Skip to main content

Network Microsegmentation

Create a network for each role

Devices can join multiple networks at once. Networks are free on Each network can have its own Network Flow Rules. "Network A allows only RDP traffic." for example.


  • Easy
  • Automatic authorization of nodes with SSO/OIDC


  • Multiple sets of subnets, IP addresses, etc… to maintain. Can be automated with Terraform.
  • Mobile devices can connect to only 1 network at a time


  • Create a ZeroTier network for each role: Red, Green, and Blue. Or: Sales, HR, IT. Or: Dev, Prod, Staging. Or: Customer A, Customer B
  • Join shared resources to multiple networks
  • Join users to the networks they need access to

ZeroTier Network Flow Rules

Tag network members with roles.


  • Fine grained, low-level access control
  • One network config and set of members to maintain


  • Tricky to build rule sets
  • Rules not integrated with OIDC yet


  • Create a network
  • Use the Flow Rules to segment the network

Here is the simplest possible ZeroTier Flow Rules example. More complex rules can be mixed in with these. See the docs or contact us for help.

Replace the default rules with:

tag role id 1
default 0
flag 0 red
flag 1 green
flag 2 blue

drop tand role 0;


Devices will be able to talk only if they have at least one overlapping role. The tagging system is based on bitwise math, which we won't try to explain here. Basically: Rename "red" "green" and "blue" with your real role names. Add more roles by adding flags in increasing order: flag 3 yellow, flag 4 indigo

After saving a rule set with tags. A tag interface appears below: