SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-03-31 14:44:34 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Allow Range of ports - or ALL ports in the AC Policies #897

New Issue
Closed
opened 2025-11-20 05:19:30 -05:00 by saavagebueno · 13 comments
saavagebueno commented 2025-11-20 05:19:30 -05:00
Owner
Copy Link

Originally created by @zzecool on GitHub (May 16, 2024).

Allow us to set range of ports in the Access Control Policies or even set the whole ports as ALL for example.

This way we can easily for example make a policy that will allow in one direction full access to every port from

PRIVATE -----> CLOUD allow ALL ports let say.

Originally created by @zzecool on GitHub (May 16, 2024). Allow us to set range of ports in the Access Control Policies or even set the whole ports as ALL for example. This way we can easily for example make a policy that will allow in one direction full access to every port from PRIVATE -----> CLOUD allow ALL ports let say.
saavagebueno added the bugfeature-requestdashboardapi labels 2025-11-20 05:19:30 -05:00
saavagebueno commented 2025-11-20 05:19:31 -05:00
Author
Owner
Copy Link

@QZAiXH commented on GitHub (May 30, 2024):

I used Nebula before, but today when I switched to Netbird, I encountered a surprising issue: Netbird does not support specifying a range of ports. If I need to open a range of ports, I have to list them out one by one.

@QZAiXH commented on GitHub (May 30, 2024): I used Nebula before, but today when I switched to Netbird, I encountered a surprising issue: Netbird does not support specifying a range of ports. If I need to open a range of ports, I have to list them out one by one.
saavagebueno commented 2025-11-20 05:19:31 -05:00
Author
Owner
Copy Link

@gspacestuart commented on GitHub (Jul 7, 2024):

Access Control Policies should allow adding multiple ports (individually and port ranges) of different types (UDP/TCP/ICMP). You could design it similar to FortiGate's "Services" and simply show a drop-down for the port type, then a start and end of the port number range, with the ability to add new lines with their own drop-down for the port type, and range start and end.

However it's designed, this functionality is crucial to making this a viable product. Without this, we'll likely have to create potentially hundreds of additional policies.

@gspacestuart commented on GitHub (Jul 7, 2024): Access Control Policies should allow adding multiple ports (individually and port ranges) of different types (UDP/TCP/ICMP). You could design it similar to FortiGate's "Services" and simply show a drop-down for the port type, then a start and end of the port number range, with the ability to add new lines with their own drop-down for the port type, and range start and end. However it's designed, this functionality is crucial to making this a viable product. Without this, we'll likely have to create potentially hundreds of additional policies.
saavagebueno commented 2025-11-20 05:19:31 -05:00
Author
Owner
Copy Link

@fti7 commented on GitHub (Jul 15, 2024):

Yes this is a major drawback. Please add this essential feature

@fti7 commented on GitHub (Jul 15, 2024): Yes this is a major drawback. Please add this essential feature
saavagebueno commented 2025-11-20 05:19:31 -05:00
Author
Owner
Copy Link

@alexcupertme commented on GitHub (Sep 6, 2024):

https://tailscale.com/kb/1337/acl-syntax#access-rules

Take a look how Tailscale did this feature. Maybe we can specify port range like this: "1000-2000" . And no serious UI improvements

@alexcupertme commented on GitHub (Sep 6, 2024): https://tailscale.com/kb/1337/acl-syntax#access-rules Take a look how Tailscale did this feature. Maybe we can specify port range like this: "1000-2000" . And no serious UI improvements
saavagebueno commented 2025-11-20 05:19:31 -05:00
Author
Owner
Copy Link

@JonTheNiceGuy commented on GitHub (Oct 17, 2024):

Duplicate of #1328

@JonTheNiceGuy commented on GitHub (Oct 17, 2024): Duplicate of #1328
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@ThHirsch commented on GitHub (Nov 23, 2024):

Hmm, the API documentation is stating, that port RANGES can be specified.
see: Api-docu which states elemnts of "port_ranges - start - end'
So if there is urgent need, using the API might help
(Note: I did not tried the API for this until now. If anyone will have success. pleas report back here and/or in related Issues #1328 and #2320)

@ThHirsch commented on GitHub (Nov 23, 2024): Hmm, the API documentation is stating, that port RANGES can be specified. see: [Api-docu](https://docs.netbird.io/api/resources/policies#create-a-policy) which states elemnts of "port_ranges - start - end' So if there is urgent need, using the API might help (Note: I did not tried the API for this until now. If anyone will have success. pleas report back here and/or in related Issues [#1328](https://github.com/netbirdio/netbird/issues/1328) and [#2320](https://github.com/netbirdio/netbird/issues/2320))
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@luehm commented on GitHub (Feb 13, 2025):

Hmmm - I tried creating a policy to allow all TCP ports (one-way) via the API, but received what seems to be an unrelated error - It may not be implemented server-side either (unless my API request is malformed).

