# Support **URL:** https://openziti.discourse.group/c/support/6.md [Latest](https://openziti.discourse.group/latest.md) · [Categories](https://openziti.discourse.group/categories.md) --- ## [About the Support category](https://openziti.discourse.group/t/about-the-support-category/37)
**Author:** [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Replies:** 0\ **Last updated:** [December 19, 2019, 2:03pm UTC](https://openziti.discourse.group/t/about-the-support-category/37 "2019-12-19T14:03:17Z")
This category is "catch all" bucket. If there is no better category for your question, this is it! This category is for general questions about OpenZiti. --- ## [Named public shares fail to recover after zrok2 agent restart (409 shareConflict)](https://openziti.discourse.group/t/named-public-shares-fail-to-recover-after-zrok2-agent-restart-409-shareconflict/6202)
**Author:** [@omarojocs](https://openziti.discourse.group/u/omarojocs)\ **Replies:** 8\ **Last updated:** [October 31, 2026, 3:35am UTC](https://openziti.discourse.group/t/named-public-shares-fail-to-recover-after-zrok2-agent-restart-409-shareconflict/6202 "2026-10-31T03:35:11Z")
Hi zrok team, I’m reporting a recurring problem with named public shares after restarting the zrok2 agent. The agent starts, but a public share can remain in retrying because the previous share still holds its reserved … --- ## [Looking to implement OpenZiti to 20k IoT devices, seeking help](https://openziti.discourse.group/t/looking-to-implement-openziti-to-20k-iot-devices-seeking-help/6176)
**Author:** [@MacFee](https://openziti.discourse.group/u/MacFee)\ **Replies:** 3\ **Last updated:** [October 27, 2026, 9:29pm UTC](https://openziti.discourse.group/t/looking-to-implement-openziti-to-20k-iot-devices-seeking-help/6176 "2026-10-27T21:29:08Z")
I have a design and looking at 2 technologies (OpenZiti and Nebula) to see if this would work for connecting 20k IoT devices. Currently we use OpenVPN which works great but the setup is ok and not perfect. It gets the jo… --- ## [Best way to go 1.5.4 → 1.6.21 and move tunnelers without endpoints dropping](https://openziti.discourse.group/t/best-way-to-go-1-5-4-1-6-21-and-move-tunnelers-without-endpoints-dropping/6173)
**Author:** [@janst](https://openziti.discourse.group/u/janst)\ **Replies:** 3\ **Last updated:** [October 22, 2026, 7:08pm UTC](https://openziti.discourse.group/t/best-way-to-go-1-5-4-1-6-21-and-move-tunnelers-without-endpoints-dropping/6173 "2026-10-22T19:08:07Z")
Hi all, Thanks for all the work on OpenZiti — it's been great to run. I've got an upgrade coming up and I'd really value a second opinion before I touch production, because I'm worried about endpoints dropping offline p… --- ## [Zrok console returns 403 from Morocco — regional restriction?](https://openziti.discourse.group/t/zrok-console-returns-403-from-morocco-regional-restriction/6193)
**Author:** [@k34n4y138](https://openziti.discourse.group/u/k34n4y138)\ **Replies:** 1\ **Last updated:** [October 22, 2026, 6:41pm UTC](https://openziti.discourse.group/t/zrok-console-returns-403-from-morocco-regional-restriction/6193 "2026-10-22T18:41:35Z")
Hi team, is access to the hosted zrok console intentionally restricted from Morocco? On 20 October 2026, https://api-v2.zrok.io/ returned HTTP 403 (Server: awselb/2.0) from my connection and two independent Globalping p… --- ## [How to delete api-v2 account](https://openziti.discourse.group/t/how-to-delete-api-v2-account/6201)
**Author:** [@jimmyking](https://openziti.discourse.group/u/jimmyking)\ **Replies:** 0\ **Last updated:** [October 21, 2026, 9:08pm UTC](https://openziti.discourse.group/t/how-to-delete-api-v2-account/6201 "2026-10-21T21:08:28Z")
I've already deleted my zork.io account, but the api-v2 account didn't get deleted, so I'd like to delete that account --- ## [Zrok2 403 forbidden error when trying to enable an account Token on and when trying to access the Api Console](https://openziti.discourse.group/t/zrok2-403-forbidden-error-when-trying-to-enable-an-account-token-on-and-when-trying-to-access-the-api-console/6177)
