Articles on: Guides

Layer 2 Bridge

[](/)
Guides
Advanced Networking
Layer 2 Bridge

On this page

Do you have devices that can't run ZeroTier that you want to access remotely? You can use a small Linux PC as a bridge between ZeroTier and physical networks.

Note

This topic is related to but different from using ZeroTier as a Layer 5 Service Proxy.



You're doing this on your home network and can log in to your router and find the DHCP settings.
You have a keyboard, monitor, and ethernet cable plugged into your Pi. Chances are high we'll break networking and lose access to the Pi.
You're somewhat familiar with the command line and ssh.
We're going to use systemd networking for this. You could probably adapt the concepts to a different Linux network configuration system if you have opinions about systemd.
We used a Raspberry Pi 2 while writing this, but a Pi 3 or 4 should work fine. Anything running a Debian 10+ based distro should be fine. It doesn't have to be a Raspberry Pi, but some of these instructions might be Raspbian specific.



Physical LAN Subnet
Physical LAN DHCP Range
ZeroTier Auto-Assign Range
Default Gateway IP Address (the router)
Bridge IP Address (will be statically assigned)
Create a new ZeroTier network and get the ID. Keep an old network around for secondary way to connect any devices already using ZeroTier.
The DHCP range and ZeroTier Auto-Assign range should be in the same subnet, but not overlap. You'd probably base this off what is already configured on your router.







Install Raspbian OS
Enable SSH



It's easier to login via ssh now and copy/paste commands from the comfort of your own PC.

The DNS name might just work for you:

ssh pi@raspberrypi.local Or ssh pi@<ip-address-of-pi>



sudo apt update && sudo apt -y full-upgrade && sudo reboot


Log back in after it's done



https://www.ZeroTier.com/download/

curl -s https://install.zerotier.com | sudo bash




NETWORK_ID=BR_IF="br0"BR_ADDR=GW_ADDR=




sudo zerotier-cli join $NETWORK_ID


We don't want ZeroTier to manage addresses or routes on $ZT_IF. We're doing it statically below, on the bridge interface.

sudo zerotier-cli set $NETWORK_ID allowManaged=0


Set one more variable

ZT_IF=


Copy the dev name from the listnetworks output for $ZT_IF. It will be something like: zt3jvirser



Go to the Members section of the Network
Open the Wrench Icon for advanced settings and check
Check Allow Bridging
Check Do Not Auto Assign
Authorize the member



Remove existing network stuff

sudo apt remove --purge --auto-remove dhcpcd5 fake-hwclock ifupdown isc-dhcp-client isc-dhcp-common openresolv


Enable systemd-networkd

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf;sudo systemctl enable systemd-networkd;sudo systemctl enable systemd-resolved;sudo systemctl enable systemd-timesyncd;


Configure interfaces

sudo zerotier-cli set $NETWORK_ID allowManaged=0


Write Network Configuration files. Puts ethernet and zerotier into the bridge and configures the bridge with a static IP. See below for DHCP configuration on the bridge.

cat << EOF | sudo tee /etc/systemd/network/25-bridge-br0.network[Match]Name=$BR_IF[Network]Address=$BR_ADDRGateway=$GW_ADDRDNS=1.1.1.1EOFcat << EOF | sudo tee /etc/systemd/network/br0.netdev[NetDev]Name=$BR_IFKind=bridgeEOFcat << EOF | sudo tee /etc/systemd/network/25-bridge-br0-zt.network[Match]Name=$ZT_IF[Network]Bridge=$BR_IFEOFcat << EOF | sudo tee /etc/systemd/network/25-bridge-br0-en.network[Match]Name=eth0 # might be en*[Network]Bridge=$BR_IFEOF


Review configuration

tail -n+0 /etc/systemd/network/*


If needed, edit the files with the editor of your preference.

If it looks good:

sudo reboot


You should be able to, from the physical LAN, connect to the Pi via $BR_ADDR



Sometimes the physical interface turns out to be a long "predictable interface name" like: "enb827eb0d4176", sometimes it's just eth0, depending on Raspbian version(???).

https://wiki.debian.org/NetworkConfiguration#Network_Interface_Names

Hook up a keyboard and monitor and check with ip addr then edit /etc/systemd/network/25-bridge-br0-en.network to match.



At `my.zerotier.com/network/$NETWORK_ID`->`Settings`->`Advanced`

Delete the default Managed Route. Add the new Managed Route $ZT_ROUTE
Change IPV4 Auto-Assign to Advanced
Remove existing Pool. Create new Pool with start and end from $ZT_POOL
For documentation purposes, assign $BR_ADDR to the ZeroTier bridge member

It should be working now.



Either it worked, and you can ssh back in to $BR_ADDR after a minute, or it didn't work and the Pi isn't on the network anymore and you need to use the keyboard and monitor to figure out what went wrong.

tip

Make a backup of the sd card so you don't have to repeat these steps



Configure bridge with DHCP

cat << EOF | sudo tee /etc/systemd/network/25-bridge-br0.network[Match]Name=$BR_IF[Network]DHCP=yesEOF






Sometimes, iptables rules apply: echo "0" > /proc/sys/net/bridge/bridge-nf-call-iptables or iptables -A FORWARD -p all -i br0 -j ACCEPT

See: https://serverfault.com/questions/162366/iptables-bridge-and-forward-chain



Say you have a laptop that is on the ZeroTier network and you bring it home. Now its WiFi address and ZeroTier address are in the same subnet. Which interface/address should your laptop use for internet access? https://en.wikipedia.org/wiki/Longest_prefix_match



Unfortunately the iOS and Android VPN APIs won't let ZeroTier use multicast/broadcast. These are typically how apps auto-discover services on the LAN. 😭 Stay tuned for an article on bridging a ZeroTier network and a WiFi access point.



https://systemd.network/systemd.network.html
https://hackaday.io/project/162164/instructions

Updated on: 12/07/2024

Was this article helpful?

Share your feedback

Cancel

Thank you!