ZeroTier

Last reviewed Aug 26, 2026 · 886 words

Pick ZeroTier when you need Layer 2, and pick Tailscale for everything else. That is the whole decision for most self-hosters, and it is worth being blunt about it because the two tools look interchangeable on a feature list and are not. ZeroTier builds a virtual Ethernet switch: broadcast, multicast, mDNS discovery, ARP, and non-IP protocols all cross it, and you can bridge it into a physical LAN so remote devices behave as if plugged into your switch. Tailscale builds a Layer 3 WireGuard mesh, which is simpler, faster to set up and enough for SSH, web UIs and file shares. If you cannot name the reason you need a flat Ethernet segment, you do not need one.

Where Layer 2 earns its complexity

The cases are specific. Game consoles and old software that find peers by LAN broadcast. Chromecast, Sonos and printers that rely on mDNS. Home Assistant discovering devices on a remote network. Lab setups where you want a PXE boot or a DHCP server to reach a machine somewhere else. Site-to-site bridging where two houses should look like one subnet. ZeroTier handles all of these because it moves Ethernet frames, and Tailscale handles none of them without workarounds. It also exposes a flow-rules language for filtering traffic on the network, and managed routes so a member can advertise a subnet for the others.

The hosted controller is fine, and it is free for a few devices

A ZeroTier network is a 16-character hex ID and a controller that decides who is a member. Most people use ZeroTier's hosted controller at my.zerotier.com, which allows a small number of devices on the free plan (10 at last check) and charges beyond that. The controller only handles membership and configuration; traffic goes peer-to-peer over UDP 9993, with a relay through ZeroTier's root servers when NAT traversal fails. Joining is two commands on the client and one click on the controller:

curl -s https://install.zerotier.com | sudo bash
sudo zerotier-cli join a09acf0233e1b8c4
sudo zerotier-cli listnetworks

The node shows as unauthorised until you tick it in the controller, at which point it gets an address from the network's managed range. Clients exist for Linux, macOS, Windows, iOS, Android, FreeBSD and several NAS platforms, and the daemon idles at the 64 MB the catalogue lists or less.

Self-hosting the controller is real, and more work than it sounds

Every zerotier-one daemon contains a controller. Self-hosting means creating networks through the local JSON API on port 9993, authenticated with the authtoken.secret file, and since that is unpleasant by hand, most people put a community web UI such as ztncui in front of it. That removes the device cap and keeps your membership list off a third party's server. It does not remove ZeroTier from the picture: discovery still goes through ZeroTier's public root servers unless you also run your own roots (the "moon" mechanism), and running roots is a further project. Compare that with Headscale, which replaces Tailscale's coordination server outright; the Headscale vs Tailscale piece covers that path. A self-hosted ZeroTier controller is a good option for a lab with 30 devices, and a fiddly one for a household with 6.

The licence is BSL 1.1, and some people care

ZeroTier is source-available under the Business Source License rather than open source. You can read, build and self-host it freely for personal and most internal use; the additional-use grant restricts selling it as a hosted service and excludes some government use, and each release converts to Apache-2.0 on a change date a few years after publication. For a homelab this changes nothing. For anyone building a product on it, or who keeps a strict open-source-only policy, it is a reason to look at Tailscale's open-source client plus Headscale, or at NetBird, both of which are BSD or AGPL throughout. The remote access category lists the alternatives.

The rough edges you will meet

Two things surprise new users. First, mobile clients on iOS drop the tunnel aggressively in the background, so "always on" remote access from a phone is less reliable than the desktop experience. Second, when peer-to-peer fails behind a strict NAT, traffic relays through ZeroTier's roots, which are shared and can be slow; check zerotier-cli peers for RELAY versus DIRECT before blaming the tool. Bridging the virtual network into a physical LAN is powerful and also the fastest way to create a broadcast loop, so enable it on exactly one member per site.

What I'd do

If you need a flat Ethernet segment across sites, for consoles, mDNS devices or a bridged lab, run ZeroTier on the hosted controller until you pass the free device count, then move the controller in-house with ztncui. Everyone else, which is most people reading this, should install Tailscale, get MagicDNS and ACLs for free, and revisit ZeroTier only when a specific Layer 2 problem shows up. I run both: Tailscale for daily access, a single ZeroTier network bridged at one site for the handful of devices that only speak broadcast.