**Author:** [@CodingHuman73](https://openziti.discourse.group/u/CodingHuman73)\ **Replies:** 2\ **Last updated:** [October 13, 2026, 5:09pm UTC](https://openziti.discourse.group/t/zrok2-403-forbidden-error-when-trying-to-enable-an-account-token-on-and-when-trying-to-access-the-api-console/6177 "2026-10-13T17:09:31Z")
Hi, am experiencing a issue when trying to access the https://api-v2.zrok.io/ on my mac, i just get the following page : I tried clearing out cookies, but to no avail. However, i'm able to access it on my Windows dev… --- ## [MFA posture check keeps failing after successful MFA enrollment/auth ("an MFA enrollment already exists") - Windows Desktop Edge, Controller 2.0.6 (also 1.6.21)](https://openziti.discourse.group/t/mfa-posture-check-keeps-failing-after-successful-mfa-enrollment-auth-an-mfa-enrollment-already-exists-windows-desktop-edge-controller-2-0-6-also-1-6-21/6171)
**Author:** [@tekook](https://openziti.discourse.group/u/tekook)\ **Replies:** 1\ **Last updated:** [October 7, 2026, 7:02pm UTC](https://openziti.discourse.group/t/mfa-posture-check-keeps-failing-after-successful-mfa-enrollment-auth-an-mfa-enrollment-already-exists-windows-desktop-edge-controller-2-0-6-also-1-6-21/6171 "2026-10-07T19:02:22Z")
Hi everyone, currently trying to role out MFA on one of my bigger networks, failed miserable and tried it now on my small home network first. I can't get an MFA posture check to pass. MFA enrollment works and the contr… --- ## [Looking for the ziti debian package maintainers](https://openziti.discourse.group/t/looking-for-the-ziti-debian-package-maintainers/6068)
**Author:** [@SometimesButNotOften](https://openziti.discourse.group/u/SometimesButNotOften)\ **Replies:** 2\ **Last updated:** [September 16, 2026, 6:19pm UTC](https://openziti.discourse.group/t/looking-for-the-ziti-debian-package-maintainers/6068 "2026-09-16T18:19:56Z")
Greetings, I was wondering who handles the OS packages? I've run into a problem with the openziti-controller debian/ubuntu package. The post-install script is blocking when installing the package non-interactively. I… --- ## [Hosted zrok2 environment stuck – enable and release both return 500](https://openziti.discourse.group/t/hosted-zrok2-environment-stuck-enable-and-release-both-return-500/6027)
**Author:** [@biharkadeepak](https://openziti.discourse.group/u/biharkadeepak)\ **Replies:** 0\ **Last updated:** [August 28, 2026, 8:07am UTC](https://openziti.discourse.group/t/hosted-zrok2-environment-stuck-enable-and-release-both-return-500/6027 "2026-08-28T08:07:42Z")
I am using zrok2 v2.0.4 on Windows 11 with: Local zrok2 status reports that no local environment exists. However, the API console contains a stale environment: Description: MSI\\Deepak@MSI Created: July 14, 2026 Ru… --- ## [Existing Session Remains Valid After Account Is Deactivated in External IdP](https://openziti.discourse.group/t/existing-session-remains-valid-after-account-is-deactivated-in-external-idp/5999)
**Author:** [@tomc](https://openziti.discourse.group/u/tomc)\ **Replies:** 5\ **Last updated:** [August 26, 2026, 7:40pm UTC](https://openziti.discourse.group/t/existing-session-remains-valid-after-account-is-deactivated-in-external-idp/5999 "2026-08-26T19:40:18Z")
I’m testing OpenZiti 2.0.1 with Authentik as the external OIDC identity provider. I authenticated successfully through Authentik and established an OpenZiti session. I then deactivated the corresponding user account in … --- ## [Ziti 2.0.2 Availability in Stable Repositories](https://openziti.discourse.group/t/ziti-2-0-2-availability-in-stable-repositories/6001)
