TCP fallback for ZeroTier nodes. Written for fun in Rust :)

By default, ZeroTier node uses global-anycast-core-svc.zerotier.com. If you want to use your own server, you have to compile zerotier-one from source. Also, there was (until version 1.2.6) a tcp proxy server in the official repository, you can compile and run it.

+----+     +----+     +----+
| N1 |     | N2 |     | N3 |
+----+     +----+     +----+
  ^           ^          ^
  |           |          |
  --------    |   --------
         | UDP|   |
         v    v   v
        +-----------+
        | TCP proxy |
        +-----------+
              ^
              |   Firewall:
              |   TCP/443 only
--------------|---------------
              v
          +-------+
          |  you  |
          +-------+

This repository provides an alternative TCP proxy server.

In case when ZeroTier node can't become online using UDP protocol (for example if it's firewalled), it's trying to use a TCP relay as a fallback. It connects to a proxy server and sends specific packets imitating TLS frames:

[TSL frame header; ...; IP; Port; Data ...]

Proxy server parses the packets and sends them to recipients using UDP. When it receives answers, it sends them back to the client.

Packet structure

You can use the server in a Docker container:

docker run -d --name zt-tcp-relay -p 0.0.0.0:443:443 akhmetov/zerotier-tcp-relay

Build docker container:

docker build . -f Dockerfile -t zerotier-tcp-relay

Build the server and run:

cargo build --release

./target/release/zt-tcp-relay 0.0.0.0:443

You can specify logging level with RUST_LOG environment variable:

RUST_LOG=info cargo run

Log level debug is descreases performance and produces a lot of messages.

Run tests

cargo test