---
title: "RBAC"
url: "/reference/filters/network/rbac/"
kind: "reference"
summary: "Network filter that allows or denies connections by client address, destination and SNI."
---

> Arion site index: [/llms.txt](/llms.txt)

# RBAC

Network filter that allows or denies connections by client address, destination and SNI.

| Attachment | Type URL (`@type`) | Per-route override | Build feature |
|---|---|---|---|
| Filter chain (`filters`) | `type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC` | Not applicable | None |

## What it does

Network RBAC decides per *connection*, before any bytes reach the terminal filter, using only L4 facts: the client address, the destination address and port, and the TLS SNI. A denied connection is closed without a response. For request-level decisions on headers, use the [HTTP RBAC filter](@/reference/filters/http/rbac.md) instead.

## Minimal configuration

The fragment sits under `filter_chains[].filters`, before the terminal filter:

```yaml,arion=fragment
- name: rbac
  typed_config:
    "@type": type.googleapis.com/envoy.extensions.filters.network.rbac.v3.RBAC
    rules:
      action: ALLOW
      policies:
        internal-only:
          permissions:
            - any: true
          principals:
            - direct_remote_ip:
                address_prefix: 10.0.0.0
                prefix_len: 8
```

## Fields

| Field | Type | Required | Default | Description |
|---|---|---|---|---|
| `rules.action` | enum | Yes | — | `ALLOW` (only matching connections pass) or `DENY` (matching connections are dropped). `LOG` is rejected. |
| `rules.policies` | map | Yes | — | Named policies; a policy matches when *any* permission and *any* principal match. Policies are evaluated in lexical order of their names. |
| `stat_prefix` | string | No | — | Accepted for Envoy compatibility but ignored; Arion logs a warning. |

Shadow rules, matchers, `enforcement_type` and policy `condition` expressions are unsupported and refused at startup.

### Permissions

| Kind | Value | Description |
|---|---|---|
| `any` | `true` | Matches every connection. |
| `destination_ip` | CIDR | Matches the local (destination) address. |
| `destination_port` | uint16 | Matches the destination port. |
| `destination_port_range` | `{start, end}` | Matches `start <= port < end`. |
| `requested_server_name` | string matcher | Matches the TLS SNI (`exact`, `prefix`, `suffix`, `contains` or `safe_regex`). Requires a [TLS inspector](@/reference/filters/listener/tls-inspector.md); without SNI it never matches. |

### Principals

| Kind | Value | Description |
|---|---|---|
| `any` | `true` | Matches every client. |
| `direct_remote_ip` | CIDR | Matches the client address of the connection (the proxy-protocol-restored address when that filter is configured). |

## Ordering and interactions

Several RBAC filters may appear in one chain and every one must permit the connection; all must precede the terminal filter. At runtime RBAC runs after the [connection limit](@/reference/filters/network/connection-limit.md) and [rate limit](@/reference/filters/network/rate-limit.md) checks, and before the terminal filter starts reading.