Help with intercepts

Hi @Guardiant314,

All of the OpenZiti tunnelers intercept connections based on the destination IP address of the segment. DNS is really just a layer on top of this, where the tunneler acts as a DNS server (to provide an IP address for e.g. "my-ziti-service.domain"). The tunneler's DNS server returns an IP address that it knows how to intercept (in the 100.64/10 range by default).

I'm not sure I understand your question about IPv4/IPv6... If your OpenZiti service uses a hostname in its intercept.v1 configuration then the IP address for the service is determined by the intercepting tunneler, by way of the previously mentioned DNS server. BTW the tunneler DNS servers currently provide IPv4 answers.

Once the underlay application (the one that is to be intercepted) starts sending packets, those packets will be picked up by the intercepting tunneler. The payloads of those packets will be sent via OpenZiti Edge messages to the hosting tunneler, which establishes its own TCP/IP connection with the underlay server application for sending the payloads to the server.

I'm not sure if this answers your question. I'm reminded of some previous replies that I've made here that may be relevant: