Yes Sob, I have mastered zerotier (okay just loading devices with it)
First use case I want to explore is a possible replacement or at least a comparison to an existing wireguard tunnel.
Users are behind ISP router/modem connected to an RB4011 (wireguard client device). (1gig connection)
Users connect to my RB450Gx4 router (wireguard server device) behind a CCR1009 and go out my internet. (1 gig connection)
The key is getting the IP address of my public WANIP, outbound to the net.
Pretty decent performance but had to fiddle with MTU on the wireguard interfaces.
Q1. Can the user client put zerotier on the desktop PC and then be routed from the zt cloud to the server router at my end and out to the internet - assuming yes?
Q2. Can the user clients use the zerotier instance on the Client Router to be routed to the Server Router here and out the the internet - assuming yes?
Q3. Which would be most efficient (faster and/or most stable)?
Both server and client routers are connected to zerotier (on my zt network).
All ideas welcome.
Q4. What would be cool is if I can create a Link between the two routers and then take a subnet on the peer router or a single IP and put it through the ZT link between the two or that is not how it works (can only be from zt running on a client)???
Easiest way to explain zerotier is it’s a virtual managed switch. So the possibilities are limited to only your imagination. you can do all the above and then some. I have not had that good success incorporating mobile devices. (I don’t have iphones to test just android)
Q1. Can the user client put zerotier on the desktop PC and then be routed from the zt cloud to the server router at my end and out to the internet - assuming yes?
Yes (tested it myself using my android → zerotier → RB5009 → PPPoE out to Internet)
Q2. Can the user clients use the zerotier instance on the Client Router to be routed to the Server Router here and out the the internet - assuming yes?
Yes (not tested, but its a matter of routing as far as I see it)
Q3. Which would be most efficient (faster and/or most stable)?
No clue if it really makes any difference. Perhaps the approach client-router > ZeroTier > Server-router is more stable & predictable in stead of making connections from indivudual clients?
Both server and client routers are connected to zerotier (on my zt network).
All ideas welcome.
Q4. What would be cool is if I can create a Link between the two routers and then take a subnet on the peer router or a single IP and put it through the ZT link between the two or that is not how it works (can only be from zt running on a client)???
If you have overlapping IP-spaces you’ll have some issues (but can probably be solved with NAT)
On my ZeroTier network I have to “add” the Local-LAN prefix in the routing-table order to reach it, but that is logical. The ZeroTier network/fabric does not know about that automagically.
There is some documentation about “bridging” too using a device eg. Raspberry
I’ve played today a bit on my RB5009 + Android Galaxy phone (Android app) and must say performance is more then acceptable and fast in terms of “setup” etc.
Okay on my CLIENT Router (which is behind an ISP modem/router), I have zerotier loaded and connected
(I can see the the route in my ip routes DAC - dst-address= (is the private network address I assigned at my zt login) - gateway is a *17 (assuming like unknown entry in firewall rules represents the ZT gateway interface), and Main Table.
I created a subnet vlan on the router of 192.168.70.0.24, which will assign dhcp to anbody that plugs into ether9 of the router.
I created a route such that any destination from any user 0.0.0.0/0 will use the gateway *17 and will go out the table created ‘zerotable’
I created route rule that states source address of 192.168.70.0/24, is ONLY allowed to use the table ‘zerotable’
Therefore I am trying to connect a subnet if used that will use the zerotier interface for all internet traffic.
Whats left to do on the router ???
I think at zerotier website I have to connect a route from the client router to the server router as the next step…
I am not sure if I have to do anything on the Router server except perhaps to make a ip route rule such that
traffic coming back from the internet GOES back through the ZT interface, but WHAT DO I USE FOR DST ADDRESS??
zt-address for client router?
vlan subnet on client router that uses the zt interface?
Okay I am second guessing myself and thinking my approach is all wrong.
What i need to do is realize that I am creating a virtual LAN between all devices.
Every device gets a route already directing all zt private network traffic through the zt interface.
So return traffic from either the internet or LAN side of devices is already routed to the ZT Lan correct ???
So do I have to create a firewall rule to allow vlan traffic to ZT interface?
How do I tell incoming zt traffic to go out the internet hmmmm
I want to get vlan70 users at the client device to go out the internet on the server device.
SO
a. get vlan70 traffic onto the virtual zt lan at the client device,
b. get vlan70 traffic from zt lan on server device to the internet…
a.. I am thinking on client device its a forward firewall rule accept in-interface=vlan70 out-interface=zt interface
b. thinking a forward chain rule in-interface=zt out-interface-list=WAN
BUT HOW TO get traffic from device A to device B, that has to be done on the zerotier website.
Okay brain is a pretzel.
Maybe I dont need a route since one rule puts it on the virtual lan so in effect its at both devices now and its enough just to send the traffic out to the internet??
but dont I need to state the vlan subnet?? arggg this is confusing!
Routing needs to be done on the ZT-portal. Also you could implement filtering also on your ZT-“network” point (eg. only allow transport of protocol X).
So if you have 2 locations A & B for sure you need to provision their IP-prefixes and then they can freely communicate.
If you want 1 location to provide “Internet” breakout you need to add a 0.0.0.0/0 pointing to the ZT-router with Internet. https://zerotier.atlassian.net/wiki/spaces/SD/pages/7110693/Overriding+Default+Route+Full+Tunnel+Mode
Hola jvan,
Yes i saw that help file but its a lingo that is not understandable due to its syntax and assumptions and I have no clue throughout what devices they may or may not be referring to. So useless for me.