How to Install ZeroTier on Windows, macOS, Linux, iPhone, Android, and More (2026)

Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.

To install ZeroTier, create or select a network in ZeroTier Central, install the client for your operating system, join that network with its 16-character Network ID, approve the new member in Central, and test the connection to another approved device. The software installation is only the first half: a private network member normally remains ACCESS_DENIED until an administrator authorizes it. This guide covers the current 2026 client releases, desktop and mobile installation, command-line and unattended deployment, verification, updates, and the fixes for the most common join failures.

What does a ZeroTier installation actually include?

ZeroTier creates a virtual network interface on each device. The client uses that interface to connect the device to a network defined in Central, while Central supplies the membership and authorization record. You therefore perform two separate jobs:

#	Preview	Product	Price
1		Yojaro 4Pack Silicone Suction Phone Case Mount, Silicon Adhesive Smartphones Stand Sticky,...	$4.99	Buy on Amazon
2		Apple EarPods Headphones with USB-C Plug, Wired Ear Buds with Built-in Remote to Control Music,...	$19.00	Buy on Amazon
3		PopSockets Adhesive Phone Grip, Holder- Black | Anti-Drop, Kickstand, Secure Comfortable Hold,...	$9.49	Buy on Amazon
4		360° Rotating Stainless Steel Phone Tether Tab (Silvery 3-Pack) - Universal for iPhone & Other...	$6.29	Buy on Amazon
5		Anteel 2 Pack Silicone Suction Cup Phone Case Mount Double Sided, Hands-Free Silicon Phone Grip with...	$4.99	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

• Install the client: put the ZeroTier service and virtual adapter on the device.
• Join and authorize: submit the network’s ID, then approve that device as a member in Central.

A device can have a correctly installed client and still have no usable network access. Conversely, authorizing a member that has not installed or joined the client cannot create a connection. Keeping those stages separate makes troubleshooting much faster.

ZeroTier’s Quickstart is designed to get two devices communicating securely in under five minutes, but the time depends on downloading the correct package, approving operating-system prompts, and completing Central authorization. The current documentation supports the current major release and the two major releases before it.

Popular on Amazon

Yojaro 4Pack Silicone Suction Phone Case Mount, Silicon Adhesive Smartphones Stand Sticky, Hands-Free Phone Accessories Holder for Selfies and Videos (Black & White & Translucent & Light Pink)

• 【Strong Adsorption】The inspiration of the silicone phone suction case comes from the adhesive force of the octopus. Each suction cup phone mount is 3.15 inches long and 2.17 inches wide, with 24 independent suction cups providing a stronger and more stable suction force, so you don't have to worry about your phone falling during use.
• 【Back of Phone Suction Grip】Remove the adhesive film on the phone suction cup and stick it on the phone case. You can then fix the phone on any smooth surface, which is very convenient. (The phone suction cup cannot be removed and reused after being attached to the phone case. It is recommended to attach it to a regular phone case, not a valuable one.)
• 【Widely Used】Our non-slip silicone phone sticky grip mount attaches to almost any flat phone case and make it compatible with common mobile phones such as iPhone and Android.You can shoot, watch videos or video calls in the kitchen, gym, dance studio, bathroom and other places.
• 【Capture the Wonderful Picture】Whether you are a TikTok creator or just like to share videos and photos, this phone suction cup can help you hands-free capture wonderful videos and photos for sharing with friends.
• 【Note】You can fix the phone suction cup on a smooth surface such as a mirror or glass. If necessary, wipe the suction cup with a damp cloth to obtain stronger suction. Before releasing your hand, make sure the phone is firmly fixed. (Not applicable to rough walls, wooden surfaces, and other uneven surfaces)

$4.99

Buy on Amazon

Which ZeroTier version and platforms are supported in 2026?

Version labels change, so check the official download page immediately before a deployment. The versions listed for 2026 are:

ZeroTier’s Tier 1 compatibility list includes Windows 10 and 11, macOS, Linux, iOS, Android, Docker, and MikroTik. For a generally responsive experience, that list recommends at least a 1 GHz, two-core CPU with AES-NI. That is a compatibility guideline, not a promise of a particular throughput or latency.

What should I prepare before installing?

• An account that can open ZeroTier Central and administer the target network.
• The 16-character Network ID for the network the device must join.
• Administrator or root privileges on the computer. Windows command-line work requires an elevated Administrator prompt; Linux normally requires root or sudo.
• A second device already connected to the same network if you want to perform the final ping test.
• Permission to install a network driver or create a VPN-style network interface. Windows asks for driver approval, and mobile operating systems ask for VPN approval.

