Client Isolation

[dougpenenman]

I have many nodes in a network that I use for my remote users to get to their respective desktops. How do I isolate each remote user to their desktop so that all the nodes can’t see each other? So i just need the one to one connection but for many users.

[zt-joseph]

As it happens I had this very link in my clipboard. Check out this article:

https://zerotier.atlassian.net/wiki/spaces/SD/pages/222330881/Client+Isolation

Let us know if you need any help getting things to work.

[dougpenenman]

I have seen this link and doesn’t make any sense to me. I only want 10.10.x.1 to connect to 10.10.x.2 and
10.10.x.3 to connect to 10.10.x.4 and so on.
I don’t want .3 or .4 to see .1 or .2 and vice versa.
So yes, I guess I need help.

[zt-travis]

How many users are on the network? like 10, 100, 1000?
Are there “admin” users that need to connect to every thing?

One option is each user gets their own network. May be be easier.
At the same time, they could all be on a 2nd admin network with the above client isolation rules if needed.

But to use Rules + Tags to segment one big network would be something like this:

    tag users1 id 1
        default 0
        flag 0 alice
        flag 1 bob
        flag 2 carlos
        ...
        flag 30 wendy
        enum 4294967295 all # admins

    ;

    accept not tand role 0;

    drop;

You can do 32 users per tag and I think 128 max tags per network. This may get a little awkward to wrangle with very large networks.

It’d look something like this

[dougpenenman]

I don’t see any kind of area in my portal to do what you show in the last shot above.

[zt-travis]

It’s underneath the rules after you save a rule set that has tags