[normis@Home] /zerotier/interface> add network=YYYYYYYYY instance=zt1
[normis@Home] /zerotier>enable zt1
Think of ZeroTier as VPN with configuration on cloud.Sounds super but of course even reading the Wiki for zerotier, still lost.
I gather this is something of not much utility for the homeowner.
Yes, And more. RC 2 is a good version, so far, stable and all known showstoppers fixed@noris
This release contains all fixes (Including Firmware fixes) of routeros-7.1beta7-arm.npk ?
Particularly regarding issue reported on SUP-44718
Thanks!
Winbox bug. Check consoleNP16 on rc2, enable zt1 and zerotier1 comes up briefly then vanishes, my zt IP address remains in IP list attached to an 'unknown' interface.
)It is possible (and fairly easy) to run your own ZeroTier One controllers and use that to manage your own ZeroTier networks.I will manage my VPNs on my own, don't need and don't want any external service for that.
Okay I am game, might have to send you some canadian bacon, okay probaby will go bad, how bout some hugs, if this works!Why not, you can install iPhone Zerotier client and then join your home LAN with this.
Should I upgrade to a newer beta version or will I lose my wireguard connectivity...........
There's always oneNO THANKS!
I will manage my VPNs on my own, don't need and don't want any external service for that.
Wireguard is working perfectly, thank you for that. OpenVPN is still working as it used to for years (slow but reliable).
BTW, instead of adding random mostly useless stuff, why first don't make usefull packages that were in v6, like APC UPS?
Thank you!
Since I have no idea what that means I will wait till its mainstream. The RBG450Gx4 that is on beta is behind the CCR1009 and working great for wireguard, dont want to upset those using the connection is my concern.Should I upgrade to a newer beta version or will I lose my wireguard connectivity...........
Well, it's beta VS release candidate. Being advanturistic (stewpid) enough to be on beta, why don't you try and then clean the mess you'll get before reporting back?
[cesar@MikroTik] > /zerotier/export verbose
/zerotier
set zt1 comment="ZeroTier Central controller - https://my.zerotier.com/" disabled=no disabled=no identity="xxx:0:xxx" interfaces=all name=zt1 port=9993
[cesar@MikroTik] > /queue/interface/print where interface=zerotier1
Columns: INTERFACE, QUEUE, ACTIVE-QUEUE
# INTERFACE QUEUE ACTIVE-QUEUE
18 zerotier1 wireless-default wireless-default
[ ID] Interval Transfer Bitrate
[ 5] 0.00-1.00 sec 2.00 MBytes 16.8 Mbits/sec
[ 5] 1.00-2.00 sec 1.67 MBytes 14.0 Mbits/sec
[ 5] 2.00-3.00 sec 1.71 MBytes 14.3 Mbits/sec
[ 5] 3.00-4.00 sec 1.71 MBytes 14.3 Mbits/sec
[ 5] 4.00-5.00 sec 1.70 MBytes 14.2 Mbits/sec
[ 5] 5.00-6.00 sec 1.64 MBytes 13.7 Mbits/sec
[ 5] 6.00-7.00 sec 1.66 MBytes 13.9 Mbits/sec
[ 5] 7.00-8.00 sec 1.69 MBytes 14.2 Mbits/sec
[ 5] 8.00-9.00 sec 1.68 MBytes 14.1 Mbits/sec
[ 5] 9.00-10.00 sec 1.72 MBytes 14.5 Mbits/sec
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bitrate
[ 5] 0.00-10.00 sec 17.2 MBytes 14.4 Mbits/sec sender
[ 5] 0.00-10.00 sec 17.0 MBytes 14.3 Mbits/sec receiver
Count it as two.There's always oneNO THANKS!
Just because you don't want to use it doesn't mean that others don't want to.
zuul@sw-lab-02.jan1.us.ipa.net] > ip route/print
Flags: D - dynamic; X - disabled, I - inactive, A - active; c - connect, s - static, r - rip, b - bgp, o - ospf, d - dhcp, v - vpn, m - modem, y - copy; H - hw-offloaded; + - ecmp
# DST-ADDRESS GATEWAY DISTANCE
DIv 10.255.128.0/19 100.125.130.1 1
0 As 0.0.0.0/0 100.126.32.81 1
DAc 10.255.34.0/24 vlan103 0
DAc 10.255.35.0/24 vlan104 0
DAc 100.125.130.0/24 zerotier1 0
DAc 100.126.32.80/29 sfp-sfpplus1 0
DAc 100.127.32.5/32 lo0 0
. Any plans for future support?
I would call VPLS not working a showstopperYes, And more. RC 2 is a good version, so far, stable and all known showstoppers fixed
You are right, this is already fixed an will be available in next release.I'm having issues with routes injected from the controller - are those supported yet? The injected route below (10.255.128.0/19) is inactive. I've set allow global and this works on other non-MikroTik ZT endpoints. Any ideas?
Agree! How about finishing networking basics, such as routing protocols, ipv6 etc before throwing in more little used completely new functionality?!NO THANKS!
I will manage my VPNs on my own, don't need and don't want any external service for that.
Wireguard is working perfectly, thank you for that. OpenVPN is still working as it used to for years (slow but reliable).
BTW, instead of adding random mostly useless stuff, why first don't make usefull packages that were in v6, like APC UPS?
Thank you!
$ unzip -l all_packages-arm-7.1rc2.zip
Archive: all_packages-arm-7.1rc2.zip
Length Date Time Name
--------- ---------- ----- ----
14053521 2021-08-31 11:30 wifiwave2-7.1rc2-arm.npk
20625 2021-08-31 11:30 calea-7.1rc2-arm.npk
24721 2021-08-31 11:30 gps-7.1rc2-arm.npk
57489 2021-08-31 11:30 iot-7.1rc2-arm.npk
131217 2021-08-31 11:30 tr069-client-7.1rc2-arm.npk
364689 2021-08-31 11:30 user-manager-7.1rc2-arm.npk
--------- -------
14652262 6 files
Press any key to continue...
https://box.mikrotik.com/f/c9a303113884413bbdca/?dl=1First of all I can't find ZT package in allpkg zip file:It is only in the support provided pkg?Code: Select all$ unzip -l all_packages-arm-7.1rc2.zip Archive: all_packages-arm-7.1rc2.zip Length Date Time Name --------- ---------- ----- ---- 14053521 2021-08-31 11:30 wifiwave2-7.1rc2-arm.npk 20625 2021-08-31 11:30 calea-7.1rc2-arm.npk 24721 2021-08-31 11:30 gps-7.1rc2-arm.npk 57489 2021-08-31 11:30 iot-7.1rc2-arm.npk 131217 2021-08-31 11:30 tr069-client-7.1rc2-arm.npk 364689 2021-08-31 11:30 user-manager-7.1rc2-arm.npk --------- ------- 14652262 6 files Press any key to continue...
