Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesYou can turn a Linux VPS into a self-hosted ZeroTier VPN gateway by running ZeroTier One, creating a private virtual network, authorizing your devices, and—if you need a full-tunnel VPN—enabling IP forwarding and NAT on the VPS. ZeroTier Central can provide the hosted control plane; it does not carry your traffic. A self-hosted controller on the VPS is also possible.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
This guide covers both designs: split tunneling for private-resource access and full tunneling, where the VPS becomes an Internet exit node.
As an Amazon Associate I earn from qualifying purchases.
What the network does
ZeroTier combines an agent on each endpoint, an encrypted peer-to-peer data layer, and a control layer that handles membership, certificates, network configuration, routes, and policy. Each endpoint receives a virtual network interface, usually named something beginning with zt.
A network controller admits members, issues certificates, and supplies default configuration. The controller may be ZeroTier Central’s hosted service or a ZeroTier node running on your VPS. In either case, the controller distributes policy; it is not a relay for ordinary user traffic. Data normally travels directly between peers when connectivity allows.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Hosted control plane versus self-hosted controller
| Design | Where control data is managed | Where user traffic flows | Operational implication |
|---|---|---|---|
| ZeroTier Central | Hosted control plane | Between your enrolled nodes over the ZeroTier data plane | Less controller maintenance; your VPS still provides routing and exit-node functions if required |
| Controller on your VPS | Local ZeroTier controller and its data directory | Between your enrolled nodes, or through the VPS when it is configured as a gateway | You maintain controller storage, API access, backups, upgrades, and recovery |
The remainder of the procedure works with either control-plane choice. Controller-specific API examples assume the controller is running locally on the VPS.
What you need before installing
- A supported Linux VPS with a stable public address and enough CPU, memory, disk, and network allowance for your users and traffic pattern.
- Provider-level firewall access, including outbound UDP. UDP port 9993 is the minimum needed to reach ZeroTier root servers; allowing broader outbound UDP generally improves peer-to-peer path establishment.
- Root or equivalent administrative access to install services, enable forwarding, and configure the host firewall.
- A private address range that does not overlap with the LANs or VPNs your clients already use. The documented example uses
192.168.192.0/24, with an auto-assignment pool from192.168.192.1through192.168.192.254; choose a different, non-overlapping range where necessary. - A plan for whether the network is split tunnel or full tunnel. Full tunnel consumes VPS bandwidth and exposes tunneled traffic to the VPS operator and its host environment.
The often-cited “$5 VPS” in ZeroTier’s exit-node documentation is an illustrative minimum-size example, not a current market price or a performance guarantee. Provider pricing, bandwidth limits, egress charges, and availability vary by region and plan.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallInstall ZeroTier One on the VPS
Install ZeroTier using the official Linux installation script or your distribution’s package manager. Then verify that the service is active before creating a network.
sudo zerotier-cli info
sudo systemctl status zerotier-onezerotier-cli info should return the node identity and an online state. If it remains offline, check DNS, the provider firewall, local egress filtering, system time, and whether outbound UDP 9993 is permitted.
On Linux, ZeroTier’s working directory is /var/lib/zerotier-one. The local controller API normally listens on 127.0.0.1:9993 and authenticates with the local token in authtoken.secret. Protect that file as you would a root credential. Do not publish the API port on a public interface.
Create a private ZeroTier network
1. Inspect the local controller
When the controller is on the VPS, read its token only through a protected administrative session and query the local status endpoint:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →TOKEN=$(sudo cat /var/lib/zerotier-one/authtoken.secret)
curl 'http://localhost:9993/status' -H 'X-ZT1-AUTH: ${TOKEN}'The response identifies the local node. Keep the token in memory only for the administrative task and avoid placing it in shell history, shared scripts, or logs.