For a new network, open New Central. The older interface remains available at Legacy Central, but the current Quickstart path uses New Central. If you are following an existing organization’s instructions, use the interface where that network is managed rather than creating a second network by accident.

How do I create or select a ZeroTier network?

1. Sign in to Central and open the network list.
2. Create a network if you are starting from scratch, or open the existing network that the device should use.
3. Copy the displayed 16-character Network ID exactly. It is the value used by the desktop menu, mobile app, and CLI.
4. Keep the Central page open while you install. You will return to it to authorize the member after the first join request arrives.

Do not confuse the Network ID with a member’s node address. The Network ID identifies the virtual network; the node address identifies one installed client. You need the former to join and the latter to match a pending member during troubleshooting.

How do I install ZeroTier on Windows?

Windows uses the official installer and a system-tray workflow. The current download listing shows version 1.16.2 for 2026.

1. Download the Windows installer from ZeroTier’s official download page.
2. Run the installer with an account allowed to install software and network drivers.
3. When Windows asks whether to install or approve the ZeroTier driver, approve it. Without the driver, the service may install but cannot create the virtual adapter needed for network traffic.
4. Finish setup and look for the ZeroTier icon in the system tray. If it is hidden, open the tray’s overflow area.
5. Open the tray menu, choose the join-network command, enter the 16-character Network ID, and submit it.
6. Return to Central, locate the new member, and authorize it. Refresh Central if the member does not appear immediately.

For command-line administration, open Command Prompt or PowerShell with Run as administrator. The cross-platform join command is zerotier-cli join NETWORK_ID; the documented Linux form adds sudo. Windows should not use a non-elevated prompt for CLI operations that require service access.

How do I install ZeroTier on macOS?

The official download listing shows version 1.16.2 for macOS in 2026, with macOS 10.13 and newer listed as supported.

1. Download and open the macOS installer.
2. Complete the package installation. macOS may ask you to approve a system extension, network content filter, or related network permission; approve the ZeroTier component when prompted.
3. After installation, find the ZeroTier icon in the menu bar.
4. Open the menu-bar control, choose the join-network option, and enter the 16-character Network ID.
5. In Central, authorize the newly listed member and wait for its status to change from pending or denied to authorized.

The official macOS CLI example does not require sudo for the join command: zerotier-cli join NETWORK_ID. If macOS blocks a system component, check System Settings for the security or network-extension approval requested during installation, then restart the ZeroTier service or the Mac if the icon does not become active.

Also popular on Amazon

Apple EarPods Headphones with USB-C Plug, Wired Ear Buds with Built-in Remote to Control Music, Phone Calls, and Volume

• SUPERIOR COMFORT — Unlike traditional circular ear buds, the design of EarPods is defined by the geometry of the ear. Which makes them more comfortable for more people than any other ear bud–style headphones.
• HIGH-QUALITY AUDIO — The speakers inside EarPods have been engineered to maximize sound output and minimize sound loss, which means you get high-quality audio.
• BUILT-IN REMOTE — EarPods with USB-C plug also include a built-in remote that lets you adjust the volume, control the playback of music and video, and answer or end calls with a pinch of the cord.
• COMPATIBILITY — Works with all devices that have a USB-C port.
• INTEGRATED MICROPHONE — A built-in microphone precisely captures your voice while you’re on the phone, taking a FaceTime call, or summoning Siri — so you’re always heard loud and clear.

$19.00

Buy on Amazon

How do I install ZeroTier on Ubuntu and other Linux distributions?

Linux support covers Debian- and RPM-based distributions through ZeroTier’s repository script, with package managers handling later updates. The current 2026 download listing shows version 1.16.2.

1. Use the official Linux installation route for your distribution family. Choose the repository script or package that matches the system rather than mixing Debian and RPM packages.
2. Run the installation with root privileges. The script or package installs the zerotier-one service and its command-line client.
3. Confirm that the service is running using your distribution’s normal service-management tools.
4. Join the network with sudo zerotier-cli join NETWORK_ID.
5. Open Central, find the new member, and authorize it.

Linux has no required desktop tray workflow, so the CLI is the normal path on servers and headless machines. A successful join request alone does not prove that traffic is permitted; authorization and a test to another member are still required.

For unattended servers, keep the repository configuration under your normal package-management policy. The package manager can then receive later ZeroTier updates without replacing the network membership configuration. Updates preserve configuration, so an updated device does not need to join every network again.

How do I install ZeroTier on Android or iPhone?

Install the mobile client from the Google Play store on Android or the Apple App Store on iPhone and iPad. The 2026 download listing shows version 1.16.0 for both mobile platforms.

