OnlineGet expert advice in online chat
Create an accountLog in
  1. Blog
  2. Manuals

Building a VPN Network with ZeroTier: Step-by-Step Setup

4 min readUnixHost team
Building a VPN Network with ZeroTier: Step-by-Step Setup

In this guide we create a ZeroTier virtual network, connect a server, a computer and a phone to it, and then use one of the nodes to open access to a whole local network. How the technology works and how it differs from a regular VPN is covered in What Is ZeroTier.

Step 1. Create a network

  1. Sign up for the ZeroTier Central panel at zerotier.com.
  2. Click Create A Network. A network with a 16-digit identifier — the Network ID — appears.
  3. Open the network and give it a meaningful name.
  4. Make sure Access Control is set to Private: new devices can exchange data only after you approve them.
  5. Under IPv4 Auto-Assign, pick an address range that does not overlap with your local networks, for example 10.147.17.0/24.

Step 2. Install the client

Linux

curl -s https://install.zerotier.com | sudo bash

The script adds the ZeroTier repository, installs the package and starts the service. Check the status:

sudo zerotier-cli info

The reply shows the node address and the ONLINE status.

Windows and macOS

Download the installer from zerotier.com. After installation the ZeroTier icon appears in the notification area (Windows) or the menu bar (macOS).

Android and iOS

Install the ZeroTier One app from the app store.

Step 3. Join the network

Linux:

sudo zerotier-cli join 1234567890abcdef

Windows and macOS: click the ZeroTier icon, choose Join New Network and enter the Network ID.

Phone: tap + in the app, enter the Network ID and switch the network on.

Step 4. Authorise the devices

In the control panel open the network and scroll to Members. Every device that joined appears in the list with its node address.

  1. Tick Auth next to the device.
  2. Enter a name in the Name field so you can tell devices apart.
  3. Optionally assign a fixed address under Managed IPs.

Within a few seconds the node receives an address. Check on Linux:

sudo zerotier-cli listnetworks
ip -br a | grep zt

The network status should be OK, and the zt... interface should have an address from the chosen range.

Step 5. Test connectivity

From one device, ping another device’s ZeroTier address:

ping 10.147.17.25

See how the connection is established:

sudo zerotier-cli peers

In the connection type column, DIRECT means a direct link and RELAY means traffic goes through an intermediate server. Everything works over a relay, only slower.

The devices can now reach each other at their ZeroTier addresses: connect over SSH, open web interfaces and network shares as if on one LAN.

Step 6. Reach a local network through a gateway

Often you need to reach not only the device running ZeroTier but other devices on its network: a printer, a camera, a NAS. For that, one node on the local network is set up as a gateway.

Say the local network is 192.168.1.0/24, the gateway is a Linux machine and its ZeroTier address is 10.147.17.10.

On the gateway

Enable packet forwarding:

echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-zerotier.conf
sudo sysctl --system

Find the interface names:

ip -br a

Add NAT rules, using your own interface names — eth0 for the local network and ztabcdefgh for ZeroTier:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i ztabcdefgh -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o ztabcdefgh -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Save the rules:

sudo apt install iptables-persistent
sudo netfilter-persistent save

In the control panel

Under Managed Routes add a route:

  • Destination: 192.168.1.0/24
  • Via: 10.147.17.10

Every network member receives the route automatically and can reach devices on the local network at their usual addresses.

Step 7. Restrict access with rules

By default all members of a network see each other. Traffic can be restricted under Flow Rules. Example: allow only SSH, HTTPS and ping, and drop everything else:

drop
  not ethertype ipv4
  and not ethertype arp
  and not ethertype ipv6
;

accept ipprotocol icmp;
accept dport 22 and ipprotocol tcp;
accept dport 443 and ipprotocol tcp;
accept chr tcp_ack;
drop;

The accept chr tcp_ack rule lets through reply packets of established connections. After editing, click Save Changes — the rules reach all nodes within seconds.

Useful commands

sudo zerotier-cli info                    # node address and status
sudo zerotier-cli listnetworks            # networks and assigned addresses
sudo zerotier-cli peers                   # connections to other nodes
sudo zerotier-cli leave 1234567890abcdef  # leave a network
sudo systemctl restart zerotier-one       # restart the service

If something does not work

  • Network status ACCESS_DENIED. The device is not authorised — tick Auth in the panel.
  • Status stays at REQUESTING_CONFIGURATION. The node cannot reach the controller: check that outgoing UDP port 9993 is not blocked.
  • Connection only through RELAY. Open incoming UDP port 9993 in the firewall on at least one of the two devices — on a server that is sudo ufw allow 9993/udp.
  • No access to the local network behind the gateway. Check packet forwarding and the NAT rules on the gateway, and that the route in the panel points to the right address.
  • Ping works but a service is unreachable. A firewall on the target device or the flow rules are in the way.

Removing a device from the network

To revoke access for a lost or unneeded device, untick Auth in the member list and delete the entry. On the device itself run zerotier-cli leave with the network ID.

Related articles