Home / Egress and tunnels
OpenZiti
openziti.io/docs/learn/introduction/Zero trust overlay (private only)egress/openzitiJSONcomparereport an errorprovider JSON
- Free allowance
- 'OpenZiti is a free, open-source zero trust networking platform that makes network services invisible to unauthorized users.' Self-hosted; the software imposes no quota.
- Verdict
- self-hosted, last resortverdict fails-egress: data cannot be read back out at a usable rate or price. Self-hosted options are listed last, because this site is for users who have no hardware.
- Cost
- free tier
- Identity
- anonymousno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- documented1 source; a first-party page was read and the sentence quoted
- Freshness
- stale on 2026-11-23checked 2026-10-23 (live); stale on 2026-11-23
| Free tier | 'OpenZiti is a free, open-source zero trust networking platform that makes network services invisible to unauthorized users.' Self-hosted; the software imposes no quota. unit unlimited; metered on none |
|---|
| Price | USD 0 |
|---|
| Binding | none Nothing counts bytes and every service is reachable only by an enrolled identity, so a public reader cannot start a transfer at all. |
|---|
| Identity | anonymous self-hosted; every endpoint is an identity with a certificate issued by the operator's controller |
|---|
| Egress | Ingress: none free allowance: none published |
|---|
| Interface | cli, rest ziti CLI and SDKs, plus the controller's REST API |
|---|
| Tooling | ziti CLI, controller, routers, tunnelers, SDKs |
|---|
| Composes with | a private fabric under zrok; it composes with a public ingress and adds none |
|---|
| Reliability | the controller is a single point of failure the operator must run |
|---|
| Notes | Recorded separately from zrok, which is OpenZiti's hosted share front end and already has two records. The distinction that matters: zrok's 5 GB/day is NetFoundry's controller policy, while OpenZiti itself has no meter and no public listener. |
|---|
| Evidence note | documented A public-router configuration read would confirm that no unauthenticated listener exists; the introduction page states the model but not the router options. |
|---|
| Parsed numbers | - has-free-tier 1
- price USD 0
|
|---|
Evidence 1
| date | source | what it proved |
|---|
| 2026-10-23 | openziti.io/docs/learn/introduction/ | 'a free, open-source zero trust networking platform that makes network services invisible to unauthorized users'; 'Every identity requires a certificate' |
More fields 5
| wg path | none |
|---|
| wg detail | No WireGuard: 'controllers, routers, tunnelers, and SDKs', with 'Every identity requires a certificate'. No .conf exists. |
|---|
| ingress | none |
|---|
| bytes transit | overlay-only |
|---|
| transit note | routers relay between authenticated identities |
|---|
Unknown values 2
- per object cap stated: the field does not apply to this kind of offer
- retention stated: the field does not apply to this kind of offer