Comment by dovholuknf

Not OP but I also work on the OpenZiti project. Yeah that's basically the idea. The biggest difference is that the "VPN Connection" is basically entirely handled by the SDKs on both sides and only available to strong identities that are authorized to send data/act as the server. No IP addresses to worrry about, no ports to open at all not even to localhost. Those SDKs connect to the overlay network (the "VPN"), the network sends the bits to the server and you have a solid, zero trust MQTT connection with e2ee as well. Neat stuff.