ZeroTier: the decentralized VPN small teams should keep around

Centralised VPNs carry the same unsolvable problem: when the hub goes down, every branch loses connectivity at once. I met it on a client project where a single cloud-hosted VPN concentrator failed with its region. Two hours without file shares was enough to reopen the architecture conversation.

The VPN we grew up with

Traditional VPNs always tunnel from a branch to a hub. Adding a site means editing gateway config and opening more ports — fine at three branches, painful at thirty.

ZeroTier changes the question from "how do I connect every branch to the hub?" to "which machines should be allowed to talk?" It builds a virtual layer-2 network in which every member is a first-class citizen.

A peer-to-peer architecture

• Root servers only handle matchmaking and key exchange — they never carry user traffic.
• Traffic flows directly between peers over encrypted UDP, falling back to relays when NAT gets in the way.
• Every member gets a ten-digit address, and you can push managed routes from the web console.
• Access control is expressed as flow rules (for example: allow port 22 only to this group of servers).

Ten minutes to a working network

Install on the first machine and join the network you created in ZeroTier Central:

curl -s https://install.zerotier.com | sudo bash
sudo zerotier-cli join 8056c2e21c000001
sudo zerotier-cli listnetworks
# 200 listnetworks <nwid> <name> <status> <type> <dev> <address>

Repeat on a second machine with the same network id. Both hosts see each other on their 10.x addresses immediately, and you never touched the router's firewall.

Making it safe for a real team

1. Turn off auto-assign in Central and allocate addresses yourself so audits stay possible.
2. Prefer flow rules over relying on each endpoint's firewall.
3. Gate membership behind SSO / OIDC beyond ten people.
4. Enable allow managed on clients but keep global routing off, so internet traffic stays on the local path.

From the field: do not use this as your PCI or data-residency-sensitive VPN without talking to compliance first. You still have to prove where packets travel.

When it earns its place

Use it when the team is distributed and needs access to dev boxes, internal databases or a NAS without running an enterprise gateway.

Do not use it as the only path into production when you need enterprise-grade audit trails, or when policy requires every packet to pass through an inspection gateway.

For me ZeroTier is the fastest answer in the toolbox — and a good reminder to make things simple before making them capable.