ZeroTier — Programmable Layer-2 Overlay Network

What it is

ZeroTier is an open-source software-defined networking tool that creates encrypted peer-to-peer Layer-2 overlay networks. It connects devices across NATs, firewalls, clouds, and on-premises infrastructure as if they were on the same local network. A controller API and flow rule engine let you define network policies programmatically.

ZeroTier is for teams that need to connect servers, containers, IoT devices, or developer machines across different networks without traditional VPNs or complex firewall rules.

How it saves time or tokens

ZeroTier eliminates VPN server setup and maintenance. Instead of configuring WireGuard or OpenVPN servers, punching firewall holes, and managing certificates, you install ZeroTier on each device and join a network ID. Peer-to-peer connectivity is automatic, even behind double-NAT.

The controller API means network changes are programmable. Add or remove members, change IP assignments, or update flow rules via REST API calls instead of manual configuration.

How to use

1. Install ZeroTier:

# Linux / macOS
curl -s https://install.zerotier.com | sudo bash

# Or via package managers
brew install zerotier-one       # macOS
apt install zerotier-one        # Debian/Ubuntu

1. Create a network at my.zerotier.com or run a self-hosted controller.

1. Join the network on each device:

sudo zerotier-cli join <network-id>

Example

Using the ZeroTier API to manage a network programmatically:

# List network members
curl -s -H 'Authorization: token YOUR_API_TOKEN' \
  'https://api.zerotier.com/api/v1/network/NETWORK_ID/member'

# Authorize a new member
curl -X POST \
  -H 'Authorization: token YOUR_API_TOKEN' \
  -d '{"config": {"authorized": true}}' \
  'https://api.zerotier.com/api/v1/network/NETWORK_ID/member/MEMBER_ID'

Once authorized, the device gets a virtual IP and can communicate with all other members as if on the same LAN.

Related on TokRepo

• AI tools for DevOps -- Infrastructure and networking tools
• Self-hosted tools -- Self-hosted alternatives for networking and services

Common pitfalls

• Leaving networks in public mode (auto-authorize). Any device that knows the network ID can join. Always use private networks and manually authorize members.
• Ignoring flow rules. ZeroTier defaults to allow-all traffic between members. Define rules to restrict access between roles (e.g., only allow SSH from admin devices).
• Expecting ZeroTier to replace a firewall. ZeroTier handles connectivity, not host-level security. Still run iptables or nftables on each device.