Rank #2
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
2. Create and configure the network
Use the controller API or the management interface to create a network and save its 16-digit network ID. Mark it private, configure an IP auto-assignment range, and add a managed route. For the example address plan:
- Auto-assignment pool:
192.168.192.1–192.168.192.254 - Managed route:
192.168.192.0/24
The range is only an example. Overlap with a client’s physical LAN can produce ambiguous routing, unreachable services, or traffic taking the wrong interface. Pick a private range that is unique across the environments that will connect.
A managed route tells members which destinations belong on the ZeroTier interface. For a private-service network, advertise only the virtual subnet or other internal prefixes you actually need.
Recommended Free Tools
3. Join the VPS and client devices
Join each intended node with the network ID:
sudo zerotier-cli join NETWORK_IDReplace NETWORK_ID with the 16-digit value you saved. Repeat on laptops, servers, phones, or gateways that should participate. Every join request appears as a network member, but a private network does not allow communication until the member is explicitly authorized.
4. Authorize members deliberately
In the controller API or management interface, approve only the node identities you recognize. After approval, check each endpoint:
sudo zerotier-cli listnetworksThe output should show the intended network as private and authorized, with an assigned virtual address. Record member names, node IDs, and addresses in your operations documentation so that an unfamiliar join request is easy to spot.
Choose split tunnel or full tunnel
| Characteristic | Split tunnel | Full tunnel through the VPS |
|---|---|---|
| Traffic scope | Only destinations covered by ZeroTier-managed routes use the virtual interface. | The client’s default route sends Internet traffic to the VPS. |
| VPS bandwidth and egress | Used primarily for private-service traffic or peer paths. | All tunneled Internet traffic consumes VPS bandwidth and may incur provider egress charges. |
| Setup effort | Network membership, addresses, and managed routes are usually sufficient. | Requires Linux forwarding, firewall forwarding rules, NAT, a default managed route, and client opt-in. |
| Client traffic exposure | Normal Internet traffic continues through the client’s existing provider. | Internet traffic exits through the VPS and is visible to the VPS host, provider, and any monitoring on that path. |
| Failure behavior | Loss of the ZeroTier path affects only managed destinations; ordinary Internet access normally remains. | If the VPS or tunnel fails, clients can lose Internet access while the default route is active. |
When split tunnel is the better choice
Use split tunnel when the goal is access to private administration panels, databases, file shares, or services on the virtual network. It minimizes gateway bandwidth, avoids changing a client’s public egress address, and limits the effect of a VPS outage.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When full tunnel is appropriate
Use full tunnel when clients need their Internet egress to be the VPS address, when you want centralized outbound filtering, or when a remote device must reach the Internet through a controlled network. Confirm that the VPS has adequate transfer capacity and that users understand the outage and privacy implications.
Configure the VPS as a full-tunnel exit node
1. Enable IPv4 forwarding
Enable forwarding immediately for testing:
sudo sysctl -w net.ipv4.ip_forward=1Persist the setting using your distribution’s supported sysctl configuration, then reload or reboot and verify that it remains enabled. If you also route IPv6, configure IPv6 forwarding and IPv6 firewall/NAT policy deliberately; enabling only IPv4 forwarding does not create a working IPv6 tunnel.
2. Identify the interfaces
Find the ZeroTier interface, which normally begins with zt, and the public-facing WAN interface. Use the actual names from your VPS rather than assuming they are eth0 or a particular zt suffix.
ip link
ip routeSet shell variables for the subsequent rules. The values below are examples:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ZT_IF=ztxxxxxxxx
WAN_IF=eth03. Permit forwarding and masquerade traffic
The VPS must accept packets arriving from the ZeroTier interface, send them out the WAN interface, accept established return traffic, and translate the source address on egress. A representative iptables policy is:
sudo iptables -A FORWARD -i $ZT_IF -o $WAN_IF -j ACCEPT
sudo iptables -A FORWARD -i $WAN_IF -o $ZT_IF -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o $WAN_IF -j MASQUERADEIntegrate these rules with the firewall framework used by your distribution or provider. Save them through that framework so they return after reboot; commands entered interactively are not a persistence mechanism. If an existing default-deny policy is active, ensure its ordering permits the intended forwarding rules. Do not broadly accept all forwarding traffic unless that is an explicit policy decision.
