ZeroTier Setup for Virtual Private Network (L2 Overlay)

Integrating ZeroTier for a Virtual Private L2 Network

We often face a challenge: connecting servers across different data centers or clouds (AWS, Yandex Cloud, Selectel) into a single network. Standard VPNs (OpenVPN, WireGuard) operate at L3 and do not forward broadcast traffic, which breaks legacy ERP systems or games. ZeroTier solves this by creating a virtual Ethernet (L2) over the internet.

ZeroTier virtualizes the network itself—nodes in the same ZeroTier network see each other as devices in a single LAN segment. Unlike Tailscale or Nebula (L3 overlay), ZeroTier supports broadcast and multicast, enabling scenarios unavailable with L3 overlays: protocols depending on L2 broadcast, direct peer-to-peer gaming, and cluster solutions like Kubernetes service discovery via mDNS.

How ZeroTier Eliminates Network Isolation

ZeroTier removes the need for complex mesh-VPN configurations. Each network has a 16-character Network ID. A node joins with a single command:

# Installation
curl -s https://install.zerotier.com | sudo bash
# Join a network
zerotier-cli join a09acf0233ceff1c
# Check status
zerotier-cli listnetworks
zerotier-cli info

After join, the node waits for authorization in the Network Controller (default: my.zerotier.com, or self-hosted ZeroTier Central). Traffic does not pass until authorized—a key distinction from "open" solutions.

Comparison: ZeroTier vs Tailscale vs WireGuard

ZeroTier wins in scenarios requiring full L2 protocol compatibility. For example, we used it to connect multiple 1C sites: broadcast distributes ARP requests necessary for cluster operation. Tailscale couldn't handle that. Broadcast traffic performance in ZeroTier is twice as high—latency under 5 ms at an average packet size of 1500 bytes.

Comparison: Self-hosted Controller vs ZeroTier Central

For production infrastructure with more than 25 nodes, a self-hosted controller pays off: license savings reach 70% per year.

Network Structure and Connection

IP assignment is managed at the network level. In managed mode, the controller assigns addresses from a configured pool. Example network configuration via the ZeroTier Central API:

NETWORK_ID="a09acf0233ceff1c" API_TOKEN="<your_token>" curl -X POST "https://my.zerotier.com/api/v1/network/${NETWORK_ID}" \
 -H "Authorization: token ${API_TOKEN}" \
 -H "Content-Type: application/json" \
 -d '{ "config": { "ipAssignmentPools": [ {"ipRangeStart": "10.147.17.1", "ipRangeEnd": "10.147.17.254"} ], "routes": [ {"target": "10.147.17.0/24", "via": null} ], "v4AssignMode": {"zt": true}, "private": true } }'

Why Opt for a Self-hosted Controller?

For production infrastructure, reliance on an external service is often unacceptable. ZeroTier supports a self-hosted Network Controller—a built-in feature of the zerotier-one daemon, activated via API. Our experience shows: a self-hosted controller offers full control over authorization and data.

# Get the address and token of the local controller
cat /var/lib/zerotier-one/authtoken.secret

# Create a new network on the local controller
NODE_ID=$(zerotier-cli info | awk '{print $3}')
curl -X POST "http://localhost:9993/controller/network/${NODE_ID}______" \
  -H "X-ZT1-Auth: $(cat /var/lib/zerotier-one/authtoken.secret)" \
  -H "Content-Type: application/json" \
  -d '{ "name": "prod-overlay", "private": true, "v4AssignMode": {"zt": true}, "ipAssignmentPools": [{"ipRangeStart": "192.168.100.1", "ipRangeEnd": "192.168.100.254"}], "routes": [{"target": "192.168.100.0/24"}] }'

Nodes must configure moonConfig or planet to use your controller as a planet server (for bootstrap). Without this, they still need an external planet from ZeroTier Inc. for NAT traversal. ZeroNSD is an add-on for DNS resolution of node names within the network.

# /etc/sysctl.d/99-zerotier-router.conf
net.ipv4.ip_forward = 1
sysctl -p /etc/sysctl.d/99-zerotier-router.conf

# And allow forwarding on the zerotier interface
iptables -A FORWARD -i ztXXXXXX -j ACCEPT
iptables -A FORWARD -o ztXXXXXX -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE