Allow Range of ports - or ALL ports in the AC Policies

[zzecool]

Allow us to set range of ports in the Access Control Policies or even set the whole ports as ALL for example.

This way we can easily for example make a policy that will allow in one direction full access to every port from

PRIVATE -----> CLOUD allow ALL ports let say.

[QZAiXH]

I used Nebula before, but today when I switched to Netbird, I encountered a surprising issue: Netbird does not support specifying a range of ports. If I need to open a range of ports, I have to list them out one by one.

[gspacestuart]

Access Control Policies should allow adding multiple ports (individually and port ranges) of different types (UDP/TCP/ICMP). You could design it similar to FortiGate's "Services" and simply show a drop-down for the port type, then a start and end of the port number range, with the ability to add new lines with their own drop-down for the port type, and range start and end.

However it's designed, this functionality is crucial to making this a viable product. Without this, we'll likely have to create potentially hundreds of additional policies.

[fti7]

Yes this is a major drawback. Please add this essential feature

[alexcupertme]

https://tailscale.com/kb/1337/acl-syntax#access-rules

Take a look how Tailscale did this feature. Maybe we can specify port range like this: "1000-2000" . And no serious UI improvements

[JonTheNiceGuy]

Duplicate of #1328

[ThHirsch]

Hmm, the API documentation is stating, that port RANGES can be specified. see: Api-docu which states elemnts of "port_ranges - start - end' So if there is urgent need, using the API might help (Note: I did not tried the API for this until now. If anyone will have success. pleas report back here and/or in related Issues #1328 and #2320)

[luehm]

Hmmm - I tried creating a policy to allow all TCP ports (one-way) via the API, but received what seems to be an unrelated error - It may not be implemented server-side either (unless my API request is malformed).

Attempted request (redacted):

curl -X POST https://<management_server>:33073/api/policies \
-H 'Accept: application/json' \
-H 'Content-Type: application/json' \
-H 'Authorization: Token <token>' \
--data-raw '{
  "name": "full-tunnel-egress",
  "description": "Allows one-way tcp egress from full-tunnel members",
  "enabled": true,
  "rules": [
    {
      "name": "full-tunnel-egress-tcp",
      "description": "Allows one-way tcp egress from full-tunnel members (tcp)",
      "enabled": true,
      "action": "accept",
      "bidirectional": false,
      "protocol": "tcp",
      "port_ranges": [
        {
          "start": 1,
          "end": 65535
        }
      ],
      "sources": [
        "cun7g2j3jkfs73co2r20"
      ],
      "destinations": [
        "cun7lhr3jkfs73co2r3g"
      ]
    }
  ]
}'

Received response:

{"message":"for all or icmp protocol type flow can be only bi-directional","code":422}

[JonTheNiceGuy]

No, that's correct. They only allow the full port range for bi-directional ICMP or "Anything". There is a work-around, which is instead of specifying

"port_ranges": [{"start": 1, "end": 65535}]

You instead change that to:

"ports": [1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,........{and so on}....,65535]

However, when I tried this, it does work, but it makes the Web UI crash.