4. Advertise the default route
Add this managed route to the ZeroTier network:
0.0.0.0/0 via VPS_ZEROTIER_ADDRESSReplace VPS_ZEROTIER_ADDRESS with the VPS member’s ZeroTier address. This route tells clients that the VPS can handle every IPv4 destination. It does not by itself forward packets; the forwarding and NAT configuration above are required.
Rank #4
- Broadcom BCM2711, quad-core Cortex-A72 (ARM v8) 64-bit SoC @ 1. 5GHz
- 2. 4 GHz and 5. 0 GHz IEEE 802. 11b/g/n/ac wireless LAN, Bluetooth 5. 0, BLE
- 2 × USB 3. 0 ports, 2 x USB 2. 0 Ports
- 2 × micro HDMI ports supproting up to 4Kp60 video resolution
- Micro SD card slot for loading operating system and data storage
5. Opt clients into the default route
On each client that should use the exit node, enable allowDefault=1, or turn on the equivalent “Allow Default” setting in that client’s ZeroTier network configuration. Clients that leave this disabled continue to use split tunnel even when the default route is advertised.
Apply the setting selectively. A server that must remain reachable through its normal provider, or a workstation with an existing corporate VPN, may need split tunnel to avoid competing default routes.
6. Check DNS separately
A changed public IP proves that traffic is exiting through the VPS, but it does not prove that DNS requests use the desired resolver. Test DNS behavior independently and decide whether clients should retain their local resolver or use a resolver reachable through the tunnel. Avoid claiming leak protection unless DNS, IPv6, and application-specific routes have all been tested.
Secure the controller and virtual network
Protect the controller API
Keep the API bound to localhost and make administrative changes through an authenticated path such as an SSH session or a tightly restricted management tunnel. Never expose port 9993’s controller API directly to the public Internet. The local auth token is the credential for that interface; anyone who obtains it can administer the controller.
The controller does not provide a separate fine-grained access-control layer beyond its control interface and token. Use operating-system permissions, provider firewalls, host firewalls, and administrative access controls around it.
Back up controller state
Back up the controller’s controller.d data, especially the controller identity and network definitions, before upgrades, migrations, or storage changes. Protect backups because they can contain the information needed to operate your virtual networks. Test restoration rather than assuming that a copied directory is usable.
Layer the firewalls
Use the VPS provider firewall and the host firewall together. Provider rules control traffic before it reaches the guest; host rules control traffic inside the VPS. ZeroTier flow rules add policy at the virtual-network layer and are enforced locally on nodes. A permissive provider firewall cannot override a restrictive host policy, and a permissive virtual-network policy does not bypass provider or host filtering.
Best Value
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Write flow rules with direction in mind
Flow rules are stateless. If you create custom rules, express both directions required by an exchange rather than assuming that a return path is automatically allowed. Limit services by protocol, port, source, and destination where practical instead of granting every member unrestricted access.
Free tools Windows power users keep installed
One-click scans. No signup required.
Current ZeroTier documentation states that templated flow rules are available on Essential and higher tiers, while custom flow rules require Scale or Enterprise. Confirm the account’s current tier before designing around custom-rule functionality. Regardless of tier, keep membership authorization and host-level firewall controls in place.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validate the finished network
- Run
zerotier-cli infoon the VPS and confirm that it reports an identity and online state. - Run
zerotier-cli listnetworkson each endpoint and verify the intended network, private status, authorization, and assigned address. - From one authorized node, ping another node’s ZeroTier address. If that fails, check authorization, overlapping subnets, local firewall policy, and whether both agents are online.
