SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-17 13:42:11 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Add support for CNAME in Network Routes #528

New Issue
Closed
opened 2025-11-20 05:13:01 -05:00 by saavagebueno · 2 comments
saavagebueno commented 2025-11-20 05:13:01 -05:00
Owner
Copy Link

Originally created by @Thunderbottom on GitHub (Nov 30, 2023).

Is your feature request related to a problem? Please describe.
Currently, there's no way to add CNAME to a network route entry in Netbird. This is particularly useful in cases where the infrastructure is hosted by a service provider, eg. AWS, Azure, et al. Or even in cases where the network host uses dynamic DNS.

As a workaround for this, currently, the entire VPC subnet that the ALB is a part of needs to be added as a network route, which is sub-optimal and does not allow granular control over permissions. For example, adding a network route for the subnet 10.0.0.0/16 (considering the ALB is in the same subnet) and distributing it to the peers in group-xyz gives the people of that group access to the entire subnet (instead of just the ALB), which might be a huge security issue for a lot of organizations.

And since Netbird cannot be installed on resources like an ALB, the only way right now is to whitelist the subnet the ALB is spawned in.

Describe the solution you'd like
There needs to be a way to add CNAME entries to a network route. This can be separate to the "Network Range CIDR" that's currently handled by Netbird as an alternate option for the CIDR range.

Describe alternatives you've considered
Currently the only other option is to whitelist an entire VPC subnet. Which, again, would be a security nightmare for a lot of organizations.

Originally created by @Thunderbottom on GitHub (Nov 30, 2023). **Is your feature request related to a problem? Please describe.** Currently, there's no way to add `CNAME` to a network route entry in Netbird. This is particularly useful in cases where the infrastructure is hosted by a service provider, eg. AWS, Azure, et al. Or even in cases where the network host uses dynamic DNS. As a workaround for this, currently, the entire VPC subnet that the ALB is a part of needs to be added as a network route, which is sub-optimal and does not allow granular control over permissions. For example, adding a network route for the subnet `10.0.0.0/16` (considering the ALB is in the same subnet) and distributing it to the peers in `group-xyz` gives the people of that group access to the entire subnet (instead of just the ALB), which might be a huge security issue for a lot of organizations. And since Netbird cannot be installed on resources like an ALB, the only way right now is to whitelist the subnet the ALB is spawned in. **Describe the solution you'd like** There needs to be a way to add `CNAME` entries to a network route. This can be separate to the "Network Range CIDR" that's currently handled by Netbird as an alternate option for the CIDR range. **Describe alternatives you've considered** Currently the only other option is to whitelist an entire VPC subnet. Which, again, would be a security nightmare for a lot of organizations.
saavagebueno added the feature-requestclientmanagement-servicedns labels 2025-11-20 05:13:01 -05:00
saavagebueno commented 2025-11-20 05:13:02 -05:00
Author
Owner
Copy Link

@joshmc82 commented on GitHub (Jan 15, 2024):

I have a similar use case for accessing AWS RDS Instances. In this case, RDS uses a hostname for access and dynamically assigns an IP from a pool on the subnet. There seems to be no way to access that hostname from the NetBird network. My workaround was to add a dedicated ssh bastion host and use SSH Tunnels. This is sub-optimal because I have to add an ssh key for every user onto the bastion host.

@joshmc82 commented on GitHub (Jan 15, 2024): I have a similar use case for accessing AWS RDS Instances. In this case, RDS uses a hostname for access and dynamically assigns an IP from a pool on the subnet. There seems to be no way to access that hostname from the NetBird network. My workaround was to add a dedicated ssh bastion host and use SSH Tunnels. This is sub-optimal because I have to add an ssh key for every user onto the bastion host.
saavagebueno commented 2025-11-20 05:13:03 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 18, 2025):

It was implemented/fixed for Network Resources recently, closing as a duplicate.

@nazarewk commented on GitHub (Apr 18, 2025): It was implemented/fixed for Network Resources recently, closing as a duplicate.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label client dns feature-request management-service
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#528
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?