> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

> NetworkRuleConfig is a network firewall rule config document.

# NetworkRuleConfig

export const VersionWarningBanner = () => {
  const latestVersion = "v1.13";
  const [latestUrl, setLatestUrl] = useState(null);
  const [currentVersion, setCurrentVersion] = useState(null);
  const [isBeta, setIsBeta] = useState(false);
  const parseVersion = v => v.replace("v", "").split(".").map(Number);
  const isGreaterVersion = (a, b) => {
    const [aMajor, aMinor] = parseVersion(a);
    const [bMajor, bMinor] = parseVersion(b);
    if (aMajor > bMajor) return true;
    if (aMajor === bMajor && aMinor > bMinor) return true;
    return false;
  };
  useEffect(() => {
    if (typeof window === "undefined") return;
    const {pathname, hash, search} = window.location;
    const match = pathname.match(/\/talos\/(v\d+\.\d+)\//);
    if (!match) return;
    const detectedVersion = match[1];
    if (detectedVersion === latestVersion) return;
    setCurrentVersion(detectedVersion);
    if (isGreaterVersion(detectedVersion, latestVersion)) {
      setIsBeta(true);
    }
    const newPath = pathname.replace(`/talos/${detectedVersion}/`, `/talos/${latestVersion}/`);
    setLatestUrl(`${newPath}${search}${hash}`);
  }, []);
  if (!latestUrl || !currentVersion) return null;
  return <div className="not-prose sticky top-6 z-50 my-6">
      <div className="border border-yellow-500/30 bg-yellow-500/10 px-4 py-3 rounded-xl">
        <div className="text-sm">
          {isBeta ? <>
              ⚠️ You are viewing a <strong>beta version</strong> of Talos ({currentVersion}).
              This version may be unstable.
              <a href={latestUrl} className="ml-2 underline text-yellow-400 hover:text-yellow-300 font-medium">
                View latest stable version {latestVersion} →
              </a>
            </> : <>
              ⚠️ You are viewing an older version of Talos ({currentVersion}).
              <a href={latestUrl} className="ml-2 underline text-yellow-400 hover:text-yellow-300 font-medium">
                View the latest version {latestVersion} →
              </a>
            </>}
        </div>
      </div>
    </div>;
};

<VersionWarningBanner />

```yaml theme={null}
apiVersion: v1alpha1
kind: NetworkRuleConfig
name: ingress-apid # Name of the config document.
# Port selector defines which ports and protocols on the host are affected by the rule.
portSelector:
    # Ports defines a list of port ranges or single ports.
    ports:
        - 50000
    protocol: tcp # Protocol defines traffic protocol (e.g. TCP or UDP).
# Ingress defines which source subnets are allowed to access the host ports/protocols defined by the `portSelector`.
ingress:
    - subnet: 192.168.0.0/16 # Subnet defines a source subnet.
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`name`</td>
      <td>string</td>
      <td>Name of the config document.</td>

      <td />
    </tr>

    <tr>
      <td>`portSelector`</td>
      <td><a href="#portselector">RulePortSelector</a></td>
      <td>Port selector defines which ports and protocols on the host are affected by the rule.</td>

      <td />
    </tr>

    <tr>
      <td>`ingress`</td>
      <td><a href="#ingress%5B%5D">IngressRule</a></td>
      <td>Ingress defines which source subnets are allowed to access the host ports/protocols defined by the `portSelector`.</td>

      <td />
    </tr>
  </tbody>
</table>

## portSelector

RulePortSelector is a port selector for the network rule.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`ports`</td>
      <td>PortRanges</td>
      <td>Ports defines a list of port ranges or single ports.<br />The port ranges are inclusive, and should not overlap.</td>

      <td />
    </tr>

    <tr>
      <td>`protocol`</td>
      <td>Protocol</td>
      <td>Protocol defines traffic protocol (e.g. TCP or UDP).</td>
      <td>`tcp`<br />`udp`<br />`icmp`<br />`icmpv6`<br /></td>
    </tr>
  </tbody>
</table>

## ingress\[]

IngressRule is a ingress rule.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`subnet`</td>
      <td>Prefix</td>
      <td>Subnet defines a source subnet.</td>

      <td />
    </tr>

    <tr>
      <td>`except`</td>
      <td>Prefix</td>
      <td>Except defines a source subnet to exclude from the rule, it gets excluded from the `subnet`.</td>

      <td />
    </tr>
  </tbody>
</table>