Role

In Managed Nebula, a role represents the primary purpose and group-identity of a host. For example, you might create roles such as Admin Endpoint, User Endpoint, or WWW Server. Every host, lighthouse, and relay is assigned exactly one role when it's created, and a role's name can't be changed afterward.

A role also carries the inbound firewall rules for the hosts assigned to it. A newly created role allows only ICMP so that ping requests can be used for troubleshooting, and all other inbound traffic is denied until you add a rule allowing traffic from hosts belonging to specific roles or carrying specific tags. The same kind of inbound firewall rules can also be configured directly on a tag, in which case they apply to every host that carries it.

For a walkthrough of creating roles and writing firewall rules, see Creating firewalls using roles and tags.