iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To create a self-hosted VPN with ZeroTier, run ZeroTier One on a VPS, create a private virtual network, authorize your devices, and decide whether the VPS should carry only private-network traffic or all client internet traffic. ZeroTier Central can provide the hosted control plane; the VPS still supplies the optional exit-node gateway for a full-tunnel design.
The setup has four security boundaries: the VPS provider firewall, the Linux host firewall and forwarding rules, ZeroTier membership and flow rules, and the controller API token. Configure and test each one before relying on the network.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What you are building
ZeroTier combines an agent on every endpoint, an encrypted peer-to-peer data layer, and a control layer that handles membership, certificates, addressing and policy. Each endpoint receives a virtual network interface. A network controller admits members, issues the credentials needed to join, and distributes default configuration.
In this design, the VPS runs ZeroTier One and can also run the controller. It may serve two different roles:
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
- Controller: maintains the private network definition, address pool, managed routes and member authorization.
- Gateway or exit node: forwards and NATs client traffic to the public internet when you configure a full tunnel.
These roles are independent. A controller distributes policy; it does not carry your application or internet traffic. A full-tunnel VPS is the node that actually handles that traffic.
Decide whether you need split tunnel or full tunnel
ZeroTier is split tunnel by default. Only destinations covered by ZeroTier-managed routes use the virtual interface. Web browsing and other ordinary internet connections continue to use the endpoint’s existing connection.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThat default is normally best for administration, private services, remote file access and site-to-site connectivity. A full tunnel is appropriate when selected clients must send all IPv4 internet traffic through the VPS public address.
| Characteristic | Split tunnel | Full tunnel through the VPS |
|---|---|---|
| Traffic scope | Only ZeroTier-managed destinations | Managed destinations plus the default route (0.0.0.0/0) |
| VPS configuration | ZeroTier membership and routes | Membership, default route, IPv4 forwarding, forwarding firewall rules and WAN masquerading |
| Client setting | Normal ZeroTier join; Allow Default remains disabled | Allow Default enabled on each client that should use the gateway |
| VPS bandwidth and egress | Used for private-network traffic | Used for all traffic from participating clients, so provider bandwidth and egress limits matter |
| Failure behavior | Private destinations fail while normal internet access usually remains available | Internet traffic for participating clients can fail or revert only if you deliberately configure a fallback |
A Raspberry Pi can perform the gateway role too, but it is a physical device that must remain powered and reachable. The VPS approach provides a public provider network, provider firewall controls and a data-center power and connectivity environment. It also introduces provider dependence and possible bandwidth charges.
Prerequisites and network planning
- A supported Linux VPS with a stable public address.
- Root or sudo access for package installation, service checks, sysctl changes and firewall configuration.
- A provider firewall that permits outbound UDP. UDP port 9993 is required at minimum for root-server connectivity; broader outbound UDP improves the chance of direct peer-to-peer paths.
- A private address range that does not overlap the LANs or VPN ranges used by your clients. The documentation example uses 192.168.192.0/24; select another non-overlapping range when that block is already in use.
- Administrative access to the ZeroTier controller, either through ZeroTier Central or the controller running on your VPS.
- A list of devices that should be authorized. Joining a network is not the same as being approved to use it.
Write down the VPS WAN interface name and the ZeroTier interface name after installation. Linux commonly gives a ZeroTier interface a name beginning with zt, but use the actual name shown on your system rather than assuming a suffix.
Install ZeroTier One and prepare the VPS
Install the agent
Install ZeroTier One with the official Linux installation script or your distribution’s supported package manager. Enable and start the service using the service manager supplied by your distribution. Do not proceed until the daemon is running and can identify the node.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Check the local node state:
sudo zerotier-cli infoThe command should return a node identity and an online state. If it reports offline, check DNS, the VPS provider’s outbound UDP policy and local egress filtering before creating a network.
Protect the working directory and token
Linux stores ZeroTier’s working data in /var/lib/zerotier-one. The file authtoken.secret grants access to the local controller API. Keep it readable only by trusted administrators, do not paste it into tickets or shell history, and do not copy it into a web-accessible directory.
Rank #2
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
The controller’s local JSON API normally listens on 127.0.0.1:9993. Keep that binding local. If you need remote administration, use an authenticated administrative channel rather than exposing port 9993 to the public internet. The controller does not provide a separate fine-grained access-control layer beyond its control interface and authentication token.
Create the private ZeroTier network
Confirm the controller API
Read the token through a root-protected local session and use it for API requests. The documented status request is:
sudo zerotier-cli info
curl "http://localhost:9993/status" -H "X-ZT1-AUTH: ${TOKEN}"The response includes the node information needed for controller operations. Use the local API or the management interface to create a network, then save its 16-digit network ID. Treat that ID as an identifier, not as a secret; the authorization decision still controls who can join.
Set the network to private
Configure the network as private so that membership must be explicitly authorized. A private network prevents an arbitrary node that knows the network ID from becoming an active participant.
