Gregory's Server@mykd @anildash last I checked, by default it connects only the specific devices running the client together such that they appear to be all on the same private network. You can optionally run a client in a mode where it will route out into your LAN to reach hosts not running the software, but that is opt in rather than default.
@mykd @anildash (and if you do it then it's really your OS kernel doing the routing from a tun/tap to your real network interface, so all the usual routing controls and packet filtering applies)