Role

In Managed Nebula, a role represents the primary purpose and group-identity of a host. For example, you might create roles such as Admin Endpoint, User Endpoint, or WWW Server. Every host, lighthouse, and relay is assigned exactly one role when it’s created, and a role’s name can’t be changed afterward.

A role also carries the inbound firewall rules for the hosts assigned to it. A newly created role allows only ICMP so that ping requests can be used for troubleshooting, and all other inbound traffic is denied until you add a rule allowing traffic from hosts belonging to specific roles or carrying specific tags. The same kind of inbound firewall rules can also be configured directly on a tag, in which case they apply to every host that carries it. Denying by default and allowing traffic by identity rather than by IP address is how Managed Nebula applies zero trust networking.

For a walkthrough of creating roles and writing firewall rules, see Creating firewalls using roles and tags.