After that, it is a question to me what functions integrated into MTik ZT package? I mean it could be MOON Root, or it could be only node/client? I'm not yet familiar with ZT and don't understand all of the hysteria about it over here, but it could be good for something one day
Of all the request to implement in RouterOS, why specifically ZeroTier?
Good to know,Of all the request to implement in RouterOS, why specifically ZeroTier?
When you look at it from a business standpoint, it makes complete sense.
1) MikroTik needed an SDWAN solution to sell more boxes
2) ZeroTier needed a hardware solution to sell more licenses
It's a phenomenal protocol and far better than any other VPN i've used in the last 20 years. This is a great partnership.
Good to know,
It seems though it seems ideal for configuring remotely MT boxes, vice lets say WIREGUARD where I want to let external users use my ISP connection for their needs.
Unless there is a way of using zerotier for that purpose???
But we're not the business, and we need to have it make sense for us clients. Remember, don't become the product.Of all the request to implement in RouterOS, why specifically ZeroTier?
When you look at it from a business standpoint, it makes complete sense.
1) MikroTik needed an SDWAN solution to sell more boxes
2) ZeroTier needed a hardware solution to sell more licenses
It's a phenomenal protocol and far better than any other VPN i've used in the last 20 years. This is a great partnership.
But we're not the business, and we need to have it make sense for us clients. Remember, don't become the product.
When you look at it from a business standpoint, it makes complete sense.
1) MikroTik needed an SDWAN solution to sell more boxes
2) ZeroTier needed a hardware solution to sell more licenses
It's a phenomenal protocol and far better than any other VPN i've used in the last 20 years. This is a great partnership.
Comparing VPN to SDWAN is basically like comparing lightbulbs to LEDs, plase don't.
I guess the final question, is throughput. Wireguard has been pretty decent, how does zerotier compare.
For example I have two computers on the same ISP 15km apart and both have 1gig connectivity.
IF wireguard gives me xxx speed, will zerotier be xxx PLUS or xxx MINUS??
disable-running-check=yes/zerotier
set zt1 identity="*" name=zt1 port=9993
/zerotier interface
add disable-running-check=yes disabled=no instance=zt1 mac-address=* name=zt-foxden network=*
I'd like to state quite the opposite opinion!I gather this is something of not much utility for the homeowner.
@Normis thank you and kudos for bringing this to life....time to fire up my CHR for testing, before I try to fry my RB4011
Note: The instructions don't include the hAP ac^2 – which is what I used – only "hAP ac³ (non LTE)" is listed. I thought it was hAP ac3 before I looked more carefully in winbox after upgradingOn a hAPac2, followed @normis directions, and it worked for me.
. My device has 1.3Mb of flash disk to spare after installing the rc2 ZeroTier package it seems.
[skyfi@hap94] /system/resource/cpu> print
Columns: CPU, LOAD, IRQ, DISK
# CPU LOAD IRQ DISK
0 cpu0 3% 0% 0%
1 cpu1 1% 0% 0%
2 cpu2 5% 0% 0%
3 cpu3 7% 2% 0%
[skyfi@hap94] /system/resource/cpu> /tool/profile
Columns: NAME, USAGE
NAME USAGE
ethernet 0.1%
console 0.1%
networking 0.2%
winbox 0.2%
management 0.7%
profiling 0%
telnet 0%
unclassified 1.1%
total 2.4%
[skyfi@hap94] /system/health/settings> /system/resource/print
uptime: 13h35m12s
version: 7.1rc2 (testing)
build-time: Aug/31/2021 08:07:46
factory-software: 6.43.10
free-memory: 52.5MiB
total-memory: 128.0MiB
cpu: ARMv7
cpu-count: 4
cpu-frequency: 448MHz
cpu-load: 1%
free-hdd-space: 1292.0KiB
total-hdd-space: 15.2MiB
write-sect-since-reboot: 322
write-sect-total: 11436
bad-blocks: 0%
architecture-name: arm
board-name: hAP ac^2
platform: SkyFi-alpha1
[skyfi@hap94] /system/resource/cpu> /interface/lte/monitor 0
status: connected
model: MC7455
revision: SWI9X30C_02.32.11.00
current-operator: AT&T
data-class: LTE
session-uptime: 13h39m16s
imei: [redacted]
imsi: [redacted]
uicc: [redacted]
rssi: -101dBm
...Get ready to fry your RB4011 because it's ARM only for the moment
ZT only counts actual nodes connected to the network, as in, devices that run the ZT client/app/package.How does ZeroTier license works with Mikrotik?
https://www.zerotier.com/pricing/
Does it count all user on the inside, or only see the Nat traffic?
You do not. You can use the router to forward packets to the ZT interface like any other interface.So you need the ZT client/app/package on each device as well as ZeroTier enabled on the MT Router?
Yes, if you want them to part of the subnet (similar in concept to 'road warrior' style VPN)... Any device that use the same ZeroTier "network id" (10 hex digits) is part of the same subnet (unless you change the flow rules/routers in ZeroTier). If you using ZeroTier to route between two subnets you control, then you just need 2 ZT client/app/package (like a site-to-site VPN)So you need the ZT client/app/package on each device as well as ZeroTier enabled on the MT Router?
From ZeroTier documentation:How does encryption / key exchange work with zerotier? Are the keys / certificates kept locally on the devices, or are they stored in the Cloud, so the provider theoretically could look at the traffic routed through their network? Do you guys have any privacy concerns?
can not install zerotier-7.1rc2: it is not made for arm64, but for arm
Devices that support this feature:
CCR2004
...
yes please although it's a promising startBig thank's!!
Any timeframe to port it to others platforms?
I'm very interested in this MPLS transport option. Currently we use EoIP for this - we have many locations added to our MPLS cloud via EoIP tunnels. Can you elaborate a bit on this? My main concern would be handling MPLS QoS with this - I understand that ZeroTier has some built in QoS stuff (or is at least implementing it), but I'm a bit unclear as to how this handles MPLS traffic. We currently successfully do MPLS QoS with EoIP and I want to be sure that this is possible with ZeroTier.That's just the tip of the iceberg - like I said, It's a phenomenal protocol and we use it in the Service Provider world for OOB Mgmt and also building MPLS transport over the Internet.
Home network with Mikrotik ethernet router rb450gx4:Why not, you can install iPhone Zerotier client and then join your home LAN with this.
