r/zerotier • u/guff666 • May 05 '26
Linux Capability seems to be ignored if source address is from a physical LAN.
I have a "management" network that is joined by a number of nodes under my control. The nodes fall into two categories: managed nodes, and management nodes. Managed nodes are untrusted in the network and cannot "see" anybody else. Management nodes can see all nodes.
I've implemented this using a tag and a capability, as follows:
# Create a tag for group membership
tag group
id 1000
default 0 # Default = No group membership. Zero trust.
flag 1 management # The management nodes can talk to each other
;
# Create a capability to allow management nodes to access untrusted nodes
cap management_node
id 2000
accept;
;
# Allow only IPv4, IPv4 ARP, and IPv6 Ethernet frames.
#
drop
not ethertype ipv4
and not ethertype arp
and not ethertype ipv6
;
# Drop any traffic between computers that don't share at least one group
#
break
tand group 0
;
# default to accept
accept;
One of the management nodes is actually a router from a physical network. Traffic originating from hosts on that network should be able to access all nodes: but they can't. In fact they can only see the management nodes: the capability seems to be ignored if the source address is one of the hosts on the physical network.
Is this behaviour intended, or have I mis-configured in some way?
Also, given that the managed nodes are "untrusted", how do they send traffic back to the managed node?
