Routing all traffic through Home with ZeroTier on travel

While you are traveling, you may not want to connect all your devices to public wifi to access the internet, so the solution is to use a VPN to securely access the internet. However if you don’t have a VPN subscription, then how?

There may be a couple of options but complex.

In this article, we will look at how you can route all your traffic from anywhere via your home using ZeroTier without VPN.

This is Part-1 of 2 part series. Check out Part-2 for configuring a travel router as client.

What is ZeroTier?

ZeroTier is a smart programmable Ethernet switch for planet Earth. It allows all networked devices, VMs, containers, and applications to communicate as if they all reside in the same physical data center or cloud region. Refer ZeroTier One github repo.

How it works?

I will not go too in-depth into ZT features and what is it capable of. At a high level, In the below example, I have a raspberry pi running at my home with ZeroTier One client and connected to ZeroTier virtual network. And on my mobile, I have ZeroTier One client installed and connected to the same virtual network. When I enable the ZeroTier connectivity, it can directly talk to raspberry pi or any other device connected to the same virtual network wherever they are and even behind the NAT.

The way it works is, the Peer-to-Peer connection will be initiated via the Planet Servers hosted by ZeroTier (You can also host your own if you would like to, it is opensource), and once the connection is established, it will try to create a UDP hole punch between these 2 networks. If successful, the network traffic will travel via the direct connection (it’s all encrypted). In case of any issues, it will route the traffic via Planet servers (which may be slow).

ZeroTier account provides up to 50 devices for free as of today. You can register at my.zerotier.com

I wanted to send all my traffic through my home securely wherever I am. So, I have configured Raspberry Pi at Home as Gateway and connected to Zerotier virtual network. And I do not want to install ZeroTier on all my devices, so I have configured a small Travel router from GL.iNet (OpenWrt) with ZeroTier client and routing any of its client traffic via ZeroTier network to my Home Raspberry Pi, which intern sends traffic out to the internet.

I will explain more about travel router configuration in Part-2.

What do you need?

• A Raspberry Pi (Preferably 3/4)
• Power Adapter for Raspberry Pi
• Ethernet cable for connecting Raspberry Pi to your Home Router.
• Ubuntu OS for Raspberry Pi (I am using 20.04 LTS Server)
• Android / iOS Mobile

Let us get started

Create a new ZeroTier Network

Go to my.zerotier.com and register a new account if not done so.

Click on ‘Create A Network’ to create a new ZeroTier virtual network. Which creates a 16 character unique network id. You can not change the network id.

When you go into the details of the network, you can see the Basic settings, where you can change the network name or add a description.

Access Control Private allows anyone who has this network id to join your network, however, you as the owner of this network need to approve.

In the Advanced section, by default, the network will assign an IP range for you, for example, 10.147.18.0/24 as shown in the below screenshot. You may change this to any available IP range which is not conflicting with your internal IP ranges.

Configure Raspberry Pi with ZeroTier

Download the Ubuntu for Raspberry Pi and create the bootable SD card using any of the imaging software. Or You may follow the steps defined in this Ubuntu tutorial for Raspberry Pi.

Setup & Login to the Raspberry Pi console, and install the ZeroTier One client.

curl -s https://install.zerotier.com | sudo bash

Join Raspberry Pi to ZeroTier network

NETWORK_ID=<YourZTNetworkId>
sudo zerotier-cli join $NETWORK_ID

Authorize the device by going to https://my.zerotier.com/network/$NETWORK_ID in the Members section.

Now if you run ifconfig in your raspberry pi, you should see a new interface (ztxxxxxxxx) with IP from ZT network. (Example, 10.147.18.21).

Go to your network page on my.zerotier.com and add a Managed Route to route all internet traffic via this IP. Under ‘Add Routes’, use the below information to create a route.

Enable IP Forwarding

Edit /etc/sysctl.conf to uncomment net.ipv4.ip_forward. This enables forwarding at boot.

Enable it now by running

sudo sysctl -w net.ipv4.ip_forward=1

Configure iptables

Find out your physical network interface name (ex: eth0). Modify the below with Raspberry Pi physical network interface name, ZeroTier interface name.

PHY_IFACE=eth0
ZT_IFACE=ztxxxxxxx

Add below iptable rules

sudo iptables -t nat -A POSTROUTING -o $PHY_IFACE -j MASQUERADE
sudo iptables -A FORWARD -i $ZT_IFACE -o $PHY_IFACE -j ACCEPT
sudo iptables -A FORWARD -i $PHY_IFACE -o $ZT_IFACE -m state --state RELATED,ESTABLISHED -j ACCEPT

Save iptable rules for loading on boot.

sudo apt install iptables-persistent
sudo bash -c iptables-save > /etc/iptables/rules.v4

Use Mobile Phone as Client

• Go to Your App Store / Play Store and download ZeroTier One app.
• Turn off Wifi, Go to browser, and find out your public IP using http://ifconfig.io
• In the ZeroTier One app, Join the network by entering the network id.
• Enable Default Route option. (Without this, you can talk to other ZeroTier devices but the internet traffic won’t be routed via Raspberry Pi).
• Once the network is added, enable the network.
• Goto your Zerotier network settings (my.zerotier.com), and Authorize this device.
• In your phone, go back to browser and refresh the ifconfig.io page, now you should see your home public IP (or ISP public IP if CGNAT)

Conclusion

With this, we are able to configure Raspberry Pi with ZeroTier network as Gateway and able to route traffic from anywhere via this gateway at home. In Part-2, we will look at configuring a mini travel router with ZeroTier, so that multiple devices connected to the router can send traffic via gateway without installing ZeroTier one client in all devices.

References

• https://zerotier.atlassian.net/wiki/spaces/SD/pages/7110693/Overriding+Default+Route+Full+Tunnel+Mode
• https://github.com/zerotier/ZeroTierOne

• Share on Twitter
• Share on LinkedIn