1. Open the appropriate app store, search for the official ZeroTier client, and install it.
2. Open the app and use its join-network control to enter the 16-character Network ID.
3. Accept the operating system’s VPN or network-configuration permission. Mobile systems require this approval before the virtual interface can carry traffic.
4. Return to Central and authorize the mobile device’s member record.
5. Activate the network in the app and test access to another authorized member.

On a phone, a network can appear joined while the operating system has paused the VPN in the background. If connectivity stops after the screen locks, check the device’s battery, background-data, and VPN settings before removing and re-adding the network.

How do I install ZeroTier with Docker or FreeBSD?

Docker

The official download listing shows version 1.16.2 for Docker in 2026. A containerized deployment still needs the host permissions and networking arrangement required by your container runtime. After the container is running, use the ZeroTier CLI inside the container (or the documented management method for that image) to join the Network ID, then authorize its member in Central. Treat the container’s lifecycle as part of your network design: recreating it can produce a new member identity unless the ZeroTier state is stored persistently.

FreeBSD

FreeBSD is listed at version 1.16.0 for 2026. Install the package using the supported FreeBSD route, start the service, join with the CLI, and authorize the resulting member in Central. For scripted deployments, FreeBSD and OpenBSD use the data path /var/db/zerotier-one/networks.d/<network-id>.conf.

How do I join a network from the command line?

The portable command is:

sudo zerotier-cli join NETWORK_ID

Replace NETWORK_ID with the real 16-character value. Linux normally needs sudo; Windows CLI work requires an Administrator prompt; the official macOS example omits sudo. The command sends a join request to the local ZeroTier service. It does not bypass Central authorization.

Also popular on Amazon

Sale

PopSockets Adhesive Phone Grip, Holder- Black | Anti-Drop, Kickstand, Secure Comfortable Hold, Black, Create a Mobile Phone Outfit

• Secure Hold: Our PopSockets adhesive phone grip gives your cell phone a secure, comfortable hold in hand to help prevent drops while texting, taking photos, or scrolling on the go. Designed to stick firmly to most phone cases and devices.
• Hands-Free Made Easy: Easily turn your PopSocket into a phone stand to prop up your phone anywhere, perfect for watching videos, video calls, or following recipes. A must-have phone holder that keeps your device secure and ready for anything.
• Compatibility: Works with all phones, tablets, and Kindles. Sticks best to smooth, hard plastic cases and may not adhere to silicone or textured cases. Easily swap your PopTop to change up your style.
• Black PopSockets: Simple, refined, and endlessly versatile. A timeless essential for any phone.
• Travel Must-Have for People On the Go: A must-have travel accessory for flights, flying, airports, air travel, airplanes, planes, international trips, cruises, and long travel days. Key gadget for your airport haul, travel accessories and must-haves.

$9.49

Buy on Amazon

After joining, use the client output or Central to identify the node address associated with the request. This is the address you match to a member record if Central shows several pending devices. If you accidentally joined the wrong network, leave it with:

sudo zerotier-cli leave NETWORK_ID

Use the platform’s equivalent privilege level when sudo is not the appropriate command prefix.

Why does ZeroTier show ACCESS_DENIED?

ACCESS_DENIED normally means that the client has joined the network but the member has not been authorized in Central. It is an administrative state, not proof that the installer failed.

1. Open the network in Central.
2. Find the new member in the member list. Refresh the page if it is not visible yet.
3. Compare the node address shown by the client with the address in Central. This prevents authorizing a different laptop, phone, or stale entry.
4. Enable or approve the member using Central’s authorization control.
5. Wait for the client status to change to OK.

If the status remains denied after you authorized the correct address, verify that the client is still online and that you edited the same network whose ID was entered. A common mistake is approving a member in one network while the device joined another network with a similar name.

How do I verify that the installation works?

Verification requires another authorized member. The Quickstart pattern is:

1. In Central, identify another member’s managed ZeroTier IP address.
2. From the newly installed device, run ping -n 3 MANAGED_IP, replacing MANAGED_IP with that other member’s managed address.
3. Confirm that replies return from the other device.

Do not ping the same device you are testing; that can only prove local protocol behavior, not member-to-member reachability. If the ping fails, check that both members are authorized and online, that you used the managed ZeroTier IP rather than a public or physical-LAN address, and that the destination device’s local firewall permits ICMP replies. A successful ping confirms basic reachability, not that every application port is open.

Which installation method should I choose?

Every method ends in the same sequence: join the Network ID, authorize the member in Central, and verify against another member. The choice mainly changes how the client is installed and how much user interaction is available.

