ZeroTier

Definition

ZeroTier is a software-defined networking and VPN platform that creates virtual Ethernet networks connecting devices across the internet as though they were on the same local area network. It combines a custom peer-to-peer networking protocol with a centralized controller for managing network membership, addressing, and access rules, letting distributed devices communicate securely without traditional VPN hardware or manually configured routers and firewalls.

Overview

ZeroTier was built to solve a problem that predates modern mesh VPNs: connecting devices scattered across homes, offices, and cloud providers into a single logical network without the overhead of configuring routers, firewalls, and site-to-site VPN tunnels for every pair of locations. Rather than treating networking as a set of point-to-point tunnels, ZeroTier models the problem as a virtual layer-two Ethernet network, letting devices behave as if they were plugged into the same physical switch regardless of their real-world location. Mechanically, ZeroTier assigns each device a cryptographic identity and joins it to one or more virtual networks defined through a controller, which can be ZeroTier's hosted service or a self-hosted alternative. Once joined, devices exchange traffic using ZeroTier's own protocol, which handles peer discovery, encryption, and NAT traversal, attempting direct peer-to-peer paths and falling back to relay nodes when direct connectivity is not possible. Because the abstraction is a virtual Ethernet segment rather than just an IP tunnel, ZeroTier networks can carry broadcast and multicast traffic and support more traditional local-network behaviors than typical layer-three VPNs. Compared to Tailscale, which layers identity and automation on top of the WireGuard protocol, ZeroTier uses its own custom cryptographic and transport protocol and emphasizes the virtual switch model over a strict point-to-point tunnel abstraction. Compared to traditional site-to-site VPN appliances or IPsec tunnels, ZeroTier removes the need to configure routing and firewall rules for every pair of connected sites, instead managing membership and access centrally through its controller. In practice, ZeroTier is used to connect Internet of Things devices, home lab servers, and distributed development or gaming setups into a shared virtual network, as well as by small businesses linking multiple office locations or cloud instances without dedicated networking hardware. Its layer-two model also appeals to use cases needing protocols that depend on local network discovery, such as certain media-sharing or device-discovery protocols that do not route well over plain IP tunnels. The trade-offs include a dependency on ZeroTier's own protocol implementation rather than a widely audited standard like WireGuard, and the fact that very large or high-throughput networks can encounter performance or scaling considerations tied to its virtual switch model and relay infrastructure. Organizations that need the simplest possible point-to-point tunnels, or that prefer to build on a protocol with the broad, independent security scrutiny that WireGuard has received, sometimes choose alternatives instead. Very large deployments should also weigh the operational maturity of a given controller option, since a self-hosted controller shifts responsibility for uptime and network membership management back onto the organization running it.

Key Features

• Creates virtual layer-two Ethernet networks over the internet
• Assigns each device a unique cryptographic network identity
• Supports broadcast and multicast traffic unlike typical layer-three VPNs
• Uses a centralized controller to manage network membership and rules
• Attempts direct peer-to-peer connections with relay fallback
• Offers both a hosted controller and self-hosted controller option
• Provides fine-grained rules for network access and flow control
• Runs across desktop, mobile, server, and embedded platforms

Use Cases

Alternatives

Frequently Asked Questions

Related in DevOps