Network

ZeroTier: when you need a virtual Ethernet switch, not just IP routing

You need to connect two local networks together so a device on one can discover another via local network discovery (mDNS, UPnP, a NAS announcing itself via broadcast), not just ping it by IP. You try a classic Layer 3 VPN and find out those protocols simply don’t traverse a regular IP tunnel, because they depend on sitting on the same Ethernet segment. That’s where the ZeroTier conversation starts.

ZeroTier is a software-defined networking (SDN) platform, open source for the client and controller side (BSL 1.1 license), with code on GitHub . Unlike WireGuard or Tailscale, ZeroTier doesn’t use the WireGuard protocol: it has its own encrypted protocol, built from scratch for a different purpose, to emulate a full Ethernet switch, not just a point-to-point IP tunnel. We evaluated it as an option for scenarios where Layer 2 matters; in production we run plain WireGuard.

What ZeroTier actually is

A ZeroTier network is identified by a 16-digit hexadecimal ID and behaves, from the perspective of connected devices, as a single virtual Ethernet segment, regardless of how many continents physically separate its members. Every device gets a virtual interface that participates in this segment, with full support for broadcast and multicast, exactly like on a physical switch.

Peer discovery happens through global root servers, called “planets,” operated by ZeroTier as public bootstrap infrastructure. On top of that, you can add your own “moons,” self-hosted relay/discovery servers, for cases where you want more control or redundancy independent of ZeroTier’s infrastructure. The network controller, the one that decides who’s part of the network and what rules apply, can also be self-hosted.

Why this approach matters

The Layer 3 model that WireGuard and Tailscale use is simple and efficient for most cases: IP routing between distinct networks. But there’s an entire class of applications that assume they’re sitting on the same physical network segment: device discovery via UDP broadcast, legacy industrial protocols, LAN games looking for servers via broadcast, management systems that rely on ARP and multicast to find each other. None of that works through a pure Layer 3 tunnel, no matter how well encrypted it is.

ZeroTier solves exactly this problem: by emulating Layer 2, any protocol that would work on a local network also works on the ZeroTier virtual network, even if members are spread across different servers in different countries. It’s the difference between “I have a connection to that server” and “that server is, from every software perspective, in the same room as me.”

What you get out of the box

Full Layer 2 emulation: working broadcast and multicast over the internet, not just unicast routing.
16-digit network ID: a network is identified and administered through a single identifier, easy to distribute to new members.
Rules engine / flow rules: a rules language that filters traffic inside the virtual network (equivalent to an internal firewall on the emulated segment).
Global root servers (“planets”) + your own moons: peer discovery without depending 100% on public infrastructure, if you choose to host your own relays.
Self-hostable network controller: you can run your own server that decides membership, without depending on the ZeroTier Central SaaS console.
Clients on every major platform, including routers and embedded devices.

Installing ZeroTier on a VPS

Installing the standard client is straightforward on any Linux distro:

curl -s https://install.zerotier.com | sudo bash
sudo zerotier-cli join <network-id>

After joining, the member shows up in the network’s admin list (either in ZeroTier Central or your self-hosted controller) and must be manually authorized before it can pass real traffic, a simple but essential security step.

For a self-hosted network controller on your own VPS (instead of using ZeroTier Central), you run the ztncui service or a similar controller on top of zerotier-one in controller mode:

docker run -d \
  --name zerotier-controller \
  --net=host \
  --device=/dev/net/tun \
  --cap-add NET_ADMIN --cap-add SYS_ADMIN \
  -v zerotier-data:/var/lib/zerotier-one \
  zyclonite/zerotier

The admin interface (either ztncui or the local API on port 9993) should never be exposed publicly. Lock it down:

ufw deny 9993/tcp
ufw allow from <your-ip> to any port 9993 proto tcp
ufw allow 9993/udp

You need a VPS with TUN/TAP support and access to the necessary kernel modules; check our VPS plans for a clean base to run it on.

Configuration patterns worth knowing

Manual authorization is not optional

Never leave a ZeroTier network on auto-authorize in production. Every new device must be explicitly approved in the admin console; otherwise, anyone who finds the network ID (which isn’t a strong cryptographic secret) can request to join.

Use flow rules, not just membership

Being a member of the network doesn’t mean a device should see all traffic. Write explicit rules (ZeroTier’s flow rules language) for internal segmentation, exactly like you’d do with VLANs on a physical network.

Self-host the controller if security requires it

If your internal policy doesn’t allow network membership to be decided by an external SaaS service, run your own controller. It’s officially documented and supported, not a hack.

Your own moons for latency and independence

If discovery through public “planets” adds extra latency, or you want a bootstrap path independent of ZeroTier’s infrastructure, host your own “moons” on servers you control.

Where ZeroTier is not the right answer

If all you need is simple routing between two servers or point-to-point administrative access, the complexity of an emulated Layer 2 network isn’t justified: WireGuard does the job more simply and faster. At large scale (thousands of devices), emulated broadcast and multicast over the internet can themselves become a source of unnecessary traffic if the applications on the network are inherently chatty, a trade-off inherited by any Layer 2 network, physical or virtual.

The BSL 1.1 license is also different from a classic permissive license; check it if you have strict compliance constraints around the type of open-source license accepted in your organization.

Alternatives we considered

WireGuard : simpler, faster, but strictly Layer 3; the right choice when you don’t need broadcast/multicast.
Tailscale : same Layer 3 philosophy as WireGuard, but with automatic coordination and SSO; doesn’t solve the Layer 2 need though.
Physical VLANs/VXLAN over a dedicated private network: if you already have your own infrastructure between locations, a classic VXLAN tunnel can be more predictable than a public overlay SDN.

So, should you run it?

If your real need is “these devices need to behave as if they’re on the same cable,” ZeroTier is one of the few tools that solves this properly, with native Layer 2 support and a solid rules engine for internal segmentation. If your need is just “these servers need to talk to each other securely,” check WireGuard first, it’s simpler to operate and understand.

Want to test a self-hosted ZeroTier controller or a stable network node? Start from a VPS with us, or let us configure it through server administration .