docs: gate a Routes exit node with a posture check on the peer policy - #976
SunsetDrifter wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reachedNext included review available in 15 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe guide now uses direct exit-node access policies with posture checks. It documents route withdrawal, reconvergence, office-network behavior, platform limitations, and updated verification steps. ChangesExit-node posture routing
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Other Merge Risk: ⚪ Minimal · up to The updated guide correctly documents posture-based exit-node route withdrawal and restoration and is ready to merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. A rabbit checks the routes at dawn Comment |
2fa21d1 to
2a38d66
Compare
2a38d66 to
72b8504
Compare
The geo section told readers to build a 0.0.0.0/0 Network resource because a posture check on a Route exit node "does not work". That is only true when the check sits on the route's access control groups. Placed on the policy between the users group and the exit node group, the check withdraws the default route entirely, because routes are only distributed from peers the device is allowed to connect to. Rewrite the section around the exit node's native Routes setup, name the wrong placement, and add the office-subnet variant with a Peer Network Range check.
72b8504 to
b6d17a8
Compare
Summary
The Geo-Based Exit Node Routing section on the exit-nodes page told readers to build the exit node as a
0.0.0.0/0Network resource, with a note that adding a posture check to an exit node created as a Route "does not work". That note is only true when the check sits on the route's Access Control Groups: the default route then still installs and the device loses internet.Placed on the access policy between the users group and the exit node group, the check gates the route itself. NetBird distributes a route only from a routing peer the device is allowed to connect to, so a failing check removes the exit node peer from the device's peer list and the default route with it. Verified against NetBird Cloud with client 0.78.1: the route is withdrawn about 10 seconds after the check applies and returns, with Auto Apply reactivating it, about 7 seconds after it stops matching.
This keeps exit nodes in their native home (Add Exit Node on the peer, Auto Apply toggle, dashboard exit node view) instead of steering readers to a Networks workaround that has none of those.
Changes
--network-monitor=true, Android cannot report local ranges).Prompted by a support ticket asking exactly for the office case.
Summary by CodeRabbit
remote-workerstoexit-nodespolicy and Auto Apply configuration.