I am wanting to join a zt network that has IPv6 only. Is that an issue? I have set allowed global= true yet I cannot ping other clients on the ZT network. Already approved on the control panel.Teleport, start with Zerotier tutorial on their webpage. Did you get a connection to their network, and then went and approved this Windows PC in the zerotier portal? You have to approve every device there.
I tried adding the firewall entries but no luck unfortunately. Maybe it's a bug?I found the official MikroTik docs really helpful for getting ZeroTier going: https://help.mikrotik.com/docs/display/ROS/ZeroTier
No IPsec policies on the network. They are used on two tunnels however.also make sure the network you try to ping is not used in an ipsec policy
You missed a step budWe are happy to announce ZeroTier support for ARM architectures with enough space*.
RC2 package available here:
https://box.mikrotik.com/f/c9a303113884413bbdca/?dl=1
But from the next v7.1 release, it will be included in the release system (all packages ZIP archive).
To join a Zerotier network, it is as simple as this:
ZeroTier documentation can be found here: https://zerotier.atlassian.net/wiki/spa ... h+ZeroTierCode: Select all[normis@Home] /zerotier/interface> add network=YYYYYYYYY instance=zt1 [normis@Home] /zerotier>enable zt1
Devices that support this feature:
RB4011
RB3011
RB1100AHx4
RB450Gx4
Audience
hAP ac³ (non LTE)
[normis@Home] /zerotier/interface> add network=YYYYYYYYY instance=zt1
[normis@Home] /zerotier/interface> enable zerotier1
[normis@Home] /zerotier>enable zt1
[normis@Home] /zerotier/interface> add network=YYYYYYYYY instance=zt1 disabled=no
[normis@Home] /zerotier>enable zt1
In fairness, @normis didn't say the hAP ac^2 is supported for ZeroTier... That being said, it worked on the couple hAPac2 I've been using to test v7, but there may be a reason this platform isn't listed as supported (even though it is ARM, and does load the package)After installing the zerotier npk on my HAP AC2, my Firewall Filter Rules are all mixed up, and wireless caps settings are gone. I also lost my Loopback Bridge, it's address was still present in /ip/address.
One unplanned reboot since I installed the package, nothing in the log, but an autosupout was generated.
Not sure if this is because of the zerotier npk or a bug in ROS 7.1rc2.
. 
+1 - assuming the "balance-aware" mode works, that be a interesting way to bond LTE, without external hardware/software, directly on the Mikrotik...Please add support for ZeroTier Multipath and its various configuration options and policies: https://zerotier.atlassian.net/wiki/spa ... /Multipath
Please add support for ZeroTier Multipath and its various configuration options and policies: https://zerotier.atlassian.net/wiki/spa ... /Multipath
People keep stating how 'simple' and 'easy' it should be to setup a zerotier link, but I can assure you: It's not. And everytime I tried it, and by now that's about 5 times over the last 5 years, it did not work, as in, I could *not* actually use it as a VPN replacement, I could not access LAN IPs through CGNAT, etc. The docs and UI are not very user-friendly at all. They should look at how OpenVPN write docs, that one was easy and works, as long as you're not behind a CGNAT.Why not, you can install iPhone Zerotier client and then join your home LAN with this.
thanks for response. those were all setup correctly. i have the setup working now after the 2 firewall rules were added (input and forward to zerotier1 interface).Teleport, start with Zerotier tutorial on their webpage. Did you get a connection to their network, and then went and approved this Windows PC in the zerotier portal? You have to approve every device there.
{
"settings": {
"allowTcpFallbackRelay": false,
"portMappingEnabled": false,
"defaultBondingPolicy": "balance-aware"
}
}
Please add support for ZeroTier Multipath and its various configuration options and policies: https://zerotier.atlassian.net/wiki/spa ... /Multipath
...Twitter was a little unclear on these details A question about encryption: what about the hardware acceleration? All models that supports IPsec HW will offload ZT’s encryption?
A question about encryption: what about the hardware acceleration? All models that supports IPsec HW will offload ZT’s encryption?
ZeroTier uses Salsa20 to encrypt and Poly1305 to authenticate packets.
As far as I know these are (very fast but) software-only algorithms and can't be offloaded to the hardware for acceleration.
New features and improvements:
AES-GMAC-SIV encryption mode, which is both somewhat more secure and significantly faster than the old Salsa20/12-Poly1305 mode on hardware that supports AES acceleration. This includes virtually all X86-64 chips and most ARM64. This mode is based on AES-SIV and has been audited by Trail of Bits to ensure that it is equivalent security-wise.
hmmmm...sounds interesting!
ZeroTier uses Salsa20 to encrypt and Poly1305 to authenticate packets.
As far as I know these are (very fast but) software-only algorithms and can't be offloaded to the hardware for acceleration.
Since version 1.6.0 ZT has new AES-GMAC-SIV encryption mode, which is supported in hardware accelerated engines. So the question is still open. This is what they say in Release Notes:
New features and improvements:
AES-GMAC-SIV encryption mode, which is both somewhat more secure and significantly faster than the old Salsa20/12-Poly1305 mode on hardware that supports AES acceleration. This includes virtually all X86-64 chips and most ARM64. This mode is based on AES-SIV and has been audited by Trail of Bits to ensure that it is equivalent security-wise.
i did it on routerboard rb450gx4 and all i had to do was drop the rc2 into 'files' and reboot twice. also take the zerotier .npk and drop in files and reboot. you are all set.Like this feature a lot!
I have the RB4011 non wireless on version v6.48.4. Apart from backing up the current config, is there anything else I need to do before going to 7.1rc2?
Since version 1.6.0 ZT has new AES-GMAC-SIV encryption mode, which is supported in hardware accelerated engines. So the question is still open. This is what they say in Release Notes:ZeroTier uses Salsa20 to encrypt and Poly1305 to authenticate packets.
As far as I know these are (very fast but) software-only algorithms and can't be offloaded to the hardware for acceleration.
(if not done already)
Since version 1.6.0 ZT has new AES-GMAC-SIV encryption mode, which is supported in hardware accelerated engines. So the question is still open. This is what they say in Release Notes:
Oh, I missed that in the 1.6.0 changelog. Nice!
They still need to support the Salsa20/Poly1305 option in code, both to keep backwards compatibility to versions pre-1.6.0 and to be able to talk to other ZT peers that do not support the new AES encryption. But it is great having AES because it can be hardware accelerated!
