Zero trust networking

Zero trust networking is a security model where no device is trusted because of where it sits on the network. Being on the office LAN, inside a VPC, or connected to the VPN earns nothing by itself. Every connection has to prove who it comes from and be explicitly allowed, and access is limited to what that identity needs.

It replaces the perimeter model, where anything inside the firewall was largely trusted. That stops working once laptops leave the office, workloads span several clouds, and one compromised machine inside can reach everything else.

How Managed Nebula applies it

Managed Nebula enforces zero trust at the network layer, on every host:

• Identity from certificates, not IP addresses: Each host's certificate, signed by the network's certificate authority, says who it is and which groups it belongs to. Every tunnel starts with both hosts checking each other's.
• Deny by default: A new role allows only ICMP. Everything else needs a firewall rule naming the roles or tags that may connect.
• Sign-in through your identity provider: With endpoint SSO, people enroll devices through your OIDC provider, with 16-hour sessions by default.
• Fast revocation: Within 60 seconds of a host being blocked, every host that can reach Defined Networking stops trusting its certificate.

Architecture covers how each of these works.

For example, say a contractor needs SSH access to your build servers and nothing else. You tag their laptop access:contractor and add a rule to the build-server role allowing TCP 22 from that tag. The laptop can reach port 22 on build servers and, apart from ping, nothing else on the network. When the contract ends, you block the laptop, and within a minute the rest of the network stops trusting it.

Where it stops

Nebula decides which hosts can open connections to which ports. It doesn't look inside those connections, so the service on the other end still needs its own authentication: a rule allowing TCP 5432 lets a host reach Postgres, not log in to it.

Endpoint SSO checks the user at sign-in, not on every connection. Disabling an SSO provider doesn't end existing sessions either, so block or delete the hosts to remove their access.

The admin panel shows each host's operating system in the host list and on the host's details page, and you can carry that into firewall rules by tagging a host os:windows and naming the tag in a rule. But a tag is a label an admin sets, not something Nebula checks on the device, so it can't enforce device health such as patch level or disk encryption. For that, pair Managed Nebula with an endpoint management tool.

Zero trust network access (ZTNA)

ZTNA usually refers to products that broker access to individual applications through a proxy or connector, often with posture checks built in. Nebula connects hosts directly and controls access per host and port instead. For a closer look, see Managed Nebula vs Twingate and Managed Nebula vs Cloudflare Tunnel.