Gah. I need to file an issue to provide better help here. Both openziti and NetFoundry instructions should be just fine. Your command is just missing the resultant identity file... the -i flag and produces NO helpful output :(

Below I made two identities and enrolled one with the 'ziti cli' and the other with 'ziti-edge-tunnel'

    ### create identity to enroll with ziti edge enroll
    clint_private_aws: ~$ ziti edge create identity user clintaws1 -o clintaws1.jwt
    New identity clintaws1 created with id: g1aO5i.7Ig
    Enrollment expires at 2022-05-26T21:18:40.289Z

    ### create identity to enroll with ziti-edge-tunnel
    clint_private_aws: ~$ ziti edge create identity user clintaws2 -o clintaws2.jwt
    New identity clintaws2 created with id: qCFO5s.YIg
    Enrollment expires at 2022-05-26T21:18:42.419Z
    Use "ziti edge create [command] --help" for more information about a command.

    ### enroll with ziti edge enroll
    clint_private_aws: ~$ ziti edge enroll clintaws1.jwt
    INFO    generating 4096 bit RSA key
    INFO    enrolled successfully. identity file written to: clintaws1.json

    ### enroll with ziti edge ziti-edge-tunnel
    clint_private_aws: ~$ ./ziti-edge-tunnel enroll -j clintaws2.jwt -i clintaws2.json
    [        0.000]    INFO ziti-sdk:ziti_enroll.c:94 ziti_enroll() Ziti C SDK version 0.26.29 @cc792e2(HEAD) starting enrollment at (2022-05-26T13:01:17.145)
    [        0.000]    INFO ziti-sdk:ziti_ctrl.c:371 ziti_ctrl_init() ctrl[ec2-18-188-201-183.us-east-2.compute.amazonaws.com] ziti controller client initialized
    [        0.022]    INFO ziti-sdk:ziti_enroll.c:41 verify_controller_jwt() verifying JWT signature
    [        0.027]    INFO ziti-sdk:ziti_ctrl.c:371 ziti_ctrl_init() ctrl[ec2-18-188-201-183.us-east-2.compute.amazonaws.com] ziti controller client initialized

Thanks for that pointer, I was able to enroll my Linux machine with: "ziti-edge-tunnel enroll -j my.jwt -i my.json" and then get connected using "ziti-edge-tunnel run -i my.json" (note that "ziti-edge-tunnel run my.json" doesn't fail, but also doesn't seem to register with the NetFoundry servers).

So that "enroll" step seems to be missing from the various "getting started" guides.

I went through the rest of the hello world example, but ran into various problems. My Mac never showed the service I created. I was never able to do DNS resolution, probably because systemd-resolved is running (and relied upon) on port 53 on the Linux side. Not sure why the Mac side couldn't do DNS resolution, probably similar (but I'm using the Mac DNS services, also relied upon to get DNS resolution to my work VPNs), possibly related to the lack of the service showing up in the Mac Ziti client.

I tried both a service by name and a service by IP, but wasn't able to connect to the IP from either machine, and iptables on the Linux side never showed the IP I gave the service.

I like the promise of OpenZiti, but man is it hard to set up. I'd say I've easily got more time in setting up OpenZiti and still haven't been able to successfully pass traffice, than I have in setting up ZeroTier, Nebula, and Wireguard combined. Just for a point of reference.

> I like the promise of OpenZiti, but man is it hard to set up.

clearly that's not an acceptable user experience! I will take this to heart and try to make a much more clear guide on this. Probably one which does some kind of matrix of all the tunneling clients.

Thank you so very much for your time and energy here. If I can help at all, I'd be eager to.

Your comments are hard to hear, but so very much appreciated! It'll help us make a better overall experience