Original credit to feliksik on our old community portal.
If you want to join a number of systems in a VPN, but you are unable or unwilling to install ZeroTier on all nodes, one option is to set up an IP (layer 3) router. Another option is to simply bridge physical networks to ZeroTier networks at the Ethernet level (layer 2). This option is in some ways simpler than layer 3 routing and has the advantage of passing broadcast and multicast traffic, but it can be somewhat more confusing and challenging to set up. Some amount of Linux network administration expertise is required.
We explain here how to connect your road warrior laptops to an office LAN, making all machines appear in one single ethernet network. You will even be able to reach Office computers that are completely unaware of ZeroTier.
These instructions are for Debian and Ubuntu, but should be easily adaptable to other distributions.
Your office LAN has maybe 10 nodes, and 6 people want to work remotely with their laptops at home. The office LAN is 10.0.0.0/16. We assume you have one server/VM at the Office that you will install ZeroTier on. This server has 2 NICs:
- eth0 receives an IP address on the LAN in the said subnet. This interface is also used for the default route and internet connectivity.
- eth1 is not receiving an IP address, but is solely used to function as a Layer2 bridge between the ZeroTier VPN and the LAN.
It is possible to set things up with a single NIC, but this is trickier to manage/debug as you are likely to break things temporarily and lock yourself out of the management network.
Configure the DHCP Server in the Office LAN to give leases in the range 10.0.0.100-10.0.0.200.
Configure the ZeroTier portal to manage IP addresses in the range range 10.0.1.100-10.0.1.200. Note how the address ranges are in the same10.0.0.0/16 subnet, but have a unique pool of IP addresses.
Pick one server/VM in the Office that you want to function as your bridge device. On this server and on all your laptop clients, you install zerotier and join the network:
Then in the my.zerotier.com portal, you allow all nodes. Only the bridging server will receive the 'bridge' checkmark.
We now have to set up the networking in the bridge server properly. Log in via the ip address of eth0 or via an attached keyboard (not the eth1 interface). Make sure bridge-utils is installed with
sudo apt-get install -y bridge-utils, and configure your
/etc/network/interfaces as follows:
You should now be able to get the interfaces up with
sudo ifup eth1; sudo ifup br0.
Note that the non-bridging ZeroTier instances get a IP address from the ZeroTier Portal, but that they do not actually actually use DHCP to get it. That is, this tutorial does not assume you configure your zt0 interface on the laptops to request a DCHP address, or that you run
sudo dhclient zt0. You can do this, in which case you should receive a DHCP Reply from the DHCP server in your Office network. However, this approach may have its own disadvantages.