Network Proflie of OpenZiti Windows Edge Client

Tunneler Apps Ziti Edge Tunnel
1

Hi supports,

I'm testing OpenZiti with WIndows Edge Client (Tunneler), it works well.

I have a quetion on the network interface created by Edge Client, the interface has a Puliic Network profile. Running "Get-NetConnectionProfile" gives information like below

Name : ziti-tun0 13
InterfaceAlias : ziti-tun0
InterfaceIndex : 24
NetworkCategory : Public
DomainAuthenticationKind : None
IPv4Connectivity : LocalNetwork
IPv6Connectivity : NoTraffic

Question: Is it possbile to config this a private? What is the impact of set to Public or Private?

2

Yes, you can change it to "Private".

A short research is advised to understand the meaning of this profile types. In my opinion "Public" is correct for Ziti.

I guess ZDEW does only accept mTLS authenticated traffic.

3

Given OpenZiti is a zero trust overlay network, we treat every network interface as 'public' on purpose. The setting primarily selects which Windows Defender Firewall rules apply in windows.

As @frm says, you can do some quick searching/llm asking and learn more (or read the MS doc directly if you like) :slight_smile:

It's not possible to change to private at this time unless you do it manually and then you'll have to do that each time the ZDEW restarts.

4

@TheLumberjack
Thanks for your information, generally that makes sense.

The reason i'm asking this is because we are testing OpenZiti used in Corporate Network, where wIndows PC was applied quite restricted Defender Firewall rules, especically on the "Public" network interfaces.

For your consideration only, probably it's useful make it configurable similar like Edge Client allow us to customzie the tunnel IP range.