Hacker News Reader

I have a few questions off the top of my head if you have any thoughts on them. Thanks so much for your replies on this comment thread.

- What is the performance of OpenZiti like? I'm seeing some Nebula performance numbers (from third parties, not clocked myself) that seem surprisingly bad, but I'm also not particularly performance sensitive as far as throughput for most things.

- I predict problems with DNS on 127.0.0.1:53 on some hosts, thinking it might be better on 127.0.0.53:53 though I feel like that might already be commonly used for something. I know on my work laptop I have dnsmasq running there that forwards DNS around, that's the primary place I'm expecting problems, I mean with the exception of my internal DNS servers.

- Automated enrollment? Most of my dev/stg machines respin every other day. I understand enrollment is done via a code that can be e-mailed, so I presume it's a one-time-use code. I need some way for the machines to re-join the OpenZiti after being deleted, a base Ubuntu installed, and then Ansible run. For Nebula this would be by delivering the certificate to the machine.

Thanks!

View on HN

### create identity to enroll with ziti edge enroll clint_private_aws: ~$ ziti edge create identity user clintaws1 -o clintaws1.jwt New identity clintaws1 created with id: g1aO5i.7Ig Enrollment expires at 2022-05-26T21:18:40.289Z ### create identity to enroll with ziti-edge-tunnel clint_private_aws: ~$ ziti edge create identity user clintaws2 -o clintaws2.jwt New identity clintaws2 created with id: qCFO5s.YIg Enrollment expires at 2022-05-26T21:18:42.419Z Use "ziti edge create [command] --help" for more information about a command. ### enroll with ziti edge enroll clint_private_aws: ~$ ziti edge enroll clintaws1.jwt INFO generating 4096 bit RSA key INFO enrolled successfully. identity file written to: clintaws1.json ### enroll with ziti edge ziti-edge-tunnel clint_private_aws: ~$ ./ziti-edge-tunnel enroll -j clintaws2.jwt -i clintaws2.json [ 0.000] INFO ziti-sdk:ziti_enroll.c:94 ziti_enroll() Ziti C SDK version 0.26.29 @cc792e2(HEAD) starting enrollment at (2022-05-26T13:01:17.145) [ 0.000] INFO ziti-sdk:ziti_ctrl.c:371 ziti_ctrl_init() ctrl[ec2-18-188-201-183.us-east-2.compute.amazonaws.com] ziti controller client initialized [ 0.022] INFO ziti-sdk:ziti_enroll.c:41 verify_controller_jwt() verifying JWT signature [ 0.027] INFO ziti-sdk:ziti_ctrl.c:371 ziti_ctrl_init() ctrl[ec2-18-188-201-183.us-east-2.compute.amazonaws.com] ziti controller client initialized

Preliminary project throughput comparison testing in OCI Ziti Tests were run with a single fabric router running in same VCN with either the source or destination ziti endpoints Test method: Iperf3 tcp test with default settings with -t set to 60 Competing technologies were tested with defaults as per published installation instructions Investigating as to whether or not stun/direct connect is working for non-ziti technologies and possibly following suboptimal paths” Source Destination Ziti Edge Tunnel Ziti Router Tailscale Netmaker Wireguard Zero tier Open Internet OCP Singapore OCP Mumbai 90.9 Mb/s 127 Mb/s 48.6 Mb/s 28.4 Mb/s 23.2 Mb/s 25.5 Mb/s 377Mb/s OCP Phoenix OCP Ashburn 95.6 Mb/s 216 Mb/s 57.7 Mb/s 37.5 Mb/s 35.8 Mb/s 18.5 Mb/s 384 Mb/s OCP Singapore OCP Phoenix 74.7 Mb/s 105 Mb/s 15 Mb/s 16.0 Mb/s 17.7 Mb/s 13.1 Mb/s 115 Mb/s