Skip to content
FIVEGUARDIAN5DOCUMENTATION
/
Español Open the panel
Administration

Networks and routes

How to give access to private networks and resources and how internet exit through the exit node works.

Concepts

The panel's Network Routing section lets FiveGuardian5 devices reach destinations that do not have the client installed, such as an office network, a server or an internal service, and defines where internet traffic exits. It has two parts: Networks and Routes.

Networks

Network Routing › Networks is the recommended way to publish private resources. A network contains:

  • Resources: the destinations you want to give access to (an address, a network range or a domain).
  • Routing peers: one or more FiveGuardian5 devices located in that network that forward traffic to the resources.
  • Policies: which groups can access each resource. Without a policy, nobody gets access.

Per-resource access control lets you grant, for example, access to a single server without opening the whole network.

Domain resources

A resource can be defined by domain name instead of by address, even with wildcards to cover all subdomains of a domain. This is useful when a service's addresses change often. When using domain resources, also check the DNS configuration, since name resolution determines where traffic is sent.

Routes

Network Routing › Routes is the classic mechanism to route traffic for an entire network range through a device acting as a router. It is still used for specific cases, such as the default internet exit route. To publish new resources, prefer Networks.

When configuring a route you specify the destination range, the device or group of devices that routes it, the device groups that receive the route and, optionally, access control groups.

Internet exit (default route)

Outside the office, users' internet traffic exits through a FiveGuardian5 exit node. In the panel it appears as a default route to the whole internet, assigned to the corresponding device groups.

This ensures traffic does not leave directly through untrusted networks (hotels, coffee shops) and the same protection applies everywhere. See How the connection works.

Do not modify, disable or reassign the default route or the exit node. Outside the office, internet access depends on them; a change can leave every remote user without internet. Any change must be coordinated with the FiveGuardian5 support team.

Cautions

  • Use ranges and resources as specific as possible.
  • Configure more than one routing peer for critical resources, where feasible, for redundancy.
  • Make sure each resource has an explicit, limited policy.
  • Changes to networks and routes are recorded in Audit Events.