# Does openziti require a public router and a public controller?

**URL:** <https://openziti.discourse.group/t/does-openziti-require-a-public-router-and-a-public-controller/3548>\
**Category:** Ziti Overlay\
**Created:** [December 8, 2024, 5:22am UTC](https://openziti.discourse.group/t/does-openziti-require-a-public-router-and-a-public-controller/3548 "2024-12-08T05:22:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![amano](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@amano](https://openziti.discourse.group/u/amano)\
**Post date:** [December 8, 2024, 5:22am UTC](https://openziti.discourse.group/t/does-openziti-require-a-public-router-and-a-public-controller/3548/1 "2024-12-08T05:22:21Z")

</div>

I don't know whether a controller and a router must be accessible on public IP addresses.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [December 8, 2024, 5:24am UTC](https://openziti.discourse.group/t/does-openziti-require-a-public-router-and-a-public-controller/3548/2 "2024-12-08T05:24:26Z")

</div>

Practically - yes. If you only want to run an OpenZiti overlay on totally private address space, you could choose to do that.

The way I put it is, wherever the clients are, they need to be able to address the controller and at least one edge router. So that means in practicality, they should be on the open internet with a public IP.

I also **highly** recommend you use DNS and not an IP in the off chance the IP of the controller/router change.

---

<div class="post-metadata">

**Author:** ![amano](https://avatars.discourse-cdn.com/v4/letter/a/ee59a6/32.png) [@amano](https://openziti.discourse.group/u/amano)\
**Post date:** [December 8, 2024, 5:27am UTC](https://openziti.discourse.group/t/does-openziti-require-a-public-router-and-a-public-controller/3548/3 "2024-12-08T05:27:59Z")

</div>

I think that's where the commercial openziti services come in.

Many people will want to use tunnels to remotely access their home computers behind NAT without having to set up the public infrastructure.

Since openziti doesn't do NAT traversal, at least one public router is going to be necessary.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [December 8, 2024, 5:29am UTC](https://openziti.discourse.group/t/does-openziti-require-a-public-router-and-a-public-controller/3548/4 "2024-12-08T05:29:47Z")

</div>

That's certainly true. There are some free VPS providers out there (Oracle) that have been used in the past and are pretty generous and have held up to very modest amounts of traffic. There are also some "pretty cheap" providers if free is too weak. 🙂

> **[Setting Up Oracle Cloud To Host OpenZiti](https://blog.openziti.io/setting-up-oracle-cloud-to-host-openziti)**
>
> For a long time, I've been concerned about relying on a company's focus on security. I generally expect the least focus on security as many companies just want to be first to market. Yikes, that sounds bad, but many companies indeed focus too little...

---

<div class="post-metadata">

**Author:** ![PhilipGriffiths](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/philipgriffiths/32/341_2.png) [@PhilipGriffiths](https://openziti.discourse.group/u/PhilipGriffiths)\
**Post date:** [December 8, 2024, 3:53pm UTC](https://openziti.discourse.group/t/does-openziti-require-a-public-router-and-a-public-controller/3548/5 "2024-12-08T15:53:51Z")

</div>

fwiw, the 'commercial openziti' (NetFoundry) provides a productised, supported, very easy to use and deploy at production scale version, whether deploy in cloud, hybrid, or completely airgapped.