ZeroTier Exit Node - BerylAX

[jaysbeekay]

Hello,

I have two BerylAX Routers that I am using (one for home and one for Travel). What I would like to be able to do is use my travel router to route all traffic through my home router IP address.

What I have done thus far is:

1. Setup new zerotier network
2. Enable zerotier on both Home and Travel router, joining them to the same ZeroTier Network
3. On Home router, enable ‘Remote Access WAN’
4. Set up a managed route in Zerotier: 0.0.0.0/0 via ZeroTier Managed IP for Home Router

…and this is where I got stuck! Joining the Wi-Fi for the travel router, I get the public IP address of the travel router, not my home router.

Any ideas on how to forward the traffic between travel routers would be appreicated.

[alzhao]

Do you not have public IP at your home?

Why not using a simple client/server setup?

[highgrade]

Why not use wire guard

[goldsteinadj]

See these threads, these two should get you where you want to go. You will likely need to build a “tunnel in a tunnel.” You will want Zerotier to get past your ISP’s CG-NATing and filtering (most home grade internet providers that I know of will NOT let you build a VPN directly, unless you have a business-tier line). Wireguard (over the internal Zerotier IP address) to route traffic and to prevent accidental IP leakage. If you were to rely on Zerotier ONLY, you will need to setup a persistent route in advanced configurations of your travel router, PLUS you might accidentally leak your IP if the persistent route gets flushed, and need to rely on custom scripts. So I STRONGLY recommend the tunnel in a tunnel approach here since it is much more reliable and supportable for 99% of people.

Ensuring Remote Work Privacy: Setting Up VPN for Location Concealment

I don’t think I can disable Bluetooth or gps, since I don’t have admin rights. By Blocking non-VPN traffic you mean the kill switch feature in WireGuard ? Another consideration: when exporting a WireGuard file, the default DNS is set to 64.6.64.6, which I believe is from Germany. when I tested on whoer.net, i can see Germany ip address under dns. To mitigate this, I have replaced the DNS in the WireGuard file with my router’s address, effectively now I have n/a under dns which mean I don’t use…

Help with ZeroTier routing between GL.iNet devices

The T-Mobile Home router does not allow port forwarding. Is that a problem with setting up a wireguard server on the home router? Also I do not know how to export and or import files from the routers. I could use a MacBook Pro to do this? And if yes, can I use Terminal App or do I need other software. You’ve been very generous with your explanations already. Your screenshots are great. Thank you so much.

[jaysbeekay]

Home Router is behind CG-NAT and this would require port forwarding

[jaysbeekay]

I think I may have been able to solve the issue through issuing the following command on my travel router:

sudo zerotier-cli set zerotiernetworkdid allowDefault=1

Still testing to see if this survives a reboot or not!

[goldsteinadj]

Zerotier is used to get around the CG-Nating. Yes, you can enforce a persistent route, however you will likely have long term issues if the network blips, or restarts, or a firmware update etc. That is why I recommend layering Wireguard within Zerotier. The performance hit should be very negligible, plus you have a SUPPORTED way to prevent accidental leakage. And assuming you have a reasonably well paid corporate job, they can and WILL detect “accidental blips” (tools like Zscaler cloud, Netskope, Microsoft Conditional Access etc) and build a case on you and terminate you. Trust me, I have been there. You will want a bulletproof and supported way to ensure that you NEVER leak your IP. “Blocking non-vpn traffic” within the Glinet router with Wireguard will mean you will stay safe, even if you fail over to a tethered connection, or your config gets accidentally wiped, and allows you to stay within a SUPPORTED solution from Glinet.