# Does OpenZiti support DTLS? **URL:** \ **Category:** Uncategorized\ **Created:** [March 2, 2024, 10:46pm UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189 "2024-03-02T22:46:52Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ehsanj](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ehsanj/32/1773_2.png) [@ehsanj](https://openziti.discourse.group/u/ehsanj)\ **Post date:** [March 2, 2024, 10:46pm UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/1 "2024-03-02T22:46:52Z")
Does OpenZiti support DTLS? If you could point me to relevant documentation, that would be very helpful. ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [March 3, 2024, 1:33am UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/2 "2024-03-03T01:33:06Z")
I don't believe we claim to support DTLS per-se, however, OpenZiti allows you to tunnel UDP or TCP connections and implements end to end encryption for both TCP and UDP between the source and destination identities. If you establish your own DTLS connection OVER OpenZiti, I would expect it to work properly but this is the application protocol, not OpenZiti... If that makes sense? It'd be similar to how OpenZiti allows TLS over OpenZiti I would think, and that works perfectly. So if your question is, can OpenZiti secure UDP datagrams, I would respond with "yes" between the source and destination identity. Is that DTLS, no I don't believe so, it's done with libsodium. That make sense and answer the question sufficently? ---
**Author:** ![ehsanj](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ehsanj/32/1773_2.png) [@ehsanj](https://openziti.discourse.group/u/ehsanj)\ **Post date:** [March 8, 2024, 4:06pm UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/3 "2024-03-08T16:06:41Z")
Thanks for your reply! I understand Ziti doesn't have built-in support for DTLS but does have the ingredients to build that support on. With that in mind, I have a follow up question: when UDP transport is selected, does Ziti deliver the payloads end-to-end as UDP; or, is UDP only at the entry and exit points and the payload is delivered as TCP within the mesh? ---
**Author:** ![plorenz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plorenz/32/54_2.png) [@plorenz](https://openziti.discourse.group/u/plorenz)\ **Post date:** [March 8, 2024, 4:34pm UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/4 "2024-03-08T16:34:52Z")
Current SDK \<-\> router and router \<-\> router traffic is TCP-based. One of our goals is to allow for UDP-based transports (likely using DTLS) for those connections. Some initial work has been done, but there's more to do before it will be a good replacement. Cheers, Paul ---
**Author:** ![ehsanj](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/ehsanj/32/1773_2.png) [@ehsanj](https://openziti.discourse.group/u/ehsanj)\ **Post date:** [March 8, 2024, 5:07pm UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/5 "2024-03-08T17:07:51Z")
Sounds good, thank you! ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [February 25, 2026, 4:39pm UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/6 "2026-02-25T16:39:54Z")
This is a copy of my [two questions](https://openziti.discourse.group/t/zrok-binds-itself-to-ipv6-on-oracle-vm/5649/5) regarding ziti/zrok. 1. Does Ziti 1.6.x support binding to a specific IPv6 address or an interface? 2. Does Ziti 1.6.x router [support DTLS](https://netfoundry.io/docs/openziti/reference/configuration/conventions#addressing) ? ---
**Author:** ![plorenz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plorenz/32/54_2.png) [@plorenz](https://openziti.discourse.group/u/plorenz)\ **Post date:** [February 25, 2026, 6:25pm UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/7 "2026-02-25T18:25:13Z")
re: IPv6 - [ipv6 Transport Address Parsing · Issue #31 · openziti/transport · GitHub](https://github.com/openziti/transport/issues/31) re: DTLS - It will probably work, but at least for the we scenarios tested, we didn't see any performance gains. You're welcome to try it and feel free to share any interesting results from your tests. Paul ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [February 25, 2026, 6:49pm UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/8 "2026-02-25T18:49:05Z")
Of course, if TCP works properly, there is no performance gain. However, when TCP packets are fragmented and fragments are heavily dropped, the TCP window will shrink dramatically (sometimes to around 500 bytes). In such conditions, DPI throttles TCP connections, making TLS effectively unusable. Regrettably, TCP performance is strongly dependent on network conditions. In degraded environments, UDP-based transport may perform better. ---
**Author:** ![Rantanplan](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/rantanplan/32/3353_2.png) [@Rantanplan](https://openziti.discourse.group/u/Rantanplan)\ **Post date:** [March 1, 2026, 9:18am UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/9 "2026-03-01T09:18:57Z")
Is it possible to specify a network interface in order to capture IPv6 & IPv4 packets on that particular interface? ---
**Author:** ![plorenz](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/plorenz/32/54_2.png) [@plorenz](https://openziti.discourse.group/u/plorenz)\ **Post date:** [March 4, 2026, 3:25am UTC](https://openziti.discourse.group/t/does-openziti-support-dtls/2189/10 "2026-03-04T03:25:18Z")
In what context? Using a tunneler? One of the configurable listeners or dialers on the controller or router?