Define an IP auto-assignment range
Add an address pool for the virtual interface. The official example assigns addresses from 192.168.192.1 through 192.168.192.254. Use a range that does not overlap a client’s physical LAN, another VPN, a container network or a cloud provider route. Overlap can cause the operating system to choose the wrong interface and make a healthy ZeroTier link appear broken.
Add a managed route
For the example pool, add a managed route for 192.168.192.0/24. The route tells members that destinations in that network are reachable through the ZeroTier interface. For a different pool, use the corresponding network prefix. A managed route is separate from membership: it advertises where traffic should go, but it does not authorize a node.
Recommended Free Tools
Join and authorize every endpoint
Install ZeroTier One on the VPS and on each client device. Join the private network from each node:
sudo zerotier-cli join <network-id>Replace <network-id> with the saved 16-digit identifier. Repeat the command on each intended member, including the VPS if it is the gateway.
After a join request, the node appears in the controller’s member list. Authorize it through the controller API or management interface. Repeat authorization deliberately for every device; do not treat a successful join command as proof that access has been granted.
On each node, verify membership and addressing:
sudo zerotier-cli listnetworksThe output should show the private network, its authorized state and an assigned ZeroTier address. Test connectivity by pinging another member’s assigned virtual address. If both nodes are authorized but cannot communicate, inspect host firewalls and ZeroTier flow rules before changing routes.
Configure the VPS as a full-tunnel exit node
Skip this section if you only need split-tunnel access to private services. A full tunnel requires all of the following: IPv4 forwarding on the VPS, forwarding rules that permit traffic between the ZeroTier and WAN interfaces, NAT on traffic leaving the WAN interface, a managed default route and client-side Allow Default.
Enable IPv4 forwarding
sudo sysctl -w net.ipv4.ip_forward=1This change takes effect immediately. Persist it using your distribution’s supported sysctl configuration so a reboot does not silently disable routing.
Identify interfaces
Set variables to the actual interface names on your VPS. The ZeroTier interface begins with zt; the WAN interface is the device carrying the VPS’s public route.
ZT_IF=ztXXXXXX
WAN_IF=eth0Replace both values with the names shown by your system. A wrong interface name can create rules that load successfully but never match traffic.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Allow forwarding and masquerade WAN traffic
The following illustrates the required rule pattern with iptables:
sudo iptables -A FORWARD -i "$ZT_IF" -o "$WAN_IF" -j ACCEPT
sudo iptables -A FORWARD -i "$WAN_IF" -o "$ZT_IF" -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o "$WAN_IF" -j MASQUERADEThe first rule permits client traffic toward the internet. The second accepts established return traffic. Masquerading rewrites private ZeroTier source addresses to the VPS WAN address so upstream networks can return packets. Apply equivalent rules if your distribution uses another firewall framework, and persist them with that distribution’s supported mechanism.
Rank #4
- Broadcom BCM2711, quad-core Cortex-A72 (ARM v8) 64-bit SoC @ 1. 5GHz
- 2. 4 GHz and 5. 0 GHz IEEE 802. 11b/g/n/ac wireless LAN, Bluetooth 5. 0, BLE
- 2 × USB 3. 0 ports, 2 x USB 2. 0 Ports
- 2 × micro HDMI ports supproting up to 4Kp60 video resolution
- Micro SD card slot for loading operating system and data storage
Do not assume these rules override an existing default-deny policy. The provider firewall, host firewall and any default forwarding policy must all permit the intended path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Advertise the default route
In the controller, add this managed route:
0.0.0.0/0 via <zerotier-ip-of-vps>Use the VPS’s assigned ZeroTier address as the next hop. This route is what makes the VPS a candidate default gateway for members; it does not force every client to use it.
Enable Allow Default only where needed
On each client that should send all internet traffic through the VPS, enable allowDefault=1, or turn on the equivalent Allow Default setting in that client’s interface. Leave it disabled on clients that should retain ordinary internet routing and use ZeroTier only for private destinations.
Secure the control and data planes
Protect controller administration
- Keep the API bound to localhost and protect
authtoken.secret. - Use an authenticated administrative path for controller changes instead of publishing port 9993.
- Back up the controller’s
controller.ddata, especially the controller identity and network definitions, before upgrades or migration. - Limit shell and sudo access on the VPS to administrators who should be able to authorize members or alter routes.
Layer the firewalls
Use the VPS provider firewall and the Linux host firewall together. The provider layer controls traffic before it reaches the instance; the host layer controls traffic after it arrives. For a full tunnel, confirm that outbound UDP 9993 is allowed and that the forwarding and NAT rules are not blocked by a broader host policy.
Use ZeroTier flow rules intentionally
Flow rules operate at the virtual-network layer and are enforced locally on nodes. The rules engine is stateless, so bidirectional communication must be expressed explicitly when you write custom rules. Start with only the member-to-member ports your application needs rather than allowing every protocol between every node.
Current ZeroTier documentation states that templated flow rules are available on Essential and higher tiers, while custom flow rules require Scale or Enterprise. Confirm the account’s current tier before designing a deployment that depends on custom rules.
