Wireguard within ZeroTier behind CG-NAT and data consumption

[mickey-mouse]

Hello. This is my first post, so welcome everyone

I am a new user of Brume 3 and Beryl 7.
I have set up the following:

1. ZeroTier on both devices
2. Wireguard server on Brume 3
3. Wireguard client on Beryl 7

I have followed the guide below and everything works quite ok. Meaning, I have a connection from the VPN client to the VPN server. Kudos to goldsteinadj for the guide and most importantly for the screenshots.

Help with ZeroTier routing between GL.iNet devices

I have two devices. I have a Brume 2 plugged into a LAN port on my home router. I have enabled ZeroTier on this device, and WAN port sharing (plugged into router via local WAN). Within the ZeroTier portal, I have a managed route of 0.0.0.0/0 via 10.147.20.167 (Brume 2 device). On my cell phone, I have the ZeroTier app, and when I enable “route all traffic through ZeroTier.”, I successfully show my home IP address on my cell phone. I also have a Beryl AX router for travel purposes, and have conne…

The issue I have is that both VPN clients and VPN server show huge data traffic.
Eg. opening a gmail on a device connected through Beryl 7 produces few GB of data on both sides. Same with opening google.com web site.

Also the connection from VPN client to VPN server drops, when Beryl is tethering from other wifi.

Can someone help me understand these 2 issues, how to troubleshoot is and how can I optimise data usage?

[will.qiu]

Hi

You might want to try Tailscale—it supports custom exit nodes directly in the firmware, so you won’t need to use WireGuard over ZeroTier/Tailscale.

On Brume 3:

How to Configure GL.iNet Router to host Tailscale Exit Node

Background Many GL.iNet routers come with a built-in Tailscale application, bringing the power of this P2P mesh VPN to your fingertips. However, the current official implementation is in the preliminary stages and does not yet expose a UI option to toggle "Exit Node" functionality. Many users want their router to act as an Exit Node (routing all internet traffic from their phone or laptop through their home router). This tutorial demonstrates how to enable this function via SSH, how to preserve…

On Beryl 7:

Custom Exit Nodes - Tailscale - GL.iNet Router Docs 4

[mickey-mouse]

Thanks. I’ve read a lot about Tailscale leaks and performance issues. Same for ZeroTier. Hence I am using Wireguard inside. And I need a good performance (up to 1GB up/down). Thats why I bought these latest toys which I love. Most users report only 5% overhead, so I don’ t think the reason is a tunnel within ZeroTier. I will test Tailscale and come back.

[will.qiu]

However, due to the presence of CGNAT, using Tailscale or ZeroTier is unavoidable.
As a result, related issues—such as potential leaks and performance limitations—cannot be avoided.

On top of that, running WireGuard over ZeroTier or Tailscale introduces additional overhead, effectively reducing device performance by half.

That’s why I recommend using Tailscale directly, without layering WireGuard on top.

[mickey-mouse]

In the end I switched to Asrtowarp. Why is nobody suggesting it!

Thanks everyone and happy nomading!

[will.qiu]

Glad to hear that Astrowarp meets your needs!

[mickey-mouse]

Hello. I used Astrowarp for some time, but data usage is…. too high for my needs and I would go bankrupt

So I reverted back to ZeroTier + Wireguard. But the 150mbps performance was too low for me.

After some exploration of the forum here and the use of AI…. I switched to Tailscale only. Now I have:

• a secure VPN tunnel from beryl to brume
• exit node on brume
• no connection drops
• no DNS leaks (DNS on the beryl side is directed to the DNS on the brume side)
• and decent 300mbps up/down performance (which is the limit of the ISP on both ends)

Lets test it over the next few days….