Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteYou can turn a Linux VPS into a private ZeroTier network and, if required, an Internet exit node. Install ZeroTier One on the VPS and each client, run the controller on the VPS or use ZeroTier Central for control, authorize members, assign a non-overlapping private range, and add a managed route. Split tunneling works as soon as members can reach one another; a full-tunnel VPN additionally requires IPv4 forwarding, NAT, a 0.0.0.0/0 route, and allowDefault=1 on each client.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The VPS carries traffic only when you deliberately configure it to do so. ZeroTier Central and a self-hosted controller distribute membership and network policy; they do not carry your game, web, or voice traffic.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What you are building
ZeroTier combines an agent on every endpoint, an encrypted peer-to-peer data layer, and a control layer. The agent creates a virtual network interface (normally named something like ztxxxxxxxx). The network controller admits members, issues certificates, and distributes the network’s default configuration. Once members are authorized, endpoints can communicate over their assigned ZeroTier addresses even when they are on different physical networks.
For a gaming use case, this can provide a private address space for a dedicated server, remote administration, file transfers, or a small group that needs to appear on one virtual LAN. It does not automatically make every Internet connection leave through the VPS. That is the difference between the two designs below.
#1 Best Overall
- Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
| Design | Traffic scope | What the VPS must do | Typical use |
|---|---|---|---|
| Split tunnel | Only traffic for ZeroTier-managed networks | Run ZeroTier and the controller; no Internet NAT is required | Reach a private game server or administration service |
| Full tunnel (exit node) | All client IPv4 traffic, including Internet traffic | Forward packets, masquerade them on the WAN interface, and advertise a default route | Use the VPS as the client’s Internet gateway |
Split tunnel is ZeroTier’s default behavior. A client that does not enable “Allow Default” continues using its ordinary Internet connection, even when the same network advertises a default route.
Requirements and network planning
- A supported Linux VPS with a stable public address and enough bandwidth for the traffic you intend to relay.
- Root or equivalent administrative access on the VPS.
- ZeroTier One installed on the VPS and on every client device that will join.
- A provider firewall that permits outbound UDP. UDP port
9993is the minimum needed to reach ZeroTier root servers; allowing broader outbound UDP generally gives peer-to-peer paths more opportunity to form. - A private address range that does not overlap with the LANs used by your players, home routers, office networks, or other VPNs.
- A plan for controller backups and for protecting the controller authentication token.
The example address pool in ZeroTier’s controller walkthrough is 192.168.192.1 through 192.168.192.254, with a 192.168.192.0/24 managed route. Treat that as an example, not a universal choice. If a player already uses that range at home, routing becomes ambiguous; select another private range instead.
Decide where control will live
ZeroTier Central is a hosted control plane. It distributes membership and policy, while endpoint traffic travels through the virtual network rather than through the hosted service. A self-hosted controller is a ZeroTier node running on your VPS. The latter gives you local control and keeps controller data on the server, but it makes backup, upgrades, token protection, and availability your responsibility.
You do not need to self-host the controller merely to use a VPS as an exit node. The VPS can join a network controlled through ZeroTier Central. Self-hosting is useful when you want the controller identity and network definitions under your own administration or need a controller that is independent of a hosted account.
Prepare the VPS
Install ZeroTier One
Use your distribution’s supported package manager or ZeroTier’s official Linux installation method. On a Debian- or Ubuntu-family system, the package-manager pattern is:
sudo apt update
sudo apt install zerotier-one
sudo systemctl enable --now zerotier-oneUse the equivalent package and service commands for your distribution. Confirm that the daemon has an identity and is online:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchsudo zerotier-cli infoThe result should include a node identity and an online state. If it is offline, check DNS, the VPS provider’s egress firewall, and outbound UDP before attempting network configuration.