Remember that a full tunnel changes the trust boundary
Clients using Allow Default send their internet traffic through the VPS. That exposes those flows to the VPS operating system, its administrators and its provider in the same way that any gateway handles forwarded traffic. A full tunnel changes routing; it is not, by itself, a promise of anonymity or a performance guarantee.
Validate the deployment before relying on it
- Run
zerotier-cli infoon the VPS and confirm a node identity and online state. - Run
zerotier-cli listnetworkson the VPS and clients. Confirm the intended network is private, authorized and assigned an address. - Ping between two members using their ZeroTier addresses. If this fails, check authorization, host firewalls, flow rules and overlapping address ranges.
- For split tunnel, verify that a private destination uses the virtual interface while an ordinary internet destination still follows the client’s normal route.
- For full tunnel, enable Allow Default on one test client and verify that its public IP is the VPS egress address. Check DNS behavior separately; a changed public IP does not prove that every DNS query uses the desired resolver.
- Reboot the VPS and test again. Confirm that the ZeroTier service starts, IPv4 forwarding is enabled, firewall and NAT rules persist, and the managed routes are still present.
- Attempt access from an unauthorized member and confirm that membership or flow policy blocks it.
- Test the ports your application actually needs rather than relying only on ping, which may be filtered independently of application traffic.
Troubleshoot common failures
The node is offline
Check the ZeroTier service, DNS resolution and outbound UDP policy. UDP 9993 is the minimum path to root servers. A restrictive egress firewall can prevent the node from establishing control connectivity even when the VPS has general internet access. Broader outbound UDP can improve peer-to-peer paths.
Best Value
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
The network appears after joining but has no address
Confirm that the network is private but the member is authorized, and verify that an IP auto-assignment range exists. Check that the pool is not exhausted and does not overlap a local network. The member list and listnetworks output distinguish a join request from an active, addressed membership.
Members have addresses but cannot communicate
Inspect both hosts’ firewalls and the network’s flow rules. Because flow rules are stateless, a rule that permits one direction may still block replies. Also verify that the managed route matches the address pool and that no more-specific competing route points elsewhere.
Full-tunnel clients still use their local internet connection
Check all three routing components: the controller must advertise 0.0.0.0/0 through the VPS, the client must have Allow Default enabled, and the VPS must forward and masquerade traffic. A missing component leaves the client in split-tunnel behavior or creates a route with no working gateway.
The client loses internet access after enabling Allow Default
Check IPv4 forwarding, the ZeroTier-to-WAN forwarding rule, established return traffic and WAN masquerading. Confirm that the WAN interface variable names match the actual interfaces. Then inspect provider and host firewall policies for a default-deny forwarding rule.
It works until the VPS reboots
Persist sysctl forwarding and firewall/NAT rules using the distribution-supported mechanism. Confirm that the ZeroTier service is enabled at boot and that controller data in controller.d remains intact. A reboot test is essential because temporary sysctl and iptables changes are otherwise easy to mistake for a permanent configuration.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsDNS looks wrong even though the public IP changed
Routing and DNS are separate. A full-tunnel default route can move web traffic through the VPS while the client continues using its previous DNS configuration. Test DNS resolution independently and configure the resolver policy appropriate for your environment.
VPS gateway or Raspberry Pi gateway?
| Decision factor | VPS gateway | Raspberry Pi gateway |
|---|---|---|
| Public reachability | Hosted on a provider network with a public address | Depends on the home or office connection and its inbound reachability |
| Power and maintenance | Provider supplies data-center power; you maintain the operating system and configuration | You supply power, hardware, storage and physical maintenance |
| Provider dependence | Depends on the VPS provider’s network, firewall and policies | Depends on the local ISP, router and premises |
| Firewall control | Provider firewall plus VPS host firewall | Local router firewall plus gateway host firewall |
| Expected uptime | Usually tied to the provider’s service and your maintenance practices | Tied to premises power, internet and hardware availability |
ZeroTier’s exit-node documentation uses “a $5 VPS” as an illustrative minimum-size example, not as a current market price or a performance promise. Choose capacity from expected concurrent users, traffic volume and provider limits rather than from that example.
Maintain and expand the network
Keep a written inventory of the network ID, address pool, managed routes, authorized members, VPS interface names and firewall persistence method. Review the member list periodically and remove devices that should no longer connect.
Back up the controller identity and network definitions in controller.d before upgrades or migration. Protect those backups as administrative secrets. If the controller identity is lost, you may need to rebuild trust and membership rather than simply reinstalling the package.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →When adding a new site or service, decide first whether it belongs in split tunnel or full tunnel. Add only the required managed routes, authorize only the required members and express both directions in flow rules when custom policy is used. Re-run the validation checklist after every route, firewall, controller or operating-system change.
What this setup does—and does not—promise
This design gives you an encrypted virtual network, controller-managed membership and the option to route client traffic through a VPS you administer. It does not establish a universal throughput, latency, uptime or anonymity figure; those depend on the VPS provider, client links, selected routes, firewall policy and traffic load. Measure those properties in your own environment after the configuration and reboot tests pass.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