Hope to see ZT offloading AES to the hardware on Routerboards
Hope to see ZT offloading AES to the hardware on Routerboards
zerotier interface printKnown remaining issues:
AES hardware acceleration is not yet supported on 32-bit ARM, PowerPC (32 or 64), or MIPS (32 or 64) systems. Currently supported are X86-64 and ARM64/AARCH64 with crypto extensions.
For one, we do not maintain the port to Mikrotik devices. Mikrotik is doing that themselves. Secondly, no ARM32 platforms that we’re aware of support the full set of hardware instructions for the AES-GMAC-SIV algorithm. ARM64 is the only ARM platform with full hardware support for all the instructions.
I still believe (and hope) that MikroTiks's team will figure out a way for implementing HW accel. on (at least) ARM/ARM64 platforms. The AES-GMAC-SIV uses auth from AES-GCM and cipher from AES-CTR, both fully supported by ARM/ARM64 platforms.For those who interested in encryption hardware offload on ZT.
I've asked on ZeroTire forum about support of ARM 32bit platforms and especially Mikrotik. And that's what they answered:
For one, we do not maintain the port to Mikrotik devices. Mikrotik is doing that themselves. Secondly, no ARM32 platforms that we’re aware of support the full set of hardware instructions for the AES-GMAC-SIV algorithm. ARM64 is the only ARM platform with full hardware support for all the instructions.
So as I can see we will not get any hardware accelerated encryption of ZeroTire on 32bit ARM platforms.
I hope that it is possible to get it on new RB5009 as it's ARM64, and has some AES hardware engine in CPU, though I'm not sure if it is compatible with AES-GMAC-SIV algo.
No need or point doing this in zerotier because routeros can already do MTU, mru, and Mss clamping so you can already force Packet sizes down if you want. Changing the zt MTU wouldn’t actually help because MTU path discover would already pass or fail so you only need to handle situations that discovery fails. Zt itself already does it’s own MTU testing and already does a lot to encourage MTU discovery to work well.Is there any way we can set the interface MTU for ZeroTier?
At first glance everything looks to work fine, but I would like to avoid all packet fragmentation if possible.
No CLI command looks to fit this purpose so far.
You can block broadcast, multicast, and whatever else you want with the rules engine.So, if I understand correctly, ZT is building a huge L2 domain inside the "Network"? There is a P2P L2 solution? We hate L2 in ISP backbone as it is very dangerous and caused a lot of issues. This huge L2 domain works only in a perfect world where we isn't living. How can we defend against problematic hosts or BUM in the L2 domain in ZT "Network"?
It is possible via the my.zerotier.com API or self-hosted controller API. It's a controller/network setting. It's not exposed in the my.zerotier UI. You might have to restart your clients or rejoin your networks. It's almost never needed to change the MTU.No need or point doing this in zerotier because routeros can already do MTU, mru, and Mss clamping so you can already force Packet sizes down if you want. Changing the zt MTU wouldn’t actually help because MTU path discover would already pass or fail so you only need to handle situations that discovery fails. Zt itself already does it’s own MTU testing and already does a lot to encourage MTU discovery to work well.Is there any way we can set the interface MTU for ZeroTier?
At first glance everything looks to work fine, but I would like to avoid all packet fragmentation if possible.
No CLI command looks to fit this purpose so far.
As was said above, this can all be filtered. The filter engine can match input and output on MAC, IP, or zerotier ID. ie, you can say "allow anything that is behind zt id 12345 to anything behind id 54321 on TCP port 80, deny everything else. That effectively blocks all layer2 from those two ID's and allows only the TCP port. It's a very flexable rules engine and it's awesome to be able to filter on traditional MAC and IP but also on the zt 'id' as well.So, if I understand correctly, ZT is building a huge L2 domain inside the "Network"? There is a P2P L2 solution? We hate L2 in ISP backbone as it is very dangerous and caused a lot of issues. This huge L2 domain works only in a perfect world where we isn't living. How can we defend against problematic hosts or BUM in the L2 domain in ZT "Network"?
I second this! When will it be available for CHR?Are we going to have ZeroTier for CHR?
In ZeroTime no doubt. But that be a better place to test this than in hardware/ARM.When will it be available for CHR?
"
/interface/bridge/port/add bridge=your_bridge interface=zt1thanks Chupaka, I've now got:Code: Select all/interface/bridge/port/add bridge=your_bridge interface=zt1
Make sure you have Neighbor Discovery enabled for your_bridge interface.before doing the 'bridge' stuff, the Mikrotiks saw each other, via zerotier, in:
ip neighbor/ print
but now they don't
from the article linked:
looks like unnecessary FUD to me. The Zerotier team is patching and good security practices and firewall rules still solve this.Practical exploitation of this vulnerability would require an attacker to have knowledge of the target private network address and the addresses for at least two existing clients connected to the private network. This advisory demonstrates a proof-of-concept exploit that injects a packet into a private network.
Zerotier promptly addressed the root server identity verification issues. This attack is still possible (as of 20/09/2021); however, an attacker is required to invest significant compute time (many many years with a single RTX2070) to generate a valid identity that collides with an intended target. Zerotier client’s still accept any identity learned via WHOIS packet as implicitly valid.
really no idea why you would do this, but it's almost certainly an MTU issue.Hi
I'm trying to connect L2TP over IP SEC over ZeroTier network but its not working.
Have anybody got i working?
/Sten
Just came in to say. Awesome. Can't wait to release on the stable version and more arch supported.We are happy to announce ZeroTier support for ARM architectures with enough space*.
RC2 package available here:
https://box.mikrotik.com/f/c9a303113884413bbdca/?dl=1
But from the next v7.1 release, it will be included in the release system (all packages ZIP archive).
To join a Zerotier network, it is as simple as this:
ZeroTier documentation can be found here: https://zerotier.atlassian.net/wiki/spa ... h+ZeroTierCode: Select all[normis@Home] /zerotier/interface> add network=YYYYYYYYY instance=zt1 [normis@Home] /zerotier>enable zt1
Devices that support this feature:
RB4011
RB3011
RB1100AHx4
RB450Gx4
Audience
hAP ac³ (non LTE)
1) yes but you need to handle routing that through the zt tunnel manually1. let say my office has fast ISP1, but my home has slow ISP2. I want all my home traffic routed thru office ISP1. is that possible
2. what I understand every devices need to install zerotier client. Since Mikrotik has zerotier app.
Is that possible every client behind Mikrotik gateway at home could connect to every device behind Mikrotik gateway at office. So that no need to install zerotier client on every devices
tq
They said it would be on all architectures, and it's a small package so I'd say chances are good.Will this work on hAP ac lite in the future?
