hi folks I had a question. If we have a data engine say in AWS VPC1 and the data source itself in Another AWS VPC2. is there a way to use ziti so all data flows of actual data within the region (assume both VPCs are within same region)? Is there a way to use attribute tags and policies to define th…

I ve a suggestion for that, Assume AWS VPC1 hosts the backend and AWS VPC2 contains the database. Instead of using a NAT Gateway, you can route database requests from AWS VPC1 through a Ziti router. In the Ziti Controller or Console, configure the intercept and host mappings to securely manage this…

The suggestion from @ss_vinoth22 is exactly what I would recommend. I'm not a pro when it comes to intra-VPC communication, but I would hope/assume that one VPC can peer to another? Then, as @ss_vinoth22 mentions, you'd deploy one or more routers in one VPC and one or more in the other. Right now, …

Thanks @TheLumberjack and @ss_vinoth22 . So much appreciate it. For the user...why 2 private routers? (the user in this case can/should only access the data engine and not the db). Also if the traffic is always one-way Engine to DB (and get results) and User to Engine... is there any simplified appr…

[image] Dns routing inside Kubernetes with Edge tunneler daemonset If you were successful using the NetFoundry console, there's functionally no difference presuming you've configured everything correctly. I understand what you're trying to do, but I don't see what the pro…

Thinking about it more, you could probably use one router in each VPC if the costs associated with the public routers are extraordinarily high. It might be worthwhile to get @plorenz to comment as well or possible @mike.gorman . I've not spent a ton of time with router costing but my still naiive und…

[image] TheLumberjack: At some point in the future, we'll have explicit control over pathing and more robust path logic, but with what we have right now I wanted to provide a mechanism that I was sure would never end up costing you egress traffic. Thanks @TheLumberjack and @ss_vinoth22 again…

Link groups are available now, so you can force routers to only form links with other routers. You can also apply manual cost to nodes, so that you could increase the cost of the public routers by a large margin. This would make them much more "expensive" in the path calculation algorithm, and ver…

It appears link groups is most deterministic approach from the above? We thought we could have some sort of attribute based policy but guess its not in the options above !

The link groups are created by applying tags to the configuration on the dialers and listeners, so they are attribute based. The issue there is that you probably want links to the public routers, for reachability, so you can't cut them off. We utilize it to implement data sovereignty, on networks …

thanks all. Will check these and get back with results

AWS VPC to VPC via Ziti

ss_vinoth22 January 23, 2025, 2:10am 5

i did something similar to this. you can refer this. you can ignore kubernetes, just look into the diagram for flow

Topic		Replies	Views
Deploy Ziti tunnel in public node and other apps in private nodes Ziti Overlay	34	400	February 4, 2025
Is this AWS architecture correct for OpenZiti ZTNA? General Questions	3	87	April 30, 2026
Help with setting up OpenZiti in AWS General Questions	6	109	March 30, 2026
Ziti Tunneler Configuration: Resolving Identical ziti0 IPs and Enabling Cross-EC2 Communication Ziti Overlay	4	75	December 28, 2024
Securing a bunch of Machines General Questions	13	1182	June 21, 2022

AWS VPC to VPC via Ziti

Related topics