Support OpenZiti, give us a GitHub Star Star

Zero Trust Workload Connectivity

OpenZiti is the open-source Zero Trust networking platform from NetFoundry that makes your services invisible.

OpenZiti
OpenZiti Architecture

One Control Plane, an Encrypted Mesh Data Plane, and Outbound-Only Endpoints

Reachability is the vulnerability: anything an attacker can reach, they can probe, and given time, exploit. OpenZiti removes it.

A controller manages identity, policy, and network state. An encrypted mesh fabric of edge routers carries every session with end-to-end encryption, smart routing, and automatic failover. Clients and services alike dial outbound only, so nothing listens for inbound connections and there is no reachable attack surface.

Controller Identity · Policy · Network State ENCRYPTED MESH FABRIC Edge Routers · smart routing · automatic failover Edge Router Edge Router Device Workload Application Tunneler no code changes Workload embedded SDK OUTBOUND ONLY Workload Application Device Tunneler no code changes Application embedded SDK OUTBOUND ONLY IDENTITY VERIFIED · mTLS ON EVERY LINK · END-TO-END ENCRYPTED · NO INBOUND PORTS

The Controller enforces identity-based policy on every connection, establishing an encrypted path only after both sides mutually authenticate.

Existing applications reach the Fabric through lightweight tunnelers with no code changes, while new applications embed an SDK to connect directly for the strongest Zero Trust model.

The OpenZiti Ecosystem

One Platform, Many Ways to Connect

OpenZiti is a platform, not a single tool. Start with the core, then add the pieces that fit how you build, whether you embed an SDK, drop in a tunneler, or share a service in seconds.

Core Platform

Ziti

The heart of the platform: a controller that manages identity, policy, and network state, edge routers that form the encrypted mesh fabric, and a full command-line interface. Everything else builds on it.

View on GitHub →

Embed

Application SDKs

Build Zero Trust connectivity directly into your application in Go, C, C#/.NET, Python, Node.js, Java/Kotlin, or Swift, so the app dials services by identity and never opens a listening port.

Explore the SDKs →

No Code Change

Tunnelers

Lightweight tunneling clients bring existing applications onto the OpenZiti network with no code changes, across Linux, Windows, macOS, iOS, and Android.

View on GitHub →

Sharing

zrok

A sharing and reverse-proxy platform built on OpenZiti for exposing services, files, and websites securely, whether you self-host it or use the free zrok.io service.

View on GitHub →

Manage

Ziti Console

A visual administration console for operating an OpenZiti network: manage identities, services, and policies, and watch the state of the overlay at a glance.

View on GitHub →

AI Connectivity

AI Gateways

Purpose-built gateways give AI assistants Zero Trust access to MCP tool servers and LLM providers, so agents reach only what they are authorized to reach.

View on GitHub →

Use Cases

Where Teams Put OpenZiti to Work

The same identity-first model solves connectivity problems that conventional networking treats as separate products.

AI Security

Give AI agents and MCP tool servers a cryptographic identity, so they dial out to only the tools and models they are authorized for, with nothing exposed inbound.

API Security

Take private APIs off the public internet. Only authenticated, authorized identities can reach them, and there is no endpoint left for the internet to probe.

VPN Replacement

Give people Zero Trust access to private resources without the flat-network blast radius that turns one stolen VPN credential into a full breach.

Site-to-Site Connectivity

Connect clouds, data centers, and edge sites over an encrypted mesh, with smart routing, automatic failover, and no public inbound anywhere.

OT and IoT Connectivity

Reach industrial and IoT devices without exposing them to the internet, and segment them down to the individual device by identity.

Microsegmentation

Segment by identity-based policy not network architecture, stopping lateral movement and limiting the blast radius.

OpenZiti in Production

Trusted Where Failure Isn’t an Option

OpenZiti is developed in the open, adopted worldwide, and carries 1B+ sessions/month of production traffic across global infrastructures today. The code that moves your data is inspectable, auditable, and free.

8,000+ GitHub stars across the OpenZiti projects
7 Official language SDKs, from Go and C to Python and Swift
Apache 2.0 Free and open source, with no cost to run in production
mTLS Mutual authentication and end-to-end encryption on every connection
Every line of code that carries your traffic is open source and auditable under Apache 2.0, with no black boxes and no vendor lock-in.OpenZiti, created and maintained by NetFoundry
Deployment Options

Start with OpenZiti.
Move to NetFoundry When You Are Ready to Scale.

