ZeroTier creates a virtual Ethernet network across the internet. Servers, laptops, phones and home devices join a network ID, get private IP addresses, and talk to each other as if they were on one LAN, even behind NAT or firewalls, with no ports to open. It’s a popular alternative to running your own VPN server, and a sibling of mesh VPNs like Tailscale.

How it works

  • Each device runs the ZeroTier client and gets a 10-digit node ID.
  • A network controller (ZeroTier’s hosted service, or your own) manages networks, members and IP assignment.
  • Devices find each other through root servers, then connect peer-to-peer wherever possible (NAT hole punching), falling back to relays when not.
  • Traffic is encrypted end to end between members.

It works at layer 2 (Ethernet), so broadcasts and multicast work too. That’s handy for LAN games and some discovery protocols.

1. Create a network

Sign in at ZeroTier Central (my.zerotier.com) and create a network. Note the network ID (16 hex characters). In the settings:

  • Access control: Private (the default), so new members need approval;
  • IPv4 auto-assign: pick a range that doesn’t clash with your other networks, such as 10.147.17.0/24. See private IP ranges.

2. Install on your VPS (Linux)

curl -s https://install.zerotier.com | sudo bash
sudo zerotier-cli info               # shows your node ID and status
sudo zerotier-cli join <network-id>

(Read install scripts before piping them to bash. Packages are also available for many distributions.)

3. Authorise the member

In ZeroTier Central, find the new member in the network’s member list, tick Auth, and give it a recognisable name. It receives an IP from the auto-assign range:

sudo zerotier-cli listnetworks
ip addr show | grep -A2 zt

4. Join other devices

Install ZeroTier on your laptop (Windows, macOS, Linux), phone (iOS, Android) or NAS, join the same network ID, and authorise each one. Now:

ping 10.147.17.10                     # the VPS's ZeroTier IP
ssh [email protected]

Use cases

  • Private admin access: SSH, databases and dashboards on the VPS reachable only over ZeroTier. Bind services to the ZeroTier IP and close public ports. See zero trust networking.
  • Connect home and cloud: reach a home NAS from a VPS without port forwarding, even behind CGNAT. See NAT explained.
  • Multi-server private network across providers and locations.
  • LAN gaming with friends.

Firewall the VPS for ZeroTier-only services

ZeroTier uses UDP port 9993. Outbound is enough, though opening it inbound helps direct connections:

sudo ufw allow 9993/udp
# allow SSH only from the ZeroTier network, and drop public SSH:
sudo ufw allow in on ztXXXXXXXX to any port 22 proto tcp
sudo ufw delete allow 22/tcp

Replace ztXXXXXXXX with your interface name from ip -br link. Test the ZeroTier SSH path before removing public SSH, and keep the VNC console available as a fallback.

Route to a whole subnet (gateway)

To reach other machines behind the VPS (for example its private network or Docker networks) via ZeroTier:

  1. In Central, add a managed route: 10.0.0.0/24 via 10.147.17.10 (the VPS’s ZeroTier IP).
  2. On the VPS, enable forwarding and NAT:
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-zt.conf && sudo sysctl --system
sudo iptables -t nat -A POSTROUTING -s 10.147.17.0/24 -o eth1 -j MASQUERADE

See port forwarding.

Flow rules (network-wide firewall)

ZeroTier Central lets you write flow rules for the whole network, such as “laptops may reach servers on port 22 and 443 only”. This is a powerful way to segment members without per-host firewall rules.

Self-hosting the controller

The hosted controller is convenient (with free-tier limits on devices). For full control, run your own: the ZeroTier client includes a controller API, and open-source UIs like ztncui or ZeroUI make it manageable. Members still use ZeroTier’s public root servers for discovery, unless you also run custom roots (“moons”).

ZeroTier vs Tailscale vs WireGuard

ZeroTier Tailscale WireGuard (plain)
Layer L2 (Ethernet) L3 (IP) L3 (IP)
NAT traversal Yes Yes No (needs a reachable endpoint)
Identity and SSO Basic Strong (OIDC, ACLs) None
Self-hosted control ZeroTier controller Headscale Not needed
Setup effort Low Very low Moderate

See Tailscale, Headscale and WireGuard.

Quick reference

Task Command
Install curl -s https://install.zerotier.com | sudo bash
Status zerotier-cli info
Join zerotier-cli join NETWORK_ID
List networks zerotier-cli listnetworks
Peers zerotier-cli peers
Leave zerotier-cli leave NETWORK_ID
Port UDP 9993

Related: VPN vs proxy and SSH jump hosts.

  • VPN
  • Networking
  • Self-Hosting