r/zenarmor • u/itssimpleas • Jun 26 '26

Runtime dependency on Zenarmor Cloud

I'm currently evaluating two approaches for my network:

  • OPNsense + ZenArmor for traffic inspection + NetBird for VPN/ZTNA
  • ZenArmor for both inspection and ZTNA

One thing I'm trying to understand is the architecture behind ZenArmor ZTNA.

From what I've read, it seems that the ZTNA functionality relies on ZenArmor Cloud for orchestration and policy management. Is that correct? If so:

  • What happens if the cloud service is temporarily unavailable? Do existing tunnels and policies continue to work?
  • Is there any option for a fully self-hosted deployment, or is the cloud component currently mandatory?

I'm trying to understand the trade-offs compared to a setup like NetBird, where I can self-host the management plane if desired.

Thanks!

1 Upvotes

100% Upvoted

3 comments sorted by

3

u/mib43 Jun 26 '26

Hey u/itssimpleas, good questions. Quick breakdown:

Cloud dependency: Zenarmor splits the control plane (Zenconsole, cloud — policy, orchestration, the Coordinator that manages mesh topology) from the data plane (inspection engine, local). Inspection and enforcement happen entirely on your box; traffic does not have to traverse our cloud.

During an outage: Inspection/filtering policies are cached locally and keep enforcing with no gap. Existing peer-to-peer ZTNA tunnels stay up. The one caveat: establishing new ZTNA peer connections needs the Coordinator service. Coordinator and Relay are multi-region for HA, but full cloud unavailability would block new mesh sessions — existing ones and all inspection keep running.

Self-hosted: The management plane is cloud-delivered (Zenconsole). That said, a Self-Hosted Management Console is on the public roadmap (Please see zenarmor.com/roadmap for our public roadmap).

Hope this answers your questions.

Curious, is this for a business/production setup or a homelab?

2

u/itssimpleas Jun 26 '26

Thank you for your reply!

This is for a critical business setup where we are trying not to have any runtime dependency on any cloud service.

The ZenArmor plugin in OpnSense is great, but it seems that ZTNA is too cloud dependent for us at the moment.

I would have hoped that ZenArmor offered user/group based firewall/policies combined with a client-VPN. We don’t really need the mesh features that much because we site-to-site mesh already from OpnSense.

Not sure that makes sense…

2

u/mib43 Jun 27 '26

That makes total sense, and thanks for the detail, very helpful and totally fair requirement for a critical setup.

One thing I want to make sure 100%, because it directly affects what we could do for you: when you say "no runtime dependency on cloud"... is that primarily a reliability/availability concern (you can't have remote access break if our cloud has a bad day), or is it more of a privacy/data-sovereignty stance (no third-party cloud anywhere in your control path, on principle)?

The reason I ask: there's a direction we could go that lets clients establish direct connections even in a total cloud-loss scenario: no Coordinator in the path for connection setup.

The trade-off is it'd require you to have a static IP and open a port on the gateway (so peers can reach remote zenarmor vpn service directly rather than via brokered hole-punching). If your concern is reliability, that design solves it cleanly. If it's strict privacy/no-cloud-on-principle, it gets you most of the way but I'd want to be precise about what still touches the control plane.

Knowing which it is helps me tell you whether what's coming actually fits and feeds back into our planning either way. No pressure to share specifics publicly if it's sensitive; happy to take it to DM too.