How do I deploy ZeroTier without an interactive join?

For managed deployment, install the official MSI, PKG, Linux script, or package first. Then create an empty file named for the network ID in the service’s networks.d directory. The documented paths are:

Also popular on Amazon

Sale

360° Rotating Stainless Steel Phone Tether Tab (Silvery 3-Pack) - Universal for iPhone & Other Phones (Fits Wristbands/Necklaces/Crossbody Straps)

• [360 ° Flexible Rotation Design] Comes with a rotatable lanyard ring that supports 360 ° free rotation, effectively solving the problem of twisted and tangled lanyards
• [Wide compatibility] The ultra-thin 0.02-inch design does not block the charging port at all, and both wired and wireless charging can be used directly without removing the pad. Compatible with most smartphones such as iPhone, compatible with various wristbands, lanyards, crossbody straps, and keychains
• [Durable and Portable Material] Premium rust-resistant stainless steel material with good flexibility, which not only avoids scratching the phone case, but also has excellent anti rust and anti fading performance
• [Multi scenario Practical] Paired with a lanyard or wristband, hands-free use can be achieved. The phone is within reach and not easily dropped, ideal for daily commuting and outdoor activities. Suitable for full coverage phone cases, does not support half coverage phone cases
• [Quality Service] If you find any damage or other issues with the product upon receipt, please contact us immediately. We will handle it quickly

$6.29

Buy on Amazon

1. Install the client package appropriate to the operating system.
2. Create the empty <network-id>.conf file in the matching directory. The file name must contain the real 16-character Network ID.
3. Restart the ZeroTier service.
4. Watch Central for the new member request.
5. Authorize the member in Central before expecting traffic.

The file causes the service to request membership; it is not an authorization token and does not grant access by itself. In a fleet, use your configuration-management system to create the file with the correct ownership and permissions, then use Central’s member controls to approve devices according to your organization’s policy.

What should I know about managed settings and security?

The enterprise guide documents four client settings that affect which network configuration values the service will accept:

Do not enable broader routing or DNS control simply to make an installation appear to work. Decide which routes and name-resolution settings the network should manage, document that decision, and test it on a non-production device first.

The file authtoken.secret controls local CLI and API operations. Protect it like a credential: limit filesystem access, do not place it in source control or a world-readable backup, and rotate access through your normal host-management process if it is exposed. Network authorization in Central and local API authentication are separate controls.

How do updates, leaving a network, and reinstallation work?

Updating

Updates preserve the device’s configuration. A normally updated device therefore does not need to re-join every network. After a major update, confirm the service is running and that the member still reports OK; this catches service-start or permission issues without unnecessarily deleting its identity.

Leaving one network

Use the desktop tray or menu-bar control to leave a network, or run sudo zerotier-cli leave NETWORK_ID from a suitably privileged shell. Leaving removes that membership from the client; it does not delete the network or other members in Central.

Reinstalling

Before removing a client from a managed device, record which networks it belongs to and whether its member entry is still needed. A clean reinstall may require a new join request, and an unattended installation should recreate the appropriate networks.d files. Do not delete the Central member record merely to fix a local installer problem unless you intend to enroll the device as a new member.

What are the most useful troubleshooting checks?

• No tray or menu-bar icon: confirm the service completed installation and restart it. On macOS, check the requested system network approval; on Windows, verify that the driver was approved.
• Network ID rejected: copy the 16-character ID again from Central. A member address, network name, or shortened value cannot substitute for it.
• Member missing in Central: refresh the Central page and confirm that the local service is online. A delayed page view does not necessarily mean the join failed.
• ACCESS_DENIED: authorize the exact node address shown by the client in the correct network.
• Status is OK but applications cannot connect: test the other member’s managed IP first, then inspect the destination host firewall and the application’s listening address and port.
• CLI permission error: use an elevated Administrator prompt on Windows or root/sudo on Linux. The official macOS join example does not require sudo.
• Mobile connection stops in the background: recheck the mobile VPN permission and battery or background restrictions before reinstalling.

Work through the checks in order: installation and service, correct Network ID, Central membership, authorization, then application-level firewall rules. Changing routes or deleting members before those basics are confirmed usually creates a second problem.