Bonjour only works on a Layer2 domain, you'd have to bridge the zt and lan ports on the mikrotiks.I have successfully linked two remote LANs via Zerotier on both Mikrotik routers.
I can ping MacBooks over the link.
However Apple's Bonjour mDNS does not show remote MacBooks in the list of my network devices in Finder.
Do I need to add special configuration for it ?
If I install ZeroTier on each MacBook instead of on the routers, then Bonjour mDNS functions perfectly, and I see other computers and their shared directories.
Siniša, "svaka ti dala"! Potpuno si u pravu!NO THANKS!
I will manage my VPNs on my own, don't need and don't want any external service for that.
Wireguard is working perfectly, thank you for that. OpenVPN is still working as it used to for years (slow but reliable).
BTW, instead of adding random mostly useless stuff, why first don't make usefull packages that were in v6, like APC UPS?
Thank you!
Use Terminalany hints for doing that ? on WinBox i do not see any zt interface to link on the main bridge thanks
/interface bridge port add bridge=your_bridge interface=zerotier1/interface/bridge/port/print
Flags: I - INACTIVE; H - HW-OFFLOAD
Columns: INTERFACE, BRIDGE, HW, PVID, PRIORITY, PATH-COST, INTERNAL-PATH-COST, H>
# INTERFACE BRIDGE HW PVID PRIORITY PATH-COST IN HORIZON
;;; defconf
0 H ether2 bridge yes 1 0x80 10 10 none
;;; defconf
1 H ether3 bridge yes 1 0x80 10 10 none
;;; defconf
2 H ether4 bridge yes 1 0x80 10 10 none
;;; defconf
3 H ether5 bridge yes 1 0x80 10 10 none
;;; defconf
4 H ether6 bridge yes 1 0x80 10 10 none
;;; defconf
5 H ether7 bridge yes 1 0x80 10 10 none
;;; defconf
6 H ether8 bridge yes 1 0x80 10 10 none
;;; defconf
7 H ether9 bridge yes 1 0x80 10 10 none
;;; defconf
8 IH ether10 bridge yes 1 0x80 10 10 none
;;; defconf
9 I sfp1 bridge yes 1 0x80 10 10 none
10 zerotier1 bridge 1 0x80 10 10 none
This is exactly what should happen. If you bridge, you're not routing any more.my MT routers manage: LAN 10.1.0.0/16 and the other one 10.2.0.0/16
With Zerotier on both routers, i ping all the machines from all LANs to all LANs
But Bonjour protocol does not work over the ZT link as i do not see the remote machines in the Network section of Finder
If i bridge the zerotier1 interface to the bridge on both MT, it becomes erratic. The ping over ZT work on and off, and then off, and Bonjour is definitely not showing.
You wouldn't.... This isn't what bonjour was made for so it's something that just doesn't work well. Put zt on individual machines connecting to a network if that's what you want to do.Fine, thanks, so how would you configure the two remote LANS so that Bonjour protocol works over ZT ?
I wanna run vpn to a double nated mikrotikreally no idea why you would do this, but it's almost certainly an MTU issue.Hi
I'm trying to connect L2TP over IP SEC over ZeroTier network but its not working.
Have anybody got i working?
/Sten
Yes. RB5009UG needs RouterOS v7.x and since v7.1rc2 ZeroTier ist available.Does RB5009UG new router supports zerotier??
Yes, if you're installing RouterOS v7.1rc2 or newer.I am looking to buy 2x CCR2004-1G-12S+2XS to use with ZeroTier.
Does anyone know if ZeroTier is available on those ?
[buraglio@rb450Gx4v7] /ipv6/address> /system/package/print
Columns: NAME, VERSION
# NAME VERSION
0 calea 7.1rc4
1 container 7.1rc4
2 user-manager 7.1rc4
3 zerotier 7.1rc4
4 routeros 7.1rc4
[buraglio@rb450Gx4v7] /ipv6/address> /system/routerboard/print
routerboard: yes
model: RB450Gx4
...
firmware-type: ipq4000
factory-firmware: 6.46.8
current-firmware: 7.1rc4
upgrade-firmware: 7.1rc4As of now... Correct.Am I get that right, no support in CHRs, right?
The procedure is no different. Once you build a cuustom controller it operates like any other. I have my test Mikrotik connected to ZeroTier networks from both the ZT cloud service as well as a private on-prem controller.Hello Guys,
What is the procedure for connect to ZeroTier custom controller?
Regards,
Humberto Valencia Toxqui
Upgrading to RC5 seems to have resolved this stuck in REQUESTING_CONFIGURATION state. FWIW, Assigned v6 addresses still missing. Happy to keep testing - having ZeroTier is game changing, thanks!Has anyone seen the behavior where the networks are stuck in status="REQUESTING_CONFIGURATION"? This worked for me for a while on 7.1RC4, but seems to be totally stuck now for whatever reason. I have not upgraded to RC5 and verified that the ZT networks do actually work.
Arm Only For now.Any chance of me getting this on my trusty old RB951-2n?
I'm anxiously waiting for controller assigned IPv6 addressing as wellFWIW, Assigned v6 addresses still missing. Happy to keep testing - having ZeroTier is game changing, thanks!
My Rb4011s have an Arm32 inside though? are some not this way? Mine has the Cortex A-15 tbc
...
Gotta go up to 7.x Router OSHello ,
I am trying to install the package and I get the following error:
I am trying to install this on a RB4011 with 6.49 version.
Thanks in advance
We are happy to announce ZeroTier support for ARM architectures with enough space*.
RC2 package available here:
https://box.mikrotik.com/f/c9a303113884413bbdca/?dl=1
But from the next v7.1 release, it will be included in the release system (all packages ZIP archive).
To join a Zerotier network, it is as simple as this:
ZeroTier documentation can be found here: https://zerotier.atlassian.net/wiki/spa ... h+ZeroTierCode: Select all[normis@Home] /zerotier/interface> add network=YYYYYYYYY instance=zt1 [normis@Home] /zerotier>enable zt1
Devices that support this feature:
RB4011
RB3011
RB1100AHx4
RB450Gx4
Audience
hAP ac³ (non LTE)
Yup... That's been my experience.Is the fact, that i can see zerotier1 interface only in CLI and not in Winbox and that adding firewall rules shows "unknown" under In.Interface normal? The device is Ac2 and apparently acess to device through zerotier works.
but how to point zerotier local conf ro it in the mikrotik router?It is possible (and fairly easy) to run your own ZeroTier One controllers and use that to manage your own ZeroTier networks.I will manage my VPNs on my own, don't need and don't want any external service for that.
There's even an open-source web interface (that mimics my.zerotier.com) somewhere on GitHub.
