Strange problem with ZeroTier VPN bypass rule + WDS

glinoob · January 25, 2026, 12:25am

Here’s a puzzler for you:

I’m using ZeroTier on my laptop (not any of my GL.iNet routers) and two servers at home.

I have always-on Wireguard VPNs on my LANs behind GL.iNet devices. The VPNs are just for internet access, I’m not using them to get into my network at home while on the road or anything like that.

I added a VPN bypass rule on my Beryl AX (used with my laptop on the road) and my Slate AX at home. These rules look like the following (screenshot includes a couple adjacent rules for comparison):

All this seems to work mostly fine, although ZeroTier doesn’t seem to bypass the VPN 100% of the time for reasons I don’t fully understand - I think it’s not as deterministic about what source port it uses as Tailscale is, but I’m not sure.

Now, here’s my problem:

When I’m on the road and connect my laptop to a Slate Plus which is connected to my Beryl AX in WDS network mode, the ZeroTier network becomes unstable.

If I set up a continuous ping between my laptop and the servers at home, they will fluctuate between responding to pings, timing out, and showing Host Unreachable replies from my laptop’s ZeroTier IP.

But as soon as I disable that VPN bypass firewall rule on the Beryl AX and only the Beryl AX, the ZeroTier network recovers and the problems stop happening!

What is going on here?

Ideally, I want traffic from ZeroTier (and Tailscale) clients behind my GL.iNet devices to bypass the always-on VPN, because the traffic is already fully secure, and going thru the VPN just adds latency and reduces bandwidth.

Is my VPN bypass rule incomplete? Maybe ZeroTier is sending some other traffic which isn’t covered by that firewall rule, and so some traffic is going thru the VPN and some not?

I’d appreciate it if any of the GLi staff in these forums have some ideas, though I know this is a pretty esoteric problem, and the easy (if unsatisfactory) solution is just to disable the bypass rule and accept the extra latency of having the ZeroTier traffic go thru the VPN. Thanks for any advice anyone has!

will.qiu · January 27, 2026, 6:12am

Hi

Your guess is correct.

ZeroTier doesn’t only use 9993 as the source port (primaryPort); it also uses random secondaryPort and tertiaryPort.

Maybe you could try creating or modifying ZeroTier’s configuration to make it fixed, and then mark it accordingly in the router’s firewall.

github.com/zerotier/ZeroTierOne

service/README.md

dev

ZeroTier One Network Virtualization Service
======

This is the actual implementation of ZeroTier One, a service providing connectivity to ZeroTier virtual networks for desktops, laptops, servers, VMs, etc. (Mobile versions for iOS and Android have their own implementations in native Java and Objective C that leverage only the ZeroTier core engine.)

### Local Configuration File

A file called `local.conf` in the ZeroTier [home](https://github.com/zerotier/ZeroTierOne/blob/6faca86bb424d0b9643b6efa50571f73310d8276/README.md) folder contains configuration options that apply to the local node. (It does not exist unless you create it). It can be used to set up trusted paths, blacklist physical paths, set up physical path hints for certain nodes, and define trusted upstream devices (federated roots). In a large deployment it can be deployed using a tool like Puppet, Chef, SaltStack, etc. to set a uniform configuration across systems.

It's a JSON format file that can also be edited and rewritten by ZeroTier One itself, so ensure that proper JSON formatting is used. To validate your config, paste it into a website like [jsonlint.com](https://jsonlint.com), or use a tool like `jq`. 

Check the output of `zerotier-cli info -j` to see if your configuration is being loaded.

Settings available in `local.conf` (this is not valid JSON, and JSON does not allow comments):

```javascript
{
	"physical": { /* Settings that apply to physical L2/L3 network paths. */
		"NETWORK/bits": { /* Network e.g. 10.0.0.0/24 or fd00::/32 */
			"blacklist": true|false, /* If true, blacklist this path for all ZeroTier traffic */

This file has been truncated. show original

system · May 13, 2026, 11:01am

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.