Permission Groups

This chapter covers MSST-Net Permission Groups.

What Are Permission Groups

A permission group is a reusable collection of principals, used to group multiple devices or users into a named group.

Once created, a permission group can be referenced directly in firewall rules instead of listing all members individually in each rule.

Each permission group has the following attributes:

Attribute	Description
Name	A human-readable name for the group, used for display only
Type	Member type: `device` or `user`
Member list	The list of device or user identifiers in the group

All members within a permission group must be of the same type (all devices, or all users).

Members can be specified by:

For details on identifiers, see:

When creating a firewall rule, you can specify a permission group instead of entering members manually.

When a permission group is referenced:

The rule applies to all members of the group
When the group's members change, all rules referencing the group are automatically updated

Compared to manually entering device IDs in each rule, permission groups offer:

Centralized management: Adding or removing members only requires updating the group — rules don't need individual updates
Less repetition: When the same set of devices needs multiple rules, create one group and reference it in each rule
Semantic clarity: A group's name can intuitively express the role or category of its members (e.g., "Trusted Friends", "Home Devices")

Scenario: Allow certain friends' devices to access the Minecraft server on your device.

Steps:

Create a device-type permission group named Trusted Friends
Add your friends' device IDs or mnemonics as members
Create a firewall rule: reference this permission group, allow access to TCP 25565

When a friend's device changes, only update the permission group's member list — the rule itself does not need to be modified.