# OpenZiti

Hacker Approved page: https://hackerapproved.com/p/openziti/

5 people recommended OpenZiti in Hacker News comments, 3 had mixed feelings and none criticized it, November 2025 to October 2026. It was recommended in 7 of 12 months, in 8 threads. It does not meet the Hacker Approved badge rule.

**Verdict:** Open-source, identity-based overlay network that lets you host services without open listening ports and set granular access per client; critics cite hard-to-use UX and incomplete desktop and mobile clients.

Summary written by Claude from 20 comments. It was written before the November 2026 recount, and 17 of those comments still count.

## Why people recommend it

- Identity-based access with no open ports (4 comments in the sample): "You have more or less described OpenZiti. Just mint a new identity/JWT for the user, create a service, and viola…" ([source](https://news.ycombinator.com/item?id=46586064)) "the kind of deployment that benefits from identity-based, zero-listening-port connectivity" ([source](https://news.ycombinator.com/item?id=48215188)) "identity- and policy-driven service access, so you get authN/Z-before-connect" ([source](https://news.ycombinator.com/item?id=47452518))
- Open source, runs at production scale (3 comments in the sample): "for the private networking problem, openziti (apache 2.0) is now integrated with Nix" ([source](https://news.ycombinator.com/item?id=46370316)) "Its open source, runs at prodution scale" ([source](https://news.ycombinator.com/item?id=46846904)) "Its also 100% open source." ([source](https://news.ycombinator.com/item?id=47071414))
- Granular access control for services (2 comments in the sample): "Being able to host dark services and impose granular access controls and routing for different clients is a game changer." ([source](https://news.ycombinator.com/item?id=49762525)) "which feels like a better fit for app-specific access based on zero trust principles than a general network relay" ([source](https://news.ycombinator.com/item?id=47452532))
- Seen as stronger than alternatives (1 comment in the sample): "I think OpenZiti/NetFoundry is in a different class entirely" ([source](https://news.ycombinator.com/item?id=46847524))

## Other mesh VPNs people recommend

- [Tailscale](https://hackerapproved.com/p/tailscale/): 638 recommend, 126 mixed, 174 criticize
- [NetBird](https://hackerapproved.com/p/netbird/): 62 recommend, 12 mixed, 23 criticize
- [Headscale](https://hackerapproved.com/p/headscale/): 60 recommend, 14 mixed, 17 criticize
- [ZeroTier](https://hackerapproved.com/p/zerotier/): 11 recommend, 5 mixed, 10 criticize

## The badge

A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged.

## Cite as

Hacker Approved, "OpenZiti", https://hackerapproved.com/p/openziti/ (5 recommend, 3 mixed, 0 criticize; Hacker News comments, November 2025 to October 2026).

Counts updated 2 Nov 2026, with data through October 31, 2026.