Skip to main content

VPN Exit Node

Route all your Internet traffic through a ZeroTier node.

In this tutorial

ZeroTier creates imaginary LANs. Default route override means that computers on your imaginary LAN will be routing Internet traffic through it. Just like a real LAN, your imaginary LAN is going to now need a gateway. Setup here is almost identical to what you'd do to configure a NAT gateway for a conventional wired LAN.

First, create your exit node

This is the node that will handle all of your internet traffic. It can be something as small as a $5 VPS or a Raspberry Pi.

  • If you haven't already, go create a network and come back
  • Install ZeroTier on it
  • Join the exit node to your ZeroTier network:
sudo zerotier-cli join <nwid>

Enable IPv4 Forwarding on the exit node

On the computer acting as the VPN exit node:

sudo nano /etc/sysctl.conf

Add the line:

net.ipv4.ip_forward = 1

Tell the kernel to reload settings:

sudo sysctl -p

Check that settings were correctly applied:

sudo sysctl net.ipv4.ip_forward

If you've joined (and authorized!) your exit node to your network then you are ready to begin configuring it. Start by setting a few environment variables that we will use later:

Get the name of your ZeroTier interface, it will start with zt:

ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
link/ether 96:00:02:8d:28:c7 brd ff:ff:ff:ff:ff:ff
altname enp1s0
3: zthnhhqofq: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 2800 qdisc fq_codel state UNKNOWN mode DEFAULT group default qlen 1000
link/ether 86:61:c6:fe:ed:dc brd ff:ff:ff:ff:ff:ff

In our case it was zthnhhqofq. Let's set the environment variable:

export ZT_IF=zthnhhqofq

Next, get the name of the regular WAN interface to the internet:

In our case it was eth0

export WAN_IF=eth0

Enable NAT and IP masquerading:

sudo iptables -t nat -A POSTROUTING -o $WAN_IF -j MASQUERADE

Allow traffic forwarding:

sudo iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Allow traffic forwarding from the ZeroTier interface to the WAN interface:

sudo iptables -A FORWARD -i $ZT_IF -o $WAN_IF -j ACCEPT

Make iptables rules persist after reboot:

sudo apt-get install iptables-persistent

Save your new iptables rules:

sudo netfilter-persistent save

At this point it would be a good idea to restart your exit node and verify that the routing rules have persisted.

sudo iptables-save

-A FORWARD -i zthnhhqofq -o eth0 -j ACCEPT




Your exit node is complete, now we need to configure your network.

Configure your network

Now that your exit node is set up we need to configure your ZeroTier network to advertise a Default Route so that other nodes know that the exit node can route traffic to the internet.

Central > Network >

Tell other nodes to use exit node


Try adding something like the following for simple tunnel on/off control:

sudo zerotier-cli set $nwid allowDefault=1

sudo zerotier-cli set $nwid allowDefault=0