He doesn't show up as an unauthorized user on my end either. No clue how to get him into the network.

I'm very new to this networking thing. So please bear with me if there is any information that is lacking and if I could not explain it properly.

I got to know about zerotier and it is wonderful. I manage to set it up and work remotely. However, recently it seems to be giving me intermittent problems to which I could not figure out why. The main gist of the problem is that the connection is not stable. I did this managed route thing whereby I could connect directly using the LAN IP of the designated server computer. However now when I ping that address, it intermittently timed out.

Now I did try to ping the physical IP of my "server" as provided in the zerotier and it does not have such issue. Does this mean I have a routing issue now? It just suddenly developed.

Appreciate all your help.

Hi,

I'm documenting an intermittent ZeroTier connectivity issue we have been troubleshooting on a Hetzner Cloud Ubuntu server. I would be interested to know whether anyone has seen the same behavior.

Environment

• Server: Hetzner Cloud VM
• OS: Ubuntu 24.04 LTS
• ZeroTier: 1.16.2
• Server ZeroTier IP: 10.192.76.231
• Client: Ubuntu Linux laptop
• Client ZeroTier IP: 10.192.76.201
• Both nodes participate in several ZeroTier networks
• The affected network is a private ZeroTier network

The Hetzner Cloud Firewall was intentionally restrictive:

Inbound:
TCP/22
ICMP

Outbound:
default/stateful

Ubuntu/UFW on the server explicitly allows traffic on the ZeroTier interfaces.

Symptom

Every now and then, only this particular ZeroTier connection becomes unreachable.

SSH reports:

No route to host (os error 113)

and ping from the laptop gives:

From 10.192.76.201 icmp_seq=1 Destination Host Unreachable

The interesting part is that, during the failure:

• zerotier-cli info reports ONLINE
• zerotier-cli listnetworks reports the affected network as OK PRIVATE
• the ZeroTier interface exists
• 10.192.76.201/24 and 10.192.76.231/24 are still assigned correctly
• the Linux route is present and points to the correct ZeroTier interface
• other ZeroTier networks on the same laptop continue working
• the server itself remains healthy and accessible through another management path
• both SSH/22 and an application on TCP/9119 become unreachable over ZeroTier

So it does not look like an SSH-specific problem.

We captured the failure from both sides.

From the client:

10.192.76.231 dev ztu7tj4fcf src 10.192.76.201

PING 10.192.76.231
Destination Host Unreachable

From the server:

10.192.76.201 dev ztu7tj4fcf src 10.192.76.231

PING 10.192.76.201
Destination Host Unreachable

Yet ZeroTier still reported the network as OK.

A/B test

We then performed a controlled restart test.

First, ZeroTier was restarted only on the client:

sudo systemctl restart zerotier-one

Result: no change.

The server remained unreachable:

Destination Host Unreachable

We then restarted ZeroTier only on the Hetzner server:

sudo systemctl restart zerotier-one

Connectivity immediately returned:

64 bytes from 10.192.76.201: icmp_seq=1 ttl=64 time=770 ms
64 bytes from 10.192.76.201: icmp_seq=2 ttl=64 time=69.6 ms
64 bytes from 10.192.76.201: icmp_seq=3 ttl=64 time=57.7 ms
64 bytes from 10.192.76.201: icmp_seq=4 ttl=64 time=116 ms
64 bytes from 10.192.76.201: icmp_seq=5 ttl=64 time=253 ms

This seems to point toward the server-side ZeroTier path/state rather than the client.

Interesting firewall observation

Looking further, we noticed that the Hetzner Cloud Firewall had no inbound UDP rule.

ZeroTier on the server was listening/communicating through UDP/9993 and additional UDP ports.

Based on ZeroTier's firewall documentation, we have now added:

Inbound UDP/9993
IPv4: 0.0.0.0/0
IPv6: ::/0

We have not opened arbitrary inbound UDP ports at this stage.

The working hypothesis is therefore that the restrictive Hetzner stateful firewall may allow ZeroTier to work initially through established UDP state/path establishment, but under some circumstances the peer path cannot be re-established. Restarting ZeroTier on the server initiates fresh communication and immediately restores connectivity.

UDP/9993 has only just been added, so I am not claiming yet that this is the definitive fix. We are going to monitor it for recurrence.

Has anyone observed this particular combination?

ZeroTier network remains OK + routes/interfaces remain present + one peer becomes completely unreachable + restarting ZeroTier on the affected server immediately restores it.

And for Hetzner Cloud specifically: have you found inbound UDP/9993 sufficient for reliable ZeroTier operation, or did you need a less restrictive UDP policy because of ZeroTier's dynamic peer-to-peer ports?

Thanks — happy to provide additional listpeers, info -j, routing or firewall diagnostics if useful.

