Features
Access controls
Decide which people and devices can reach each other, with rules by group, tag, service or app, and tests that run before you save.
Access controls are your workspace's policy: a list of rules saying who can reach what. You edit them on the dashboard's Access controls page.
Important
Until you save a policy, every device in your workspace can reach every other. Once you save one, only what the rules allow gets through and everything else is blocked. A policy with no rules blocks all traffic between machines. Write your rules, and a few tests, before you save.
How rules work
Each rule says: these sources can reach these destinations, on this protocol and these ports. Rules only ever allow; if no rule allows a connection, it's blocked.
{
"src": ["group:eng"],
"dst": ["tag:prod"],
"proto": "tcp",
"ports": ["22", "5432"],
"note": "Engineers manage production"
}Selectors
| Selector | Means | Use in |
|---|---|---|
* | Every machine | Sources and destinations |
group:<name> | Every machine owned by a member of the group | Sources and destinations |
user:<email> | Every machine that person owns | Sources and destinations |
tag:<name> | Machines that joined with a key carrying that tag | Sources and destinations |
machine:<id> | One machine, by its ID | Sources and destinations |
svc:<name> | A service | Destinations |
app:<app ID> | An app, through its connectors | Destinations |
192.168.1.0/24 | A subnet route | Destinations |
autogroup:internet | Internet traffic through an exit node | Destinations |
Protocols: any, tcp, udp or icmp.
Ports: one port (22), a range (8000-8100), or * for all. Ports are ignored for icmp.
The policy
A policy has four parts:
{
"groups": {
"group:eng": ["priya@acme.com", "jonas@acme.com"],
"group:sales": ["sam@acme.com"]
},
"rules": [
{ "src": ["group:eng"], "dst": ["tag:prod"], "proto": "tcp", "ports": ["22", "5432"] },
{ "src": ["group:sales"], "dst": ["svc:crm"], "proto": "tcp", "ports": ["443"] },
{ "src": ["*"], "dst": ["svc:wiki"], "proto": "tcp", "ports": ["443"] }
],
"ssh": [
{ "src": ["group:eng"], "dst": ["tag:prod"] }
],
"tests": [
{ "src": "priya@acme.com", "accept": ["tag:prod:22"], "deny": [] },
{ "src": "sam@acme.com", "accept": ["svc:crm:443"], "deny": ["tag:prod:22"] }
]
}Groups
Named lists of people's emails, written in lowercase. Use them as group:<name> in rules.
SSH rules
SSH rules always mean TCP port 22, to machines only (not services or apps). Keeping them separate makes it easy to see who can log in where.
Tests
A test names a source and lists what it must reach (accept) and what it must not reach (deny), written as <selector>:<port> over TCP, like tag:prod:22. A policy only saves if every test passes, so a change can't silently break access.
Where rules are enforced
Each device enforces the rules for the traffic it receives:
- It lets in only what the rules allow, plus replies to connections it started itself (replies are remembered for 5 minutes of quiet).
- What a device sends out is never blocked.
- A rule that can't be applied is skipped, never treated as allow-all.
Warning
Devices enforce access rules from app version 0.3 onwards. Keep every device up to date so all of them enforce your policy.
Limits
| What | Limit |
|---|---|
| Rules (including SSH rules) | 200 |
| Groups | 100, with up to 500 members each |
| Tests | 100, with up to 50 targets each |
| Sources and destinations per rule | 1 to 50 |
| Notes | 200 characters, one line |
| Tag names | tag: + letter or digit, then up to 62 of A-Z a-z 0-9 _ . - |
| Group names | group: + lowercase letter or digit, then up to 62 of a-z 0-9 _ . - |
History
Every saved change is recorded in the audit log, with who made it.