How to Set Up Your Own ZeroTier Server and Connect All Your Devices into One Private Network

Your own ZeroTier server lets you tie a laptop at home, a production server in a data center, and a phone on the road into a single private network that runs over the public internet. The devices begin to see each other directly, as if they sat in the same room, with no port forwarding and no need to buy a static public IP from your provider.

The technology solves a familiar pain. A system administrator needs to reach a server stuck behind someone else's NAT, a home lab owner wants access to a NAS from anywhere, and a small company needs to join two offices into one network. This used to call for a bulky VPN setup. Now a single program and a handful of terminal commands are enough.

This guide walks through how to build your own ZeroTier server from scratch, how it differs from a traditional VPN, which scenarios it covers, and where the common pitfalls hide. Explanations stay in plain language without a wall of jargon, so the material works even if you have never rented a server before. By the end you will have a working private network.

What ZeroTier Is and Why Run Your Own Server

ZeroTier is a service for building virtual networks. Put simply, it behaves like a network switch the size of the planet. You install a small program on each device, join them into one network, and every member receives an address from a shared range. After that a laptop, a server, and a smartphone communicate as though plugged into the same home router, even when they physically sit in different countries.

This approach differs from a classic VPN in a fundamental way. In an ordinary VPN all traffic flows through one central server that becomes a speed bottleneck. ZeroTier builds direct device to device connections instead. Each node finds the shortest path to its neighbor on its own, and the data is encrypted from sender to receiver. To punch through home routers and carrier networks that hide devices behind NAT, ZeroTier uses a technique called UDP hole punching and opens a tunnel outward automatically.

A reasonable question follows. If the service already hands out addresses and helps devices find each other, why run your own ZeroTier server at all? There are several reasons. Your own infrastructure removes the limits of the free plan, speeds up connections within your region, and keeps the data about your network under your control. We will look at each scenario below, but first let us see what parts such a network is made of.

Inside a ZeroTier Network: Planets, Moons, and Controllers

To understand what exactly we will configure on the server, it helps to know the roles that nodes play. There are only three of them, and the developers gave them cosmic names.

A planet is one of the public root servers run by ZeroTier itself. These work like an information desk: they help devices find each other and temporarily relay traffic until a direct connection is established. The servers are shared by all users.

A moon is your own private root server. It plays the same information desk role but belongs to you alone and sits wherever you find convenient. A moon usually runs on a machine with a permanent public IP address. Resource requirements are tiny, since such a node needs very little memory and CPU.

A leaf is an ordinary member device: your computers, phones, and application servers.

The network controller stands apart. It is the brain that decides who gets into the network, issues certificates, and hands out settings. By default the controller is the cloud panel called ZeroTier Central, and management happens through the company website. The controller can be moved to your own machine, however, and then full authority over the network passes to you. Under the hood there are two layers: the lower one handles encrypted transport between nodes, and the upper one emulates an ordinary local network with its familiar addresses. You do not need to dive deep into this, a general picture is enough.

Why Install ZeroTier on Your Own VPS

Now to the heart of it. Installing ZeroTier on your own VPS covers three different jobs, and it is important not to mix them up.

The first job is a private relay node, the moon. When two devices cannot connect directly because of strict NAT at a mobile carrier or provider, their traffic goes through the public planet servers. Those can be far away, so even a conversation between two neighboring computers may travel across the world and come back with noticeable delay. A VPS acting as a moon becomes a regional exchange point and cuts that delay. When your devices are clustered in one region, a moon close to them keeps traffic nearby and avoids a long detour.

The second job is a private controller. A recent change to pricing matters here. Since November 5, 2025 the free ZeroTier plan has been trimmed: it now covers 10 devices and up to three networks, after which a paid subscription kicks in with a per device charge. When the controller lives on your server, the device ceiling disappears entirely, and all information about the network membership is stored with you rather than in someone else's cloud.

The third job is a gateway node. A server in a ZeroTier network can advertise a route to an entire subnet that sits behind it. This lets you link cloud infrastructure with an office local network, or pull together several servers from different hosting providers into one private cluster.

Both of the key jobs, the moon and the controller, need a VPS with a permanent public IP address and a stable channel. You can rent such a server on Serverspace and get a ready platform for your network in a couple of minutes.

Cloud VPS ServerRun a VPS virtual server
with preinstalled Linux or Windows
from €4/moGet Cloud VPS

What Self-Hosting Solves and What It Does Not

Before moving on to setup, it is worth being honest about where self-hosting helps and where it does not, so expectations stay realistic.

Self-hosting genuinely solves three things. It removes the device cap of the free plan, since your own controller has no built in limit. It keeps control of your data, because membership details and logs stay on hardware you own. And it improves latency for nodes that sit in one region, because a moon placed near them shortens the path their traffic takes. For teams with data residency or compliance requirements, running the controller in a specific jurisdiction is a practical way to keep network metadata where it needs to be.

Choosing the right location is part of that decision, and providers with several data center regions make it easier. You can pick a VPS in a region close to your devices so both latency and data residency line up with your needs.

