Ziti overlay network and reverse proxy public DNS redirection

[TheLumberjack]

@jfj

If I have services which would be accessed from the Internet by IoT devices which cannot run Ziti tunnelers/clients locally and I also can’t run an edge router on their networks, is that the end of the road for that service?

Not the end of the road, no but you'd "probably" want to use zrok for that since this is exactly what zrok accomplishes. It allows you to make public url that takes you to a private resource. Quick demo I did for a different discourse post that shows it in action. It's built on top of OpenZiti but not quite "integrated" fully with OpenZiti just yet. There are backlog items to allow zrok to play more tightly with OpenZiti but it gives you the idea... It's basically pretty close to the same thing as the reverse proxy you already have setup, kinda mostly.... I dunno if that will add confusion to your learning, it might! But maybe it'll just click with you... The big difference is you could keep your proxy in the dmz and STILL keep inbound firewall rules closed. You don't have to have an inbound 'hole' in the firewall to allow the proxy to send data to the target service... Maybe a couple of diagrams help

...

Classic approach (inbound hole from DMZ to private service)

"DMZ" established, hole in firewall forwarding traffic to proxy. Hole in "private network" firewall allowing traffic in from DMZ to specified apps

zrok 'proxy' (no inbound firewall holes)

"DMZ" established, hole in firewall forwarding traffic to zrok front end. NO Hole in "private network" firewall allowing traffic in from DMZ to specified apps. zrok attaches outbound to edge router

@jfj

Jellyfin client streaming to various IoT endpoints is a perfect example to understand this limitation as a concept

You should be able to accomplish this with zrok v0.4 (not 0.3). You'll also have to have one instance of zrok running per service (right now, another backlog item to do 'n' services per zrok instance exists)

BrowZer

BrowZer definitely changes the equation, but I'm not sure if it'd run on a Roku... Here you have no proxy, no zrok frontend but instead BrowZer is able to communitcate to the 'public' edge router (I'm intentionally leaving out some BrowZer bits for simplicity's sake) Here though, anything running a simple web browser should be able to access web content without the need to install client-side software.

@jfj

There are many cases where a client or edge router on a client network are simply not possible. Does that mean that I will have a list of services which I still need to use some sort of old-world non Ziti access process, like my existing reverse proxy and firewall only setup?

I think I answered this by now? I hope? If not, lemme know... So "yes and no"...

@jfj

Or is there some way to intercept this at my own edge router and make work, even if the IoT to edge router session is less secure?

Yes you can do this too! @NicFragale does exactly this on his home network if you have the right kind of router... Nic, did you write that up somewhere? This is also exactly what that video I showed before can do. We'd refer to that as "zero trust network access" meaning, you still trust the local netowork to a decent extent.

Hopefully this helps