**Author:** [@tomc](https://openziti.discourse.group/u/tomc)\ **Replies:** 1\ **Last updated:** [August 11, 2026, 4:20am UTC](https://openziti.discourse.group/t/ziti-2-0-2-availability-in-stable-repositories/6001 "2026-08-11T04:20:17Z")
I noticed that Ziti 2.0.1 is affected by the security issues addressed in Ziti 2.0.2, so upgrading to 2.0.2 appears advisable. However, it looks like 2.0.1 is still the version available from the OpenZiti stable package… --- ## [How Can I View Active Ziti Sessions?](https://openziti.discourse.group/t/how-can-i-view-active-ziti-sessions/5990)
**Author:** [@tomc](https://openziti.discourse.group/u/tomc)\ **Replies:** 4\ **Last updated:** [August 10, 2026, 9:15pm UTC](https://openziti.discourse.group/t/how-can-i-view-active-ziti-sessions/5990 "2026-08-10T21:15:31Z")
Hello, friends! For ziti 2.0.1, I’m having trouble viewing active sessions. Both the Ziti CLI and ZAC return an empty session list, even though ZDEW and ZET appear to be logged in, as indicated by the green status dots … --- ## [Correlating OpenZiti Access with Load Balancer/WAF Logs](https://openziti.discourse.group/t/correlating-openziti-access-with-load-balancer-waf-logs/5984)
**Author:** [@tomc](https://openziti.discourse.group/u/tomc)\ **Replies:** 6\ **Last updated:** [August 6, 2026, 4:27pm UTC](https://openziti.discourse.group/t/correlating-openziti-access-with-load-balancer-waf-logs/5984 "2026-08-06T16:27:01Z")
I have an application architecture consisting of: OpenZiti router → load balancer/WAF → web application The load balancer, WAF, and application typically record the Ziti router’s IP address rather than the identity or … --- ## [Giant Logs from Ziti](https://openziti.discourse.group/t/giant-logs-from-ziti/5973)
**Author:** [@actieve](https://openziti.discourse.group/u/actieve)\ **Replies:** 8\ **Last updated:** [July 31, 2026, 12:54pm UTC](https://openziti.discourse.group/t/giant-logs-from-ziti/5973 "2026-07-31T12:54:48Z")
I have had this happen before where Ziti will fill my HDD with log files, I caught this one at 7GB. Any idea what causes this, here is the end of the file. um\[2026-07-29T00:33:21.726Z\] INFO ziti-sdk:ziti.c:2192 ve… --- ## [How to properly setup ZAC and management API](https://openziti.discourse.group/t/how-to-properly-setup-zac-and-management-api/5665)
**Author:** [@martoAs](https://openziti.discourse.group/u/martoAs)\ **Replies:** 10\ **Last updated:** [July 28, 2026, 7:48pm UTC](https://openziti.discourse.group/t/how-to-properly-setup-zac-and-management-api/5665 "2026-07-28T19:48:58Z")
Hello again! I’ve playing with Ziti for a few weeks now and I’ve come to realize that I’ve never changed the default configuration of the ZAC and the management API. That means that the config.yml of the controller rema… --- ## [Ziti edge login fails in 2.0.0 when edge-oidc and edge-management are on separate listeners](https://openziti.discourse.group/t/ziti-edge-login-fails-in-2-0-0-when-edge-oidc-and-edge-management-are-on-separate-listeners/5969)
**Author:** [@jnsfndr](https://openziti.discourse.group/u/jnsfndr)\ **Replies:** 1\ **Last updated:** [July 28, 2026, 12:31pm UTC](https://openziti.discourse.group/t/ziti-edge-login-fails-in-2-0-0-when-edge-oidc-and-edge-management-are-on-separate-listeners/5969 "2026-07-28T12:31:56Z")
We upgraded a controller from 1.6.17 to 2.0.0 and ziti edge login stopped working. Both CLI and controller are v2.0.0. Also tested it with a fresh install. The default config is everything one listener. We split ours i… --- ## [How to setup OpenZiti and Wireguard/OpenVPN protocol together?](https://openziti.discourse.group/t/how-to-setup-openziti-and-wireguard-openvpn-protocol-together/5964)
