Give a vendor access to one internal application

The problem

Vendors may need an ERP panel, remote desktop, SSH service, or database. Adding them to a broad VPN can expose adjacent systems and complicate offboarding.

Choose and scope the connection model

Create individual vendor identities and a dedicated group. The full client provides direct private access, while the restricted group-publisher policy defines the network boundary.

1. 1Deploy a publisher that can reach the internal application and expose its containing CIDR.
2. 2Create individual vendor users and a dedicated group linked to that publisher with restricted access.
3. 3Add an effective AccessRule for the application's /32 and TCP port.
4. 4Have the vendor run wireztna connect and open the private hostname with an individual application account.

When this pattern fits

• A vendor needs recurring access to one HTTPS, RDP, SSH, or database service.
• The vendor device can run the full client and use the real private hostname.
• A dedicated group and explicit restricted rules can be maintained.
• The application provides individual accounts and auditable authorization.

Security boundary and limitations

• A dedicated group or published app entry alone does not enforce host-and-port access. Verify the restricted policy and effective AccessRule.
• The application still needs individual accounts, MFA where appropriate, role-based permissions, and user-level audit logs.
• Use wzctl instead when the vendor should receive one local TCP endpoint without private DNS or routes.