There are also things self-hosting does not fix. You take on responsibility for uptime, updates, and backups of the controller and moon, which the managed cloud would otherwise handle. ZeroTier also relies on a custom protocol rather than an open standard like WireGuard, which makes the encryption harder for independent specialists to audit. And if a network path is being throttled or filtered somewhere upstream, your own server does not change what happens outside its walls. For many home and small business setups the managed ZeroTier cloud is perfectly fine, and self-hosting earns its place mainly when device counts, data control, or regional latency become real concerns.

How to Set Up Your Own ZeroTier Server Step by Step

Now to the practice. The steps below show how to build your own ZeroTier server and assemble a first private network. Everything runs in the server terminal, and the commands can be copied as they are.

Step 1. Rent and Prepare a VPS

Take a VPS with Ubuntu 22.04 or 24.04 and, importantly, with a public static IP address, otherwise the moon will not work. For a personal network or a small team the most modest configuration is enough. A suitable machine is easy to rent on Serverspace, after which you connect to it over SSH and update the system:

ZeroTier communicates over UDP on port 9993, so open it in the firewall:

Step 2. Install ZeroTier and Create a Network

The client itself installs with a single command, and the script does everything for you:

After installation, check that the service is up and note the node identifier, you will need it later:

The command prints a line with the ONLINE status and a ten digit node number. Now you have a choice. You can create a network in the ZeroTier Central cloud panel and join the server to it by its identifier:

Or you can stand up a fully private controller so you depend on no cloud at all. We cover that in the next step.

Step 3. A Private Controller with a Web Interface

Managing a controller through the bare command line is inconvenient, so people add a graphical panel to it. The most active project today is ZTNet: it deploys through Docker Compose and supports multiple users and even organizations. As a simpler and older option, ztncui will do.

If Docker is not installed yet, install it:

Then download the ready ZTNet configuration file and start the whole set of services:

After launch the panel opens in a browser at the server address. Through it you create networks, add devices, and see their status without touching the command line. The first account you create gets administrator rights, so log into the panel right after installation.

Step 4. Set Up a Moon (Optional)

If you want a private relay for speed, turn the server into a moon. Generate a configuration template in the ZeroTier working directory, enter the server public IP into it, then create a signed moon file with the genmoon command. Place the resulting file into the moons.d subfolder and restart the service. On the client side a single command is left to make devices start using your moon:

You can verify that a client picked up your relay like this:

If a line with the MOON role appears in the output, everything is set up correctly.

ZeroTier Alternatives Compared

ZeroTier is not the only option for private networks, and it helps to know what people compare it against before you start. Its main rival is Tailscale, built on the standard WireGuard protocol. Tailscale itself cannot be deployed entirely on your own, but for that there is an open project called Headscale, which replaces its coordination server and works with the same clients. Plain WireGuard offers maximum speed and simplicity, though keys and nodes have to be written by hand and it has no automatic NAT traversal. Netmaker and NetBird are modern mesh solutions also based on WireGuard, with a web panel and the option of full self-hosting.

The strong side of ZeroTier is its support for the second network layer, where the virtual network behaves like a real physical switch with broadcast and multicast. That matters for older applications and games that look for peers on the local network. ZeroTier also has very broad platform coverage, reaching network attached storage devices and routers. It is weaker where full transparency of encryption matters, since a custom protocol is harder for independent specialists to verify than the widely adopted WireGuard.

Common Mistakes When Setting Up Your Own ZeroTier Server

The installation itself is not hard, but it is easy to step on a few typical rakes at the start. Let us go through the five most common.

The first mistake is an open port with no protection. If you leave the controller panel or a service port reachable from the whole internet, anyone can knock on them. The fix is simple: restrict access to the panel by a list of trusted addresses, or hide it behind an SSH tunnel.

The second mistake is a web panel without encryption. When you open the controller interface over plain HTTP, the login and password travel across the network in clear text. Put an Nginx reverse proxy in front of the panel with a free Let's Encrypt certificate.

The third mistake is a VPS without a permanent public IP. The moon and the controller have to be reachable at the same address. If the address changes or is missing, nodes simply will not find the server. So choose a configuration with a dedicated IP right when you rent.

The fourth mistake is treating ZeroTier as a way to bypass restrictions on a mobile network. That is a different task, and the approach is unreliable for it. Use the service for what it is meant to do, a private network of your own machines.

The fifth mistake is forgotten updates and lost keys. The client evolves quickly, so update it every couple of months. Separately, store the controller and moon files in a safe place, because without them you cannot rebuild the network with its previous settings.

Conclusion

Your own ZeroTier server turns scattered devices into one private network, removes the limits of the free plan, and keeps the data about the network under your control. For business there is an added benefit: running the controller in a chosen jurisdiction helps meet data residency and compliance requirements.

It is best to start small. Take one VPS, install ZeroTier on it, create a network, and join a couple of devices to it. Once the scheme works, expand it: add your own controller with a panel, set up a moon for speed if needed, and grant access to the team. The barrier to entry is low, and the benefit is visible on the very first day. The one thing worth keeping in mind is that you take on the upkeep of your own infrastructure, so plan for updates and backups from the start.

Frequently Asked Questions (FAQ)