ZeroTier, Inc. is a software company with a freemium business model based in Irvine, California. ZeroTier provides proprietary software, SDKs[1] and commercial products and services to create and manage virtual software-defined networks. The company's flagship end-user product ZeroTier One[2] is a client application that enables devices such as PCs, phones, servers and embedded devices to securely connect to peer-to-peer virtual networks.[3][4][5]
ZeroTier markets proprietary tools, which are licensed under a Business Source License 1.1,[7] intended to support the development and deployment of virtual data centers:
In 2021, the product line consists of the following tools:
ZeroTier One, first released in 2014,[8] is a portable client application that provides connectivity to public or private virtual networks.
Central, a web-based UI portal for managing virtual networks.
libzt (SDK), a linkable library that provides the functionality of ZeroTier One but that can be embedded in applications or services.
LF (pronounced "aleph"), a fully decentralized fully replicated key/value store.
Client
The ZeroTier client is used to connect to virtual networks previously created in the ZeroTier Central web-based UI. Endpoint connections are peer-to-peer and end-to-end encrypted. STUN and hole punching are used to establish direct connections between peers behind NAT. Direct connection route discovery is made with the help of a global network of root servers via a mechanism similar to ICE in WebRTC.
Controller
Virtual networks are created and managed using a ZeroTier controller. Management is done using an API, proprietary web-based UI (ZeroTier Central), open-source web-based[9][10] or CLI[11] alternative. Using root servers other than those hosted by ZeroTier Inc. is impeded by the software's license.
Security
The following considerations apply to ZeroTier's use as an SDWAN or VPN application:
Asymmetric public key encryption is Curve25519, a 256-bit elliptic curve variant.
All traffic is encrypted end to end on OSI layer 1 using 256-bit Salsa20 and authenticated using the Poly1305 message authentication (MAC) algorithm.[12] MAC is computed after encryption (encrypt-then-MAC) and the cipher/MAC composition used is identical to the NaCl reference implementation.[13]
Packages
ZeroTier One is available on multiple platforms and in multiple forms:
