Unlike Nebula, it gives you an IPv6 address (actually, millions of them per node, if needed).
They now also have a userspace only SOCKS 5 proxy server that can connect your app to the whole network without forcing user to install drivers or to mess with their network configuration.
The last time I tried ZeroTier (years ago, I admit) it wasn't possible to self-host all of it I think and I couldn't make it reliably use my own relays for good performance of non-direct connections.
I've been happily using Nebula for a while now, pretty easy to configure and self-host.
Thanks for the recommendation! I wanted a VPN like this for a long time, to manage HA in a remote propery, and this seems like a great option. Even the hosted service is very reasonably priced - https://www.defined.net/pricing/
They are not directly comparable. Nebula is a mesh VPN. Wireguard can be used as a building block for a mesh VPN (as it is in Tailscale), but it does not have that function organically.
I have tried Tailscale / Headscale and did not find the overhead worth it. Both can saturate a 10Gbps link and that's all I need right now. Nebula's much simpler to administer. The configuration's spelled out in the client configs and in the certificates you provision. If you're already using some form of configuration management, it's quite easy to make changes. If you require a Web UI, Tailscale / Zerotier / etc may be better. There is a company that provides a Nebula-based service with a Web UI but I haven't tried it.
I'd characterize it as such: Wireguard is more of a plumbing solution that gives you a point-to-point connection, either it's enough for you or you can use this to build what you need.
Nebula is more of an end-user ready-to-use solution, gives you features like NAT traversal, automatic selection of direction connections if possible, the nodes don't need to know other nodes' addresses ahead of time(x) etc.
Hugged to death but what i like about zerotier is that I can access my Home Assistant instance (and other home services) with same ip address (resolved from dns and then TLS terminated with traefik) from home network and from zerotier.
And it does not matter if I have ZT network connected when home.
Not sure if that is possible with tailscale (from my understanding, it generates always tailnet ip for hosts).
Tailscale does support this. Using the Subnet routing feature you can expose other devices on the network to the Tailnet. I had to use this for a while with TrueNAS because of the way it handles TS integration (eventually I moved to using a reverse proxy).
The best part of tailscale is that you can use an Apple TV as a subnet router and exit node. So even if you do not have any home networking equipment, you can utilize this by just using the Apple TV app. This is particularly great if you have a second home etc.
> from my understanding, it generates always tailnet ip for hosts
It does, but it should connect over LAN when both devices are on the same network. The tailnet IP doesn’t exist outside the WireGuard network, so it’s up to the WireGuard routing algorithm.
I thought it was Tailscale that always selects which IP to use as endpoint for other devices, and set that up for Wireguard? If I'm wrong, could I replicate that behavior (using relay on WAN, direct connection on LAN) with Wireguard without external configuration tools?
Tailscale DNS might cause a bit of trouble, but the overhead isn’t too bad, I’m measuring ~1ms ping difference, which is a lot in relative terms, but in absolute it makes 0.5ms into 1.5ms.
I've been using Zerotier personally and professionally for some 10 years or more and as a network engineer I love the product, and have long recommended it. I've compared it to Tailscale, and while Tailscale has a lot more enterprise-y features, they too miss some key features of Zerotier like being able to use route ANY subnet IP addresses, not just limited to their 100.64/10 addressing Tailscale limits you to. Tailscale also requires you to use an oauth account for users, which has never been compelling for personal use.
I also believe it was around before Tailscale, or at least I knew of it before Tailscale, but I've never seen a compelling need to move from Zerotier to Tailscale.
Also great to bypass Netflix/Hulu/Disney geo or VPN restrictions. I run ZT on my travel Amazon firestick, connect to my home network, turn on use default gateway and all traffic goes via my home router.
Using a similar setup, a friend in Oz and I also share ZT networks, so either he or I can use them to watch content that is only available regionally. The traffic uses home IPs, so it won't get blocked or detected.
It just works.
(Disclosure: was part of the first angel round investment in ZT)
The guide for Shellys [0] is highly appreciated. I always thought about touching those, but all the guides I've found required knowledge I didn't have. I guess it's a precaution because one can cause real damage doing this wrong, but I feel now, I could do it.
