Also check out slack's nebula, easier to understand and configure IMO, and it has ACLs natively