Take on the operations yourself, or hand them to NetFoundry for a faster, easier path to production at scale. Every tier runs the same open-source OpenZiti software.

Open Source

OpenZiti

Stand up your own controllers and edge routers, issue certificate-based identities to every user, service, and workload, and run services dark with no inbound ports. You own and run the OpenZiti Fabric, free under the Apache 2.0 license.

  • Self-hosted and self-managed, with full control of the fabric
  • Seven language SDKs and multi-OS tunnelers
  • Quickstarts, Docker, and Helm for stand-up and upgrades
  • Community support through Discourse, GitHub, and documentation
Licensed

NetFoundry Self-Hosted

Use NetFoundry’s licensed management suite to run your own OpenZiti fabric. Purpose-built for regulated, air-gapped, and sovereign environments, it lets you control the infrastructure while NetFoundry’s tooling, support, and compliance evidence lighten the operational lift.

  • NetFoundry management suite to accelerate and simplify deployment, orchestration, operation, and scaling
  • 24×7 Enterprise support from the team that builds and maintains OpenZiti
  • FIPS-compliant cryptography and post-quantum-ready encryption
  • Controls pre-mapped to NIST 800-53 and 800-207 to speed RMF work
Licensed

NetFoundry-Hosted

NetFoundry provisions and operates a dedicated OpenZiti fabric for you, in minutes, securing, managing, monitoring, and scaling it on your behalf. You build on the network instead of running it, backed by a contractual uptime SLA of up to 99.95%.

  • Dedicated, global, isolated fabric provisioned in minutes
  • 100+ points of presence across AWS, Azure, Google Cloud, and OCI
  • Managed PKI, upgrades, backups, and proactive monitoring
  • SOC 2 Type II report and pre-mapped evidence to accelerate ATO
  • Up to 99.95% SLA

Want to learn alongside other builders? Join the Community →

FAQ

OpenZiti, Answered

What is OpenZiti?

OpenZiti is an open source Zero Trust networking platform, created and maintained by NetFoundry and licensed under Apache 2.0. It gives every user, device, service, and workload an X.509 certificate identity, then authenticates and authorizes each connection by identity before any network path exists. Services run with no inbound ports, endpoints dial outbound only, and traffic is encrypted end to end.

How does OpenZiti work?

A controller manages identity, policy, and network state. An encrypted mesh fabric of edge routers carries every session with smart routing and automatic failover. Clients and services dial outbound only and are authorized by identity before a path is built, so nothing listens for inbound connections and there is no reachable attack surface.

What is included in the OpenZiti ecosystem?

The core Ziti project provides the controller, edge routers, and command-line interface. Around it sit SDKs for seven languages, multi-OS tunnelers for applications you cannot modify, zrok for secure sharing, the Ziti Console for administration, and gateways that give AI agents Zero Trust access to MCP tool servers and LLM providers.

What can I build with OpenZiti, and is it really free?

OpenZiti is free and open source under the Apache 2.0 license, and you can run it in production at no license cost. Teams use it to secure AI agents and APIs, replace VPNs, connect sites, reach operational technology and IoT devices, and embed Zero Trust connectivity directly into products. You embed a language SDK for new applications, or use a tunneler for applications you cannot change.

Does OpenZiti require opening inbound firewall ports?

No. OpenZiti connections are outbound-only from every endpoint, which means you open no inbound firewall ports, publish no public IP addresses, and run no listening services for attackers to find. Authentication and authorization complete before any routable path is created, and your firewalls can enforce a single deny-all inbound policy.

How does OpenZiti relate to NetFoundry, and when should I move to the commercial platform?

NetFoundry created and maintains OpenZiti, and its commercial platform is built on the same open source code. Run OpenZiti yourself when you want full control and have the team to operate it. Move to NetFoundry Self-Hosted or NetFoundry-Hosted when production demands — scaling, monitoring, incident response, coordinated upgrades, compliance attestation, and a contractual uptime commitment — start to compete with running your business.

Ready to Secure Services, Not IPs?

Stand up the open-source platform today, or let NetFoundry run it for you at production scale.