RouterOS ZeroTier

RouterOS uses /zerotier instances and interfaces rather than the Linux zerotier-cli. This skill covers the native package and its controller role. The original lab used arm64 CHR 7.25; its reported results and the limits of that evidence are recorded in Grounding.[^lab]

Package and device-mode

• Install the zerotier extra package matching the router's version and architecture, then reboot. See Extra packages.[^docs]
• The native package supports ARM/ARM64. For a CHR lab, use arm64: the official 7.25 arm64 archive contains zerotier-7.25-arm64.npk; the x86 archive has no ZeroTier package. This distinction was independently rechecked during review.[^packages]
• Check /system/device-mode/print for zerotier: yes before configuring it. If blocked, follow the device-mode procedure, including any required physical confirmation.[^docs]

Instance, interface, and peer

Enable the default instance before joining a network:[^docs]

/zerotier/enable [find where name="zt1"]
/zerotier/print

• /zerotier is the local node instance. Its 10-digit hexadecimal ZeroTier address is the prefix of its public identity; use that address to identify the member in Central. It is not the interface MAC address. Treat the full identity as sensitive; do not publish private identity material.[^cli]
• /zerotier/interface has one interface per network membership. Each network acts as a virtual Ethernet segment; the interface can be routed or bridged.[^docs]
• /zerotier/peer shows known peers, roles such as LEAF/PLANET, and tunnel paths. Check recvd/sent ages as well as active; a listed path alone does not establish current end-to-end reachability.[^peer]
• /zerotier/controller hosts a network on RouterOS. It manages membership and configuration; it does not replace the root-server infrastructure.[^docs]

Join and authorize

Replace the synthetic network ID below with your controller's 16-digit ID. Private networks require authorization at their controller; public networks allow joining without that approval.[^docs]

/zerotier/interface/add network=0123456789abcdef instance=zt1 name=zt-example
/zerotier/interface/print

For a private network, identify the joining instance's ZeroTier address, then:

• Central-hosted: authorize the member in the owning Central console or matching API. See Central accounts and API.
• RouterOS-hosted: authorize it on the controller router under /zerotier/controller/member. See RouterOS controller.

Re-read the interface until it reports OK. Check /ip/address and /ip/route when managed addressing/routing is configured and permitted by the client; authorized membership alone does not guarantee an assigned IP.[^docs][^lab]

The 7.25 lab reported these statuses; they are diagnostic leads, not a complete status enumeration:[^lab]

Status	Interpretation
OK	Network configuration accepted; separately verify addressing and traffic
ACCESS_DENIED	Controller denied membership; check private-network authorization
NOT_FOUND	Network not found; verify the ID and controller before inferring a cause
REQUESTING_CONFIGURATION	Awaiting configuration; seen during rejoin

A malformed network ID was rejected at add time with network id not valid.[^lab]

Managed addresses and routes

These gates belong to /zerotier/interface, not controller member rows:[^cli]

Setting	Effect
allow-managed=yes	Accept controller-managed addresses and routes
allow-global=yes	Also permit managed addresses/routes in public IP space
allow-default=yes	Permit a controller-managed default route

Choose the gates deliberately; allowing managed routes does not itself grant permission to replace the default route. Do not translate desktop DNS settings into an invented RouterOS flag: the documented interface properties expose no allow-dns equivalent.[^cli]

With managed configuration enabled, RouterOS can install addresses and routes automatically. Inspect the resulting route table before adding statics. Site-to-site access also needs forwarding permission and a return path; other LAN routers may need routes through the ZeroTier router.[^docs]

In the 7.25 lab, allow-managed=no removed managed configuration while the interface stayed OK. Restoring yes did not restore it within two minutes; a disable/enable cycle did. This is a versioned observation, not a guaranteed recovery time or a reason to bounce a production interface immediately.[^lab]

Firewall and service integration

Check transport traffic and overlay traffic separately. UDP 9993 is the default instance port, but ZeroTier also uses high ports and peers may listen on any UDP port. Permit outbound UDP and the corresponding return traffic through stateful firewall/NAT rules; a 9993-only peer policy can prevent direct paths.[^docs]

For traffic arriving on zt-example, review the existing input/forward rules. Prefer explicit access for the required services and destination subnets. If every member is trusted as LAN, and the existing rules use the LAN interface list for that policy, membership can integrate the interface:[^firewall]

/interface/list/member/add list=LAN interface=zt-example

This grants the access defined by that list; it is not suitable for an untrusted or shared overlay. The manual's blanket input/forward accept examples are permissive alternatives, not prerequisites for every installation.[^docs]

Also review these independent controls:[^services]

• /ip/service allowed addresses for IP management services.
• /ip/neighbor/discovery-settings and its discovery interface list.
• /tool/mac-server and /tool/mac-server/mac-winbox allowed interface lists. Do not assume factory defaults; Layer 2 management is not protected by the IP input firewall.

Flow rules, RoMON, and bridging

ZeroTier flow rules add distributed, stateless filtering. A ruleset that admits only IPv4, IPv6, and ARP blocks RoMON (0x88bf) and VLAN-tagged frames (0x8100). That is a common ruleset on Legacy Central. New Central documents flow rules as disabled initially, with all traffic allowed; enabling its Layer 2 Protocol Filter restricts Ethernet types. Inspect the actual network policy before assuming which Ethernet types pass.[^rules]

RoMON can extend management through ZeroTier and onward through explicitly permitted RoMON ports. Restrict its default all port policy before enabling it; adding a ZeroTier port alone does not restrict the wildcard. RoMON is a Layer 2 protocol, so IP firewall accept rules do not enable or contain it.[^romon]

See Flow rules, RoMON, and bridging for separate rule-language and RouterOS examples, member settings, and address pool planning.

Common mistakes

Mistake	Correct approach
Run zerotier-cli join on RouterOS	Enable an instance, then add /zerotier/interface
Treat every join as requiring Central	Private networks authorize at their owning controller; RouterOS can host it
Match a Central member by interface MAC	Match the instance's 10-digit ZeroTier address
Add static routes before checking managed routes	Inspect /ip/route and the client gates first
Assume all CHR architectures have the package	Use arm64 for the verified 7.25 lab path[^packages]
Treat managed IP assignment as DHCP	ZeroTier controller assignment is separate; a bridge can still carry DHCP
Enable RoMON, then add one allowed port	Set the wildcard policy and review explicit ports before enabling RoMON

Additional resources

• Grounding and version notes
• RouterOS controller
• Central accounts and API
• Flow rules, RoMON, and bridging
• routeros-centrs — validated device operations
• routeros-quickchr — disposable CHR labs
• routeros-container — container deployment when investigating upstream ZeroTier
• routeros-firewall — interface lists and rule ordering

[^lab]: Grounding distinguishes the original issue's lab reports from this review's independent checks. [^docs]: MikroTik ZeroTier manual. [^packages]: Official 7.25 arm64 archive and x86 archive; see Grounding. [^cli]: MikroTik CLI references: instance, interface, member. [^peer]: MikroTik peer reference; path-age caveat from Amm0's community guide, not an independent live-path test here. [^firewall]: RouterOS firewall skill. [^services]: MikroTik IP services, Neighbor discovery, and MAC server. [^rules]: ZeroTier Rules Engine. [^romon]: MikroTik RoMON.