Manual

ZeroTier and Back To Home

Two services that dial out from the inside, and why WireGuard is usually still the answer.

The ordinary way in from outside is a VPN server on your router and a port reachable from the internet. That works well, until your line has no public address. ZeroTier and Back To Home solve that by turning it around: your router dials out to a service, your laptop or phone does the same, and the service introduces them to each other.

Back To Home

Back To Home is MikroTik's own and sits in Management access, under IP Cloud. The switch only appears once you enable IP Cloud DDNS, because the service uses that same cloud registration. The script writes one line for it:

/ip cloud set back-to-home-vpn=enabled

Underneath it is WireGuard, with MikroTik as the meeting point. You install the MikroTik app on your phone or laptop, scan a QR code, and you are on your home network. For someone who needs to reach their NAS once a month, that is exactly enough.

The tool only flips the switch. It does not add the users: you create those in WinBox under IP, Cloud, Back To Home, or from the terminal under /ip cloud back-to-home-user. Without a user the service is on and nobody can get in.

What you get is simplicity, and what you give up is insight. The traffic passes MikroTik, the configuration is largely fixed, and there is little for you to steer. For a customer site you manage, that is rarely what you want.

ZeroTier

ZeroTier is a third-party service that builds a virtual network between devices that otherwise cannot reach each other. You create a network in ZeroTier Central, get a network id of sixteen hexadecimal characters, and put that id on every device that should join.

The configurator has exactly one field for it, in the VPN section: ZeroTier network id. Fill it in and the script writes:

  • /zerotier set zt1 disabled=no port=9993, the instance running on the router;
  • /zerotier interface add network=<your id> instance=zt1 name=zerotier1, with allow-default=no, allow-global=no and allow-managed=yes;
  • a firewall rule accepting UDP 9993 to the router.

Those three values are set that way on purpose. allow-default=no means ZeroTier does not take over your default route, allow-global=no that it may not route public address ranges, and allow-managed=yes that it may accept the address you assign to this device in ZeroTier Central. The tool adds no routes beyond that; what is reachable over the ZeroTier network is decided in ZeroTier's console.

Which devices can run it

ZeroTier is a separate package and it does not exist for every architecture. The field in the tool says so: ARM and ARM64 devices, plus x86. A hEX on MIPS will not do this. Check before you start:

/system resource print
/system package print

architecture-name tells you what you are on, and the package list shows whether zerotier is installed. If it is not, take it from the Extra packages of exactly the same RouterOS version. See Packages.

Device-mode

On newer RouterOS versions ZeroTier is blocked by device-mode, and that is not a setting you flip remotely. The script adds a line as a reminder: you run /system device-mode update zerotier=yes and then have five minutes to press the reset button physically or power the device off and on. Without that the change does not take effect.

That is exactly the kind of thing you discover once you have left the site. Under System there is therefore an advanced switch that puts the parts device-mode blocks into a separate startup script, so they are applied at the next start.

Authorising

A new member does not just join your network. You have to approve it in ZeroTier Central and assign it an address; the tool warns about that while generating. Then look on the router:

/zerotier print
/zerotier interface print

The status should be OK and the interface should have an address.

When WireGuard is the better answer

In most cases we come across, that is: usually. WireGuard is part of RouterOS, needs no extra package, runs on every architecture, and has no third party in the middle. The configurator generates the keys in your browser and gives you a ready-made client configuration per peer.

Pick WireGuard when:

  • your line has a public address, or one side has a fixed address (a VPS or an office line, say) that the other side can dial into;
  • you want to join two locations. See Site-to-site tunnels;
  • you want to see and decide exactly what runs;
  • the device is not ARM or x86.

Pick ZeroTier or Back To Home when:

  • neither side has a reachable address, for example two lines behind CGNAT. See Reaching a changing address;
  • you want a handful of devices on different networks to talk without getting into routing;
  • it is about your own access rather than a network link that has to stay up.

There is a middle road that gets overlooked: one WireGuard tunnel from your router to a small VPS with a fixed address, and everything over that tunnel afterwards. You keep management entirely in your own hands and need nobody else's service to get in. What it costs is a few euros a month and half an hour of setup.

Read on: WireGuard, Remote access VPN and Reaching a changing address.

Want to try it right away? Open the configurator