Route between ZeroTier and Physical Networks

This seems to be the simplest pattern for getting remote access to your LAN. It doesn't require access to the LAN's router or have some of the pitfalls of bridging. This requires a Linux PC or VM, something that runs iptables, on your LAN. A raspberrypi works. This is a NAT/Masquerade setup.

Possible Disadvantages:

  • No broadcast/multicast across networks (but the mobile OS's don't allow this anyways).

  • Can't initiate connections from the LAN to an external ZeroTier client.


  • Install ZeroTier

  • Add a managed route to the ZeroTier network (at

  • Enable IP Forwarding

  • Configure iptables

Required information

For Example:



Shorthand Name Below



Shorthand Name Below

ZeroTier Network ID



ZeroTier Interface Name



Physical Interface Name



ZeroTier subnet


Physical subnet


ZeroTier IP Address of "Router"


Install ZeroTier

1 2 sudo zerotier-cli join $NETWORK_ID sudo zerotier-cli listnetworks

Authorize it at$NETWORK_ID

The listnetworks output has the ZeroTier Interface name under <dev>

Configure the ZeroTier managed route

At$NETWORK_ID -> Settings -> Managed Routes

This adds another route to every device joined to the ZeroTier network.







For example:





Configure the destination route as slightly larger than the actual physical subnet, here /23 instead of /24 (a smaller number is a bigger subnet in this notation) This makes devices that are on both the physical and the ZeroTier network prefer the physical connection.

Enable IP forwarding

This can vary depending on linux distribution. Typically:

Edit /etc/sysctl.conf to uncomment net.ipv4.ip_forward. This enables forwarding at boot.

To enable it now

1 sudo sysctl -w net.ipv4.ip_forward=1

Configure iptables

Assign some shell variables (personalize these)

1 PHY_IFACE=eth0; ZT_IFACE=zt7nnig26

Add rules to iptables

1 2 3 sudo iptables -t nat -A POSTROUTING -o $PHY_IFACE -j MASQUERADE sudo iptables -A FORWARD -i $PHY_IFACE -o $ZT_IFACE -m state --state RELATED,ESTABLISHED -j ACCEPT sudo iptables -A FORWARD -i $ZT_IFACE -o $PHY_IFACE -j ACCEPT

Save iptables rules for next boot

1 2 sudo apt install iptables-persistent sudo bash -c iptables-save > /etc/iptables/rules.v4


  • Turn off wifi on your phone

  • Join it to the zerotier network, authorize it

  • Try to access something on the physical LAN