Connecting through a corporate proxy - Ziti VS Chisel

I have a use case where I’ll be hosting and connecting to/from a service in a corporate network environment which only allows http traffic. There is an alternative solution in place that uses Chisel proxy with another ZTNA solution, but I’d like to solve this with Ziti if possible because I’ll be able to embed the ZT into my application. I saw the thread about using proxychains, but if I’m using the SDK is that necessary?

Hi @sjakos, welcome to the community and to OpenZiti!

Exciting stuff! :slight_smile:

I don't recall which thread you're referring to. I don't know if I can answer definitively if it's necessary or not. When you state "only allows http traffic" it makes me wonder if there's L7 introspection going on. OpenZiti relies on mutual TLS connections and is not tolerant of DPI type introspections which terminate TLS prematurely as is sometimes done by firewalls/network appliances.

Also, OpenZiti will be making TCP requests on port 443 and will not be making HTTP requests so there wont' be any HTTP packets for the firewall/network appliance to inspect.

If you can establish a normal TCP connection on port 443, I suspect you'll be just fine. Without knowing more though, I can't say for sure.

Hope that helps, let us know! We are always eager to hear about people embedding zero trust into their app! If it's open source even better. If you do get a project togehter and you can discuss it, it would be a fun Ziti TV. :slight_smile: https://www.youtube.com/playlist?list=PLMUj_5fklasKBlnVqh6YJuURKlgo39Yo1