flags to netbird expose #6673
• Proposed implementation PR: [codex] Add access control flags to netbird expose #6675

I opened the issue and PR before seeing the discussion-first contributor flow. Happy to adjust the implementation or pause the PR until maintainers confirm the intended scope.