That way you don't have to rely on an "external service" and can still enjoy all (or at least most) ZeroTier awesome features.
but how to point zerotier local conf ro it in the mikrotik router?
well done and congratulation !!Finally found a device we had that supported it, Tried it and had a working VPN->Private network bridge in less than 10 minutes!
Amazing and very fast.
Any word on Progress for other architectures?
I'd really love to see this on CHRs for VPN to Private Infrastructure, Sick of opening ports up to make a new target for hackers
Is zerotier safe? how works zerotier?Why not, you can install iPhone Zerotier client and then join your home LAN with this.
You need to set up routes AT ZEROTIER.Did you have to add any specific routes or firewall/NAT rules to make it work ?
I have a route into a site and i can ping the not ZT ip of the device running ZT, but any other device on the LAN is not available.
You need to add a NAT Masquerade on the Mikrotikwhat i need now is this :
from the laptop in network A i want to access files or RDP of any PC in network B
i dont want mikrotik to give internet to the PCs ,just acting as switch to allow me to access any device in the network B
i can manage zerotier routing in the zerotier console portal no problem ,it is working fine with linux debian .
Put it in files.I was having difficulty installing zerotier package. I downloaded it from mikrotik.com and uploaded .npk file to RouterOS 7.1 device, but there is no clear instructions how to install it. Turns out only reboot is necessary.
sorry mistake i mean (main DSL router ip:172.16.16.1)Well, from the data you provided it seem's that you have a double NAT configuration. Your modem already work's as a router and it provides your Mikrotik with internal IP adress (not public IP). Usualy this isn't realy desired situation. Also, where is your current DHCP server for LAN network?
nothing at all except WAN for just allowing internet connection for zerotier client inside mikrotik and lan only to expose LAN devices . we bought mikrotik board specially for zerotier service.That doesn't realy change anything. So you actualy wan't to use Mikrotik as just another device on your network, no routing functions or anything?
/zerotier>disable zt1Hi,
Can You explain me how to remove interface zerotier1? I added 2nd zerotier network and now in /zerotier/interface print I see two networks - zerotier 1 and zerotier 2.
I 'll have a look since you suggest it...Anyone else done speedtests wireguard vs zerotier.
(for the case of client using servers internet connection for internet).
Nice video.....
https://www.youtube.com/watch?v=eFI59jJ2MM8
As far as it seems its ARM devices only. 750GR3 is mmips.Anyone knows if ZeroTier is available already fo the 750gr3?
That will be fun to see.. CHR, very likely at some stage. But MMIPS? uhhh... maybe never. Point here is, that ZT uses 3rd party codebase and it may be not available for other than mainstream architectures. I really want to see how this turns out, because until now, RouterOS offered all features on all devices. (obviously, no wifi on non-wifi models)As far as it seems its ARM devices only. 750GR3 is mmips.Anyone knows if ZeroTier is available already fo the 750gr3?
Can't wait for it to release for 750GR3 and CHR. I have hundreds of both in use.
Yes, ZeroTier interfaces are not yet supported by Winbox, currently use CLI instead.I have a problem with ZeroTier.
In the wiki are two firewall rules and the in-interface=zerotier1
This interface zerotier1 cannot be found and in place the interface zerotier1 it switches to ether1
What can I do to allow Zerotier traffic?
Is this a bug?
thanks
Give us a configuration example from the CLI, will see what we can suggest or improve in RouterOS.Thanks for your quick reply but I did this. But the zerotier interface disappears so that the in-interface zerotier1 cannot be set as in-interface.
I use the CLI
zerotier enable zt1
zerotier/interface add network=...... instance=zt1 and i set the firewall as like the wiki.
If i try to login with ZeroTier it don't work.
If i make a firewall rule input accept it works but that is not what i want.
I want accept input traffic to the zerotier1 interface and not all the interfaces.
I hope you understand me
I have not had one problem with zerotier. If your on the firewall rule in winbox then you are going to mess the rule up, as zerotier is not supporteds on anything but CLI. To work around this problem for noww add zerotier1 to a interface list and use the interface list in the firewall rules, that way you can mess with the firewall rules all you want in winbox. just don't touch the list now!Sometimes I can login via Zerotier and sometimes not.
This is definitely a bug in Mikrotik ZeroTier. I consider this not reliable.
There is still work to be done.
That sounds like something you could temporarly fix with a script when pppoe comes upI had issues on the last beta and now again with 7.1 in that Zerotier on my RB3011 becomes unresponsive. Other devices on the same Zerotier network are still contactable.
About every 5 days I need to disable the Zerotier interface on my RB3011 and re-enable it again. However my RB3011 is bridged to my ISP supplied VDSL router and connects using PPPoE. I'm fairly certain now that when DSL drops and resyncs and the RB3011 re-establishes its PPPoE connection the Zerotier interface doesn't automatically reconnect.
And, yes, I recall difference in discovery & MAC winbox connection from ~rc4 to 7.1 – what I exactly was going on when, harder to say. I do want to saw L2 winbox connection worked more consistently in the early betas. But in V7.1 discovery has worked well, and L3 connection always has worked in V7... on Audience, wAP ac, hAP ac2 at some point, but no RB3001 to try.I have 2 RB3011s running Zerotier.
One 7.1rc4 the other it 7.1.
The RC unit passes ARP discovery to external clients.
The Upgrade 7.1 (Stable) does not.
I can manually enter the mac address into my client and reach the 7.1 unit. But it never shows up as a neighbor in winbox and I can't discover devices on the LAN.
Maybe its the RB3011 and Zerotier 1.6.6?
I have several hAP AC2s with 7.1 and ZT1.6.6 and they discover just fine.
Anyone else see this or have any ideas?
I just added Zerotier to a running hAP AC2 with a very similar config to the 3011s firewall.
ARP and discovery work just fine.
I have the same observation as plisken.I have not had one problem with zerotier. If your on the firewall rule in winbox then you are going to mess the rule up, as zerotier is not supporteds on anything but CLI. To work around this problem for noww add zerotier1 to a interface list and use the interface list in the firewall rules, that way you can mess with the firewall rules all you want in winbox. just don't touch the list now!Sometimes I can login via Zerotier and sometimes not.
This is definitely a bug in Mikrotik ZeroTier. I consider this not reliable.
There is still work to be done.
If you just added a ZeroTeir interface to the Mikrotik, and installed the ZT client on Android - both joined to same ZT network. The ZT network traffic shouldn't "come out with WAN IP from MT".Hi, at the moment there are two devices connected to ZT - Mikrotik router and Android phone. Everything works, devices can see each other, ping, etc. But … is there any chance that in this configuration my phone will come out with WAN IP from MT in this configuration? I would like to add that there are private WAN IPs on both sides.
