SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-12 19:21:55 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Prevent netbird client to modify windows firewall #696

New Issue
Open
opened 2025-11-20 05:16:05 -05:00 by saavagebueno · 4 comments
saavagebueno commented 2025-11-20 05:16:05 -05:00
Owner
Copy Link

Originally created by @rpellerej on GitHub (Mar 11, 2024).

When I connect a windows server to my netbird server using a setup key, it will automatically add a rule in the windows firewall, allowing all incomming trafic from the netbird network.

I'd like to have the possibility to prevent this firewall modification, to have a second security check inside my server, and to not delegate fully to netbird server the ACLs. On Linux debian based servers, the netbird client does not seems to update iptables for instance.

I did not found a way to prevent directly from windows the firewall modification. I found someone who add an automatic task which trigger on a specifi event to rewrite the firewall, but I did not succeed to set up such a task.

Thank you in advance for your returns ! :)

Originally created by @rpellerej on GitHub (Mar 11, 2024). When I connect a windows server to my netbird server using a setup key, it will automatically add a rule in the windows firewall, allowing all incomming trafic from the netbird network. I'd like to have the possibility to prevent this firewall modification, to have a second security check inside my server, and to not delegate fully to netbird server the ACLs. On Linux debian based servers, the netbird client does not seems to update iptables for instance. I did not found a way to prevent directly from windows the firewall modification. I found someone who add an automatic task which trigger on a specifi event to rewrite the firewall, but I did not succeed to set up such a task. Thank you in advance for your returns ! :)
saavagebueno added the feature-requestwaiting-feedback labels 2025-11-20 05:16:05 -05:00
saavagebueno commented 2025-11-20 05:16:06 -05:00
Author
Owner
Copy Link

@pappz commented on GitHub (Mar 12, 2024):

On the Dashboard, policies page you can create rules for groups. When you create a setup-key you can set auto-assigned groups for the key. If you start to use that key then the peers will set the restrictions automatically.

@pappz commented on GitHub (Mar 12, 2024): On the Dashboard, [policies page](https://app.netbird.io/access-control) you can create rules for groups. When you create a setup-key you can set **auto-assigned groups** for the key. If you start to use that key then the peers will set the restrictions automatically.
saavagebueno commented 2025-11-20 05:16:06 -05:00
Author
Owner
Copy Link

@rpellerej commented on GitHub (Mar 12, 2024):

Even if my setup key does not have auto assigned groups, Netbird will add this inbound rule in the windows firewall :

image

The problem for me is the following :

  • Because of this rule, every trafic which is allowed by netbird will go in the windows server.

  • My windows firewall is configured to reject every inbound trafic which is not allowed by a specific rule. So, I want to be able to reject a connection on the windows server side, even if this connection was allowed by the Netbird server. Because of this rule, it is not possible.

The behaviour I would like to have :
A user try to connect to the server using RDP throug Netbird -> Check Netbird ACLs (OK) -> Check Windows firewall (NOT OK, because the windows firewall is bypassed by the automatic Netbird rule)

I can delete manually the rule to achieve what I want, but this is not a long term solution.

I would be very grateful if you have any idea or suggestion.

@rpellerej commented on GitHub (Mar 12, 2024): Even if my setup key does not have auto assigned groups, Netbird will add this inbound rule in the windows firewall : ![image](https://github.com/netbirdio/netbird/assets/159896546/f7525774-3351-4b0f-b803-59a4249ddf58) The problem for me is the following : - Because of this rule, every trafic which is allowed by netbird will go in the windows server. - My windows firewall is configured to reject every inbound trafic which is not allowed by a specific rule. So, I want to be able to reject a connection on the windows server side, even if this connection was allowed by the Netbird server. Because of this rule, it is not possible. The behaviour I would like to have : A user try to connect to the server using RDP throug Netbird -> Check Netbird ACLs (OK) -> Check Windows firewall (NOT OK, because the windows firewall is bypassed by the automatic Netbird rule) I can delete manually the rule to achieve what I want, but this is not a long term solution. I would be very grateful if you have any idea or suggestion.
saavagebueno commented 2025-11-20 05:16:06 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 18, 2025):

@rpellerej having some related discussions within a team recently I believe this might not be an issue anymore in the recent versions, can you confirm?

@nazarewk commented on GitHub (Apr 18, 2025): @rpellerej having some related discussions within a team recently I believe this might not be an issue anymore in the recent versions, can you confirm?
saavagebueno commented 2025-11-20 05:16:06 -05:00
Author
Owner
Copy Link

@hvolpers commented on GitHub (Oct 22, 2025):

I'm having the same issue the other way around. I cannot RDP into a client running netbird and am looking for the reason. RDP is active, Netbird firewall rule is in place (v.0.59.7, initial installation was v0.59.3).

@hvolpers commented on GitHub (Oct 22, 2025): I'm having the same issue the other way around. I cannot RDP into a client running netbird and am looking for the reason. RDP is active, Netbird firewall rule is in place (v.0.59.7, initial installation was v0.59.3).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label feature-request waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#696
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?