**Author:** [@MacFee](https://openziti.discourse.group/u/MacFee)\ **Replies:** 3\ **Last updated:** [July 24, 2026, 11:50am UTC](https://openziti.discourse.group/t/how-to-setup-openziti-and-wireguard-openvpn-protocol-together/5964 "2026-07-24T11:50:06Z")
Currently we use OpenVPN/Wireguard Full Tunnel encryption behind a DNS server for connecting to our clients devices. (We have over 6000+.) We have OpenZiti used within our company connecting to our internal services whic… --- ## [Ziti Controller Update to 2+ Breaks Service](https://openziti.discourse.group/t/ziti-controller-update-to-2-breaks-service/5937)
**Author:** [@bvh](https://openziti.discourse.group/u/bvh)\ **Replies:** 13\ **Last updated:** [July 24, 2026, 11:45am UTC](https://openziti.discourse.group/t/ziti-controller-update-to-2-breaks-service/5937 "2026-07-24T11:45:55Z")
Hi all. I finally had the time and decided to start updating my Ziti stack. I started with the controller, under the assumption that the controller would maintain compatibility to outdated ziti routers while ziti routers… --- ## [Linux Local Docker Compose Quick Start Service - Client Tunnel Connection Issues/Confusion](https://openziti.discourse.group/t/linux-local-docker-compose-quick-start-service-client-tunnel-connection-issues-confusion/5961)
**Author:** [@joey](https://openziti.discourse.group/u/joey)\ **Replies:** 1\ **Last updated:** [July 22, 2026, 6:55pm UTC](https://openziti.discourse.group/t/linux-local-docker-compose-quick-start-service-client-tunnel-connection-issues-confusion/5961 "2026-07-22T18:55:14Z")
Hi, I'll preface this by saying I'm new to self-hosting/docker/openziti so I feel like I'm probably missing something obvious. My initial goal is to setup a main self-hosted server with all/most of the services I need i… --- ## [Benchmarks for OpenZiti compared to other competitors](https://openziti.discourse.group/t/benchmarks-for-openziti-compared-to-other-competitors/5926)
**Author:** [@MacFee](https://openziti.discourse.group/u/MacFee)\ **Replies:** 2\ **Last updated:** [July 3, 2026, 3:58am UTC](https://openziti.discourse.group/t/benchmarks-for-openziti-compared-to-other-competitors/5926 "2026-07-03T03:58:25Z")
With OpenZiti being our primary VPN in our company, developers love using it and Director also never knew this existed as an open source tool and loves it. Again, I appreciate the team open sourcing this awesome project. … --- ## [System down due to Unknown Expired Cert Issue](https://openziti.discourse.group/t/system-down-due-to-unknown-expired-cert-issue/5925)
**Author:** [@greggw01](https://openziti.discourse.group/u/greggw01)\ **Replies:** 3\ **Last updated:** [June 30, 2026, 9:55pm UTC](https://openziti.discourse.group/t/system-down-due-to-unknown-expired-cert-issue/5925 "2026-06-30T21:55:16Z")
Greetings, I am running version 1.6.15, and I restarted my controller this morning, and things went badly. None of my routers can connect to the controller, as they show this message: Jun 30 18:04:55 storziti01.ops.gq… --- ## [Entra auto entroll with JoinByURL](https://openziti.discourse.group/t/entra-auto-entroll-with-joinbyurl/5918)
**Author:** [@jcarpenter-uam](https://openziti.discourse.group/u/jcarpenter-uam)\ **Replies:** 13\ **Last updated:** [June 30, 2026, 6:34pm UTC](https://openziti.discourse.group/t/entra-auto-entroll-with-joinbyurl/5918 "2026-06-30T18:34:54Z")
I am trying to setup entraID with auto entroll, using JoinByURL. I followed these docs here to configure the entra app, and these CLI command to create the JWT signer and Auth policy: ziti edge create ext-jwt-signer ent… --- ## [Should routable IPs be included in Ziti controller certificates?](https://openziti.discourse.group/t/should-routable-ips-be-included-in-ziti-controller-certificates/5908)
**Author:** [@jnsfndr](https://openziti.discourse.group/u/jnsfndr)\ **Replies:** 1\ **Last updated:** [June 22, 2026, 8:01pm UTC](https://openziti.discourse.group/t/should-routable-ips-be-included-in-ziti-controller-certificates/5908 "2026-06-22T20:01:07Z")
I'm setting up a 3-node HA controller cluster and I'm following the PKI example from the docs, where each controller's server cert is created like this: ziti pki create server --pki-root ./pki --ca-name ctrl1 \\ --dns … --- ## [Question using SSH in OpenZiti](https://openziti.discourse.group/t/question-using-ssh-in-openziti/5893)