I added ZT interface to bridge and unfortunately I still have on my mobile phone WAN IP from sim card provider. Maybe I must to add some rules in ZT admin console? Generally I'd like to looks it the same like in connection via L2TP or Wiregourad .If you just added a ZeroTeir interface to the Mikrotik, and installed the ZT client on Android - both joined to same ZT network. The ZT network traffic shouldn't "come out with WAN IP from MT".Hi, at the moment there are two devices connected to ZT - Mikrotik router and Android phone. Everything works, devices can see each other, ping, etc. But … is there any chance that in this configuration my phone will come out with WAN IP from MT in this configuration? I would like to add that there are private WAN IPs on both sides.
Now the tunnels ZT will establish to create the ZT network, will go out the WAN at least on the Mikrotik side. But those may or may not be used depending on what network the Android uses... e.g. same LAN as MT ZT, firewall configs, IPv6 config/availablity/paths, etc. could all effect how the Android and Mikrotik are connected by ZT.
But if your wanted your android ZT client to use the Mikrotik as WAN, not the phone. You'd need to add the ZT interface to a bridge, or in some way enabled DHCP on the Mikrotik ZT interface so ZT clients would get DHCP from the MT, thus routed by it. So possible, but it won't happen by accident – or shouldn't.
Are you seeing something odd? Otherwise, the MT WAN shouldn't be involved if you just have a ZT interface on MT and Android ZT client – that should be a private network by default.
Fair question. Bridging the ZT interface be fine, to get you the LAN on your phone from anywhere. But the phone using ZT as its default route, that take CLIENT settings in the app. Dunno the specific android client settings for ZT, but you'd want to look at the "Send All Traffic" and/or "Allow Default Route Override" (names be different, help in ZT app may explain) are set right.I added ZT interface to bridge and unfortunately I still have on my mobile phone WAN IP from sim card provider. Maybe I must to add some rules in ZT admin console? Generally I'd like to looks it the same like in connection via L2TP or Wiregourad .
But if your wanted your android ZT client to use the Mikrotik as WAN, not the phone. You'd need to add the ZT interface to a bridge, or in some way enabled DHCP on the Mikrotik ZT interface so ZT clients would get DHCP from the MT, thus routed by it. So possible, but it won't happen by accident – or shouldn't.
Hi,Fair question. Bridging the ZT interface be fine, to get you the LAN on your phone from anywhere. But the phone using ZT as its default route, that take CLIENT settings in the app. Dunno the specific android client settings for ZT, but you'd want to look at the "Send All Traffic" and/or "Allow Default Route Override" (names be different, help in ZT app may explain) are set right.
I added ZT interface to bridge and unfortunately I still have on my mobile phone WAN IP from sim card provider. Maybe I must to add some rules in ZT admin console? Generally I'd like to looks it the same like in connection via L2TP or Wiregourad .
The ZT web console is kinda like "Bridge" in the ROS - you add "ports" (e.g. ZT device connections), but once connected to ZT network, how the routing works depends on what the ports connected do on IP/Layer-3. The ZT console does have essentially the equivalent of "DHCP Server" that hands out IPs, but the "Auto IP" does NOT hand out default routes. Since ZT operates at Layer-2, the Mikrotik can certainly bridge any of it's interfaces to a ZeroTier network.
The ZT client will control what happens with the default route on a device like android (and after it's bridged to the MT). But, unlike L2TP or Wiregaurd, just having multiple ZeroTier mobile phone clients will bridge them all together without any router – so the default I'm sure isn't to use the ZT network for all phone device traffic, since a ZT network has no route out to the internet by default too. ZT support doing that it and useful sometimes, but philophosicallly that's not in line with ZT's "disaggregated" approach.
Try adding route to 0.0.0.0/0 gateway "your Mikrotik IP in zerotier network" in Zerotier dasboard and then enable Route Via Zerotier. Not realy sure if this will work, but you can try.Hi,
Fair question. Bridging the ZT interface be fine, to get you the LAN on your phone from anywhere. But the phone using ZT as its default route, that take CLIENT settings in the app. Dunno the specific android client settings for ZT, but you'd want to look at the "Send All Traffic" and/or "Allow Default Route Override" (names be different, help in ZT app may explain) are set right.
The ZT web console is kinda like "Bridge" in the ROS - you add "ports" (e.g. ZT device connections), but once connected to ZT network, how the routing works depends on what the ports connected do on IP/Layer-3. The ZT console does have essentially the equivalent of "DHCP Server" that hands out IPs, but the "Auto IP" does NOT hand out default routes. Since ZT operates at Layer-2, the Mikrotik can certainly bridge any of it's interfaces to a ZeroTier network.
The ZT client will control what happens with the default route on a device like android (and after it's bridged to the MT). But, unlike L2TP or Wiregaurd, just having multiple ZeroTier mobile phone clients will bridge them all together without any router – so the default I'm sure isn't to use the ZT network for all phone device traffic, since a ZT network has no route out to the internet by default too. ZT support doing that it and useful sometimes, but philophosicallly that's not in line with ZT's "disaggregated" approach.
I added screenshot from ZT Android Client. There is one option - Route via ZT, but if I marked it was the same. Generally I am not such good in Mikrotik ROS, and generally in networks, so I think it will be "to high mountain" for me. But thx a lot for Your full answer.
BINGO! It is working! Thx a lot!Try adding route to 0.0.0.0/0 gateway "your Mikrotik IP in zerotier network" in Zerotier dasboard and then enable Route Via Zerotier. Not realy sure if this will work, but you can try.
Hi,
I added screenshot from ZT Android Client. There is one option - Route via ZT, but if I marked it was the same. Generally I am not such good in Mikrotik ROS, and generally in networks, so I think it will be "to high mountain" for me. But thx a lot for Your full answer.
That actually make sense, so simple if you don't need full L2. I presume you had to also tick the "Route via ZeroTier" in the Android ZT app too? The iPhone app has "Enable Default Route" that seem to needed to be set for the default route to take if 0.0.0.0/0 added to my.zerotier.com network's route table. But the default route "trick" (okay, it just client route injection) worked on iPhone too - but did seem gated by the client app too.BINGO! It is working! Thx a lot!
Try adding route to 0.0.0.0/0 gateway "your Mikrotik IP in zerotier network" in Zerotier dasboard and then enable Route Via Zerotier. Not realy sure if this will work, but you can try.
