# Ziti Edge Router General Questions

**URL:** <https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221>\
**Category:** General Questions\
**Created:** [April 27, 2023, 11:17am UTC](https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221 "2023-04-27T11:17:32Z")\
**Posts on this page:** 7\
**Page:** 3

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [May 4, 2023, 8:34pm UTC](https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221/41 "2023-05-04T20:34:20Z")

</div>

> [@jruiz94](#):
>
> You mean that I can remove the ziti-host docker container, alongside the `privatemachine` identity

yessir, you got it!

> [@jruiz94](#):
>
> put the same attributes `sshd` to the `192.168.1.123` Router

yes but not on the "router", but on the "router identity" -- a **VERY** easy mistake to make so do be careful here... I think you knew what you meant, but I've made the mistake so... I don't want you to 🙂

> [@jruiz94](#):
>
> I also think that I’ll have to set the network type of the router container as “host”

That's a wee bit out of my docker knowlege. I never have to do that, but maybe you do? 🙂 So sure!

I also think this will fix your path problem. I was talking to @plorenz about this and we think that since the private identity on the docker network could use both routers, the path selected ended up being the one that didn't make sense. i _think_ (and hope) when you remove that private ziti host, you'll see the right path.

---

<div class="post-metadata">

**Author:** ![jruiz94](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/jruiz94/32/652_2.png) [@jruiz94](https://openziti.discourse.group/u/jruiz94)\
**Post date:** [May 4, 2023, 10:05pm UTC](https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221/42 "2023-05-04T22:05:56Z")

</div>

> [@TheLumberjack](#):
>
> yes but not on the “router”, but on the “router identity” – a **VERY** easy mistake to make so do be careful here… I think you knew what you meant, but I’ve made the mistake so… I don’t want you to 🙂

Ahahahah yes I meant that. Just to be double sure, when I do that, adding the attribute, the `ziti edge list identities` will show the following, right?

```auto
╭────────────┬─────────────────┬────────┬────────────────┬─────────────╮
│ ID │ NAME │ TYPE │ ATTRIBUTES │ AUTH-POLICY │
├────────────┼─────────────────┼────────┼────────────────┼─────────────┤
│ -2Z8CrYt4 │ 192.168.1.123 │ Router │ sshd │ default │
│ VHpEV6vmO │ Default Admin │ User │ │ default │
│ VpJLXZYt8 │ client │ User │ sshd-clients │ default │
│ gS9VdXTt4 │ publicmachine │ Router │ │ default │
╰────────────┴─────────────────┴────────┴────────────────┴─────────────╯

```

> [@TheLumberjack](#):
>
> That’s a wee bit out of my docker knowlege. I never have to do that, but maybe you do? 🙂 So sure!

Yepyepyep leave that to me.

I've been so full of docker and ziti these days that I'm tempted to start doing a Docker compose Ziti user guide from my POV so maybe that helps other users ahahah

> [@TheLumberjack](#):
>
> I also think this will fix your path problem. I was talking to @plorenz about this and we think that since the private identity on the docker network could use both routers, the path selected ended up being the one that didn’t make sense. i _think_ (and hope) when you remove that private ziti host, you’ll see the right path.

Nice! Then when I'm back at home I'll test everything and update the post!

Again, thanks to all, you folks are awesome!

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [May 5, 2023, 2:36am UTC](https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221/43 "2023-05-05T02:36:02Z")

</div>

> [@jruiz94](#):
>
> I’m tempted to start doing a Docker compose Ziti user guide

You should! 😄 Hopefully quite soon we will get Geoffs branch merged and it'll be more straightforward and even easier..

> [@jruiz94](#):
>
> when I do that, adding the attribute, the `ziti edge list identities` will show the following, right?

Assuming you use the attribute for ssh, yes.

> [@jruiz94](#):
>
> Again, thanks to all, you folks are awesome!

Thanks! We are glad you're finding OpenZiti powerful and useful!

---

<div class="post-metadata">

**Author:** ![jruiz94](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/jruiz94/32/652_2.png) [@jruiz94](https://openziti.discourse.group/u/jruiz94)\
**Post date:** [May 5, 2023, 7:21am UTC](https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221/44 "2023-05-05T07:21:24Z")

</div>

> [@jruiz94](#):
>
> Nice! Then when I’m back at home I’ll test everything and update the post!
> 
> Again, thanks to all, you folks are awesome!

Nah i couldn't wait, before my leave, I removed the `sshd` attribute from the privatemachine and added it to the private router.

Then in the docker compose that had the `ziti-host` container i completely removed it.

