Skip to main content
Star us on GitHub Star

Run a Controller in a Public Cloud

1.1 Create a VM to be used as the Controller

  • It is easier to use resource group to organize and manage all your resources for this demo.
  • Create a resource group and change into that resource group.
  • Use + Create button to create a resource.
  • Azure will take you to the Marketplace screen. In the search bar, type in Ubuntu Server.
  • Choose "Ubuntu Server 22.04 LTS".


On the Create a virtual machine screen.

  • The Subscription and Resource group should already be filled.
  • In the Instance details section, enter the VM name.
  • Select the Region to host your VM.
  • Leave default Availability options and Security type(Standard).
  • Leave the selected image Ubuntu Server 22.04 LTS x64 Gen2.
  • For the Size, choose the appropriate size for your application. For this demo, Standard_B2s(2CPU,4 GB) size was used.


  • Next, choose Authentication type to log in to the VM. Logging in with a password is insecure.

  • Enter a username (remember the username, you will need it to log in to the VM), or leave the default user azureuser

  • Choose your SSH key

  • For inbound ports, select the ssh. You can add an extra port based on your OpenZiti setup.

  • You can leave everything default. Press Review + create Diagram

  • After the Validation passed. Press Create to create VM. Diagram

  • Important: If you are creating the network controller, you need to associate a DNS name to the public IP of your VM.

  • You can do this from "Virtual machine" page. Diagram

1.2 Firewall

  • Azure's firewall is blocking all incoming access to the VM. You will need to open the ports you configured for Ziti services. Here is an example of the firewall ports. Diagram

1.3 Login and Setup Controller

  • Once the VM is created, we can get the IP address (and the DNS name) of the VM from the Virtual machine screen.
  • Login to the VM by using defined user "username" (default username is azureuser) and the private sshkey:
ssh -i <private_key> <username>@<ip>
ssh -i <private_key> <username>@<dns-name>

Use a fully qualified domain name (FQDN) to deploy the controller.