ZeroTier Rules Engine - Hub and Spoke - Client Isolation

zerotier - client isolation.md

Common ZeroTier Rules Engine question

• Non-servers can talk to servers, but not each other
• Kind of like Client Isolation on some WiFi controllers

Rules

# Allow only IPv4, IPv4 ARP, and IPv6 Ethernet frames. Typical default
drop
not ethertype ipv4
and not ethertype arp
and not ethertype ipv6
;

# Is this member a server?
tag server
id 2
enum 0 No
enum 1 Yes
default Yes
;

# if both members are not servers
break
not tor server 1
;

# Accept anything else. This is required since default is 'drop'.
accept;

• After saving the rules, you'll see a Tags Matrix at the bottom of the Flow Rules section