What is ZeroTier?
ZeroTier is a virtual networking system that lets networked devices, VMs, containers and applications communicate as if they were on the same physical network. The ZeroTierOne README describes it as a programmable Ethernet switch that combines a cryptographically addressed peer-to-peer network, called VL1, with an Ethernet emulation layer similar to VXLAN, called VL2. VL2 adds access control rules for network micro-segmentation and security monitoring. Most traffic flows directly between peers, and ZeroTier offers free but slow relaying for nodes that cannot connect directly.
ZeroTier is developed by ZeroTier, Inc. The about page names Adam Ierymenko as founder and states that two years of spare-time coding led to an open-source release in 2013; the company terms of service give a San Francisco, California address. The product consists of the ZeroTier One agent, installed on every device, and a network controller that issues network configuration. ZeroTier Central is the hosted controller service, and the New Central documentation describes it as the next generation of that hosted controller, organized into organizations, network groups and networks.
According to the protocol documentation, each node has a 40-bit ZeroTier address derived from its public key, and a 64-bit network ID combines the controller's address with a 24-bit network number. Root servers help peers find each other. Public-key operations use Curve25519 and Ed25519, and packets are encrypted with 256-bit Salsa20 and authenticated with Poly1305. NAT traversal uses UDP hole punching, port prediction and, where available, uPnP or NAT-PMP port mapping.
The code is written mainly in C++ in the zerotier/ZeroTierOne repository. Since version 1.16.0 the core in node/ and the service in service/ and osdep/ are under the Mozilla Public License 2.0, while the network controller under nonfree/ is under the ZeroTier Source-Available License, which permits non-commercial use only; commercial use of those components requires a separate commercial license. The build documentation describes a ZT_NONFREE option for building a purely MPL daemon without the bundled controller. The latest GitHub release is 1.16.2, published on May 28, 2026, which raised the network specialist limit from 256 to 512, fixed delays when switching networks on Windows and updated the central controller build pipeline. Version 1.16.1 disabled metrics collection by default.
Similar projects on iThub include Tailscale, NetBird, Nebula and Netmaker.
ZeroTier screenshots
Explore the interface. Open a screenshot to view it at full size.
Template flow rules in New Central, from the ZeroTier documentation.
Member Devices view in New Central with a pending device and Authorize and Reject actions (annotated by ZeroTier).
Bridging diagram: a ZeroTier bridge joins a LAN segment and ZeroTier nodes into one Layer 2 network.
Members section of the legacy Central interface with annotations from the ZeroTier quickstart.
Source: official ZeroTier project page.
Key capabilities
- Virtual Layer 2 networks A ZeroTier network behaves like an Ethernet segment: members receive managed IPv4 or IPv6 addresses from pools defined on the controller, and the VL2 layer provides multicast and VLAN-style boundaries. Network IDs are 16 hexadecimal characters, and a device joins with
zerotier-cli joinor the app. - Peer-to-peer transport with relaying The VL1 layer connects nodes directly after NAT traversal. When a direct path is not possible, traffic is relayed by ZeroTier, and direct connection attempts continue periodically. Version 1.16.0 added network-specific relays as a preview.
- End-to-end encryption All ZeroTier traffic is encrypted end to end with keys held by the nodes. The protocol page states that VL1 does not provide forward secrecy. HELLO packet encryption can be enabled with
encryptedHelloEnabledinlocal.confsince 1.16.0. - Flow rules engine The rules engine defines traffic policies centrally that are enforced locally on each device. In New Central, template flow rules include a Layer 2 protocol filter (IPv4, IPv6 and ARP only) and a restricted mode that allows only selected services such as ICMP, SMB, DNS, HTTP, HTTPS or SSH. Tags and capabilities support micro-segmentation, and custom flow rules are listed in the Scale plan.
- ZeroTier Central The hosted controller manages networks, member authorization, IP assignment, routes and DNS. New Central adds organizations with their own billing, network groups, relationship-based access control and service accounts with API tokens for automation.
- Self-hosted network controller Every ZeroTier node can act as a controller. The controller guide creates networks and authorizes members through the local service API on port 9993 with an
X-ZT1-AUTHtoken, and stores state in thecontroller.ddirectory. The controller code is source-available for non-commercial use, and the pricing page lists self-hosted and air-gapped deployment under Enterprise. - APIs The API documentation covers the New Central API, the legacy Central API and the local client (service) API, with OpenAPI references. The pricing page lists API and AI agent access in the Essential plan.