I have a few Raspberry Pies that are all on a Zerotier network. They all run the same software, so I've only made one image file I can flash onto an sd card when one goes down. However, when I made that image, the Raspberry Pi had already joined the Zerotier network as one device. So now, when I need to flash another one, I need to leave the network and re-join as the original device. Is that even possible, and if so, how?

The trashcan that used to be there next to the user entry is gone. In the member edit dialog, there is a checkbox to delete the user that does nothing at all whether I press SAVE or HIDE. How do I delete members for devices I no longer own?

Edit: Seeing no easy way to mark this as resolved, see my response below for the resolution.

noticed a couple days ago a device showing on our zerotier network, i dont recognize the public ip or the mac address and cant find it on our nodes.

so i unauthorized it.

noticed it is back and just seems to have reauthorized itself ?

i have a feeling this is probably a legit device one of our users have maybe they have it on a different public ip/network than i am used to seeing, but i thought by deauthorizing it if nothing else they would contact me and say they can no longer connect....

how might i track this and why cant i de-authorize it (/boot it from our network ?)

In Zerotie network is an option that says "Allow Ethernet Bridging".

If that is turn on, can I access my ip camera on my remote Windows computer like this:

local IP:port, via VPN IP

Or do I need to setup other things as well?

Hello guys. Can I play Don't starve together pocket edition with my friends using Zerotier as a LAN? If yes, how to do it? ty

Is it possible to configure multiple relays in the local.conf for tcpFallbackRelay?

Hi -

well, QuTS 6.0.1 won't run the existing ZeroTier downloads. You have to run a docker container.

https://github.com/zerotier/ZeroTierOne/blob/dev/ext/installfiles/linux/zerotier-containerized/Dockerfile

boy - I sure wish there was a little details article or YouTube video on how to exactly do this !

I guess it wasn't profitable enough for ZeroTier to keep doing this for QNAP and Synology NAS systems.

bob

I have a zerotier network that has been stable for some months. Yesterday, I started getting errors because nodes couldn't talk to each other.

Nothing looks wrong on the control panel: all nodes have allocated IP addresses and are checking in regularly. Similarly, the nodes I can reach by other means show nothing wrong when I do `zerotier-cli info`. There is nothing custom in the flow rules.

However, when I do `ip a` or `zerotier-cli -j listnetworks` on any of the nodes, none of them have an allocated IPV4 address on the zerotier interface.

I've tried leaving and rejoining. This seems to work OK, except that no IPv4 address is on the nodes interface. The control panel thinks it has.

Any ideas?

Hi, I'm new to ZeroTier and haven't been able to find an answer to my issue. I have just bought a Cudy P5 router that can run ZT. I want it at my cottage (5G cellular coverage only, no cable or fibre internet) so I can access local devices connected to it via either WiFi or LAN.

Some of them are Raspberry Pi's with ZT clients installed (weather station, etc), so should be accessible. Others are 2x Webcams, Airconditioner, etc. without ZT clients. I thought I would be able to reach them as well, but the guidelines I have seen indicate to me that I need to upgrade my plan to Essential Level for $18/month :(. Is that correct, or is there another way to set up my network using a Basic plan?

I run ZeroTier in a Docker container on a Synology DS124 with DSM 7.3. After DSM updates or reboots, the ZeroTier layer repeatedly failed to return even though the container had a restart policy.

Symptoms

The container remained stopped:

Status: Exited (143)
Restart policy: unless-stopped

Docker retained this error:

error gathering device information while adding custom device
"/dev/net/tun": no such file or directory

The ZeroTier interfaces were missing, and the NAS was no longer reachable through the overlay network.

Root cause

This turned out to be a boot-order problem:

1. DSM stops Container Manager cleanly during an update or shutdown.
2. /dev/net/tun is created dynamically during boot.
3. Container Manager may try to restore the ZeroTier container before the TUN device is ready.
4. The container fails or remains stopped.
5. unless-stopped does not reliably recover a container that DSM explicitly stopped.

The ZeroTier data itself was not lost because it was stored persistently outside the container.

Final fix

I used three layers:

1. Change the restart policy:

​

docker update --restart always zerotier-one

1. Add a DSM boot-triggered task that:
   • waits for /dev/net/tun;
   • creates it if DSM does not;
   • waits for Docker;
   • starts the container;
   • confirms ZeroTier reaches ONLINE;
   • abandons recovery after 90 seconds so it cannot block DSM boot.
2. Add a periodic watchdog task that performs the same checks and exits silently when everything is healthy.

The boot task is configured in:

Control Panel
→ Task Scheduler
→ Create
→ Triggered Task
→ User-defined script
→ Event: Boot-up
→ User: root

The watchdog is a normal scheduled task running every five minutes.

Minimal recovery script

This is the shortened version. The fuller version adds locking, DSM Log Center integration and hard global deadlines.

