MuskeTier is a modern, secure web dashboard for managing ZeroTier VPN networks. It provides enterprise-grade tools for monitoring members, configuring network settings, managing DNS, and controlling VPN access.

Is MuskeTier free to use?

Yes, MuskeTier is completely free and open source. It requires a ZeroTier Central account and API token to function.

What are the system requirements?

MuskeTier works in modern web browsers that support ES2020 features. It requires no installation and runs entirely in the browser.

Yes, MuskeTier implements multiple layers of security including Content Security Policy, HTML sanitization, rate limiting, CSRF protection, and enterprise-grade input validation.

MuskeTier - ZeroTier VPN Network Management Dashboard

Adds a node before it joins (can also undelete a member).

	Status	Name	Notes	Node ID / IP	Managed IPs	Last Seen	Version	OS	Actions

0 members Rows per page

Address Assignment

Control IPv4 and IPv6 pools handed to members.

IPv4 auto-assign

Auto-assign members IPs from this pool. Click a preset or define a custom range.

IPv6 auto-assign

Use custom RFC4193 pool or toggle built-in ZeroTier/6PLANE modes.

Managed Routes

Push network-level routes to inform clients where to find downstream networks.

0 routes

Routes are advertised to authorized members. Leave “Via” empty for local egress.

Central Status

Overview of the ZeroTier Central account linked to the saved API token.

Display name—

Email—

User ID—

Organization—

Token—

Permissions—

Read-only mode—

Clock—

Uptime—

Fetch a token-enabled status update to populate account details.

Diagnostics

Snapshot of the current session. Values refresh whenever data loads or settings change.

API Base—

Network—

Mode—

Theme—

Members0

Last Sync—

API Credentials

Manage the token used for authenticated calls to ZeroTier Central.

ZeroTier API Token

Stored per network in localStorage. Tokens are never sent unless you save.

Import / Export

Backup your current configuration or stage a snapshot for review.

Import JSON

Exports current config & visible members. Import stages data — review changes and apply them inline.

Use an Apache proxy at /ztapi for CORS-safe live calls.

ProxyPass        /ztapi/ https://api.zerotier.com/api/v1/
ProxyPassReverse /ztapi/ https://api.zerotier.com/api/v1/

Members Help

Members: When a node joins a ZeroTier network, we call it a member.
Auth?: When a member is authorized, it's allowed to talk to other members of the network. If you don't have an Auth column, your network is set to public access. See the Settings section of this network.
Address: A ZeroTier Node's Address. This is the node's unique ZeroTier ID.
Name and Description: You can put whatever you like here. It is hard to remember node IDs, so names help you remember which device is which. If you use a DNS tool with your network, like zeronsd, you may want to use valid hostnames for your member names. Something like "bob-laptop" or "sql-server-01"
Managed IPs: These are the IP addresses you use when you use ZeroTier. Typically Easy Auto-Assign is enabled and you do not need to change anything. You can set Managed IPs manually if you like.
Last Seen: The last time this member checked in with the network controller for this network.
Physical IP: The physical IP address the member is connecting to the controller. It is Probably the IP address of your internet router/modem.
Delete: If you never want to see a node in this member list again, you can delete it. If you deleted a member and decide you want it back, you can use the "manually add member" form.
Hide: This deauthorizes and hides the member from the list. You can select the "hidden" checkbox to show hidden members.

Settings Help

Network ID: The network's globally unique 16-digit ID. This cannot currently be changed.
Name: A user-defined short name for this network that is visible to members. We recommend using something like a domain name (e.g. zerotier.com) or e-mail address.
Description: A longer description of this network.
Access Control: How is membership controlled? This should be left on its default Certificate setting unless you want to create a totally open network for testing, gaming, etc.
Multicast Recipient Limit: The maximum number of recipients that can receive an Ethernet multicast or broadcast. If the number of recipients exceeds this limit, a random subset will receive the announcement. Setting this higher makes multicasts more reliable on large networks at the expense of bandwidth. Setting to 0 disables multicast, but be aware that only IPv6 with NDP emulation (RFC4193 or 6PLANE addressing modes) or other unicast-only protocols will work without multicast.
Managed Routes: IPv4 and IPv6 routes to be published to network members. This can be used to create routes to other networks via gateways on a ZeroTier network. Note that for security reasons most clients will not use default routes or routes that overlap with public IP address space unless this is specifically allowed by the user. Public IP ranges are marked with an icon.
IPv4 Auto-Assign: IPv4 range from which to auto-assign IPs. Note that IPs will only be assigned if they also fall within a defined route. Easy mode allows users to pick an IP range and a route and pool definition will automatically be created.
IPv6 Auto-Assign: IPv6 addresses can be automatically assigned with the RFC4193 or 6PLANE addressing schemes, or from a user-defined IPv6 range.
IPv6 Auto-Assign Details: RFC4193 assigns each device a single IPv6 /128 address computed from the network ID and device address, and uses NDP emulation to make these addresses instantly resolvable without multicast.
IPv6 Auto-Assign Details: 6PLANE assigns each device a single IPv6 address within a fully routable /80 block and uses NDP emulation to “magically” route the entire /80 to its owner, allowing each device to assign up to 2^48 IPs without additional configuration. This is designed for use with Docker or on VM hosts.
IPv6 Auto-Assign Details: Range assigns each device an IP from a user-defined IPv6 range. An example might look like: “2001:abcd:ef00::” to “2001:abcd:ef00:ffff:ffff:ffff:ffff:ffff”.
DNS Push: Requires ZeroTier version 1.6. Older versions of ZeroTier will ignore these settings.
DNS Push Details: On macOS, iOS, Windows, and Android, ZeroTier can automatically add DNS servers for a specific domain. It does not set up or host a DNS server. You must host your own.
DNS Push Example: If you configure zt.example.com as your search domain, and 10.147.20.1 as a server address, then your computer will ask 10.147.20.1 to look up IP addresses for hostnames ending in zt.example.com.
DNS Push Enablement: This must be enabled on each client with the allowDNS option. There is a checkbox in the UI in each network's details, near the Allow Managed checkbox.