Rules

In nixscale, no traffic is allowed by default. Two devices on the same network can't reach each other unless a rule allows it. A rule defines one permission: source → destination → protocol and port.

How rules work

• The source is the devices that can open a connection; the destination is the devices they connect to.
• The source or destination can be a people group (the personal computers of the people in it) or a label (the machines that carry it).
• A rule is one-way: the source can connect to the destination, and replies to an allowed connection come back automatically. For the destination to open its own connections to the source, you need a separate rule in the other direction.
• Only the protocols and ports you choose in the rule are opened.

Example: developers group → db label → TCP 5432. Developers' computers can connect to the database servers on the PostgreSQL port; the servers can't open connections to developers' computers.

Add a rule

1. Open the form

   From the network page's menu, go to Rules and click Add rule.

2. Choose source and destination

   In the Source and Destination lists, groups are under 👤 People groups and labels under 🖥 Machine labels. You can create a missing label right here with + New label.

3. Choose protocol and port

   Pick the protocol in Protocol. For TCP, UDP and SCTP a Port field appears: pick a preset service, any port or Manual port…. For a port range, enter the first port and fill in Range end.

4. Add

   Before you save, the form shows what the rule will do: New rule, Port will be added to the existing rule or No change — this port is already open, how many devices the source and destination cover, and a warning if the rule would open no traffic today. Click Add. The policy is compiled and applied right away; use Show on map in the notification to see the rule on the access map.

Preset services

Protocols

TCP, UDP, ICMP, SCTP, GRE, ESP, AH, IGMP. Ports can only be chosen for TCP, UDP and SCTP; for the others, the rule allows all traffic of that protocol.

Add ports to the same rule

There is one rule per source and destination. When you add a rule with the same source and destination again, the new port is added to the existing rule and shows up as a separate tag on it.

• To remove a port, click the × next to its tag.
• When the last port is removed, the rule is deleted too.

Delete a rule

Click Delete rule next to the rule and confirm. The access path closes immediately; this can't be undone.

How the policy is applied

On every change, the rules are compiled into a policy that's applied to the network's control server and reaches devices shortly after.

• When a change is applied, the panel shows the new policy version and the policy badge in the network header updates.
• If a change doesn't alter the policy, the rule list shows Policy already up to date. Saving group membership doesn't show that notice: when the policy is unchanged, the people-groups section stays silent.

See what a rule affects

• Rules with a label as the destination show how many devices they affect; if no machine carries the label, the rule affects no devices.
• A rule whose source is a group in which no member has a personal computer is marked covers no devices; that rule allows no traffic. Only network admins see the marker, and only on the source side.

What do members see?

Rules are read-only for people with the member role. Members only see rules that involve a group they're in: rules whose source is their group (what they can reach) and rules whose destination is their group (who can reach their devices). They don't see the network's other rules.