I have much simpler zerotier configuration that works on 7.16.2 but fails on 7.17.2, on both a RB1100AHx4 and a hAP-AX3. The Zerotier interface comes up, the router shows as connected on my.zerotier.com, but ping, ARP, etc. all fail for other hosts in the same subnet. When I upgrade a router from 7.16.2 to 7.17.2 the problem starts, and when I downgrade back to 7.16.2 the problem goes away again.
I’ve set up a test router with the barest minimal configuration for this purpose and it still happens (identical config works on 7.16.2 and not on 7.17.2):
[admin@Test-Router-hAP-AX3] > /export
# 2025-02-15 22:00:47 by RouterOS 7.17.2
# software id = {REDACT}
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = {REDACT}
/interface wifi
set [ find default-name=wifi1 ] configuration.country="United States" .mode=station .ssid={REDACT} disabled=no
/zerotier
set zt1 disabled=no disabled=no
/zerotier interface
add allow-default=no allow-global=no allow-managed=no disabled=no instance=zt1 name=zerotier1 network={REDACT}
/ip address
add address=172.23.3.10/16 interface=zerotier1 network=172.23.0.0
/ip dhcp-client
add interface=wifi1
/system clock
set time-zone-name=America/New_York
/system identity
set name=Test-Router-hAP-AX3
/system routerboard settings
set auto-upgrade=yes
[admin@Test-Router-hAP-AX3] > /ip address/ print
Flags: D - DYNAMIC
Columns: ADDRESS, NETWORK, INTERFACE
# ADDRESS NETWORK INTERFACE
0 172.23.3.10/16 172.23.0.0 zerotier1
1 D 192.168.52.110/24 192.168.52.0 wifi1
[admin@Test-Router-hAP-AX3] > /ip route print
Flags: D - DYNAMIC; A - ACTIVE; c - CONNECT, d - DHCP
Columns: DST-ADDRESS, GATEWAY, DISTANCE
DST-ADDRESS GATEWAY DISTANCE
DAd 0.0.0.0/0 192.168.52.1 1
DAc 172.23.0.0/16 zerotier1 0
DAc 192.168.52.0/24 wifi1 0
[admin@Test-Router-hAP-AX3] > /zerotier print
Flags: R - ONLINE
Columns: NAME, PORT, IDENTITY.PUBLIC
# NAME PORT IDENTITY.PUBLIC
;;; ZeroTier Central controller - https://my.zerotier.com/
0 R zt1 9993 0c2812d231:0:a37fbcbba8ec4a8036cbf09000f5ad77382366607ce75a7904c33ad5b8aea720e213b88dc383f43663a4e537a3ed1bb620cb7c735c21e38d990562c5af8933ad
[admin@Test-Router-hAP-AX3] > /zerotier interface/ print
Flags: R - RUNNING
Columns: NAME, MAC-ADDRESS, NETWORK, NETWORK-NAME, STATUS
# NAME MAC-ADDRESS NETWORK NETWORK-NAME STATUS
0 R zerotier1 2E:4E:8C:7D:9A:6F {REDACT} {REDACT} OK
[admin@Test-Router-hAP-AX3] > /zerotier peer print
Columns: INSTANCE, ZT-ADDRESS, LATENCY, ROLE, PATH
# INSTANCE ZT-ADDRESS LATENCY ROLE PATH
0 zt1 778cde7190 37ms PLANET active,preferred,103.195.103.66/9993,recvd:40s34ms,sent:601ms
1 zt1 cafe04eba9 111ms PLANET active,preferred,84.17.53.155/9993,recvd:40s495ms,sent:30s604ms
2 zt1 cafe80ed74 73ms PLANET active,preferred,185.152.67.145/9993,recvd:40s533ms,sent:30s604ms
3 zt1 cafefd6717 175ms PLANET active,preferred,79.127.159.187/9993,recvd:39s934ms,sent:30s604ms
4 zt1 {REDACT} 38ms LEAF active,35.208.167.241/21029,recvd:39s973ms,sent:30s604ms
active,preferred,35.208.167.241/21029,recvd:1s561ms,sent:1s561ms
active,35.208.167.241/21029,recvd:39s934ms
[admin@Test-Router-hAP-AX3] > ping 172.23.0.1
SEQ HOST SIZE TTL TIME STATUS
0 172.23.0.1 timeout
1 172.23.0.1 timeout
2 172.23.0.1 timeout
3 172.23.3.10 84 64 153ms498us host unreachable
4 172.23.0.1 timeout
5 172.23.0.1 timeout
6 172.23.0.1 timeout
7 172.23.3.10 84 64 141ms377us host unreachable
8 172.23.0.1 timeout
9 172.23.0.1 timeout
sent=10 received=0 packet-loss=100%
[admin@Test-Router-hAP-AX3] > /ip arp print
Flags: D - DYNAMIC; C - COMPLETE
Columns: ADDRESS, MAC-ADDRESS, INTERFACE, STATUS
# ADDRESS MAC-ADDRESS INTERFACE STATUS
0 DC 192.168.52.1 {REDACT} wifi1 stale
1 D 172.23.0.1 zerotier1 failed
[admin@Test-Router-hAP-AX3] >
EDIT: The issue for me specifically appears to be related to this part of my Flow Rules, which was from a default example provided by Zerotier:
tag server
id 2
enum 0 No
enum 1 Yes
default No;
# if both members are not servers, break
break not tor server 1;
If I comment out the break then things work as expected. 172.23.0.1 is a non-Mikrotik Zerotier node running 1.14.2, and it has the server tag set to 1. This means that the traffic should be allowed to/from that IP by the rest of the Zerotier network.