How access control works

Every network has one access policy: a JSON document that lists who can connect to what. Devices in the network can only open connections that a rule in the policy allows. Anything no rule allows is denied.

You edit the policy in the console under Access. The page is titled Access Control and has seven tabs: Rules, Shadowing, Groups, Tests, Tags, History, and Advanced (the raw JSON).

What the policy contains

The document has four sections:

The full schema is in the policy file reference.

The policy a new network starts with

A new network allows everything, so devices can reach each other while you set up:

{
  "rules": [
    {
      "name": "Default allow all",
      "description": "Allow all devices to communicate on all ports and protocols",
      "action": "accept",
      "source": ["*"],
      "destination": ["*"],
      "ports": ["*"],
      "protocol": ["*"],
      "enabled": true
    }
  ],
  "groups": {},
  "tests": [],
  "shadowing": [
    {
      "name": "Default allow all",
      "description": "Allow all devices to shadow each other",
      "source": ["*"],
      "destination": ["*"],
      "allowed_sessions": ["*"],
      "control": true,
      "consent_required": true,
      "enabled": true
    }
  ]
}

Replace both default rules with narrower ones before you rely on the policy. Write your first rule walks through it.

How a connection is checked

1. A device sends a packet to a peer. The sending device does not filter it.
2. The receiving device checks the packet against the rules that name it as a destination, top to bottom.
3. The first enabled rule whose source, protocol and port match decides: accept lets the packet in, any other action drops it.
4. If no rule matches, the packet is dropped.

Two properties follow from this:

• Rules control who can open a connection to a device. A rule from tag:web to tag:db lets web servers start connections to database servers. It does not let database servers start connections to web servers.
• Replies don't need their own rule. Once a connection is allowed, its return traffic is let through. How rules are evaluated lists exactly which packets count as replies.

Each device receives only the rules that apply to it. No device holds the whole policy.

Selectors

Rules name devices with selectors: * for every device, tag:<name> for tagged devices, and email:, group: or role: for the devices that people are signed in on. Prefer tags for servers and shared machines; they keep working when addresses change. See Tags, groups and roles.

When changes take effect

The control plane rebuilds each connected device's view of the policy every few seconds, so a saved change normally reaches devices within about 10 seconds. No restart or re-login is needed.

Who can edit the policy

See Members and roles for the full permission list.

What the policy does not control

• The console. Access to web.peerlify.com depends on your role, not on rules. A policy that denies everything does not lock you out of the console.
• Traffic outside the network. Rules apply to traffic between devices in the network. Who may send internet traffic through an exit point is set on Access → Exit points instead.
• IPv6. The network carries IPv4 only.

Next steps

• Write your first rule
• How rules are evaluated
• Policy file reference