Access Control Lists

By default, every peer in a Bline-X mesh can reach every other peer. Access Control Lists (ACLs) let you restrict that traffic using tags: you group peers with tags, then write allow rules between tag groups.

1. Assign tags to peers

Tags are arbitrary labels of the form tag:name. Assign them by updating a peer through the API or dashboard:

curl -X PUT https://your-host:8080/api/peers/<pubkey> \
  -H "Authorization: Bearer <jwt>" \
  -H "Content-Type: application/json" \
  -d '{"tags":["tag:web"]}'

The peer's WireGuard public key is the :key path parameter. A peer can carry multiple tags.

2. Write a policy

ACL rules use tag:name in both the src and dst fields. For example, to allow web servers to reach the database tier but nothing else:

{
  "acls": [
    { "action": "accept", "src": ["tag:web"],   "dst": ["tag:db:5432"] },
    { "action": "accept", "src": ["tag:admin"], "dst": ["tag:web", "tag:db"] }
  ]
}

Manage rules through the ACL endpoints (GET/POST/PUT/DELETE /api/acls) or the dashboard.

3. List tags in use

To see every tag currently assigned across the mesh, query the tags endpoint:

curl https://your-host:8080/api/tags \
  -H "Authorization: Bearer <jwt>"

How rules are enforced

ACLs are enforced locally on kernel-TUN peers using iptables. Peers running in netstack mode (Windows, macOS, and unprivileged LXC containers) do not enforce ACLs locally. Design your policies so that a kernel-TUN peer sits on the enforcing side of any rule you depend on.

Example: lock down a three-tier app

Tag the front-end peers tag:web, the database peers tag:db, and your admin laptops tag:admin.
Allow tag:web → tag:db and tag:admin → everything.
With no rule permitting it, database peers cannot initiate connections back to the web tier, and untagged peers cannot reach either tier.