Skip to main content

Network Groups and Networks

Central vs New Central

ZeroTier Central is available in two versions. Please follow the appropriate instructions based on which version you are using:

Not sure which version you're using? Check the bottom-left corner of your page for a version number (v2.x.x = New Central), or see How to Check Your Central Version.

New Central Network Management​

Understanding the Hierarchy​

New Central organizes your ZeroTier infrastructure in three levels:

  1. Organizations - The top level with its own billing and users
  2. Network Groups - Categories for organizing networks and managing access control
  3. Networks - Individual virtual networks where devices connect

When you create an Organization, it includes one Network Group and one Network by default.

Network Groups​

Network Groups allow you to categorize and manage access control for many networks at once. This is particularly useful for organizing networks by department, project, or environment.

Creating a Network Group​

  1. Navigate to either the Organizations page or the Network Groups page
  2. Click New Network Group
  3. Name your network group

Create Network Group

Managing a Network Group​

  1. Access the network group from the Network Groups menu in the left sidebar
  2. Select the Settings tab
  3. Update name, description, or access controls as needed
warning

Deleting a network group will delete all networks within that group. This action cannot be undone.

Create and Manage Networks​

Networks are where your devices actually connect. Each network has its own Network ID, IP assignment settings, and member devices.

Creating a Network​

Additional networks can be created from either:

  • The Networks page (then assign to a Network Group)
  • Within a specific Network Group (automatically assigned to that group)

Steps:

  1. Click New Network or navigate to a Network Group and click New Network
  2. Name your network and choose your Network Group if necessary
  3. The network is created with a unique 16-character Network ID

Create Network

Assign to Network Group

Managing Network Settings​

  1. Access your network from either:
    • The Networks tab in the left sidebar
    • Within its parent Network Group
  2. Select the Settings tab

Here you can configure:

  • Name and Description - Identify your network
  • IP Assignment - Configure managed IP ranges and settings
  • Custom Routes - Add routes for bridging or advanced networking
  • Access Control - Set authorization requirements
  • DNS - Configure network DNS settings

Network Settings

Add a Device​

When a device joins your network, it will appear in the Member Devices tab and needs to be authorized.

  1. Open your network
  2. Navigate to the Member Devices tab
  3. A pop-up may appear showing your new device, or find it in the device list
  4. Click Authorize to approve the device

Authorize Device

Manage Devices​

Once devices are on your network, you can manage them from the Member Devices tab.

Manage Devices

Authorize a Device​

New devices that join your network must be authorized before they can communicate:

  1. Navigate to the Member Devices tab
  2. Find the device in the list
  3. Click Authorize

De-authorize a Device​

To temporarily remove a device from the network without deleting it:

  1. Navigate to the Member Devices tab
  2. Find the device you want to de-authorize
  3. Click the authorization toggle to turn it off

The device will remain in your list but won't be able to communicate on the network.

note

De-authorized devices do not count toward your device limits. Only authorized devices are counted.

Manually Add a Device​

If you need to add a device by its Node ID:

  1. Go to the Settings tab of the network
  2. Find the Manually Add Member section
  3. Paste in the Node ID (10-character identifier)
  4. Click Add

The device will appear in your Member Devices list and can then be authorized.

tip

You can find a device's Node ID in the ZeroTier app on that device.

Hide a Device​

To hide a device from the member list without deleting it:

  1. Navigate to the Member Devices tab
  2. Find the device you want to hide
  3. Click Hide on the right side of the device row

The device will be de-authorized and hidden from view. Hidden devices can be revealed by toggling the Show Hidden option above the device list.

note

Hidden devices still count toward your device limits. They remain in the network and can be un-hidden at any time.

Delete a Device​

To permanently remove a device from your network:

  1. Navigate to the Member Devices tab
  2. Find the device you want to remove
  3. Click Delete on the right side of the device row
note

Delete should only be used if the node will never join again. Just de-authorize them instead if you don't want them counted against your node limits.

If you don't see the Delete and Hide buttons, your network may be set to Public. Public networks have no access control, so deleted or de-authorized members would reappear within seconds. Set your network to Private to use these features.

Adding Devices to a Network​

  1. From your Network page, copy the Network ID
  2. Install ZeroTier on your device
  3. Join the network using the Network ID (via UI or CLI)
  4. Return to New Central - a pop-up will appear for the new device
  5. Click Authorize to approve, or Reject to deny

Alternatively, authorize devices directly in the Member Devices tab to avoid accidental bulk authorizations.

Next Steps​

Frequently Asked Questions​

Can I make my subnet bigger or change my network's IP range?​

Yes. Your network's existing devices will keep their existing IPs.

To expand your subnet:

  1. Create a new, larger Managed Route
  2. Delete the old, smaller Managed Route
  3. Change IPv4 Auto-Assign from Easy to Advanced
  4. Delete the existing range
  5. Add the new, bigger range

Example: If your network was on the Easy Mode 192.168.195.* (/24):

  • Change the managed route to 192.168.194.0/23
  • Change the auto assign range to: 192.168.194.1 to 192.168.195.254

To change to a completely different subnet:

If you change to a completely different, non-overlapping subnet, your network's devices will get new IPs in the new range and keep their old IPs. You will have to delete the old IPs from each device if you don't want to see them in the list.

For example, if you change from 192.168.195.* to 10.244.*.*, the devices will have IPs in both ranges, like: 192.168.195.1 and 10.244.1.1

note

IPs don't actually get applied on the operating system unless the network has a matching managed route.