I finally understand Cloudflare Zero Trust tunnels

Re:I finally understand Cloudflare Zero Trust tunnels by indigo945 on Monday November 17, 2025 @10:50AM (#45954647)

    > It'll still terminate TLS at the servers, though. It's not mTLS all the way 
    > through to the endpoint.

That was the entire point, though. If NetFoundry Frontdoor can see the traffic (because it gets terminated on their servers, mTLS or not), then it's not end-to-end encrypted as the parent commenter claimed.

[ Parent | on HN ]

Re:I finally understand Cloudflare Zero Trust tunnels by gz5 on Monday November 17, 2025 @03:11PM (#45957709)

i should have been more clear - you have the option:

+ e2ee via netfoundry's zero trust products

+ non-e2ee via netfoundry frontdoor

[ Parent | on HN ]

Re:I finally understand Cloudflare Zero Trust tunnels by gormami on Monday November 17, 2025 @03:24PM (#45957851)

I think the issue is zrok vs. NetFoundry/OpenZiti. Zrok is the easy button to project a public endpoint from inside a network. It is not encrypted all the way through, as it is a proxy solution. NetFoundry/OpenZiti provides methods to provide tunnels all the way through. NetFoundry is a company, OpenZiti is a FOSS project/technology sponsored by NetFoundry, and zrok is a product of NetFoundry built on OpenZiti tech, so it is easy to cross things up. I think the comment was in regard to NetFoundry/OpenZiti, while your response referenced zrok. The list above has both.

[ Parent | on HN ]