Your access
What you can reach and what you may do on ISC³ is decided by the groups on your account. There is nothing to configure on your side: the staff put you in the groups your work needs, and your devices pick them up when you sign in. This page lists the groups, where you log in, and what to do when something is refused.
Your account itself is your SWITCH edu-ID — see Connecting for the VPN client.
The groups
| Group | Kind | What it gives you |
|---|---|---|
students / staff | sign-in | Lets you sign in to the VPN at all. On its own it reaches nothing. |
vpn-carnaval | reach | Every Carnaval guest: the lab VMs and the Kubernetes API/UI |
vpn-rack-operators | reach | The service subnet, where the Proxmox web interfaces, the NAS and the rack PDU live — a route to them, not a login |
vpn-rack-mgmt | reach | The out-of-band server management interfaces (iDRAC) |
role-pve-auditor | rights | Read-only on everything in Proxmox, once you can reach it |
role-rack-admins | rights | Full administrator in Proxmox, and the admin pages behind the SSO gate |
Everyone gets exactly one of students / staff plus the groups their work needs. The prefix
says the kind: vpn- is a route, role- is a right inside an application (names since
2026-09-08). The exact
subnets behind each one are on the
access model page.
Reach decides which machines your packets may get to over the VPN; rights decide what you
may do once you are there. The two do not replace each other, so a Proxmox session needs
vpn-rack-operators to reach the interface and role-pve-auditor or role-rack-admins to be let in:
- reach without rights — the login page loads, you sign in, and the interface is empty;
- rights without reach — the page never loads at all.
The admin pages are the exception: they are published on the public web behind the SSO gate, so
role-rack-admins alone is enough and no VPN is needed.
Where you log in
| VPN | The NetBird client, management URL https://vpn.isc-vs.ch — see Connecting |
| Lab VMs | SSH with your key, once the VPN is up: ssh firstname.lastname@gpu0 (the name is the one your teacher gives) |
| Proxmox (needs the VPN) | https://rumba:8006 for the service cluster, https://carnaval0:8006 for the lab cluster — pick the realm isc in the dropdown, then Login |
| Admin pages (no VPN) | The links on the landing page — one edu-ID login covers them all |
On the Proxmox login page, use one of rumba, rumba.isc3 or the node's IP address (and the
same for carnaval0–carnaval10). Any other name gives Invalid parameter: redirect_uri — the
addresses are registered one by one.
Read-only Proxmox
role-pve-auditor, alongside the vpn-rack-operators that gets you there, lets you see everything the
cluster holds — nodes, VMs and containers, their configuration, the storages, the task log — and
change none of it. Two limits worth knowing before you go looking for them:
- no VM or container console, and
- no shell on the nodes (that is an SSH key, not a group — ask the staff).
If your work needs to start, stop or create guests, say so: it is a different role, not a setting you can turn on.
When your groups change
A group added or removed today does not reach a device that is already connected. The VPN client
rides the token it got at its last sign-in, and it keeps it for up to 48 hours — running
netbird up again does not refresh it and does not prompt you for anything.
So after the staff change your access:
- wait — it takes effect by itself within two days, or
- ask the staff to remove your device in the NetBird dashboard. Your next
netbird upthen asks you to sign in again, and the new groups apply immediately. You lose the tunnel for the minute it takes.
Proxmox reads your groups at every login, so there you only have to log out and back in.
When something is refused
- The edu-ID login works but ends on an error page — you are not on the ISC roster yet. The page names who to ask.
- Connected, but Proxmox or the NAS times out — you are missing
vpn-rack-operators. Check withnetbird status --detail: it lists the networks you actually have. - The Proxmox login succeeds and the interface is empty — you reached it but hold no rights group, or you changed group less than 48 h ago and are still on the old token.
- A button in Proxmox fails with a permission error — expected with
role-pve-auditor; it is read-only. - Everything worked yesterday and nothing works today — check that the client is connected to
https://vpn.isc-vs.chand not to the NetBird cloud.
Anything else, or if you need more access than you have: contact the staff.