Skip to content

Instantly share code, notes, and snippets.

@michele-tn

michele-tn/ubuntu-tailscale-vs-zerotier-complete-guide.md

Last active May 18, 2026 10:00
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save michele-tn/a0d958e91486fa57492f98b49475943d to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save michele-tn/a0d958e91486fa57492f98b49475943d to your computer and use it in GitHub Desktop.
Download ZIP
A comprehensive technical guide for deploying Tailscale and ZeroTier on Ubuntu 22.04.5 LTS, including installation, exit node configuration, routing, security hardening, troubleshooting, verification, and technical comparison.
Raw
ubuntu-tailscale-vs-zerotier-complete-guide.md

Ubuntu 22.04.5 LTS — Tailscale vs ZeroTier Complete Guide

image

A comprehensive technical guide for deploying Tailscale and ZeroTier on Ubuntu 22.04.5 LTS, including installation, exit node configuration, routing, security hardening, troubleshooting, verification, and technical comparison.

Table of Contents

  1. Introduction
  2. Architecture Overview
  3. Prerequisites
  4. Installing Tailscale
  5. Configuring Tailscale Exit Node
  6. Installing ZeroTier
  7. Configuring ZeroTier as Exit Gateway
  8. Security Hardening
  9. Technical Comparison
  10. Common Use Cases
  11. Verification & Testing
  12. Troubleshooting
  13. References
  14. Conclusion

1. Introduction

Modern mesh VPN solutions such as Tailscale and ZeroTier simplify secure connectivity between devices over untrusted networks.

Both solutions create encrypted overlay networks while abstracting NAT traversal, firewall issues, and remote routing complexity.

Tailscale is ideal for

  • WireGuard-based secure mesh VPN
  • Identity-aware networking
  • Fast remote SSH access
  • Native exit nodes
  • ACL-based access policies
  • Minimal configuration

ZeroTier is ideal for

  • Virtual LAN over Internet
  • Layer 2 and Layer 3 overlays
  • Advanced routing scenarios
  • Homelabs and clusters
  • Self-managed virtual network topologies

2. Architecture Overview

Tailscale

Core technologies

  • WireGuard transport
  • DERP relay fallback
  • Automatic NAT traversal
  • Identity provider authentication

Features

  • Native exit nodes
  • Subnet routers
  • MagicDNS
  • ACL policy engine
  • SSH integration

Deployment models

  • SaaS control plane
  • Self-hosted Headscale

Official docs:

ZeroTier

Core technologies

  • Virtual Ethernet switch
  • SD-WAN overlay
  • L2 bridging + L3 routing
  • Managed routes

Features

  • Virtual LAN
  • Network segmentation
  • Flow rules
  • Controller-based management

Deployment models

  • ZeroTier Central
  • Self-hosted controller

Official docs:

3. Prerequisites

Tested on:

  • Ubuntu 22.04.5 LTS
  • sudo privileges
  • outbound HTTPS access

Recommended packages:

sudo apt update
sudo apt install curl iptables ufw jq net-tools -y

Optional tools:

sudo apt install dnsutils traceroute tcpdump -y

Kernel requirements:

uname -r
sysctl net.ipv4.ip_forward

4. Installing Tailscale

Installation

curl -fsSL https://tailscale.com/install.sh | sh

Enable service:

sudo systemctl enable --now tailscaled

Authenticate:

sudo tailscale up

Verify:

tailscale status
tailscale ip -4
tailscale version

Check daemon:

systemctl status tailscaled

5. Configuring Tailscale Exit Node

Enable IP forwarding:

echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
echo 'net.ipv6.conf.all.forwarding=1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Advertise exit node:

sudo tailscale up --advertise-exit-node

Optional SSH:

sudo tailscale up --advertise-exit-node --ssh

Approve route in admin console.

Optional subnet router:

sudo tailscale up --advertise-routes=192.168.1.0/24

Client usage:

tailscale up --exit-node=<NODE_IP>

6. Installing ZeroTier

Install:

curl -s https://install.zerotier.com | sudo bash

Enable daemon:

sudo systemctl enable --now zerotier-one

Join network:

sudo zerotier-cli join <NETWORK_ID>

Status:

sudo zerotier-cli info
sudo zerotier-cli listnetworks

Authorize device:

7. Configuring ZeroTier as Exit Gateway

Enable forwarding:

echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

NAT masquerade:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Persist rules:

sudo apt install iptables-persistent -y
sudo netfilter-persistent save

Managed route:

0.0.0.0/0 via <ZEROTIER_NODE_IP>

Optional IPv6:

::/0 via <ZEROTIER_NODE_IP>

8. Security Hardening

Firewall

sudo ufw allow ssh
sudo ufw enable

Restrict unnecessary services:

sudo systemctl disable apache2
sudo systemctl disable nginx

Check listening ports:

sudo ss -tulpn

Disable password SSH:

sudo nano /etc/ssh/sshd_config

Recommended:

PasswordAuthentication no
PermitRootLogin no

Restart SSH:

sudo systemctl restart ssh

Common risks

  • DNS leaks
  • Public gateway exposure
  • Incorrect NAT rules
  • Broad route advertisement
  • Unrestricted ACL policies

9. Technical Comparison

Feature Tailscale ZeroTier
Base protocol WireGuard Proprietary overlay
Encryption WireGuard AES-based
Exit node Native Manual
Layer support L3 L2/L3
NAT traversal Excellent Good
Setup complexity Low Medium/High
ACL support Native Flow rules
Self-hosting Headscale Native controller
Mobile UX Excellent Good
LAN emulation No Yes

10. Common Use Cases

Choose Tailscale for

  • Personal VPN
  • Secure SSH
  • Exit node deployment
  • Mobile VPN
  • Developer remote access
  • Corporate identity-aware networking

Choose ZeroTier for

  • Homelabs
  • Kubernetes clusters
  • Proxmox clusters
  • Broadcast-sensitive workloads
  • Virtual LANs
  • Lab segmentation

11. Verification & Testing

Public IP verification

curl ifconfig.me

DNS leak test

nslookup google.com

Route verification

ip route
ip addr

Connectivity

ping 8.8.8.8
traceroute 8.8.8.8

12. Troubleshooting

Restart services:

sudo systemctl restart tailscaled
sudo systemctl restart zerotier-one

Logs:

journalctl -u tailscaled -f
journalctl -u zerotier-one -f

Common issues:

Exit node not visible

  • IP forwarding disabled
  • Route not approved

No internet via ZeroTier gateway

  • Missing NAT rule
  • Incorrect managed route

DNS issues

Check resolver:

resolvectl status

Firewall issues

Temporarily test:

sudo ufw disable

13. References

Tailscale

ZeroTier

14. Conclusion

Tailscale

Best for:

  • simplicity
  • secure remote access
  • identity-aware networking
  • native exit nodes

ZeroTier

Best for:

  • advanced networking
  • virtual LANs
  • homelabs
  • routing flexibility

Summary:

  • Tailscale = plug-and-play secure mesh VPN
  • ZeroTier = advanced software-defined networking toolkit
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment