Build a Private Network with ZeroTier on Linux and Windows

Plan the Network

ZeroTier creates encrypted virtual Ethernet networks between authorized devices. Each device receives a 10-character node address, and each network has a 16-character network ID.

This guide uses the following examples:

ZeroTier network: 10.147.20.0/24
Linux member: 10.147.20.10
Windows member: 10.147.20.20
Optional physical LAN behind the Linux member: 192.168.50.0/24

Select a ZeroTier subnet that does not overlap any LAN, VPN, container, or cloud network used by the members. Overlapping routes are a common cause of traffic going through the wrong interface.

A network ID identifies a network but does not authorize a member. Keep the network private and approve only node addresses that you have verified. Never publish identity.secret, authtoken.secret, or a ZeroTier Central API token.

Create a Private Network

Sign in to ZeroTier Central.
Create an organization and network if they do not already exist.
Keep the network private so new members require authorization.
Copy the 16-character network ID.
Configure an IPv4 auto-assignment pool inside a unique private subnet, such as 10.147.20.0/24.
Leave default-route and public-address management disabled unless the network is intentionally designed as a full-tunnel VPN.

The Central interface may label these settings differently as it evolves, but the network ID, member authorization, managed IPs, and managed routes remain the relevant controls.

Install ZeroTier on Linux

ZeroTier’s installer supports common Debian, Ubuntu, Fedora, RHEL, and compatible distributions. Download the script from the official site to a file so it can be inspected before it runs:

curl -fsSL https://install.zerotier.com -o /tmp/install-zerotier.sh
less /tmp/install-zerotier.sh
sudo bash /tmp/install-zerotier.sh
rm /tmp/install-zerotier.sh

The installer configures ZeroTier’s package repository and installs zerotier-one. Future updates should come through the operating system’s package manager:

sudo apt update && sudo apt upgrade zerotier-one

On a DNF-based distribution, use:

sudo dnf upgrade zerotier-one

Enable the service and confirm that the node is online:

sudo systemctl enable --now zerotier-one.service
sudo systemctl status zerotier-one.service --no-pager
sudo zerotier-cli info

A healthy node normally reports ONLINE. Record the 10-character node address shown by zerotier-cli info; use it to identify the correct member in Central.

Join the Network from Linux

Join the private network, replacing NETWORK_ID with its 16-character ID:

sudo zerotier-cli join NETWORK_ID

The command should return 200 join OK. List the network state:

sudo zerotier-cli listnetworks

Before authorization, a private network normally reports ACCESS_DENIED or REQUESTING_CONFIGURATION. This does not mean that the installation failed.

Install and Join on Windows

Download the Windows installer from the official ZeroTier download page.
Run the signed installer and allow the ZeroTier service and virtual network adapter to be installed.
Open the ZeroTier system-tray application and select Join New Network.
Enter the same 16-character network ID.

The same operation can be performed from Windows Terminal opened as an administrator:

zerotier-cli join NETWORK_ID
zerotier-cli listnetworks
zerotier-cli info

Check the Windows service independently of the tray application:

Get-Service -Name ZeroTierOneService

The background service provides the network connection. The tray application is only a user interface for controlling that service.

Authorize the Members

Return to the network in ZeroTier Central:

Open the member list.
Match each pending member’s node address with the value reported by zerotier-cli info on that device.
Give the member a descriptive name.
Authorize the member.
Confirm its automatically assigned managed IP, or assign a fixed managed IP inside the configured subnet.

Do not authorize a member based only on when it appeared in the list. Verify the node address on the device itself.

After authorization, check each client again:

sudo zerotier-cli listnetworks

The network should report OK, display a virtual interface name such as ztabcdef12, and show at least one managed IP address.

Set the Client Route Policy

For an ordinary split-tunnel network, allow private managed addresses and routes while rejecting public and default routes:

sudo zerotier-cli set NETWORK_ID allowManaged=1
sudo zerotier-cli set NETWORK_ID allowGlobal=0
sudo zerotier-cli set NETWORK_ID allowDefault=0
sudo zerotier-cli set NETWORK_ID allowDNS=0

Run the equivalent commands from an elevated Windows Terminal without sudo.

allowManaged=1 accepts ZeroTier-managed private IP addresses and routes.
allowGlobal=0 rejects managed routes for public address ranges.
allowDefault=0 prevents this network from replacing the system’s default route.
allowDNS=0 prevents this network from changing system DNS settings.

Enable allowDNS, allowGlobal, or allowDefault only when the corresponding Central configuration is intentional and trusted. A full-tunnel or exit-node design also requires a correctly configured router; changing the client flag alone is insufficient.

Test Connectivity

On Linux, inspect the managed address and route:

ip -brief address
ip route

Ping another member’s managed IP rather than the current device’s own address:

ping -c 4 10.147.20.20

On Windows, test the Linux member:

Test-Connection -ComputerName 10.147.20.10 -Count 4
Test-NetConnection -ComputerName 10.147.20.10 -Port 22

Successful ping proves basic IP connectivity. A failed application connection with successful ping usually indicates that the service is not listening or a host firewall is blocking its port.

Restrict Services to the ZeroTier Network

The ZeroTier interface behaves like another LAN interface and remains subject to the host firewall. Permit only the services that members need.