Also popular on Amazon

Anteel 2 Pack Silicone Suction Cup Phone Case Mount Double Sided, Hands-Free Silicon Phone Grip with Higher Suction Power for Selfies and Videos, Non Slip Phone Accessories (LightPink&White)

• 【PKYAA Double Sided Silicone Suction Phone Case Mount】PKYAA With Double Sided 40 Strong and Reliable individual suction cups, PKYAA provides a thicken and upgraded universal silicon suction mount for your phone.
• 【Friendly to Content Creators】If you are a content creator or an online influencer, you can create videos anywhere with this suction mount completely hands free with this silicone cell phone mount for cases.
• 【HANDS-FREE & Adhere to Mirrors】This Double Sided silicone suction phone case mount allows you to stick your phone to the mirror easily. No longer holding your phone in one hand to watch video tutorials while making up.
• 【Strong Grip on the Smooth Surface】You can easily hang your phone anywhere with a smooth surface. All you do is you clean off your phone and smooth surface. It is STURDY and it not only sticks to mirrors, it also sticks to windows, it sticks to refrigerators, tiles and other clean, flat surfaces.
• 【Press Down Firmly Every 30 Minutes】Use your palm or fingers to press the phone down firmly and check it's secure before letting go. Apply even pressure for a few seconds to allow the suction cup to adhere properly. To maintain the grip and prevent accidental falls, it's a good practice to periodically reapply pressure to the suction cup.

$4.99

Buy on Amazon

Is ZeroTier installation different for a game server?

The installation sequence is the same for a gaming PC, a dedicated server, or a second player’s laptop. Install the client on every participant’s device, join the same Network ID, authorize each member, and give players the server’s managed ZeroTier IP and game port. ZeroTier provides the virtual path; the game server still has to listen on the correct interface and allow inbound traffic through its operating-system firewall.

For a private gaming group, Central authorization is the access-control step: do not distribute the Network ID as if it alone were an invitation. Remove a member in Central when someone should no longer reach the virtual network, and have that device leave the network locally if it is no longer used.

What is the shortest reliable installation checklist?

1. Open New Central at central.zerotier.com or the existing Legacy Central account at my.zerotier.com.
2. Create or select the network and copy its 16-character Network ID.
3. Install the client for Windows, macOS, Linux, Docker, FreeBSD, iOS, or Android.
4. Approve the required driver, network extension, VPN, or administrator prompt.
5. Join with the desktop control, mobile app, or sudo zerotier-cli join NETWORK_ID.
6. Refresh Central, match the new node address, and authorize the member.
7. Wait for OK, then ping another authorized member’s managed IP with the Quickstart pattern ping -n 3 MANAGED_IP.

Frequently Asked Questions

Can I use ZeroTier without creating a Central account?

You need access to a Central-managed network to obtain its Network ID and authorize private-network members. Installing the client alone does not create an authorized, shared network between devices.

Does every device need its own ZeroTier member entry?

Yes. Each installed client has its own node identity and appears as a separate member in Central, even when several devices belong to the same person or household.

Will changing Wi-Fi networks force me to join ZeroTier again?

Normally no. The client membership is stored independently of the physical network connection, so moving between Wi-Fi, wired Ethernet, or another internet connection should not require a new join. Connectivity can still depend on the new network’s firewall or captive portal.

Can I authorize a device before it finishes installing?

Central can only authorize a member after the client has submitted a join request and its member record appears. If nothing is listed, refresh Central and check the local service and Network ID before attempting authorization.

What happens if I lose the Network ID after installation?

The device can remain connected to an existing membership, but you will need the Network ID to join that network from another device or to issue the leave command. Copy it from the network’s Central page and store it in your organization’s approved documentation.

Quick Recap

Bestseller No. 1

Yojaro 4Pack Silicone Suction Phone Case Mount, Silicon Adhesive Smartphones Stand Sticky, Hands-Free Phone Accessories Holder for Selfies and Videos (Black & White & Translucent & Light Pink)

$4.99

Bestseller No. 2

Apple EarPods Headphones with USB-C Plug, Wired Ear Buds with Built-in Remote to Control Music, Phone Calls, and Volume

COMPATIBILITY — Works with all devices that have a USB-C port.

$19.00

SaleBestseller No. 3

PopSockets Adhesive Phone Grip, Holder- Black | Anti-Drop, Kickstand, Secure Comfortable Hold, Black, Create a Mobile Phone Outfit

$9.49

SaleBestseller No. 4

360° Rotating Stainless Steel Phone Tether Tab (Silvery 3-Pack) - Universal for iPhone & Other Phones (Fits Wristbands/Necklaces/Crossbody Straps)

$6.29

Bestseller No. 5

Anteel 2 Pack Silicone Suction Cup Phone Case Mount Double Sided, Hands-Free Silicon Phone Grip with Higher Suction Power for Selfies and Videos, Non Slip Phone Accessories (LightPink&White)

$4.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.