ZeroTier Alternatives for MSPs: Layer 2 Mesh vs One Tunnel Per Site

ZeroTier is a popular peer-to-peer mesh VPN. Devices join a virtual network with a network ID, and ZeroTier does something most rivals do not: it emulates a Layer 2 Ethernet segment, so joined machines behave as if they share one switch, broadcast and multicast included. Plenty of MSPs have tried it for reaching client sites. But the mesh model that is elegant for a flat network of your own machines runs into friction once you manage many separate client sites, each full of devices that will never run a VPN client.

How ZeroTier Works

ZeroTier combines a peer-to-peer transport (VL1) with an Ethernet emulation layer (VL2). VL1 handles the handshake between nodes and relays traffic when a direct connection is not possible; VL2 handles the virtual network, authorization, and flow rules. Every node that participates runs the ZeroTier One client, available for desktops, servers, phones, routers, and embedded devices. The network controller that admits nodes and pushes rules is hosted by ZeroTier (ZeroTier Central), or you can self-host it.

Where It Falls Short for MSP Remote Access

You can bridge a whole site, but you have to build it. ZeroTier is not strictly one client per device. On an OpenWrt or GL.iNet router you can enable Ethernet bridging and add the ZeroTier interface to the LAN bridge, which puts remote nodes on the same segment as the site's devices. That works, but you are hand-configuring the bridge, managed routes, and flow rules per network, and a wireless client cannot sit in a Layer 2 bridge at all. It is a build, not a setting.

The accessing side still needs the client. Every laptop or phone that reaches the network runs ZeroTier One and has to be authorized onto the network first. For your own engineers that is a one-time install. The sharper problem is everyone who is not a full-time engineer: a client who wants to glance at their own camera feed, or a contractor who needs ten minutes on one PLC. Provisioning a VPN client and a network membership is a lot of ceremony for a short task.

Billing is per device, not per site. ZeroTier's free tier is capped at a small number of devices on a single network (10 devices as of late 2026, down from 25), and paid plans scale by device count. For an MSP that axis is backwards: your cost grows with every node and every engineer you add, not with the number of sites you run. Check ZeroTier's current pricing on its own site before comparing, because the tiers change.

The control plane is US-operated, and there is no session console. ZeroTier, Inc. is a US company based in Irvine, California, and the hosted controller runs as its SaaS. You can self-host the controller, but then it is yours to run. For clients under NIS2 or GDPR, where the control plane sits is a supply-chain question worth raising with your DPO. And once connected, your engineer still opens their own RDP client, VNC viewer, or terminal against the target; nothing records the session.

The Architectural Difference: One Tunnel Per Site

ProxyLink puts the tunnel on the network, not on each device. You run one WireGuard tunnel on the router or firewall at each client site: MikroTik, pfSense, OPNsense, OpenWRT, or a Linux box such as a Raspberry Pi. The router dials out, and the server can then route to any IP on that LAN and on every VLAN you declare, a main network, a camera VLAN, and a PBX VLAN behind a single tunnel. Nothing is installed on the individual devices, and because the connection is outbound, CGNAT and a missing static IP are irrelevant.

From the dashboard, each device gets its own link:

• HTTP and HTTPS proxy links for NVR web UIs, PBX admin panels, switch management, Synology DSM, and UniFi controllers, on any port
• Browser RDP and VNC for Windows and desktop machines, no client software on the laptop
• Browser SSH for Linux servers, MikroTik, and Cisco gear, including enable mode
• TCP and UDP links for raw RTSP camera streams and SIP or RTP voice traffic

The accessing side is just a browser. For one-off or third-party access, a shareable access link opens a single device in a browser with no ProxyLink account at all.

Security and Isolation

ProxyLink runs on open-protocol WireGuard through a single dedicated server in Germany (Hetzner), with no third-party routing in the path. Isolation is enforced at the firewall with per-user and per-team ipsets, so no two client sites can reach each other through the server, on by default rather than assembled with flow rules. The devices stay dark the whole time: no public IP, no open ports, no published endpoints. Paid plans add a per-session audit log and optional session recording per proxy link, which maps onto the access-control evidence a NIS2 audit asks for.

When to Use Which

ZeroTier is a strong fit for a flat mesh of your own machines, Layer 2 apps that need broadcast or multicast, or a homelab where installing a client on every node is no burden. The mismatch appears when you manage many separate client sites full of devices that will never run a VPN client, when the accessing side is a mix of engineers, clients, and contractors, and when you need the session itself, a browser RDP or SSH console, not only the network path to it.

One WireGuard tunnel per client router. Every device on every VLAN reachable from a browser, nothing on the devices, no per-node bill. Try ProxyLink free at app.proxylink.dev, no card required, free during early access. After early access, the MSP plan is 69 euro per month for 300 tunnels and 1,000 links, locked in for life for anyone who signs up now. Setup guides are in the docs. Related: Tailscale for MSPs and Twingate alternatives for MSPs.