OpenZiti
Hacker ApprovedShares rank 7 of 12 mesh VPNs by recommenders
Open-source, identity-based overlay network that lets you host services without open listening ports and set granular access per client; critics cite hard-to-use UX and incomplete desktop and mobile clients.
Open-source, identity-based overlay network that lets you host services without open listening ports and set granular access per client; critics cite hard-to-use UX and incomplete desktop and mobile clients.
11 people gave an opinion
- recommend it
- 10
- criticize it
- 1
- approval share
- 91%
Recommended in 8 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 10 people recommend itNeeds 10 or more, met.
- 10 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 8 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Identity-based access with no open ports
“You have more or less described OpenZiti. Just mint a new identity/JWT for the user, create a service, and viola, only that user has access to your machine.”
Comment from 12 Jan 2026 in “2026 is the Year of Self-hosting” “the kind of deployment that benefits from identity-based, zero-listening-port connectivity”
Comment from 20 May 2026 in “Show HN: Agyn, an open-source Kubernetes runtime for AI agents” “identity- and policy-driven service access, so you get authN/Z-before-connect”
Comment from 20 Mar 2026 in “Noq: n0's new QUIC implementation in Rust” - Comment from 1 Feb 2026 in “Netbird a German Tailscale alternative (P2P WireGuard-based overlay network)”
Open source, runs at production scale
“for the private networking problem, openziti (apache 2.0) is now integrated with Nix”
Comment from 23 Dec 2025 in “Towards a secure peer-to-peer app platform for Clan” “Its open source, runs at prodution scale”
Comment from 1 Feb 2026 in “Netbird a German Tailscale alternative (P2P WireGuard-based overlay network)” “Its also 100% open source.”
Comment from 19 Feb 2026 in “Tailscale Peer Relays is now generally available” Granular access control for services
“Being able to host dark services and impose granular access controls and routing for different clients is a game changer.”
Comment from 19 Sep 2026 in “Cloudflare Quick Tunnels” “which feels like a better fit for app-specific access based on zero trust principles than a general network relay”
Comment from 20 Mar 2026 in “Noq: n0's new QUIC implementation in Rust” Seen as stronger than alternatives
“OpenZiti/NetFoundry is in a different class entirely and any lurkers here should consider it for their use”
Comment from 1 Feb 2026 in “Netbird a German Tailscale alternative (P2P WireGuard-based overlay network)” “I think OpenZiti/NetFoundry is in a different class entirely”
Comment from 1 Feb 2026 in “Netbird a German Tailscale alternative (P2P WireGuard-based overlay network)”
Other mesh VPNs people recommend
The four most recommended other mesh VPNs, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
See all 12 mesh VPNs, rankedWhat people said
20 of the 22 comments that mention it, newest first. Each links to the original comment.
“Being able to host dark services and impose granular access controls and routing for different clients is a game changer.”
“OpenZiti seems like a solid project otherwise”
“"openziti can be app-embedded" is actually completely false”
“all the ceremony about setting up daemons, servers, controllers”
“OpenZiti fits that really well.”
“the kind of deployment that benefits from identity-based, zero-listening-port connectivity”
“If that sort of thing interests you, you could check out OpenZiti.”
“The overlay has strong identity and end-to-end encryption.”
“which feels like a better fit for app-specific access based on zero trust principles than a general network relay”
“identity- and policy-driven service access, so you get authN/Z-before-connect”
“Its also 100% open source.”
“OpenZiti/NetFoundry is in a different class entirely and any lurkers here should consider it for their use”
“I think OpenZiti/NetFoundry is in a different class entirely”
“UX was overall atrocious. Our users could not comprehend it at all.”
“Tunnelers exist for Windows, Android, iOS, Linux, MacOS, and more”
“their desktop and mobile clients are very incomplete”
“identity is bound into connection establishment itself”
“Its open source, runs at prodution scale”
“You have more or less described OpenZiti. Just mint a new identity/JWT for the user, create a service, and viola, only that user has access to your machine.”
“for the private networking problem, openziti (apache 2.0) is now integrated with Nix”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.