For example, allow SSH to an Ubuntu host only from the example ZeroTier subnet:

sudo ufw allow from 10.147.20.0/24 to any port 22 proto tcp comment 'SSH over ZeroTier'
sudo ufw status verbose

To allow RDP on a Windows member only from the same subnet, run this in an elevated PowerShell session:

New-NetFirewallRule -DisplayName 'RDP over ZeroTier' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 3389 -RemoteAddress 10.147.20.0/24 -Profile Any

Create a rule only when the corresponding service is enabled and intended for ZeroTier members. Network authorization does not replace service authentication, host firewalls, updates, or strong account credentials.

Optional: Route to a Physical LAN

A ZeroTier member can route remote clients to a physical subnet without installing ZeroTier on every LAN device. Routed mode is easier to reason about than an Ethernet bridge and avoids extending broadcast traffic.

This example assumes:

Router’s ZeroTier IP: 10.147.20.10
Router’s physical IP: 192.168.50.5
Physical LAN: 192.168.50.0/24
ZeroTier interface: ztabcdef12
Physical interface: eth0

In ZeroTier Central, add this managed route:

192.168.50.0/24 via 10.147.20.10

On the Linux router, enable IPv4 forwarding persistently:

sudoedit /etc/sysctl.d/99-zerotier-forwarding.conf

Add:

net.ipv4.ip_forward=1

Apply the setting:

sudo sysctl --system

If UFW manages the router, allow forwarding in both directions with the actual interface names:

sudo ufw route allow in on ztabcdef12 out on eth0 from 10.147.20.0/24 to 192.168.50.0/24
sudo ufw route allow in on eth0 out on ztabcdef12 from 192.168.50.0/24 to 10.147.20.0/24

Finally, add a route on the physical LAN’s gateway so LAN devices can return traffic to ZeroTier members:

10.147.20.0/24 via 192.168.50.5

The exact gateway procedure depends on the router. Without this return route, connections initiated from ZeroTier may reach the LAN device but replies will use the wrong gateway. NAT can avoid a return route but hides the original client addresses and should be a deliberate design choice.

Firewall and NAT Requirements

ZeroTier uses UDP hole punching. For the best chance of direct peer connections:

Permit outbound UDP to arbitrary destination ports when policy allows.
Permit established return traffic.
Allow local ZeroTier traffic on UDP 9993.
Avoid symmetric NAT, double NAT, and wireless client isolation when possible.
Do not configure manual router port forwarding merely for a normal client installation.

ZeroTier listens on UDP 9993 and additional high-numbered UDP ports. Restricting it to relay paths can increase latency and reduce throughput.

On a UFW-managed Linux endpoint, allow the standard ZeroTier transport port:

sudo ufw allow 9993/udp comment 'ZeroTier transport'

Troubleshooting

The CLI Cannot Reach the Service

On Linux, inspect and restart the service:

sudo systemctl status zerotier-one.service --no-pager
sudo journalctl -u zerotier-one.service -b --no-pager
sudo systemctl restart zerotier-one.service

On Windows, use an elevated terminal:

Get-Service -Name ZeroTierOneService
Restart-Service -Name ZeroTierOneService

The Network Reports Access Denied

Compare the node address from zerotier-cli info with the pending member in Central, then authorize that exact member. If the member is already authorized, confirm that it has a managed IP and that the client joined the intended network ID.

Peers Are Relayed

Display the peer paths:

sudo zerotier-cli peers
sudo zerotier-cli info -j

DIRECT is the preferred peer path. Many RELAY paths, TUNNELED status, or active TCP fallback indicate that UDP is blocked or NAT traversal is failing. Review the ZeroTier router guidance before changing firewall or NAT behavior.

Ping Works but an Application Does Not

Confirm that the application listens on the expected address and port. On Linux:

sudo ss -lntup

On Windows:

Get-NetTCPConnection -State Listen | Sort-Object LocalPort

Then check the host firewall and the application’s own access-control configuration.

Traffic Uses the Wrong Interface

Look for an overlapping or more-specific route:

ip route get 10.147.20.20

On Windows:

Get-NetRoute -AddressFamily IPv4 | Sort-Object DestinationPrefix,RouteMetric

Renumber the ZeroTier network when it overlaps a local or remote subnet. Route metrics cannot reliably solve identical-address conflicts.

Protect the Node Identity

On Linux, ZeroTier stores its state under /var/lib/zerotier-one; on Windows, it uses C:\ProgramData\ZeroTier\One. The identity.secret file permits node impersonation, and authtoken.secret permits local control of the service.

Do not copy one identity to several active machines. Copy identity files only as part of a controlled migration in which the original node is permanently stopped. Restrict access to the state directory and revoke an old or compromised member in Central.

Leave or Disable the Network

Leave the network before removing the software:

sudo zerotier-cli leave NETWORK_ID
sudo zerotier-cli listnetworks

On Windows, run the same commands from an elevated terminal without sudo, or remove the network from the tray application’s network details.

Revoke or delete the member in ZeroTier Central so an abandoned identity cannot reconnect later. To stop ZeroTier on a Linux system without uninstalling it:

sudo systemctl disable --now zerotier-one.service