openziti/zrok
Zrok
zrok is a zero trust networking service that provides a secure overlay mesh to expose local services and files through firewalls and NAT without the need for manual port forwarding. It functions as a zero trust network manager, orchestrating identities, policies, and routers to establish secure connectivity between applications and users.
The project distinguishes itself through the use of identity-based routing and hardened HTTP frontends that integrate with external identity providers. These capabilities allow for the creation of identity-aware proxies and secure reverse proxies that authenticate users before granting access to internal web applications.
The platform's broader capabilities include peer-to-peer resource sharing for TCP and UDP services, network drive sharing, and identity-aware micro-segmentation for IT and operational technology networks. It also provides a programmatic interface via a secure sharing SDK to embed these tunneling capabilities directly into external applications.
The infrastructure can be deployed as a self-hosted controller and private network stack across Linux, Docker, or Kubernetes environments.
Features
- Mesh Networking - Creates a secure overlay mesh network to connect peers without requiring firewall port forwarding.
- Zero Trust Networking - Provides a secure overlay mesh for identity-based network communication that bypasses firewalls and NAT.
- Infrastructure Orchestration - Provides a centralized platform for orchestrating identities, policies, and routers across the network.
- Reverse Proxies with Integrated Security - Implements a hardened reverse proxy that enforces identity-based authentication before routing traffic to internal services.
- Local Resource Exposure - Exposes local web applications to the public internet via secure encrypted tunnels without manual port forwarding.
- Peer-to-Peer Tunneling - Establishes secure peer-to-peer connections for services and files without opening firewall ports.
- Secure Local Service Exposure - Exposes local web applications or files to the internet through firewalls and NAT without manual port forwarding.
- Centralized Security Agents - Uses a centralized management plane to push security policies to distributed agents that enforce connectivity.
- Encrypted Tunneling - Encapsulates data within secure tunnels to bypass NAT and firewalls with end-to-end encryption.
- Identity-Aware Proxies - Provides a gateway that verifies user identity through external providers to secure internal web applications.
- Cryptographic Identity Networks - Directs network traffic based on cryptographically verified user identities instead of IP addresses.
- Identity-Aware Web Gateways - Provides a secure entry point for web services that authenticates users via an external identity provider.
- Orchestration Consoles - Provides a centralized console for orchestrating zero-trust identities, policies, and network routers.
- Private Infrastructure Hosting - Supports deploying and managing a complete zero-trust networking stack on self-hosted or air-gapped hardware.
- Self-Hosted Deployments - Provides automated installation for the controller, frontend, and data stores on private Linux servers.
- Zero Trust Infrastructure Deployment - Supports installation and management of zero-trust infrastructure across Linux, Docker, and Kubernetes.
- Network Drive Sharing - Turns local folders into shareable network drives accessible to remote users.
- Network Stacks - Enables the deployment of a complete zero-trust networking stack within on-premises or air-gapped environments.
- Network Tunneling Tools - Provides a utility for creating secure tunnels to expose local services to remote clients.
- Secure Tunneling SDKs - Provides a secure sharing SDK for embedding tunneling capabilities directly into external applications.
- External Identity Provider Integration - Requires users to verify their identity via external providers before accessing services through HTTP frontends.
- External Resource Sharing - Provides secure connection methods for TCP and UDP services between specific users without public exposure.
- Identity Provider Integrations - Hardens service entry points by delegating user verification to external identity providers.
- Authenticated HTTP Gateways - Implements secure gateways that authenticate users via identity providers for browser-based access to HTTP services.
- Micro-Segmentation Techniques - Enforces identity-aware security policies and observes traffic flows across IT and OT networks.
- OT - Deploys firewall agents in operational technology environments to enforce identity-based security policies.
- Embedded Zero Trust SDKs - Provides a secure sharing SDK to embed zero-trust tunneling capabilities directly into external applications.
- Tunneling and Proxying - Effortless sharing for both public and private endpoints.
