> Second, and far more important, meshing all your devices into a single flat network is dangerous. There is a reason why networks are designed with isolation s

> Second, and far more important, meshing all your devices into a single flat network is dangerous. There is a reason why networks are designed with isolation strategies. Introducing an overlay into your networks breaks down these barriers for you, but also for an attacker. What prevents you from meshing the individual services on a per-need basis? The fact that they're overlays makes them even more convenient for such isolation. > The only overlay network that has built in firewall capabilities is Nebula. Are those built in firewall capabilities really missing from the other networks? As far as I know, ZeroTier is more of a SDN that an simple overlay (That's what made me interested in ZeroTier in the first place). If conventional "L4 transport-layer" firewall/routing capabilites are enough for real networks, then ZeroTier SDN capabilities are probably enough for it's virtual networks. Granted, it doesn't have some nice built-in high-level generic "L7 application-level" firewall capabilities, but I don't trust those in the first place.