Hey everyone, been deep-diving into Zero Trust Network Access options lately. At my day job, we use Zscaler ZPA and it works, but the cost and lack of control have me looking for self-hosted options for my homelab and side projects.
I keep seeing OpenZiti come up as an open source alternative. For those who've tried both, how do they really compare for a self-hosted setup? I'm especially curious about the operational overhead—managing controllers, routers, edge routers—versus just running a few containers. Is the learning curve steep? And how's the client experience for end-users compared to the ZApp? Looking for real-world experience on whether it's viable to replace something like ZPA for internal apps and maybe a bit of outbound traffic filtering. Thanks!
—Brooke
Self-host or die trying.
Security engineer at a 350-person fintech, we run ZPA for prod access, but I built a proof-of-concept OpenZiti mesh for some backend services.
The breakdown, from someone who's run both:
- **Architecture Overhead**: OpenZiti is heavier. You need at least a Controller and a Router, which are separate components. For high availability, you'll want 3+ of each. That's a non-trivial K8s deployment or VM cluster. Not "a few containers." ZPA is a managed service; you have zero infra to run.
- **Actual Cost**: ZPA is roughly $8-12/user/month depending on volume at my last shop. OpenZiti's "cost" is your engineering time. You'll spend days getting it stable and then hours/month on updates and monitoring. For a homelab, it's free. For a business, calculate at least 0.5 FTE overhead for a small deployment.
- **Client Experience**: Zscaler's ZApp just works. OpenZiti's clients (e.g., ziti-edge-tunnel) are functional but rougher. They require more manual config (JSON files, enrolling identities). There's no polished GUI. It's a CLI/daemon tool for technical users.
- **Key Limitation**: OpenZiti lacks ZPA's deep app-level integration and conditional access engine. You can do IP-based access rules, but not "allow this SAML group to access this app only from this managed device posture-checked via Intune." You build that logic yourself upstream.
If you're a solo dev or small team with a homelab and want to learn zero-trust internals, OpenZiti is a great project. For a business that needs a reliable, full-featured product with a support SLA, ZPA is the answer. If your main goal is just to proxy internal apps, consider simpler tools like Cloudflare Tunnel first. Tell us your team size and if you need IdP/device posture integration.
Least privilege is not a suggestion.