- SSO and OIDC SSO with OIDC can be enabled per network so that members authenticate through an identity provider. OIDC single sign-on is listed in the Essential plan.
- Exit nodes and default routes The exit node guide routes all internet traffic of members through a Linux node. It uses a managed route of 0.0.0.0/0 to the exit node's ZeroTier IP and requires Allow Default on each member.
- Bridging physical networks A ZeroTier node can act as a Layer 2 bridge between a physical LAN and a ZeroTier network, so devices without the agent share an address range with ZeroTier members. The documentation also covers routing, gateway and masquerade setups.
- Audit logs and webhooks The documentation covers organization audit logs and webhooks. The pricing page lists 30-day audit logs on Essential and 90-day audit logs on Enterprise.
- Automation tools The documentation includes Terraform, Ansible deployment, cloud-init and MDM guides (including Intune) for provisioning agents and networks.
- libzt libzt is a library version of ZeroTier One that brings ZeroTier networking into an application in user space, without a system-wide virtual network interface.
- Plans The pricing page lists Personal (free, 10 devices, 1 network, non-commercial use only), Essential at $18 per month (10 devices, then $2.00 per device, 10 networks), Scale at $179 per month (100 devices, then $1.80 per device, unlimited networks) and Enterprise with custom pricing for 500+ devices. ZeroTier Quantum is a separate post-quantum platform sold through sales.
- Desktop clients The download page offers an MSI installer for Windows (version 1.6.6 for Windows 7 and Server 2012) and a PKG installer for macOS 10.13 or newer. FreeBSD has a community-maintained package.
- Linux installation
curl -s https://install.zerotier.com | sudo bashinstalls DEB or RPM packages and adds the repository, after which apt or yum handle updates. A GPG-verified variant of the script is also documented. - Mobile, NAS, routers and containers ZeroTier One apps are available for iOS and Android. Official Docker images are on Docker Hub, and the download page recommends Docker for NAS devices because native Synology, QNAP, ASUSTOR and Western Digital packages are deprecated. OpenWRT has a community port.
Where ZeroTier fits
Remote access to home and office devices
A user creates a network in ZeroTier Central, installs ZeroTier One on each device, joins the network ID and authorizes the new members in the Member Devices view. Members receive managed IPs and reach each other directly, including devices behind NAT on different internet connections. The quickstart walks through creating a network, joining devices and authorizing them.
Connecting servers across clouds and sites
VMs, containers and physical servers in different clouds or data centers join one network and communicate on a shared virtual subnet. The documentation includes AWS and Azure guides, Docker images and automation through Terraform, Ansible or cloud-init.
Extending a physical LAN
A node configured as a Layer 2 bridge connects a physical LAN to a ZeroTier network, so devices without the agent become reachable from remote members on the same address range. Routed and masqueraded gateway setups are documented as alternatives on the bridging and physical network integration pages.
Micro-segmentation with flow rules
Network administrators restrict traffic with the rules engine: a restricted network allows only selected services and ports, while tags and capabilities define which members may talk to each other. Rules are configured centrally and enforced locally on each member device.
Full-tunnel VPN through an exit node
A Linux node with IP forwarding and NAT serves as the default gateway for members that allow default routes, sending their internet traffic through that node's connection. The exit node guide lists the iptables and sysctl settings used on the gateway.
Embedding networking in applications
Developers use libzt to give an application its own ZeroTier connectivity in user space, or use the local service API and Central API to create networks and authorize members from their own software.
Install
curl -s https://install.zerotier.com | sudo bashReviews of ZeroTier
Be the first to share your experience with ZeroTier.
Write a review
Loading review form…
Alternatives to ZeroTier
TailscaleTailscale connects devices and services in a private network called a tailnet, with identity-based access policies, traffic routing and an API for automation.
NetBirdNetBird is a WireGuard-based overlay network from NetBird GmbH in Berlin. Agents connect peer to peer with relay fallback, while a management service applies group policies, posture checks, DNS and routes. It runs as NetBird Cloud or self-hosted.
NebulaNebula is an open-source, self-hosted overlay networking tool created at Slack. Hosts authenticate each other with certificates from your own CA, find peers through lighthouses, traverse NAT and filter traffic with group-based firewall rules.