下载zerotier

curl -s https://install.zerotier.com | sudo bash

加入网络

sudo zerotier-cli join $NETWORK_ID

查看已加入网络信息：

sudo zerotier-cli listnetworks

开启ip转发（用于访问局域网其他机器）

永久开启：

vim /etc/sysctl.conf
## 加入如下内容：
net.ipv4.ip_forward = 1

临时开启：

sudo sysctl -w net.ipv4.ip_forward=1

配置防火墙

iptables

PHY_IFACE=eth0; ZT_IFACE=zt7nnig26
sudo iptables -t nat -A POSTROUTING -o $PHY_IFACE -j MASQUERADE
sudo iptables -A FORWARD -i $PHY_IFACE -o $ZT_IFACE -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i $ZT_IFACE -o $PHY_IFACE -j ACCEPT

firewalld

firewall-cmd --add-masquerade --permanent
systemctl restart firewalld.service

nftables

vim /etc/nftables.conf
## 配置ip表的postrouting链为如下内容（$PHY_IFACE替换成物理网卡名，$ZT_IFACE替换成ZEROTIER网卡名）
table ip nat {
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        oifname $PHY_IFACE masquerade
    }
}
## 如果存在其他ip表或者inet表，需要关注forward链（开放允许ct state和ZT->PHY网卡转发）
table inet filter {
    chain forward {
        type filter hook forward priority 0; policy drop;
        ct state vmap { established : accept, related : accept, invalid : drop }
        iifname $ZT_IFACE oifname $PHY_IFACE accept
    }
}