OpenZiti

openziti.io · Egress and tunnels · 1 record · JSON

OpenZiti Egress and tunnels

fails: egressanonymousno cardD

openziti.io/docs/learn/introduction/ · zero trust overlay (private only) · egress/openziti · JSON · compare

Free tier	'OpenZiti is a free, open-source zero trust networking platform that makes network services invisible to unauthorized users.' Self-hosted; the software imposes no quota. unit unlimited; metered on none
Price	USD 0
Per-object cap	not applicable
Retention	not applicable
Egress	ingress: none free_allowance: none published
Identity	anonymous self-hosted; every endpoint is an identity with a certificate issued by the operator's controller
Binding	none Nothing counts bytes and every service is reachable only by an enrolled identity, so a public reader cannot start a transfer at all.
Interface	cli, rest ziti CLI and SDKs, plus the controller's REST API
Tooling	ziti CLI, controller, routers, tunnelers, SDKs
Composes with	a private fabric under zrok; it composes with a public ingress and adds none
Reliability	the controller is a single point of failure the operator must run
Notes	Recorded separately from zrok, which is OpenZiti's hosted share front end and already has two records. The distinction that matters: zrok's 5 GB/day is NetFoundry's controller policy, while OpenZiti itself has no meter and no public listener.
Evidence rung	documented A public-router configuration read would confirm that no unauthenticated listener exists; the introduction page states the model but not the router options.
Checked	2026-10-23 (live); stale on 2026-11-22
Parsed numbers	`$.price_per_tb_month` price-per-tb USD0.0 TB / month

Evidence (1)

date	source	what it proved
2026-10-23	openziti.io/docs/learn/introduction/	'a free, open-source zero trust networking platform that makes network services invisible to unauthorized users'; 'Every identity requires a certificate'

More fields (7)

{
 "wg_path": "none",
 "wg_detail": "No WireGuard: 'controllers, routers, tunnelers, and SDKs', with 'Every identity requires a certificate'. No .conf exists.",
 "ingress": "none",
 "volume_tib_month": null,
 "volume_stated": null,
 "bytes_transit": "overlay-only",
 "transit_note": "routers relay between authenticated identities"
}

Unknown or withheld values (3)

$.extras.volume_stated withheld
$.per_object_cap.stated not-applicable
$.retention.stated not-applicable