Network Access Control

Overview

Being on the VPN does not mean you can reach every device on it. Access is scoped to the people who are supposed to have it, and ARROW keeps that scoping in sync with your consultant assignments so you never have to write firewall rules by hand. Assign a consultant to a device in the Console, and their VPN access to that device follows automatically. Unassign them, and it goes away.

You do not manage any of this directly, but you can review it. Open the VPN section, then View Details, to inspect the peers, users, routes, groups, and policies that back your access rules.

Open View Details on the NetBird VPN page to review the groups and access policies that control device access

How It Works

When you assign a consultant to a device, ARROW creates the VPN groups and access policy that let that consultant connect to it, and the access takes effect within a few minutes. When you remove the consultant, ARROW revokes the access just as automatically. There is nothing to configure on the VPN itself; the device assignment is the control.

One-Way by Design

Access policies are intentionally one-way. Consultants can reach devices over SSH, VNC, and other management protocols, but devices can never open connections back toward consultant workstations. This matters most in exactly the situation ARROW is built for: if a device you are testing from gets compromised, it cannot turn around and pivot into your own machines or the rest of your infrastructure.

What You See in the Console

Under VPN then View Details, two tabs show you the access model in action.

The Policies tab lists the access-control rules currently in effect. ARROW manages these, so they are read-only, but they are worth understanding: a users-to-infrastructure policy lets consultants reach ARROW devices, per-device policies grant access to specifically assigned consultants, and separate policies cover virtual machines.

The Groups tab shows how peers are organized:

Group	Description
users	User workstations authenticated via IDP
pve	Physical ARROW devices (Proxmox hosts)
pvm	Virtual machines on physical ARROW hardware
vm	Virtual machines on other infrastructure

Managing Access

Access is driven entirely by device assignments, so you manage it the same way you manage a device. To grant access, open the device in the Console, edit its request or settings, add the consultant to the assignment list, and save; access appears within minutes. To revoke it, remove the consultant from that same list and save, and their access is pulled immediately.

VM-Specific Access Control

Virtual machines follow the same model, set up for you when the VM is provisioned: ARROW creates a group for the VM, a group for its assigned consultants, and a one-way policy connecting the two. When the VM is marked complete, all of it is cleaned up automatically, including the peer registration, both groups, and the policy.

Requirements

For this to work, each consultant needs a VPN user account, their email address must match between ARROW and the VPN system, and they must authenticate through your organization’s identity provider. If a consultant is assigned but cannot connect, a mismatched email is the first thing to check.

Best Practices

Because access tracks assignments, keeping assignments honest is what keeps access tight. Review consultant assignments periodically, remove people promptly when they roll off a project, and note in the device request why a given consultant is assigned so the reasoning is not lost.

VPN Management - VPN connection and status
Device Management - Managing devices and assignments