Features Request: Peer Approval, Client Logout, Simplified DNS Resolution, Remote Management, Resources Tab

[hotline007]

Hi Team, Thank you for your exceptional contributions to this project. Your unique efforts are greatly appreciated. I've been diving deep into NetBird over the past few months, and there are a few features I feel might be great additions. I hope you'll consider them for future updates.

1- Enhance network security by introducing a peer approval process.

• Introduce an approval mechanism for new peers trying to join the Netbird network.
• Upon attempting to connect, new devices, whether via SSO login or access keys, should be notified that their connection is pending approval.
• Devices in the approval queue should be restricted from sending or receiving traffic. This ensures that only trusted devices, like servers, workstations, laptops, or phones, access the secure network.

2- Enhance user flexibility by allowing multiple account logins.

• Currently, the NetBird client supports only one active user login.
• For practical purposes, users may need to connect to different NetBird networks.
• While deleting the client config file prompts reauthentication, a seamless multi-account login feature would be more efficient. This feature would eliminate the need to delete any files for account switches.

3- Enhance usability by allowing the resolution of peer names without requiring the full FQDN.

• Currently, the NetBird client resolves the full FQDN of peers.
• Given that each NetBird client possesses an integrated DNS server, enabling resolution using only the peer name would streamline the process. This adjustment could lead to a more user-friendly experience.

4- Streamline the update process for large-scale deployments.

• Currently, updating the NetBird desktop client requires uninstalling the old version and installing the new one.
• While feasible for a few clients, this method becomes a pain for larger deployments (e.g., 100-200 users). Implementing a remote update management system would address this challenge, ensuring smooth transitions to newer versions.

5- Dedicated 'Resources Tab' for Service Management.

• The 'Resources Tab' should consolidate and display company-specific private services (e.g., web, SSH, RDP, and so on).
• Rather than showing all peers to every user, allow administrators to define and assign user or group-specific visibility. This structure would provide more control, preventing users from accessing or even seeing non-relevant peers, such as routing peers.

I hope these suggestions are helpful. Looking forward to an ETA for these features. Regards

[braginini]

Hey @hotline007 Thank you very much for submitting this request. The features are definitely something that we should implement. We will review it.

FYI: Also responded on Slack to you.

[hotline007]

@braginini You are welcome, and looking forward

[mlsmaycon]

Hello @hotline007, thanks for submitting this request. We are looking into our roadmap and should have an ETA for you in the coming weeks.

We do have some questions and notes about the point; please see below:

1- Enhance network security by introducing a peer approval process.

How do you see the approval process once the peer is added to the queue? Would it be easier to have a Dashboard (API) option for it?

We've seen other solutions approving new clients via management consoles or via other existing clients.

2- Enhance user flexibility by allowing multiple account logins.

We are looking into adding multiple login profiles in our UI and CLI clients, making it easier to switch accounts.

3- Enhance usability by allowing the resolution of peer names without requiring the full FQDN.

This is already part of our DNS feature for peer domain names. If it fails for you, please open another issue for us to check if it is a bug.

4- Streamline the update process for large-scale deployments.

We will take a few steps to integrate this into our NetBird management system. Now, we are working on an upgrade notification feature for Windows and MacOS clients. Once this is available, we will evaluate the best option for triggering the deployment from the dashboard or making it fully automated on the client side.

In any case, currently, we are relying on a few things to make the upgrade easier for large-scale deployments:

1. For Windows, we have MSI that can be easily integrated with RMM/MDM tools
2. MacOS offers installation packages (.pkg) and homebrew options as well that can facilitate
3. On Linux, we have Debian and RedHat packages that already offer some form of automated updates depending on the package manager settings.

5- Dedicated 'Resources Tab' for Service Management.

How do you see service + domain names for this feature?

We would love to discuss this in detail; if you have the time, please reach out in slack.

[hotline007]

Hi @mlsmaycon

Please check my answers below:

How do you see the approval process once the peer is added to the queue? Would it be easier to have a Dashboard (API) option for it?

Admins should approve peers via the NetBird Dashboard. Let's add MFA for extra security during approvals. Admins get email alerts and real-time portal notifications for new requests

How do you see service + domain names for this feature?

Can you explain more about this?

Thanks

[mlsmaycon]

Thanks for the feedback @hotline007

Regarding the service + domains. As we would expose an internal resource, we are thinking how the end user would access a particular service like a database or web service. The initial thought is to use a domain for it, which potentially is managed by NetBird as well, similar to peers domains but more flexible.

[gabriel-henriq]

@mlsmaycon , when I attempt to Netbird at first, I thought that I could achieve the "Resource" functionality like that one that exists on Twingate.

I think that the @hotline007 said that when he said about the:

Dedicated 'Resources Tab' for Service Management.

If the Netbird could resolve Resources like the Twingate does, it would be a great feature for everyone.

There an thread opened on Slack also here and here.