Compose service classes

A service class is the technical policy tier applied to an authorized device. It combines one optional bandwidth profile with any firewall rules that target the class. It does not contain pricing, duration, DHCP, a gateway, or a VLAN.

The complete ownership model

This prevents a package edit from readdressing a client and keeps business product management separate from low-level network policy.

1. Prepare the policy components

Create the bandwidth profile first and decide which filtering the tier needs. After the service class exists, author the matching firewall rules and select it as their scope. Firewall rule order remains global and visible on the Firewall page.

2. Create the class

Open Service Classes → New service class.

1. Enter a clear technical name such as Guest Basic, Guest Premium, or Staff.
2. Select an active bandwidth profile, or Unlimited / no bandwidth profile.
3. Set status to active.
4. Confirm the tenant and save.

3. Add class-specific firewall behavior

Open Firewall, create an input or forward accept/drop/reject rule, and select the service class in Service. Reorder the rule in Firewall until its priority expresses the intended policy.

When you reopen the service class, Applied firewall displays every rule that targets it. This section is intentionally read-only: editing remains on Firewall so operators always see the global first-match order.

4. Select the class in a business package

In the Business Portal, create or edit an access plan and select this service class. When a free-tier activation or PIN redemption occurs, Core copies the plan's current service class onto the account as effective_service_class_id.

That snapshot has important behavior:

• editing a plan later does not silently repolicy accounts already online;
• a newly activated or redeemed entitlement receives the plan's current class;
• the edge receives only the effective technical policy, not price or package details;
• changing policy never chooses a DHCP pool or forces a new lease.

5. Validate end to end

Use one client account and verify this sequence:

1. The client receives an address from its physical network.
2. Portal activation creates a current entitlement.
3. NOC Leases shows the correct network and MAC.
4. The agent firewall authorization set contains the client IP.
5. The service-class firewall rule affects only the intended class.
6. tc shows the selected download and upload rate on the network interface and IFB.
7. Deleting or expiring the account removes authorization and class membership without deleting the DHCP lease.

Status and deletion

Disable a class to prevent new package selection while preserving the record and its references. Deletion is blocked while a package, account, or firewall rule still uses the class. Release those references deliberately rather than forcing orphaned policy.

Recommended rollout order

1. Install and enroll the agent.
2. Enable required edge services.
3. Create and converge native/VLAN networks.
4. Create bandwidth profiles.
5. Create service classes.
6. Add and test firewall rules.
7. Select classes from Business Portal packages.
8. Activate a test device and validate both permitted and denied traffic.

Return to the system overview or review firewall policy before introducing another tier.