Protect the controller’s local credentials
On Linux, ZeroTier’s working directory is /var/lib/zerotier-one. The local controller API normally listens on 127.0.0.1:9993 and authenticates with the token in authtoken.secret. Read the token only when needed and do not copy it into shell history, tickets, chat, or a public repository:
Rank #2
- Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
- Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
- CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
- CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
- CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)
sudo cat /var/lib/zerotier-one/authtoken.secretKeep the API bound to localhost. If you need to administer it remotely, use an authenticated administrative channel rather than opening TCP or HTTP access to the public Internet. The controller does not provide a separate fine-grained access-control layer beyond its control interface and authentication token.
Create the private network
Inspect the local controller
First verify that the service is responding and retrieve its node identity:
sudo zerotier-cli info
TOKEN=$(sudo cat /var/lib/zerotier-one/authtoken.secret)
curl "http://localhost:9993/status" -H "X-ZT1-AUTH: ${TOKEN}"The controller walkthrough uses the returned node ID when creating a network. Use the controller’s local API or its management interface to create that network, set it to private, and define the address pool and managed route. The important fields are:
- Private membership: members must be explicitly authorized before they can use the network.
- IP auto-assignment pool: a non-overlapping range from which authorized members receive virtual addresses.
- Managed route: at minimum, the ZeroTier network prefix (for example,
192.168.192.0/24via the VPS’s ZeroTier address when the VPS is serving as a gateway).
Use the API rather than editing live JSON files by hand. Network definitions and the controller identity are stored under the controller’s controller.d directory; direct file edits can produce invalid or conflicting state.
Join the VPS and clients
After you have the 16-digit network ID, join the VPS and each endpoint:
sudo zerotier-cli join <network-id>On a desktop, server, or other client, run the platform’s equivalent ZeroTier join command. Joining creates a member record; it does not by itself authorize that member on a private network.
Authorize only intended members
In the controller API or management interface, review each pending member and authorize only the node IDs you recognize. Then verify membership locally:
sudo zerotier-cli listnetworksThe intended network should be shown as private and authorized, with an assigned ZeroTier address. Repeat the check on each endpoint. If a member remains unauthorized, confirm that you approved the correct node ID rather than relying on a device name that may have changed.
Configure split tunnel networking
For private game servers and administration, split tunnel is usually the least complex design. The controller advertises the ZeroTier subnet, and clients send only traffic destined for that subnet through the virtual interface. Their normal route continues to handle web browsing, game downloads, voice services, and other Internet traffic.
Test the assigned addresses directly. From one authorized member, ping another member’s ZeroTier address if the operating-system firewall permits ICMP. Then test the actual service port, such as the port used by your game server. A successful ping does not prove that the game service is listening or that its host firewall allows the service port.
Turn the VPS into a full-tunnel exit node
A full tunnel makes the VPS the gateway for client Internet traffic. It adds moving parts and consumes VPS bandwidth and egress allowance, so use it only for clients that need it.
1. Enable IPv4 forwarding
Enable forwarding immediately for testing:
sudo sysctl -w net.ipv4.ip_forward=1Persist it with a distribution-supported sysctl file, for example:
echo 'net.ipv4.ip_forward=1' | sudo tee /etc/sysctl.d/99-zerotier-forward.conf
sudo sysctl --system2. Identify both interfaces
Find the ZeroTier interface and the interface that reaches the public Internet:
ip -br link
ip routeThe virtual interface will have a zt... name. The WAN interface may be named eth0, ens3, or something distribution-specific. Do not copy an interface name from an example without checking your VPS.
3. Permit forwarding and masquerade Internet traffic
The following illustrates the required iptables policy. Replace ztxxxxxxxx and eth0 with the interfaces on your server:
sudo iptables -A FORWARD -i ztxxxxxxxx -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o ztxxxxxxxx -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEThe first rule permits clients to leave through the WAN interface. The second permits return traffic that belongs to an established connection. Masquerading translates the clients’ private source addresses to the VPS’s WAN address. Persist these rules with the firewall mechanism supported by your Linux distribution; rules entered interactively can disappear on reboot.