Do you have any feedback regarding lag? I like the potential of Shelly products, but every single light I bought from them has a 2-second lag, as the devices seem to want to light up only AFTER being connected to the WiFi.
> want to light up only AFTER being connected to the WiFi
Do you isolate them at the switch? If you do, then it's less likely "connected to WiFi" and more likely that's the time to boot up the firmware.
If you don't, then they should always be up and connected to the wifi.
I've used Shelly lights with no issues, even pressing the button on a Zigbee switch to send a signal to Home Assistant who would in turn tell the Shelly to switch on was always instant.
Readit News
ZeroTier does not use an OSI approved open-source license. It is under a freedom-restricting "Business Source License". Nebula is MIT licensed.
Nebula is much simpler and in most cases faster than ZeroTier.
Unlike Nebula, it gives you an IPv6 address (actually, millions of them per node, if needed).
They now also have a userspace only SOCKS 5 proxy server that can connect your app to the whole network without forcing user to install drivers or to mess with their network configuration.
The last time I tried ZeroTier (years ago, I admit) it wasn't possible to self-host all of it I think and I couldn't make it reliably use my own relays for good performance of non-direct connections.
I've been happily using Nebula for a while now, pretty easy to configure and self-host.
Do they route announcements over the network? Can I just setup two machines and expect them to just work by finding each other?
Does it support name resolution?
I have tried Tailscale / Headscale and did not find the overhead worth it. Both can saturate a 10Gbps link and that's all I need right now. Nebula's much simpler to administer. The configuration's spelled out in the client configs and in the certificates you provision. If you're already using some form of configuration management, it's quite easy to make changes. If you require a Web UI, Tailscale / Zerotier / etc may be better. There is a company that provides a Nebula-based service with a Web UI but I haven't tried it.
I'd characterize it as such: Wireguard is more of a plumbing solution that gives you a point-to-point connection, either it's enough for you or you can use this to build what you need.
Nebula is more of an end-user ready-to-use solution, gives you features like NAT traversal, automatic selection of direction connections if possible, the nodes don't need to know other nodes' addresses ahead of time(x) etc.
(x) except for the lighthouse
EDIT: actually, they just use various I/O abstractions that WireGuard developed.
And it does not matter if I have ZT network connected when home.
Not sure if that is possible with tailscale (from my understanding, it generates always tailnet ip for hosts).
It does, but it should connect over LAN when both devices are on the same network. The tailnet IP doesn’t exist outside the WireGuard network, so it’s up to the WireGuard routing algorithm.
Dead Comment
I also believe it was around before Tailscale, or at least I knew of it before Tailscale, but I've never seen a compelling need to move from Zerotier to Tailscale.
I want to connect a local bare metal k8s cluster to the internet but completely walled off from the rest of my network.
Could probably redo it and skip the double proxy but honestly it's fine.
We used to have Hamachi, but the limited networks, the unintuitive UI and the need to create an account are all things that ZeroTier does best.
Need someone to join the network ? Just send them the ZeroTier download link, and the network ID. No account, no complicated prompts, nothing !
And you can customize everything on the backend, like ip addressing and routing.
And it's even self hostable ! (But then the users need to set the url to your server so this adds a bit of setup obviously)
Using a similar setup, a friend in Oz and I also share ZT networks, so either he or I can use them to watch content that is only available regionally. The traffic uses home IPs, so it won't get blocked or detected.
It just works.
(Disclosure: was part of the first angel round investment in ZT)
The guide for Shellys [0] is highly appreciated. I always thought about touching those, but all the guides I've found required knowledge I didn't have. I guess it's a precaution because one can cause real damage doing this wrong, but I feel now, I could do it.
Dzieki.
[0] https://blog.tomaszdunia.pl/shelly-smart-oswietlenie-eng/
Do you isolate them at the switch? If you do, then it's less likely "connected to WiFi" and more likely that's the time to boot up the firmware.
If you don't, then they should always be up and connected to the wifi.
I've used Shelly lights with no issues, even pressing the button on a Zigbee switch to send a signal to Home Assistant who would in turn tell the Shelly to switch on was always instant.