By Toolverly Editorial. Research and local analysis checked on October 19, 2026.
Choose private-network access by the smallest resource and permission your team can maintain. Tailscale exposes grants, Twingate groups address/port Resources, Cloudflare combines routing with Gateway policies, NetBird separates peers and routed resources, and ZeroTier offers packet-flow rules over an overlay network. Our executed 12-pair authorization model found that “allow the ERP host” still granted two unwanted SSH paths when the actual requirement was ERP over HTTPS only.
The audience is an IT team granting finance staff and an external contractor access to a private business application, with wider rights for administrators. This complements workforce SSO, which establishes identity, and device management, which can establish device conditions. Neither alone specifies which private destination and port a user should reach.
Five ways to express the same access requirement
| Service | Decision boundary | What to verify |
|---|---|---|
| Tailscale | Source/destination/protocol grants | Remove broader permissions that also match |
| Twingate | Group access to address/port Resources | A host Resource defaults to broad ports |
| Cloudflare One | Tunnel routing plus Gateway policy | A route is not an identity-specific allow policy |
| NetBird Cloud | Peer/resource groups and access policies | Separate permissive peer default from routed Networks |
| ZeroTier | Virtual-network membership plus flow rules | Custom-rule plan entitlement and stateless return traffic |
Tailscale
Tailscale’s policy reference supports source/destination access rules and recommends grants for new configurations. Its policy tests can assert expected access decisions. For our requirement, express finance and contractor access to the ERP service’s TCP 443 separately from administrators’ wider permissions.
A new narrow grant cannot be expected to subtract access already granted by another broad rule. Review the effective permission set and test disallowed paths as well as allowed ones. This makes Tailscale a useful shortlist choice for teams comfortable reviewing policy as configuration; it is not a claim that our Python model executed its policy engine. Pricing separates Personal, Standard, Premium and Enterprise offerings, including user/resource dimensions. Use the business entitlement and resource counts appropriate to the deployment.
Twingate
Twingate Resources combine an address with optional protocol/port restrictions and group access. The documentation says a Resource without restrictions forwards broad TCP/UDP traffic, while a user without Resource access is denied. Those two defaults describe different boundaries: resource membership and permitted services on that resource.
Create an ERP HTTPS Resource and a separately restricted administrative Resource rather than granting finance access to an unrestricted ERP host. Verify both the hostname and any intended IP-based access paths; DNS resolution and routing assumptions matter. Plan comparison distinguishes Teams and Business features, including identity-provider lifecycle capabilities. A low per-user price is not enough if contractor provisioning and revocation need a higher entitlement.
Cloudflare One
Cloudflare’s private-network guide describes client-to-network connectivity through a tunnel. Treat that route as reachability infrastructure. Gateway network policies separately express identity, destination, protocol and port controls; its default-block pattern uses specific Allow policies above a catch-all Block.
This fits teams already operating Cloudflare’s client and traffic-policy infrastructure, provided they own policy ordering and bypass exceptions. The HTTPS application login is an additional layer; it does not stand in for restricting private SSH/database reachability. The checked commercial plan page did not expose a complete comparable numeric quote in our fetched text. Confirm seats, policy features, support and logs for the exact plan. We do not claim that routing alone creates an access policy or that a nominal free allowance covers this full scenario.
NetBird Cloud
NetBird’s peer-policy documentation describes an initial permissive Default policy between peers and allows restrictions by source/destination groups, protocol and port. Its Networks documentation describes a different routed-resource model where resources need an access policy. Distinguish those surfaces when reviewing an existing account; “default deny” is incomplete without specifying which surface and current policies.
Map finance and contractor devices into maintained source groups, restrict the exact ERP destination/port and review user-to-device lifecycle changes. Removing a broad peer policy is a deployment change requiring validation, not an instruction to interrupt an existing network. Cloud pricing includes both active-user and machine allowances, with additional machines a separate consideration. Our abstract user labels do not test NetBird’s actual group synchronization.
ZeroTier
ZeroTier’s rules documentation distinguishes network membership from flow restrictions and explains that its rules engine is stateless. A simple one-way destination-port rule is not a complete bidirectional TCP policy. Return paths and additional protocol traffic must be considered when implementing the intended access set.
The same documentation and pricing page place custom flow rules in Scale/Enterprise, while Essential exposes templated rules. That is a material purchasing boundary for a custom policy design. If the required ERP/contractor separation cannot be expressed by the entitled template, price the suitable plan or select a different architecture. Our model does not demonstrate a vulnerability, evaluate packet filtering or prove any ZeroTier template inadequate.
Original access-set audit: identity, destination and port
We modeled three principals: finance, contractor and admin. Four TCP services were ERP HTTPS at 10.42.0.10: 443, ERP SSH at 10.42.0.10: 22, a database at 10.42.0.20: 5432 and another web service at 10.42.0.30: 443. The intended set contains six pairs: finance→ERP HTTPS, contractor→ERP HTTPS, and admin→all four services.
All-members/all-services access produced six unexpected pairs. Granting non-admin users every port on the ERP host produced two unexpected SSH pairs. Granting them HTTPS across the subnet produced two unexpected pairs to the other web service. Exact resource access produced no unexpected or missing pairs. All four shapes satisfied the two intended non-admin ERP HTTPS connections; positive tests alone therefore could not distinguish them.
principals = ["finance", "contractor", "admin"]
services = ["erp_https", "erp_ssh", "db", "other_https"]
wanted = {(u,"erp_https") for u in principals}
wanted |= {("admin",s) for s in services}
for extra in [set(),
{(u,"erp_ssh") for u in principals if u!="admin"},
{(u,"other_https") for u in principals if u!="admin"}]:
allowed = wanted | extra
print(len(allowed-wanted), len(wanted-allowed))
# Exact:0,0. Host-all-ports:2,0. Subnet-HTTPS:2,0.This makes the shortlist actionable. Favor a resource model that your administrators can express without broad exceptions, and require negative acceptance cases for each non-admin identity. Include revocation and independent authentication to the application in the eventual pilot. Overlay membership, a tunnel being online and a successful login are three different facts.
Methodology and limitations
We expanded four abstract policy shapes over 12 principal/service pairs in Python 3.14.6 on macOS 26.6.2, then compared the resulting sets with an explicit intended set. Documentation research identifies the relevant control points and commercial boundaries in each service. We did not translate the model into actual vendor configuration.
We did not install clients, change live policies, create tunnels, send packets, verify posture integration or measure revocation, latency or security effectiveness. The model excludes DNS, UDP, IPv 6, return traffic, routing conflicts and compromised endpoints. In particular, it is not a complete ZeroTier rule set. Validate the chosen implementation in an isolated authorized environment before changing production access. AI assistance was used for research, local analysis code and writing; source claims and executed outputs were reviewed before publication.
Photo by Sasun Bughdaryan on Unsplash. Read about our publication or send a correction.