Rule recipes

The recipes on this page give you the values to enter in the Add rule form in Rules. They all work the same way: source → destination → protocol/port, and with no rule there's no access.

Names like developers, ops and db are examples; replace them with your own group and label names.

Let a team SSH into servers

So the ops team can reach every server from a terminal:

Let developers reach the database

If you add a second port for the same source and destination (say MySQL), it joins the existing rule.

Let everyone open an internal app

So the whole team can reach an internal web app:

Let an app server reach the database

Rules aren't only for people; machine-to-machine access is defined the same way:

Let a team reach each other's computers

For team members to reach each other's computers (screen sharing, file sharing), the source and destination are the same group:

Ping for connectivity tests

If you want ping to work, add the ICMP protocol for the same source and destination. With ICMP there's no port field; the rule allows all of that traffic.

Access to an office network

To reach a local network a gateway device shares (printers, a NAS), first approve the shared network. The approved network becomes part of the gateway's label, and then you write a rule for that label:

What to avoid

• Don't grant any port everywhere. If you know the service, pick its port; the rules stay readable and you don't open access you didn't mean to.
• Don't manage people with labels. Labeling a personal computer can't be undone and detaches the device from its owner.
• Remember it's one-way. A rule opens from source to destination. If you need both directions, write a rule the other way too.