# openziti/ziti

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/openziti-ziti).**

3,883 stars · 236 forks · Go · apache-2.0

## Links

- GitHub: https://github.com/openziti/ziti
- Homepage: https://openziti.io
- awesome-repositories: https://awesome-repositories.com/repository/openziti-ziti.md

## Topics

`appsec` `golang` `mesh` `netsec` `network` `networking` `overlay` `overlay-network` `secure-networking` `vpn` `vpn-2` `zero-trust` `zero-trust-cloud` `zero-trust-network` `zero-trust-network-access` `zero-trust-security` `zerotrust` `ztaa` `ztha` `ztna`

## Description

Ziti is a zero-trust network overlay and identity-based mesh network. It provides a software-defined perimeter that replaces traditional IP-based routing and VPNs by mapping network services to cryptographically verified identities, effectively cloaking applications from the public internet.

The project distinguishes itself through an outbound-only connection model that eliminates open listening ports and a Zero Trust SDK that allows developers to embed encryption and identity-based access control directly into application source code. It also provides transparent tunneling proxies to extend these security principles to legacy applications without requiring code changes.

The platform covers a broad range of networking and security capabilities, including multi-cloud workload connectivity, network microsegmentation, and private service discovery. It manages traffic through a distributed fabric of routers using dynamic routing based on real-time latency and throughput, all governed by centralized policy orchestration and mutual TLS authentication.

The system supports deployment across various operating systems and cloud providers to establish its distributed architecture.

## Tags

### Security & Cryptography

- [Cryptographic Identity Networks](https://awesome-repositories.com/f/security-cryptography/identity-verification-modules/cryptographic-identity-verification/cryptographic-identity-networks.md) — Provides an identity-based mesh where cryptographic identities replace IP addresses for routing and isolation.
- [Zero Trust Networking](https://awesome-repositories.com/f/security-cryptography/zero-trust-networking.md) — Provides a complete zero-trust networking framework that enforces identity-based access for all network communication.
- [Distributed Policy Management](https://awesome-repositories.com/f/security-cryptography/access-control-centralization/distributed-policy-management.md) — Implements centralized orchestration of network-wide authorization rules and identity certificates.
- [Embedded Networking SDKs](https://awesome-repositories.com/f/security-cryptography/embedded-networking-sdks.md) — Provides a Zero Trust SDK to embed networking and process-to-process encryption directly into application code.
- [Identity-Embedded Protocols](https://awesome-repositories.com/f/security-cryptography/end-to-end-encryption-protocols/identity-embedded-protocols.md) — Embeds cryptographic identities directly into application code to achieve process-to-process end-to-end encryption. ([source](https://openziti.io/docs/openziti))
- [Process-Level Encryption](https://awesome-repositories.com/f/security-cryptography/firewall-management/application-level-access-controls/process-level-encryption.md) — Provides an SDK-based approach for encrypted traffic and identity integration without requiring host-level agents. ([source](https://cdn.jsdelivr.net/gh/openziti/ziti@main/README.md))
