From fdb01e39ba8992f01cbc78997ede9cc635f3d771 Mon Sep 17 00:00:00 2001 From: Ian Foster Date: Wed, 28 Jan 2026 11:31:10 -0800 Subject: [PATCH] add note on firewall being experimental and how to opt a single client out of the firewall. --- docs/content/guides/admin.md | 6 ++++++ docs/content/guides/clients.md | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/docs/content/guides/admin.md b/docs/content/guides/admin.md index f09ba79b..ff93ddf7 100644 --- a/docs/content/guides/admin.md +++ b/docs/content/guides/admin.md @@ -10,6 +10,12 @@ Enable server-side firewall filtering to enforce network access restrictions per When enabled, each client can have custom "Firewall Allowed IPs" configured that restrict which destinations they can access through the VPN. These restrictions are enforced by the server using iptables/ip6tables and cannot be bypassed by the client. +/// warning | Experimental Feature + +This feature is currently experimental. While functional, it should be thoroughly tested in your environment before relying on it for production security requirements. Always verify that firewall rules are working as expected using test traffic or by manually inspecting the rules. + +/// + **Requirements:** - `iptables` must be installed on the host system diff --git a/docs/content/guides/clients.md b/docs/content/guides/clients.md index 292b854c..5c723a9f 100644 --- a/docs/content/guides/clients.md +++ b/docs/content/guides/clients.md @@ -59,7 +59,9 @@ Protocol specifiers (`/tcp` or `/udp`) require a port number. The following form - **Empty**: Falls back to the client's "Allowed IPs" setting - **Specified**: Only listed destinations are accessible (allow-only, everything else is blocked) -- **Use Case Examples**: +- **Disable for specific client**: To disable firewall filtering for a single client while keeping it enabled for others, add `0.0.0.0/0, ::/0` to allow all traffic + +**Use Case Examples**: - Allow only specific servers: `10.10.0.5` - Allow only internal network: `10.10.0.0/24, 192.168.1.0/24` - Allow only web browsing: `0.0.0.0/0:80, 0.0.0.0/0:443, ::/0:80, ::/0:443`