ZeroTier: Virtual Networks with Controllers and Flow Rules

🌏 中文版

ZeroTier creates a software-defined virtual Ethernet network. Each node has a cryptographic identity. A controller authorizes membership and distributes managed addresses, routes, and capabilities, while the data plane prefers direct peer-to-peer paths and can relay through root infrastructure.

Controllers configure; nodes carry data

Hosted ZeroTier Central is the common controller, and self-hosting is supported. A self-hosted controller does not automatically replace public roots: controllers and planet/root infrastructure have distinct jobs. Private roots require moons or a custom planet plus discovery, upgrade, and availability work. Test how controller loss affects established traffic and new authorization.

Managed routes expose a physical subnet through a member. Routing or layer-2 bridging can reach legacy devices without clients. Bridging also imports broadcast traffic, loops, MTU problems, and a larger failure domain, so avoid stretching a broadcast domain unless L2 semantics are required.

Flow Rules execute in the distributed data plane and can accept, drop, redirect, or rate-limit based on tags, addresses, protocols, and ports. They are stronger than a peer list and easier to make overly permissive. Start deny-first, version policies, test with dedicated nodes, and retain controller audit evidence.

ZeroTier fits cross-platform fleets, branch networks, labs, games, and L2 requirements. WireGuard is smaller and manual; Tailscale centers identity ACLs over WireGuard; Twingate maps users to resources; Teleport audits infrastructure sessions. Verify NAT traversal, relay fallback, CIDR overlap, DNS, IPv6, MTU, controller compromise, member revocation, route spoofing, and bridge loops.

References

• ZeroTier documentation
• ZeroTier protocol
• Network controllers
• Rules engine
• Route between physical and virtual networks