Rank #4
- Broadcom BCM2711, quad-core Cortex-A72 (ARM v8) 64-bit SoC @ 1. 5GHz
- 2. 4 GHz and 5. 0 GHz IEEE 802. 11b/g/n/ac wireless LAN, Bluetooth 5. 0, BLE
- 2 × USB 3. 0 ports, 2 x USB 2. 0 Ports
- 2 × micro HDMI ports supproting up to 4Kp60 video resolution
- Micro SD card slot for loading operating system and data storage
If your existing host firewall has a default-drop forwarding policy, add equivalent rules there instead of assuming the iptables append commands will be effective. Apply the provider firewall and the host firewall together: the provider filter can block packets before they reach Linux, while the host policy controls packets after they arrive.
4. Advertise the default route
Add this managed route to the ZeroTier network:
0.0.0.0/0 via <zerotier-ip-of-vps>Use the VPS’s assigned ZeroTier address as the next hop. Do not replace the route with the VPS’s public address; the route is carried inside the virtual network.
5. Enable Allow Default on selected clients
On each client that should use the exit node, enable allowDefault=1, or turn on the equivalent “Allow Default” setting in that client’s ZeroTier configuration. Leave it disabled on clients that should remain split tunnel. After changing the setting, inspect the client’s route table and confirm that the default route points through the ZeroTier interface.
6. Check DNS separately
A changed public IP proves that Internet traffic is exiting through the VPS, but it does not prove that DNS queries use the same path. Test DNS behavior separately and decide whether the client should keep its local resolver or use a resolver reachable through the tunnel. The VPS’s NAT rules do not automatically prevent DNS leaks or configure a DNS service.
Secure the virtual network
Use layered firewalls
Keep the VPS provider firewall restrictive, allow only the management and service traffic you actually need, and maintain a host firewall on the VPS. ZeroTier flow rules add policy at the virtual-network layer and are enforced locally on nodes. They are not a replacement for the provider or host firewall.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Flow rules are stateless. If you write custom rules, express both directions required by the application; allowing a packet from a client to a server does not automatically create a reverse-direction permission. Start with a narrow set of game-server, administration, and monitoring ports rather than permitting every member to reach every service.
Check account-tier capabilities
ZeroTier documentation states that templated flow rules are available on Essential and higher tiers, while custom flow rules require Scale or Enterprise. Verify the current tier attached to your account before designing a policy that depends on custom rules. A tier change or documentation update can alter what the management interface exposes.
Back up controller state
Back up the controller identity and network definitions in controller.d before upgrades or migrations, and protect those backups like credentials. Losing the controller identity can require rebuilding network definitions and reauthorizing members. Do not expose the local API just to simplify backups; copy the protected data through your authenticated administrative channel.
Best Value
- Includes Raspberry Pi 5 16GB with 2.4Ghz 64-bit quad-core CPU (16GB RAM)
- Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
- CanaKit Turbine Black Case for the Raspberry Pi 5
- CanaKit Low Noise Bearing System Fan
- Mega Heat Sink - Black Anodized
Validate the deployment
- Run
sudo zerotier-cli infoon the VPS and confirm a node identity and online state. - Run
sudo zerotier-cli listnetworksand confirm that the intended network is private, authorized, and assigned an address. - Repeat the membership check on every client.
- Test member-to-member reachability over ZeroTier addresses, then test the actual game or administration port.
- If using full tunnel, confirm that a client’s public IP is the VPS egress address and test DNS behavior separately.
- Reboot the VPS. Confirm that the ZeroTier service starts, forwarding is enabled, NAT rules persist, and the expected routes return.
- Attempt access from an unauthorized member and verify that it cannot communicate with protected services.
- Review flow rules and firewall logs to confirm that only intended ports and directions are allowed.
These checks validate configuration, not performance. The documented procedures do not establish a guaranteed throughput, latency, uptime, anonymity, or maximum-user figure for a VPS deployment.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Troubleshoot common failures
The VPS reports offline
Check the service status and outbound connectivity. Ensure the provider firewall allows outbound UDP 9993; broader outbound UDP can help peer-to-peer connectivity. Also verify DNS resolution and that the VPS clock is sane. A node that cannot reach the root infrastructure cannot reliably discover peers.
