# ZTNA Options & differences for private DNS

**URL:** <https://openziti.discourse.group/t/ztna-options-differences-for-private-dns/732>\
**Category:** Ziti Overlay\
**Created:** [September 5, 2022, 8:31am UTC](https://openziti.discourse.group/t/ztna-options-differences-for-private-dns/732 "2022-09-05T08:31:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![markamind](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/markamind/32/157_2.png) [@markamind](https://openziti.discourse.group/u/markamind)\
**Post date:** [September 5, 2022, 8:31am UTC](https://openziti.discourse.group/t/ztna-options-differences-for-private-dns/732/1 "2022-09-05T08:31:02Z")

</div>

# Situation

I have setup a private git repo on a private compute and want to perform git operations over a Ziti network

# ZTNA (Ziti Network Access) options

**1. LAN Gateway using two private routers**

> [@Configure an edge-router as gateway?](https://openziti.discourse.group/t/configure-an-edge-router-as-gateway/508/8):
>
> Hi Markamind:  
> Here is a video on using an open ziti-router as a Lan GW [Using an OpenZiti router as a LAN Gateway - YouTube](https://www.youtube.com/watch?v=H0qGRBMGNIA)

**2. Ziti Edge Tunneller**

A normal setup to create a tunneller

# Differences

After working through the LAN Gateway option, my understanding is that this does not use a public edge router. It is not needed because the connection is made within the fabric between the two ziti routers that connect to the host via the nic.

In contrast, the Ziti Edge Tunneller operates at the edge, which by definition needs to pass via the public edge router.

Is this correct? Am i missing anything.

The impact of this difference is seen in how the Service Edge Router Policy is configured.

---

<div class="post-metadata">

**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\
**Post date:** [September 5, 2022, 11:27am UTC](https://openziti.discourse.group/t/ztna-options-differences-for-private-dns/732/2 "2022-09-05T11:27:08Z")

</div>

If you have the two ziti identities in different clouds/private networks, you’ll absolutely need and use a public edge router for the private edge routers or local tunneling apps to link to.

You always need at very least, one public edge router if you’re spanning two private networks.