Why would you use ZeroTier when in actual fact TailScale is much easier to use [implement], performs much better especially if your internet connection is via fiber [much less latency] ...like yours is and there is ABSOLUTLY nothing to configure on MikroTik? No public keys to remember or exchange ??? Give me ONE good reason @anav only ONEmaking little progress thus far but it is intriguing.
YOU will be SHOCKED how easy it is to create a TailScale Network .... why wait ..... do it now ..... will not take more than 10 minutes to set up .... use your phone and if you have a NAS use itBecause tailscale is not a service on the router, once I get it working then I will compare to wireguard performance already on board.
Since I can now do simple connections directly via wireguard, tailscale is not necessary.Correct me if i'm wrong, but Tailscale is stupid simple way to connect two or more devices directly, but ZeroTier is for network admins to create complex large networks (virtual switch). They both serve kind of different purpose, although with ZT you can also connect just two devices, if you want.
Well I am only a home owner and thus do not have 'no real IP" or where Private IPs change all the time necessarily.Wireguard is something else. How will you run wireguard between two networks that have no real IP and where the private IP is changing all the time? This is where Zerotier can help
And when will we get Zerotier on other Routers, (MIPS)?This is where Zerotier can help
Yes You are wrong .. BECAUSE TailScale will SCALE a very large network, networks far more easily than ZeroTier .... The KEY words is VERY easily .... Yes ZeroTier is more mature currently and ABSOLUTLY there is no question ZeroTier will make far more work for the Techie admin ... far more work for the techie means far more money for both the Techie and ZeroTier in compensation ... so people like me should LOVE ZeroTier ...... MY only argument is that TailScale is remarkable in what it achieves not only for the individual ... like Anav the homeowner but more importantly what it achieve for the mega corp or any business enterprise with hundreds [even thousands] of devices. Yes TailScale needs to mature and they are making significant headway so far.Correct me if i'm wrong, but Tailscale is stupid simple way to connect two or more devices directly, but ZeroTier is for network admins to create complex large networks (virtual switch). They both serve kind of different purpose, although with ZT you can also connect just two devices, if you want.
Anav, does not have to be a NAS it could be your Desktop Computer or your daughters computer sitting in Spain or is it Portugal or in VancouverWhat is the purpose of NAS?
So tailscale is superior but I have to go out and buy an NAS first ;-PPP
You have to do better than that LOL
But a NAS is far more fun IMOYes it would be nice if RouterOS became a TailScale ClientHow will it scale, if you can't install it on the router? You must install it on all end devices? Not very practical
However .....BTWSubnet routers and traffic relay nodes
Tailscale works best when the client app is installed directly on every client, server, and VM in your organization. That way, traffic is end-to-end encrypted, and no configuration is needed to move machines between physical locations.
However, in some situations, you can’t or don’t want to install Tailscale on each device:
With embedded devices, like printers, which don’t run external software
When connecting large quantities of devices, like an entire AWS VPC
When incrementally deploying Tailscale (eg. on legacy networks)
In these cases, you can set up a “subnet router” (previously called a relay node or relaynode) to access these devices from Tailscale. Subnet routers act as a gateway, relaying traffic from your Tailscale network onto your physical subnet. Subnet routers respect features like access control policies, which make it easy to migrate a large network to Tailscale without installing the app on every device.
Regarding home routers I agree but if you go automative with the LtAP series, there is no choice. And ZeroZier makes much sense to reach the device from outside.The ARM devices are nice, you should get one. I love my RB4011.
Use the MIPS device for something else
When one uses their TailScale Admin Account you then can configure a subnet Router that can interact with your MikroTik Router --- following is its description:what is meant by a subnet router???
Subnet routers act as a gateway, relaying traffic from your Tailscale network onto your physical subnet. Subnet routers respect features like access control policies, which make it easy to migrate a large network to Tailscale without installing the app on every device.
Things I have ran Zerotier on:Hi all,
In the OP, one of the supported devices is the "hAP ac³ (non LTE)". This is acually a little overkill for my home office use case - will the hAP ac2 support this Zerotier package?
This looks like it's gonna be a killer feature for me, and I'd really like to deploy it in my use case!
will add RB4011 and RB450Gx4..........Things I have ran Zerotier on:Hi all,
In the OP, one of the supported devices is the "hAP ac³ (non LTE)". This is acually a little overkill for my home office use case - will the hAP ac2 support this Zerotier package?
This looks like it's gonna be a killer feature for me, and I'd really like to deploy it in my use case!
Audience
cAP AC
RB3011
hAP AC2
CRS326
Is this cpu usage when testing file transfer via ZT network? If that's so it can be that one cpu core (hac3 is 4 core) is busy dealing with this traffic and that zt/wg engine cannot scale beyond one core (ie single threaded)?The cpu load of hap ac3, when transfering files is 20-30%, avg 25%, but i dont think this explains the slow download speed.
i checked the links between peers(pc-hap ac3) on the zerotier central and using the zerotier-cli on windows, they show a direct(non relayed) connection, and the respective public IPs are also showing up properly. ping times also give away a direct link. Any suggestions on improving my speeds would be appreciated.
Is this cpu usage when testing file transfer via ZT network? If that's so it can be that one cpu core (hac3 is 4 core) is busy dealing with this traffic and that zt/wg engine cannot scale beyond one core (ie single threaded)?The cpu load of hap ac3, when transfering files is 20-30%, avg 25%, but i dont think this explains the slow download speed.
i checked the links between peers(pc-hap ac3) on the zerotier central and using the zerotier-cli on windows, they show a direct(non relayed) connection, and the respective public IPs are also showing up properly. ping times also give away a direct link. Any suggestions on improving my speeds would be appreciated.
I think this is your problem. You have Zerotier interface in bridge in your configuration:Hi y'all, I'm getting an error message trying to configure Zerotier on RB4011, running 7.1.1; I have two other clients in the pool which work well - an iPhone and RB5009. I have the new interface enabled online. I upgraded the RB4011 from 6.48.4 to 7.1.1 and after completing the Zerotier installation I get an error in the firewall rules - "in/out-interface matcher not possible when interface (zerotier1) is slave - use master instead (bridge)". I did check my configuration and Ether1 is not listed in the bridge. Since this is primarily CLI I'm not sure what to do. I think I have a configuration error and haven't been able to solve it yet, any help is kindly appreciated. I have attached my config.
Or for CHR's? That would be awesome.Is there a current Roadmap for adding ZT functions to non ARM based boards? (specifically Mipsbe)
We install a lot of LGH/SXT LTE devices so adding ZeroTier to these could be a great way for us to gain remote login functionality to devices we normally have a hard time accessing.