- [Mutual TLS Authentication](https://awesome-repositories.com/f/security-cryptography/identity-access-management/authentication-strategies/machine-and-protocol-identity/specialized-authentication-protocols/mutual-tls-authentication.md) — Requires every network endpoint to prove its identity using mutual TLS authentication before data exchange.
- [Identity-Based Authentication](https://awesome-repositories.com/f/security-cryptography/identity-authentication/identity-based-authentication.md) — Coordinates authentication and authorization to ensure every endpoint connection is mutually authenticated. ([source](https://openziti.io/docs/openziti/latest/intro))
- [Identity-Based Access Control](https://awesome-repositories.com/f/security-cryptography/identity-based-access-control.md) — Restricts network access to individual applications using cryptographic certificates and identity-based policies. ([source](https://openziti.io/docs/openziti/latest/intro))
- [Cryptographic Identity Verification](https://awesome-repositories.com/f/security-cryptography/identity-verification-modules/cryptographic-identity-verification.md) — Issues unique cryptographic certificates to users and devices to ensure strong network authentication. ([source](https://cdn.jsdelivr.net/gh/openziti/ziti@main/README.md))
- [Network Microsegmentation](https://awesome-repositories.com/f/security-cryptography/network-microsegmentation.md) — Restricts access to specific applications using granular identity-based policies to prevent lateral movement.
- [End-to-End Encryption](https://awesome-repositories.com/f/security-cryptography/privacy-data-protection/data-encryption/end-to-end-encryption.md) — Applies strong cryptography to all communications to ensure data remains secure from end to end. ([source](https://openziti.io/docs/openziti))
- [Embedded Secure Connectivity](https://awesome-repositories.com/f/security-cryptography/secure-network-connectivity-modules/embedded-secure-connectivity.md) — Integrates networking and encryption directly into application code via SDKs for end-to-end secure communication.
- [Service Cloaking](https://awesome-repositories.com/f/security-cryptography/service-cloaking.md) — Removes listening ports and public URLs by requiring authenticated clients to connect through a secure overlay. ([source](https://cdn.jsdelivr.net/gh/openziti/ziti@main/README.md))
- [Software-Defined Perimeters](https://awesome-repositories.com/f/security-cryptography/software-defined-perimeters.md) — Employs a software-defined perimeter to make network services invisible to unauthorized users and scanners.
- [Zero Trust Access](https://awesome-repositories.com/f/security-cryptography/zero-trust-access.md) — Connects users and devices to applications using cryptographic identities instead of traditional VPNs.
- [Developer SDKs](https://awesome-repositories.com/f/security-cryptography/zero-trust-networking/developer-sdks.md) — Ships a Zero Trust SDK for embedding encryption and identity-based access control directly into application code.
- [Service Cloaking](https://awesome-repositories.com/f/security-cryptography/zero-trust-networking/service-cloaking.md) — Removes open listening ports and public URLs to make services invisible to unauthorized users and internet scanners. ([source](https://openziti.io/docs/openziti/learn/quickstarts/))
- [Zone Access Management](https://awesome-repositories.com/f/security-cryptography/network-infrastructure-security/web-network-security/network-security/network-zone-segregation/zone-access-management.md) — Secures access to applications within trusted network spaces using routers for devices that lack native tunneling capabilities. ([source](https://openziti.io/docs/openziti))