**Author:** [@MacFee](https://openziti.discourse.group/u/MacFee)\ **Replies:** 1\ **Last updated:** [June 12, 2026, 8:11pm UTC](https://openziti.discourse.group/t/question-using-ssh-in-openziti/5893 "2026-06-12T20:11:23Z")
When adding ssh into OpenZiti, I am confused on ways to ssh into our servers. Here are some that I have read: Utilize zssh when accessing servers. I read this blog post here: https://blog.openziti.io/zitifying-ssh Util… --- ## [Bug report: Cluster has no leader during express install](https://openziti.discourse.group/t/bug-report-cluster-has-no-leader-during-express-install/5885)
**Author:** [@Henna](https://openziti.discourse.group/u/Henna)\ **Replies:** 1\ **Last updated:** [June 9, 2026, 4:01pm UTC](https://openziti.discourse.group/t/bug-report-cluster-has-no-leader-during-express-install/5885 "2026-06-09T16:01:11Z")
Hello, I'd like to report a bug. Ever since Openziti was upgraded to 2.0, our team has been having trouble with running the function expressInstall from the bash script found in https://get.openziti.io/ziti-cli-function… --- ## [I locked myself out of my controller when enforcing MFA](https://openziti.discourse.group/t/i-locked-myself-out-of-my-controller-when-enforcing-mfa/5859)
**Author:** [@MacFee](https://openziti.discourse.group/u/MacFee)\ **Replies:** 1\ **Last updated:** [May 31, 2026, 7:42am UTC](https://openziti.discourse.group/t/i-locked-myself-out-of-my-controller-when-enforcing-mfa/5859 "2026-05-31T07:42:39Z")
I began looking into enabling MFA for developers. I first began with the following commands: # Setup posture check of MFA ziti edge create posture-check mfa global-mfa-check \\ -a "mfa-required" \\ -w -u \\ -s 28800 … --- ## [OpenZiti ZTNA issue when communicating from 1 VPC CIDR to another in AWS](https://openziti.discourse.group/t/openziti-ztna-issue-when-communicating-from-1-vpc-cidr-to-another-in-aws/5846)
**Author:** [@MacFee](https://openziti.discourse.group/u/MacFee)\ **Replies:** 4\ **Last updated:** [May 29, 2026, 11:38am UTC](https://openziti.discourse.group/t/openziti-ztna-issue-when-communicating-from-1-vpc-cidr-to-another-in-aws/5846 "2026-05-29T11:38:12Z")
@TheLumberjack hey again. I would like to come back to this post I spoke on before: Is this AWS architecture correct for OpenZiti ZTNA? I have been able to setup OpenZiti ZTNA but I'm having issues. I setup the followin… --- ## [Best practice for multi-user zero-trust isolation on the same host](https://openziti.discourse.group/t/best-practice-for-multi-user-zero-trust-isolation-on-the-same-host/5811)
**Author:** [@tttjhgan](https://openziti.discourse.group/u/tttjhgan)\ **Replies:** 2\ **Last updated:** [May 7, 2026, 3:32am UTC](https://openziti.discourse.group/t/best-practice-for-multi-user-zero-trust-isolation-on-the-same-host/5811 "2026-05-07T03:32:31Z")
Hi everyone, I’m evaluating OpenZiti / NetBird for a scenario where multiple users share the same Linux host. Example: User A and User B log in to the same machine. User A should only access A’s resources. User B … --- ## [Addressable Terminators In A Clustered Setup](https://openziti.discourse.group/t/addressable-terminators-in-a-clustered-setup/5766)
**Author:** [@montwepa](https://openziti.discourse.group/u/montwepa)\ **Replies:** 11\ **Last updated:** [May 4, 2026, 9:29pm UTC](https://openziti.discourse.group/t/addressable-terminators-in-a-clustered-setup/5766 "2026-05-04T21:29:24Z")
Hey! Following this post I'm wondering if addressable terminators behave differently in clustered setups? I was able to get the addressable terminators working with the examples provided in that post, but when I tried i… [Next page](https://openziti.discourse.group/c/support/6.md?page=1)