Just Dashboard Network
Read and change the server's interfaces, routes, firewall, gateway, tunnels, and resolver, with a confirmation step that protects your own connection.
The Network section in the sidebar treats this server as a router. It shows the server's devices, routes, firewall, gateway, tunnels, resolver, and traffic, and an administrator can change them. Until 0.7.1, part of this lived under Security. Security now keeps SSH, intrusion prevention, and sign-ins, and the firewall is here.
The network is still experimental: it works, but it is still being tested. A new account doesn't get it in its sidebar unless it picks Route the network or Show me everything at first sign-in. You can turn it on later in Account → Workspace. A hidden section is still reachable from links and search.
Find the right page
| Page | What it answers |
|---|---|
| Overview | How the internet and this browser reach the server, a live topology of its uplink, tunnels, and the networks it routes, the last fifteen minutes of throughput, and what needs attention. |
| Drift | Whether the host still holds the network configuration the dashboard saved, with a reviewed repair for selected differences. |
| Address planning | Shared IPv4 and IPv6 pools to plan non-overlapping prefixes against what Docker, interfaces, routes, WireGuard, and Tailscale already use. |
| External checks | DNS, TCP, and optional TLS measured from a machine you enroll elsewhere. Results describe that source only. |
| Interfaces | Every device on the machine, its traffic, and network namespaces. Create devices such as bridges, VLANs, VXLAN or GRE tunnels, and dummy devices. |
| Routing | Policy rules and routing tables, with the path this browser's replies take highlighted, plus whether the server forwards each address family, and BGP readings where FRR runs. |
| Egress groups | Groups of ways out, each member measured through its own path, with the decisions taken and a simulation before automation switches traffic. |
| Firewall | Whether the host firewall is enforcing, its rules, and who can still get in. |
| Gateway | Port forwards and NAT. The reverse proxy, streams, and certificates are under Proxy & TLS. |
| Protection | Blocklists (countries, feeds, addresses), rate limits, addresses that are never blocked, and kernel defences. |
| VPN | WireGuard tunnels with their peers and QR codes, this server on Tailscale, and Headscale nodes where Headscale runs. |
| DNS | Who answers the server's lookups: upstreams, DNS over TLS, DNSSEC, host records, and lookups. |
| Traffic | Per-device charts, live or recorded, the programs and containers moving bytes, shaping, and loaded eBPF programs. |
| Socket history | Recorded connections and which process owned them. |
| Connections | Current connections and their peers. |
| Connection path | Follows one connection through DNS, policy rules, the kernel route, and the owners involved. Each step says whether it was observed, modelled, or measured. |
| Tools | Diagnostics run from this server: DNS, ping, traceroute, port checks, HTTP and TLS, mail, whois, and a packet snapshot. |
| Packet captures | Short, bounded captures you can download as PCAP files. |
| Saved runs | Diagnostic results you chose to keep, and TCP endpoints watched on a schedule. |
Change the network safely
A wrong route or firewall rule can cut off the connection you are using. The dashboard guards against this in two ways:
- Your own path is checked. Each routing change is compared with how the kernel reaches the address your request came from. This includes requests that arrive through an SSH tunnel. A change that would move that path is undone and refused with the reason.
- Changes can wait for your confirmation. On hosts that support it, Confirm managed network changes after reconnecting (90 seconds) is on by default. Interface, routing, egress, gateway, protection, shaping, kernel-setting, firewall, and drift-repair changes are then applied temporarily, and a banner appears on every page. Select Verify reconnection, then Confirm network change. If nobody confirms within 90 seconds, the host restores the previous settings on its own, even if the dashboard itself is down. Restore settings undoes the change right away.
Settings the dashboard makes are restored at boot, so they survive a reboot even while the dashboard isn't running. The dashboard only removes devices, routes, and rules it created. Docker's bridges, Tailscale's device and routes, and your provider's routes are shown with their owner and never deleted from here.
On a host where NetworkManager or resolvconf writes /etc/resolv.conf, the DNS page can't change what programs use. It tells you where to make the change instead.
Who can use it
| Action | Needs |
|---|---|
| Overview, interfaces, routing, traffic, and the other readings not listed below | read |
| VPN, Address planning, External checks, Socket history, Connection path, Packet captures, Saved runs | system.admin (admin) |
| Tools diagnostics (the subnet calculator works for every role) | system.admin (admin) |
| Make or change devices, routes, rules, forwards, tunnels, and resolver settings | system.admin (admin) |
| Remove or turn off something that carries traffic | destructive (admin) |
Temporary changes that wait for confirmation need an administrator signed in through a browser, not an API key. See Roles and capabilities.
Limits
- Packet captures are limited to 1–10,000 packets, 1–120 seconds, and 2 MiB per file. They filter by one interface, address family, protocol, and optional address and port. Arbitrary capture expressions are not accepted.
- A diagnostic run from this server shows what this server sees. An open port measured from here is not proof that the internet can reach it. Use External checks from an enrolled machine for an outside view.