The network appears but has no address
Confirm that the member was authorized and that the controller has an IP auto-assignment pool. Check that the pool is not exhausted and does not overlap a physical LAN used by the client. Run zerotier-cli listnetworks again after correcting the controller configuration.
Members joined but cannot communicate
Check both endpoints’ local firewalls, the network’s private-member authorization, and the managed route. If you added custom flow rules, remember that they are stateless and may need an explicit rule for the return direction. Test by ZeroTier address rather than by a hostname that may resolve to a public or local address.
Full tunnel joins but Internet access fails
Verify all four dependencies: IPv4 forwarding, forwarding firewall rules, WAN masquerading, and the 0.0.0.0/0 managed route. Then check that the client has “Allow Default” enabled. A missing return rule commonly permits outbound packets while dropping replies. A wrong WAN interface in the masquerade rule produces the same symptom.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The client still uses its normal Internet connection
Check the client’s allowDefault setting and route table. A default route advertised by the controller is not sufficient when the client declines it. Also make sure another VPN client or operating-system policy has not installed a higher-priority default route.
It works until reboot
Persist the sysctl forwarding setting, save the firewall and NAT rules using the distribution’s supported mechanism, and enable the ZeroTier service at boot. Re-run the validation checklist after reboot rather than assuming an interactive test represents the persistent configuration.
VPS gateway versus a Raspberry Pi gateway
ZeroTier’s exit-node guidance notes that the gateway can be a small VPS or a Raspberry Pi. Both can forward and NAT traffic, but they suit different constraints.
| Consideration | VPS gateway | Raspberry Pi gateway |
|---|---|---|
| Reachability | Normally has a public provider network and does not depend on your home router’s inbound reachability. | Runs on your physical network and may require careful home-router and ISP configuration for remote administration. |
| Power and maintenance | Provider supplies the physical platform; you maintain the operating system, firewall, and ZeroTier service. | Requires local power, hardware, storage, cooling, and physical access. |
| Provider dependence | Subject to provider filtering, bandwidth limits, egress charges, and maintenance windows. | Uses your home Internet connection and is independent of a VPS provider. |
| Inbound firewall control | Usually offers a provider firewall plus the Linux host firewall. | Uses the home router, the Pi’s host firewall, and possibly an ISP-managed gateway. |
| Failure behavior | Fails when the VPS, provider network, or its firewall is unavailable. | Fails when local power, the home router, or the home Internet connection is unavailable. |
For the VPS design in this guide, the public server is the primary gateway and controller host. A physical gateway is an alternative architecture, not a requirement for using ZeroTier.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Costs, capacity, and operational trade-offs
ZeroTier documentation uses “a $5 VPS” as an illustrative minimum-size example for an exit node. That is not a current market price or a performance guarantee. The appropriate plan depends on concurrent users, game and voice traffic, storage needs, provider bandwidth limits, and egress billing.
Every byte that takes the full-tunnel path consumes VPS bandwidth. Split tunnel usually reduces VPS traffic because only private-network traffic crosses the gateway. A VPS being online does not guarantee a particular latency, throughput, uptime, or anonymity level; those depend on the provider, geography, routing, client access networks, and your configuration.
Quick Recap
Recommended deployment sequence
- Choose a non-overlapping private subnet and decide whether clients need split tunnel or full tunnel.
- Prepare the VPS, allow the required outbound UDP, install ZeroTier One, and verify the node is online.
- Choose ZeroTier Central or run the controller locally on the VPS. If self-hosting, protect
authtoken.secretand keep the API on localhost. - Create a private network with an IP auto-assignment pool and the managed route appropriate to your design.
- Join the VPS and clients, authorize known members, and verify assigned addresses.
- For split tunnel, test private service ports. For full tunnel, enable forwarding, persist firewall/NAT rules, advertise
0.0.0.0/0, and enable Allow Default only on selected clients. - Reboot-test the VPS, verify DNS separately, and keep controller backups current.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