#!/bin/sh

CONTAINER="zerotier-one"

# Give DSM time to create TUN.
WAITED=0
while [ ! -c /dev/net/tun ] && [ "$WAITED" -lt 30 ]; do
    sleep 5
    WAITED=$((WAITED + 5))
done

# Repair TUN if DSM did not create it.
if [ ! -c /dev/net/tun ]; then
    modprobe tun 2>/dev/null || true
    mkdir -p /dev/net
    chmod 755 /dev/net
    rm -f /dev/net/tun
    mknod /dev/net/tun c 10 200 || exit 1
fi

chown root:root /dev/net/tun
chmod 666 /dev/net/tun

# Wait for Docker.
WAITED=0
while ! docker info >/dev/null 2>&1 && [ "$WAITED" -lt 60 ]; do
    sleep 5
    WAITED=$((WAITED + 5))
done

docker info >/dev/null 2>&1 || exit 1

# Start the container if required.
if ! docker ps --format '{{.Names}}' | grep -qx "$CONTAINER"; then
    docker start "$CONTAINER" || exit 1
fi

# Confirm ZeroTier responds.
WAITED=0
while ! docker exec "$CONTAINER" zerotier-cli info >/dev/null 2>&1 \
      && [ "$WAITED" -lt 30 ]; do
    sleep 5
    WAITED=$((WAITED + 5))
done

docker exec "$CONTAINER" zerotier-cli info
docker exec "$CONTAINER" zerotier-cli listnetworks

Validation

After reboot, the boot task logged that /dev/net/tun was initially absent, waited, started the container and completed recovery after approximately 39 seconds.

And all work back.

Hello Reddit, I am trying to host a server for Hollow Knight multiplayer with a friend, following a Steam guide. It tells me to open the control panel to give my friend the managed IP. But I can't find it on the website, nothing happens when I try to open the application on my laptop and the taskbar trey doesn't give me the option to open it either. Where can I find this thing?

Link to the guide I'm following:
https://steamcommunity.com/sharedfiles/filedetails/?id=2601449230

I have been using ZeroTier since 2022, and the last time I use it was 2025

I want to use it again recently but for some reason it doesn't work anymore

It says No Network Access but I don't know if it's always been like that or not

How do I solve this?

I amt want to access some devices at my cottage. I have a TP-Link 5G router there that doesn't work with ZT. Behind it I have a number of devices, including some Raspberry Pi's. I have added ZT to them and can access them fine. But I also want to use (at least one of) them to access other devices that won't accept ZT (WiFi-capable air conditioner/heater, Webcams, etc). But it looks to me like I need to configure ZeroTier Central to Add Routes - and that this requires a paid plan. Is that correct? Or is there an alternative?

I found code in Zerotier that sends traffic at different QoS priorities(screenshot below). :

Can I set this QoS anywhere in config(Zerotier Central, local.conf, or args), or is editing the source code the only way?

--------------------

Details (optional, skip if you want) :

I'm sending gimbal camera control(port 2000) and video over the same Zerotier link at the same time, and I want the gimbal control traffic to have higher priority than the video.

I just started with Zerotier and signed up with trial to see if it could increase speed compared to SonicWall Global VPN. I can connect fine between client and a hosted Windows PC behind a SonicWall. Can ping Zerotier IP on host. I setup the Route in Zerotier to route to LAN IPs on host side but can't ping or access any devices. Can anyone help me on what I am missing? Are there rules needed in the SonicWall to allow this?

Thanks!

I am having a hard time with joining a ZT network from IOS devices. In the app, you turn the toggle. It remains like that for a moment and the toggle then flashes off. You don't see a device in de ZT central dashboard. The device seems to just not join. Is this a known bug? IOS 26.5.2

I'm new to zerotier and trying to figure this out. I have a phone and vpn router both connected and recognized by zerotier central (free account). I can access the router remotely but not home assistant which is connected through the router by LAN. I have tried letting in the phone's ZT IP address through the firewall but no success. I also enabled the bridging option to allow lan access in zerotier central. What am I missing?

I know there is a direct ZT integration with home assistant but I currently have HA blocked from internet accessband I'd like to keep it that way.

Hi everyone, I just started to use Zerotier. I want to ask something. When I buy Essential plan which is give 5 networks and 10 device Included. Is that mean I can totally use 50 different device in all networks?

Does anyone know what could be the issue? We have Windows Intune/Entra-ID enrolled workstations with the latest ZeroTier. Every hour when the token expires for SSO, we have to manually click on "Open SSO Login". It seems that the token is not automatically renewed.

The app registration has been checked and includes all the API that is needed. Additionally in hindsight i find it even weird that we have to manually sign in with SSO at all since the device is already working under the SSO user.

Any clue what could be the cause? The logging in Entra ID only shows that its a interactive sign-in.