Then in the docker compose that had the `ziti-router` I simply added the line `network_mode: "host"`

And started everything in the private machine, then tried to do the SSH connection and it worked, and now look at this

```auto
╭───────────┬───────────────────────────┬────────────────────┬──────────────────────────────────────┬─────────────────╮
│ ID │ CLIENT │ SERVICE │ TERMINATOR │ PATH │
├───────────┼───────────────────────────┼────────────────────┼──────────────────────────────────────┼─────────────────┤
│ HjxzUHcG1 │ clha7vieg4s4lc1mk4tptlk2z │ test_ssh_service │ fb17c5ad-4d0d-45fc-8c00-807acd53f683 │ r/192.168.1.123 │
╰───────────┴───────────────────────────┴────────────────────┴──────────────────────────────────────┴─────────────────╯

```

Seems like everything is now working as expected! Thanks for all the help! When I have some time I'll update the post and add the docker compose and env files in case they help somebody in the future!

As I was writing this, I just was wondering to myself some extra questions...

In the setup I have planned, my idea is to have some machines in my house, and some in my friends' house. Machines in both households would have services to be hosted through Openziti.

In order to establish optimized paths between machines, as we've seen here, wouldn't it be best to deploy ziti edge routers instead of tunnelers (`ziti-host`) just like we did here? Since they can route AND act as tunnelers, I see them as the superior choice when there are other computers that can benefit from those services in the same network.

Another question, in this setup I mentioned with my friend, we would deploy each one of us a private Ziti router just like I did, that would optimize connections in the same LAN, but is there a way to make it so paths are established between the 2 households directly skipping the public machine on Oracle Cloud? I assume for this to work, they shouldn't be private routers but rather public routers with addressable IP and port, right?

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [May 5, 2023, 10:07am UTC](https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221/45 "2023-05-05T10:07:51Z")

</div>

> [@jruiz94](#):
>
> wouldn’t it be best to deploy ziti edge routers instead of tunnelers

I definitely don't think of them as superior, they service different needs. For your use case, it ended up that the edge router was exactly what you needed. The go-based routers are a bit "heavier" than the c-based tunnelers. I would still say it really does depend. For what you're looking to do though, yes, having an edge router in the satellite private networks is going to serve you well.

> [@jruiz94](#):
>
> between the 2 households directly skipping the public machine on Oracle Cloud?

While I understand exactly why you're asking this question, I'm not sure it's actually something to worry about and it's not how OpenZiti operates at this time. The only way to accomplish this would be to open and forward a port in your home routers. But if you choose to do that, you could. You'd almost definitely need the dynamic DNS setup then, but if you have active connections, maybe your isp wouldn't change your IP on you, dunno. So yeah, you could do it and avoid the relay server.

> [@jruiz94](#):
>
> they shouldn’t be private routers but rather public routers with addressable IP and port, right?

Yeah, exactly. You would likely want to setup a more detailed/restrictive edge router policy then too. They need to have "link listeners" enabled so that other routers would also dial and link to them which is really the biggest maybe only differentiator that makes a router "private" vs "public".

---

<div class="post-metadata">

**Author:** ![jruiz94](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/jruiz94/32/652_2.png) [@jruiz94](https://openziti.discourse.group/u/jruiz94)\
**Post date:** [May 8, 2023, 3:53pm UTC](https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221/46 "2023-05-08T15:53:08Z")

</div>

> [@TheLumberjack](#):
>
> While I understand exactly why you’re asking this question, I’m not sure it’s actually something to worry about

Yeah I mean, I'm not worried about that now, I just like to have a backup plan in case in the future the free Oracle Cloud instances get taken down or heavier networking limits start applying.

> [@TheLumberjack](#):
>
> it’s not how OpenZiti operates at this time

Maybe in the future? Or isn't that in the roadmap? I'm just curious, not demanding or anything.

Anyways, maybe these questions are deviating a little bit from the original post, and I got everything working, so I just wanted to reiterate my thanks for all the info and help 🙂

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [May 8, 2023, 3:55pm UTC](https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221/47 "2023-05-08T15:55:44Z")

</div>

> [@jruiz94](#):
>
> Maybe in the future? Or isn’t that in the roadmap?

Yes. In the future, we are pretty sure we want to extend the capabilities of routers into all sdks/clients and be able to support direct linking and whatnot. Big ambitions, tempered only by time!

> [@jruiz94](#):
>
> I just wanted to reiterate my thanks for all the info and help

🤜 🤛  
Happy to help

[Previous page](https://openziti.discourse.group/t/ziti-edge-router-general-questions/1221.md?page=2)