Replace traditional VPN with OpenZiti, and few additional questions?

[TheLumberjack]

Hi @Idriel, welcome to the community and to OpenZiti!

You have a LOT of questions packed in here !

@Idriel

It should be able to tunnel entire IP ranges

Yes you can do this. When you create an intercept you can specify a CIDR block if you like. You'd do this using an "intercept" .

@Idriel

and protocols like SSH and RDP

OpenZiti does not care about protocols - only ports/port ranges. Not 'protocol'.

@Idriel

Can the destination server see the real client IP so we can map it to a VPN user

OpenZiti isn't a VPN so, I'll say "no" to this but the real answer is --pretty complicated... You can fwd the intercepted IP but because of how OpenZiti tunnelers work and accepting traffic at the tun, the IP would be 100.64.0.1 for everyone as it is. You'd have to go out of your way to update that IP for all the users. It's "doable" but I wouldn't try to do that until you are well-versed with OpenZiti and know you need it. In OpenZiti you would control access to services using OpenZiti itself so you may find this might not end up being necessary.

@Idriel

What about Kerberos authentication if Ziti becomes the authoritative DNS server?

I'm no domain admin so I can't help here. I know plenty of people do lots of cool things on Windows with AD like this Hosting AD-related services via ziti-edge-tunnel on any domain-joined Windows host (DC or member server) breaks Cloud Kerberos Trust ticket issuance for Entra ID–joined dial clients; same configuration on an Edge Router works - #5 by msbusk

@Idriel

Is there an “always‑on” mode similar to a VPN

OpenZiti has generally been user-in-controll-focused and not central-administration-focused. This means the user is generally allowed to 'turn it on and turn it off'... By default, the Windows tunneler is started on startup. It requires admin escalation to install/change that value but once started the UI will allow a user to "stop and start" the tunnel - purposefully. We've had "centralized control" types of questions in the past but it's never been something that we've ended up decidign to add to OpenZiti yet.

@Idriel

In that case, how would our proxy be aware of the Ziti client IP and username

I would generally think it wouldn't be. zfw might provide that but I'm not entirely sure if it would work for what you want/need.

@Idriel

especially if we want to perform SSL inspection?

If you are using OpenZiti you must do this outside of OpenZiti (either before or after). OpenZiti fundamentally breaks if you want to do any sort of DPI. It's just not possible to do at any point along the OpenZiti overlay.

@Idriel

how to deal if we have internal reverse proxy that holds N fqdn-s to different internal web sites?

I don't qiute understand the question without a lot more detail (probably requires too much detail) but my guess would be that OpenZiti can handle that fine. The other option is to use a companion project to OpenZiti called zrok that is a distributed reverse proxy and sharing solution.