Access control
Approval decides who is on the network. Policies decide who may talk to whom. Keep both.
Groups
Devices belong to groups; policies are written between groups. Assign groups from a peer's row, from a setup key (auto-assigned), or from your identity provider's group claims. The built-in All group contains every device.
Policies
Access Control → Policies. Each policy has sources, destinations, a direction, a protocol and ports:
| Example | Sources | Destinations | Rule |
|---|---|---|---|
| Everyone reaches everyone (default) | All | All | all traffic, both directions |
| Laptops reach servers on SSH only | laptops | servers | TCP 22, one direction |
| Monitoring scrapes everything | monitoring | All | TCP 9100 |
Delete or narrow the default policy once you have real groups; it is generous on purpose so a fresh network works.
Posture checks
A policy can require the source device to pass checks before it applies: client version, operating system, geographic location, or that a process is running. A laptop with an old client, or the wrong OS, simply does not get the sensitive groups. Attach checks in the policy editor.
How enforcement works
The control plane computes, per device, which peers it may reach and hands out only those. A device never learns the keys of peers it has no policy for, so there is nothing to attack. Firewall rules on each device mirror the ports.
Reading the result
A peer's Accessible Peers tab lists what it can reach and through which policy. Start there when "it cannot connect".