- For a split-tunnel design, test a private service by its ZeroTier address or managed route and confirm that unrelated Internet traffic still uses the client’s normal connection.
- For a full-tunnel design, confirm that the client’s public IP is the VPS egress address, then test DNS and IPv6 behavior separately.
- Reboot the VPS. Verify ZeroTier service startup, forwarding, NAT, firewall persistence, and route advertisement after the restart.
- Submit a test join from an unapproved node and confirm that it cannot communicate until you authorize it.
- Exercise every intended flow-rule path, including the return direction and both allowed and denied ports.
Troubleshoot common failures
The VPS is offline in ZeroTier
Check the service status and zerotier-cli info. Confirm outbound UDP 9993 at the provider and host firewalls, verify DNS resolution and system time, and inspect local service logs. Broader outbound UDP may be needed for reliable peer-to-peer paths even when root-server connectivity works.
The member joined but has no usable address
Confirm that the node is authorized, the network is private but active, and an IP auto-assignment range is configured. Check that the range does not overlap another interface or VPN. Then run zerotier-cli listnetworks again after reconnecting the network.
Nodes have addresses but cannot communicate
Look for overlapping private subnets, host firewall blocks, restrictive flow rules, and incorrect managed routes. Because flow rules are stateless, verify that the required reverse direction is explicitly permitted. Test by ZeroTier address before testing a service name or application.
Full tunnel connects but the client has no Internet
Verify IPv4 forwarding, the ZeroTier-to-WAN forwarding rule, established return traffic, and WAN masquerading. Confirm that the default managed route points to the VPS’s ZeroTier address and that the client has allowDefault=1. Check the VPS’s own default route and provider egress filtering.
The public IP changes but some applications fail
Check DNS resolution, IPv6 paths, MTU-sensitive applications, and software that installs its own routes. A working IPv4 NAT path does not automatically provide IPv6 routing or guarantee that every application honors the ZeroTier default route.
VPS gateway or Raspberry Pi gateway?
| Consideration | VPS gateway | Raspberry Pi gateway |
|---|---|---|
| Public reachability | Hosted in a datacenter with a stable public address and provider networking. | Usually behind a residential or office connection and may need upstream port forwarding or an outbound reachability strategy. |
| Power and maintenance | No on-site power hardware, but you maintain the virtual server, operating system, firewall, and provider account. | Low running power consumption, but you maintain physical hardware, storage, cooling, and local connectivity. |
| Provider dependence | Depends on the VPS provider’s uptime, network policy, and bandwidth or egress limits. | Depends on the local ISP, router, power, and physical network. |
| Inbound firewall control | Provider and host firewalls can be managed centrally, with a public address available for administration when properly restricted. | Must account for the home or office router and ISP filtering. |
| Expected uptime | Often easier to place in a monitored datacenter environment, but no uptime figure is guaranteed by this design. | Can be dependable on a stable site, but local outages directly affect the gateway. |
A Raspberry Pi is an optional physical alternative, not a requirement for the VPS architecture. Choose it when local egress and on-site control matter more than datacenter reachability; choose a VPS when remote availability and a stable public network location are the priorities.
Operational checklist
- Use a private network and authorize members individually.
- Keep the controller API on localhost or behind a restricted administrative channel.
- Protect
authtoken.secretand back upcontroller.d. - Document the virtual subnet, auto-assignment pool, managed routes, member identities, and firewall intent.
- Persist sysctl, forwarding, NAT, and firewall configuration across reboots.
- Monitor VPS bandwidth and egress consumption if full tunnel is enabled.
- Review authorized members and flow rules periodically, removing stale devices.
- Test both normal operation and the failure mode in which the VPS gateway is offline.
This design provides the mechanics for a self-hosted encrypted overlay and, when configured, a VPS exit node. It does not establish a particular throughput, latency, uptime, or anonymity level; those depend on the VPS, paths between peers, client networks, firewall policy, and the services you place behind the tunnel.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
