yes, zrok is open source and tailscale is not. zrok has a private share mode in which you share the resource without any internet exposure (not even temporary)

yes, zrok is open source and tailscale is not. zrok has a private share mode in which you share the resource without any internet exposure (not even temporary) - nice for security and cases where you need 2 or more private enviros (rfc 1918 space) to talk w/o opening any ports. if your question was centered on the compare between wireguard and openziti. both are open source network overlay solutions and both have large scale saas options (e.g. cloudziti from netfoundry; tailscale for wireguard). 4 key differences between openziti vs wireguard are (1) app vs. device; (2) p2p tunnel vs full mesh; (3) management model; (4) security model. it mainly comes down to what your use case needs and doesn't need. (1) app vs. device the atom of wireguard is a device. the atom of openziti is an app. devs embed openziti directly into the process space of an app or api as code (using openziti sdks) such that installing your app spins up a zero trust overlay for your app w/o distributing agents. alternatively you can use openziti agents for mobile, desktop, cloud edge, etc. in that model, the agents are still app-specific, e.g. only services you specify go on the overlay; rest are ignored. (2) vpn vs. sdn like mesh wireguard gives you p2p tunnels like most vpns. openziti gives you control of a full mesh, latency optimized network - like a programmable sdn. if you want x connections from a given machine (e.g. an api to cloud1, a different service to cloud2, some other app to cloud3) then openziti is designed to make that simple for you. if you want a single device level tunnel for all data, then wg may be for you. (3) management model with wg, you manage certs, p2p tunnels, restrictions/ACLs (tailscale etc help you with much of this but then you are buying a closed source product). openziti builds all this into the foss for you. you even control the full mesh fabric (programmable ziti routers) listed above. so wg may be simpler if you have a limited # of endpoints, routes and restrictions to manage. (4) security and compliance model openziti provides mTLS, X.509 based identities, private DNS, e2e encryption all the way to the process space of the app (see item #1 above), default least privileged access, mfa, posture checks, etc. that is overkill for some uses - it does carry some complexity with it - wireguard may be a better choice for those cases.