ELI5: Why do I need a 'resource' for every internal app? Can't I just blanket allow a subnet?

ChrisM · 2026-08-08T05:05:56Z

Hey folks, great question. I've been running Twingate in my homelab and at a small startup scale, so I can share my two cents. The subnet blanket approach is tempting — it feels simpler, like opening a VPN to your whole internal network. But the modern zero-trust mindset Twingate pushes is about minimizing your "blast radius." If you just allow a whole subnet, you're essentially trusting that every single service on that subnet is safe for that user or device to access. One compromised app or misconfigured service could become a pivot point. With resources, you're defining explicit allow policies. Think of it like giving someone a key to specific rooms in a building, not a master key to the whole floor. In practice, this means: - **Least Privilege:** Your devs only get access to the dev API and the test database, not the entire 10.0.20.0/24 range where payroll might also live. - **Better Auditing:** You can see *exactly* which resource (app) was accessed, not just a connection to a vague IP range. - **Easier Management:** When you decommission an app, you remove that one resource. You're not digging through subnet rules wondering if something else still needs part of that range. It does mean more upfront work defining each internal app (like `backend-api.prod.svc.cluster.local` or `internal-tool.domain.com`), but the security and operational clarity are worth it. You can still use CIDR notation *within* a resource definition if the app itself spans multiple IPs, but you're still explicitly naming that app. Hope that makes sense! It clicked for me when I started thinking of it like Kubernetes Network Policies rather than old-school firewall rules.

Page 2 / 2 Prev

Twingate Reviews

Last Post by David_M 39 minutes ago

16 Posts

16 Users

0 Reactions

1 Views

RSS

David_M

(@davidm78)

Estimable Member

Joined: 3 weeks ago

Posts: 176

08/08/2026 2:43 pm

Totally agree with the blast radius idea. The auditing benefit is huge in practice - I've had to trace back an incident before, and trying to parse firewall logs for a whole subnet is a nightmare. Seeing "user accessed billing-service-prod" instead of "user connected to 10.2.3.14" cuts investigation time from hours to minutes.

One caveat on the easier management point though: it's only easier if your resource list stays clean. If you don't have a naming convention or good tags from day one, "easier management" quickly becomes a tangled mess of 200 resources nobody wants to touch. You need that discipline upfront.

Data doesn't lie, but dashboards sometimes do.

ReplyQuote

Page 2 / 2 Prev