Zerotier

Zerotier creates a virtual network between hosts.

opkg update
opkg install zerotier

• Create the virtual network on Zerotier Central. Note the Network ID.
• Add the virtual network to the Openwrt zerotier config (the section name my_zt_net is arbitrary, you can consistently replace it with whatever label you want)

uci delete zerotier.sample_configuration
uci add zerotier my_zt_net
uci add_list zerotier.my_zt_net.join=<network_id_from_zerotier_central>
uci set zerotier.my_zt_net.enabled='1'
uci commit zerotier
service zerotier restart

• When a new virtual network is joined, a secret will be generated, which may take a while. When it's finished, the secret will be saved in /etc/config/zerotier, and the device will join the virtual network.
  • Typical communication with Zerotier peers will happen on UDP port 9993, and no additional configuration is needed for an out-of-the-box router configuration.
• To use the virtual network, the device must be authorized on Zerotier Central by clicking the “Auth?” box next to the device under Members
• Device connectivity can be seen by using the “info” command:

zerotier-cli info

• Some services (eg dropbear, luci) may need to be reconfigured to allow access from the new Zerotier virtual interface. The easy way is to un-restrict them from specific networks/interfaces.
  • For dropbear (allow access from anywhere, potentially unsafe):

cat /etc/config/dropbear 

config dropbear
	option PasswordAuth 'on'
	option Port '22'

# Configure firewall
uci -q delete firewall.vpn
uci set firewall.vpn="zone"
uci set firewall.vpn.name="vpn"
uci set firewall.vpn.input="REJECT"
uci set firewall.vpn.output="ACCEPT"
uci set firewall.vpn.forward="REJECT"
uci set firewall.vpn.masq="1"
uci set firewall.vpn.mtu_fix="1"
uci add_list firewall.vpn.device="zt+"
uci -q delete firewall.lan_vpn
uci set firewall.lan_vpn="forwarding"
uci set firewall.lan_vpn.src="lan"
uci set firewall.lan_vpn.dest="vpn"
uci -q delete firewall.ssh
uci set firewall.ssh="rule"
uci set firewall.ssh.name="Allow-SSH"
uci set firewall.ssh.src="vpn"
uci set firewall.ssh.dest_port="22"
uci set firewall.ssh.proto="tcp"
uci set firewall.ssh.target="ACCEPT"
uci commit firewall
service firewall restart

The sample configuration is helpful to see which uci options are available for configuring the ZeroTier client.

While basic uci configuration of ZeroTier as shown above is supported, almost no advanced configuration support via uci has yet been added. The ZeroTier documentation requires manipulation of the configuration files for many advanced features. However, ZeroTier configurations are stored by default under /var/lib in Linux-based systems, which is a temporary filesystem in OpenWrt, where changes are not persistent. Instead, ordinarily OpenWrt writes a new configuration folder in that location based on the uci configuration above each time the service is started. These configuration files are lost on reboot or service restart, and rewritten each time the service starts again. For a basic configuration which will suit most users, this is not an issue.

In order to configure advanced features, two uci directives may be used to configure OpenWrt to load a copy of a persistent configuration folder from another location when starting the service, such as /etc/zerotier, which the user must first create and populate based on the simple copy made upon first joining a network. Once this persistent location is configured, the user may make persistent changes according to the ZeroTier documentation, with support for all current features otherwise enabled.

• Complete the basic configuration steps above to joint a working network, which will create a temporary copy of the configuration folder with which to start.
• Create the persistent folder in any permanent location (/etc/zerotier will be used for this example), and copy the contents of the temporary folder to the permanent location:

mkdir /etc/zerotier
cp -r /var/lib/zerotier-one/* /etc/zerotier/

• Add the directives to use the new persistent folder. The network name deadbeef00 will be used, similar to most ZeroTier documentation examples:

uci set zerotier.deadbeef00.config_path='/etc/zerotier'
uci set zerotier.deadbeef00.copy_config_path='1'
uci commit zerotier
service zerotier restart

The router will now refer to the configuration in /etc/zerotier for persistent advanced changes. Restarting the service after any configuration changes using the last line above will reset and apply any changes made. Do not attempt to edit the configuration in the /var/lib/zerotier-one location, as this temporary location will still be overwritten on restart by the configuration in the new persistent directory.