Attempted request (redacted):

curl -X POST https://<management_server>:33073/api/policies \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: Token <token>' \
--data-raw '{
  "name": "full-tunnel-egress",
  "description": "Allows one-way tcp egress from full-tunnel members",
  "enabled": true,
  "rules": [
    {
      "name": "full-tunnel-egress-tcp",
      "description": "Allows one-way tcp egress from full-tunnel members (tcp)",
      "enabled": true,
      "action": "accept",
      "bidirectional": false,
      "protocol": "tcp",
      "port_ranges": [
        {
          "start": 1,
          "end": 65535
        }
      ],
      "sources": [
        "cun7g2j3jkfs73co2r20"
      ],
      "destinations": [
        "cun7lhr3jkfs73co2r3g"
      ]
    }
  ]
}'

Received response:

{"message":"for all or icmp protocol type flow can be only bi-directional","code":422}
@luehm commented on GitHub (Feb 13, 2025): Hmmm - I tried creating a policy to allow all TCP ports (one-way) via the API, but received what seems to be an unrelated error - It may not be implemented server-side either (unless my API request is malformed). Attempted request (redacted): ``` curl -X POST https://<management_server>:33073/api/policies \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -H 'Authorization: Token <token>' \ --data-raw '{ "name": "full-tunnel-egress", "description": "Allows one-way tcp egress from full-tunnel members", "enabled": true, "rules": [ { "name": "full-tunnel-egress-tcp", "description": "Allows one-way tcp egress from full-tunnel members (tcp)", "enabled": true, "action": "accept", "bidirectional": false, "protocol": "tcp", "port_ranges": [ { "start": 1, "end": 65535 } ], "sources": [ "cun7g2j3jkfs73co2r20" ], "destinations": [ "cun7lhr3jkfs73co2r3g" ] } ] }' ``` Received response: ``` {"message":"for all or icmp protocol type flow can be only bi-directional","code":422} ```
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@JonTheNiceGuy commented on GitHub (Feb 14, 2025):

No, that's correct. They only allow the full port range for bi-directional ICMP or "Anything". There is a work-around, which is instead of specifying

"port_ranges": [{"start": 1, "end": 65535}]

You instead change that to:

"ports": [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,........{and so on}....,65535]

However, when I tried this, it does work, but it makes the Web UI crash.

@JonTheNiceGuy commented on GitHub (Feb 14, 2025): No, that's correct. They only allow the full port range for bi-directional ICMP or "Anything". There is a work-around, which is instead of specifying ``` "port_ranges": [{"start": 1, "end": 65535}] ``` You instead change that to: ``` "ports": [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,........{and so on}....,65535] ``` However, when I tried this, it does work, but it makes the Web UI crash.
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 18, 2025):

Seems to be implemented by https://github.com/netbirdio/netbird/pull/3232 , but it might not be supported on the dashboard yet and still have some issues.

@nazarewk commented on GitHub (Apr 18, 2025): Seems to be implemented by https://github.com/netbirdio/netbird/pull/3232 , but it might not be supported on the dashboard yet and still have some issues.
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 23, 2025):

FYI: Current implementation is purely internal: a side effect of supporting a single very specific use case.

Continuous interest caught our attention, and we will be looking to polish and make it generally available in the near future (most likely this quarter).

@nazarewk commented on GitHub (Apr 23, 2025): FYI: Current implementation is purely internal: a side effect of supporting a single very specific use case. Continuous interest caught our attention, and we will be looking to polish and make it generally available in the near future (most likely this quarter).
saavagebueno commented 2025-11-20 05:19:32 -05:00
Author
Owner
Copy Link

@glennvenghaus commented on GitHub (May 29, 2025):

Yes please. Moved ethousiasticaly over to netbird , only to discover a simple one direction all ports rule is not yet possible. PLease asap !!! Thanks for this otherwise amazing product . Am just amazed how good it works

@glennvenghaus commented on GitHub (May 29, 2025): Yes please. Moved ethousiasticaly over to netbird , only to discover a simple one direction all ports rule is not yet possible. PLease asap !!! Thanks for this otherwise amazing product . Am just amazed how good it works
saavagebueno commented 2025-11-20 05:19:33 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Jun 19, 2025):

FYI: We are currently working to finish the implementation. Please don't report port-range issues until this feature request is fully implemented and closed.

CC: https://github.com/netbirdio/netbird/issues/4008

@nazarewk commented on GitHub (Jun 19, 2025): FYI: We are currently working to finish the implementation. Please don't report port-range issues until this feature request is fully implemented and closed. CC: https://github.com/netbirdio/netbird/issues/4008
saavagebueno commented 2025-11-20 05:19:33 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Sep 11, 2025):

This is already life for a while

Image
@nazarewk commented on GitHub (Sep 11, 2025): This is already life for a while <img width="1536" height="1534" alt="Image" src="https://github.com/user-attachments/assets/f7711d7c-ba46-4153-a996-8e6a6ca17b19" />
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label api bug dashboard feature-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#897
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?