From 5e2d1ff991942939be9aa0a3fa18cd4a90224300 Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Tue, 3 Mar 2026 13:49:08 +0100 Subject: [PATCH 1/2] feat: Add localnetworkaccess policy --- .../reference/policies/LocalNetworkAccess.mdx | 165 ++++++++++++++++++ 1 file changed, 165 insertions(+) create mode 100644 src/content/docs/reference/policies/LocalNetworkAccess.mdx diff --git a/src/content/docs/reference/policies/LocalNetworkAccess.mdx b/src/content/docs/reference/policies/LocalNetworkAccess.mdx new file mode 100644 index 0000000..d1a2d13 --- /dev/null +++ b/src/content/docs/reference/policies/LocalNetworkAccess.mdx @@ -0,0 +1,165 @@ +--- +title: "LocalNetworkAccess" +description: "Configure local network access security features." +category: "Network security" +--- + +Configure local network access security features. +The `LocalNetworkAccess` policy controls Firefox's behavior when websites attempt to access local network resources (localhost and local network addresses). + +**Compatibility:** Firefox 147\ +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `network.lna.enabled`, `network.lna.block_trackers`, `network.lna.blocking`, `network.lna.skip-domains` + +## Values + +- `Enabled`: a Boolean that enables or disables the policy. + - When `true` (default), Firefox enforces local network access security checks. + This is the base flag without which none of the local network access checks below would be enforced. + - When `false`, all local network access checks are disabled and websites can freely access local network resources. +- `BlockTrackers`: a Boolean that controls blocking third-party trackers. When `true`, third-party trackers are directly blocked from accessing localhost and local network resources. + This is an experimental feature that helps prevent tracking scripts from scanning your local network. +- `EnablePrompting`: a Boolean to gate user permission prompts. + When `true`, access to local network resources will be explicitly gated via user permission prompts. + Users will be asked to grant permission before a website can access local resources. +- `SkipDomains`: an array of domain names for which local network access checks should be skipped. This allows administrators to create exceptions for trusted domains. +- `Locked`: if set to true, users cannot change the local network access settings. + +## Description + +When providing a list of exceptions for trusted domains, the `SkipDomains` array can contain both **source domains** (the website making the request) and **target domains** (the local resource being accessed). + +When a **source domain** is listed, that website is allowed to access local network resources without restrictions. +For example, if `"trusted-app.example.com"` is listed, that website can freely make requests to any local network resources. + +When a **target domain** is listed, any website can access that specific local network resource without restrictions. +For example, if `"printer.local"` is listed, all websites can access the printer device. + +Suffix wildcard patterns for are supported using the `*.` prefix to match all subdomains: + +- `"*.company.com"` - Skips checks for all subdomains of company.com (matches `app.company.com`, `portal.company.com`, etc.). +- `"*.internal"` - Skips checks for all .internal domains (matches `device.internal`, `printer.internal`, etc.). +- `"web-app.example.com"` - Skips checks for this specific domain only (no subdomain matching). +- `"*.devices.local"` - Allows access to all local devices with `.devices.local` suffix (`printer.devices.local`, `scanner.devices.local`, etc.). +- `"*.corp.internal"` - Allows access to all corporate internal domains. + +#### Windows (GPO) + +``` +Software\Policies\Mozilla\Firefox\LocalNetworkAccess\Enabled = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\LocalNetworkAccess\BlockTrackers = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\LocalNetworkAccess\EnablePrompting = 0x1 | 0x0 +Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\1 = "intranet.company.com" +Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\2 = "*.devices.local" +Software\Policies\Mozilla\Firefox\LocalNetworkAccess\SkipDomains\3 = "*.corp.internal" +Software\Policies\Mozilla\Firefox\LocalNetworkAccess\Locked = 0x1 | 0x0 +``` + +#### Windows (Intune) + +OMA-URI: + +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_Enabled +``` + +Value (string): + +``` + or +``` + +OMA-URI: + +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_BlockTrackers +``` + +Value (string): + +``` + or +``` + +OMA-URI: + +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_EnablePrompting +``` + +Value (string): + +``` + or +``` + +OMA-URI: + +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_SkipDomains +``` + +Value (string): + +``` + + +``` + +OMA-URI: + +``` +./Device/Vendor/MSFT/Policy/Config/Firefox~Policy~firefox/LocalNetworkAccess_Locked +``` + +Value (string): + +``` + or +``` + +#### macOS + +``` + + LocalNetworkAccess + + Enabled + | + BlockTrackers + | + EnablePrompting + | + SkipDomains + + intranet.company.com + *.devices.local + admin-portal.enterprise.com + *.corp.internal + + Locked + | + + +``` + +#### policies.json + +``` +{ + "policies": { + "LocalNetworkAccess": { + "Enabled": true | false, + "BlockTrackers": true | false, + "EnablePrompting": true | false, + "SkipDomains": [ + "intranet.company.com", + "*.devices.local", + "admin-portal.enterprise.com", + "*.corp.internal" + ], + "Locked": true | false + } + } +} +``` From 625c720e2acb4f7bfb7115db463b8c5e327490aa Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Mon, 9 Mar 2026 12:21:28 +0100 Subject: [PATCH 2/2] Apply suggestion from review --- src/content/docs/reference/policies/LocalNetworkAccess.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/reference/policies/LocalNetworkAccess.mdx b/src/content/docs/reference/policies/LocalNetworkAccess.mdx index d1a2d13..f00e16e 100644 --- a/src/content/docs/reference/policies/LocalNetworkAccess.mdx +++ b/src/content/docs/reference/policies/LocalNetworkAccess.mdx @@ -7,7 +7,7 @@ category: "Network security" Configure local network access security features. The `LocalNetworkAccess` policy controls Firefox's behavior when websites attempt to access local network resources (localhost and local network addresses). -**Compatibility:** Firefox 147\ +**Compatibility:** Firefox 149\ **CCK2 Equivalent:** N/A\ **Preferences Affected:** `network.lna.enabled`, `network.lna.block_trackers`, `network.lna.blocking`, `network.lna.skip-domains`