### DevOps & Infrastructure

- [Outbound Connectivity Agents](https://awesome-repositories.com/f/devops-infrastructure/outbound-connectivity-agents.md) — Eliminates open listening ports by requiring services to initiate outbound connections to the controller.

### Networking & Communication

- [Mesh Networking](https://awesome-repositories.com/f/networking-communication/mesh-networking.md) — Establishes a distributed mesh network of controllers and routers for identity-based service connectivity. ([source](https://openziti.io/docs/openziti/maint/learn/introduction/))
- [Mesh Traffic Optimization](https://awesome-repositories.com/f/networking-communication/network-traffic-routing/latency-based-path-selection/mesh-traffic-optimization.md) — Relays encrypted traffic through a distributed router fabric using real-time latency and throughput optimization.
- [Identity-Based Tunnels](https://awesome-repositories.com/f/networking-communication/vpn-controllers/identity-based-tunnels.md) — Creates secure network tunnels bound to verified identities instead of IP addresses. ([source](https://blog.openziti.io/))
- [Identity-Based Mesh Fabrics](https://awesome-repositories.com/f/networking-communication/vpn-controllers/identity-based-tunnels/identity-based-mesh-fabrics.md) — Implements a distributed fabric of controllers and routers for identity-based encrypted traffic routing.
- [Legacy Application Tunneling](https://awesome-repositories.com/f/networking-communication/cloud-application-connectivity/legacy-application-tunneling.md) — Provides secure connectivity to legacy applications via lightweight tunnelers without modifying the original code. ([source](https://openziti.io/docs/openziti/maint/learn/introduction/))
- [Multi-Cloud Overlays](https://awesome-repositories.com/f/networking-communication/cloud-application-connectivity/multi-cloud-overlays.md) — Creates a single overlay network across multiple cloud providers and on-premise data centers without using VPN tunnels. ([source](https://cdn.jsdelivr.net/gh/openziti/ziti@main/README.md))
- [Intelligent Routing Engines](https://awesome-repositories.com/f/networking-communication/intelligent-routing-engines.md) — Implements an intelligent routing engine to balance security requirements with network performance across a secure overlay fabric. ([source](https://openziti.io/docs/openziti))
- [Centralized Management Interfaces](https://awesome-repositories.com/f/networking-communication/load-balancers/centralized-management-interfaces.md) — Ships a centralized graphical dashboard and API for controlling and monitoring the network overlay. ([source](https://openziti.io/docs/openziti/learn/quickstarts/))
- [Traffic Optimization](https://awesome-repositories.com/f/networking-communication/network-infrastructure-routing/network-routing-traffic-management/edge-routers/traffic-optimization.md) — Directs encrypted traffic through a mesh of routers to optimize paths based on real-time latency, throughput, and cost. ([source](https://cdn.jsdelivr.net/gh/openziti/ziti@main/README.md))
- [Multipath Latency Routing](https://awesome-repositories.com/f/networking-communication/network-infrastructure-routing/network-routing-traffic-management/network-traffic-management/multipath-latency-routing.md) — Uses a mesh fabric that monitors real-time latency across multiple peer links to select the fastest path and provide automatic failover. ([source](https://openziti.io/docs/openziti/intro))
- [Overlay Networks](https://awesome-repositories.com/f/networking-communication/overlay-networks.md) — Links diverse workloads across multiple cloud providers and on-premise data centers into a unified private network.
- [Private DNS Resolution](https://awesome-repositories.com/f/networking-communication/private-networks/private-dns-resolution.md) — Maps service names to secure overlay tunnels using authenticated private DNS resolution. ([source](https://openziti.io/docs/openziti))
- [Transparent Host Security](https://awesome-repositories.com/f/networking-communication/secure-communication-channels/transparent-host-security.md) — Extends zero trust principles to existing hosts and applications using a tunneler-based approach without code changes. ([source](https://openziti.io/docs/openziti))
- [Private](https://awesome-repositories.com/f/networking-communication/service-discovery/private.md) — Maps service names to secure tunnels using private DNS to hide applications from the public internet.
- [Transparent Network Proxies](https://awesome-repositories.com/f/networking-communication/transparent-network-proxies.md) — Implements transparent network proxies that intercept and route traffic for unmodified software. ([source](https://cdn.jsdelivr.net/gh/openziti/ziti@main/README.md))
- [Tunneling Proxies](https://awesome-repositories.com/f/networking-communication/tunneling-proxies.md) — Ships transparent tunneling proxies to provide secure connectivity to legacy applications without code changes.

### System Administration & Monitoring

- [Access Control Policies](https://awesome-repositories.com/f/system-administration-monitoring/access-control-policies.md) — Defines granular permissions and policies to restrict which identities can access specific network paths. ([source](https://cdn.jsdelivr.net/gh/openziti/ziti@main/README.md))
- [Network Administration Consoles](https://awesome-repositories.com/f/system-administration-monitoring/network-administration-consoles.md) — Provides a dedicated management interface for administering network identities and connectivity policies. ([source](https://openziti.io/docs/openziti/category/deployments/))

### Part of an Awesome List

- [VPN Alternatives](https://awesome-repositories.com/f/awesome-lists/security/vpn-and-networking/vpn-alternatives.md) — Provides a connectivity solution that eliminates open listening ports by routing traffic through an authenticated overlay.
- [Networking & Connectivity](https://awesome-repositories.com/f/awesome-lists/devops/networking-connectivity.md) — Zero-trust, programmable network overlay.
- [Overlay Networks](https://awesome-repositories.com/f/awesome-lists/devops/overlay-networks.md) — Zero trust overlay network for application-level security.
- [Security And Privacy](https://awesome-repositories.com/f/awesome-lists/security/security-and-privacy.md) — Zero-trust, full-mesh overlay network for secure access.
- [Security & Privacy](https://awesome-repositories.com/f/awesome-lists/security/security-privacy.md) — Zero-trust, full-mesh overlay network for secure connectivity.