ZeroTier

ZeroTier One is the cross-platform client that joins your Mac (and nearly every other OS) to ZeroTier virtual networks. Where classic VPNs hairpin all traffic through a central concentrator, ZeroTier builds encrypted peer-to-peer paths that behave like a global virtual Ethernet switch, Layer 2 semantics, stable virtual MACs/IPs, and controllable bridging for labs and edge devices. As of August 2026 the supported desktop/mobile client line is ZeroTier One 1.16.x (1.16.2 released 20 May 2026), with macOS 10.13+ packages still published on the official download page. The control plane story evolved too: ZeroTier Central has a New Central experience for organizations created after 5 November 2025 alongside Legacy Central for older accounts. Pricing on the platform side is device-based: Personal free (10 devices, 1 network, 1 admin), Essential at $18/month for 10 devices ($2 per extra device), Scale at $179/month for 100 devices ($1.80 per extra device), plus Enterprise and Quantum custom tiers that include post-quantum-oriented options. On a Mac, ZeroTier One appears as a menu-bar app plus a background service. You paste a 16-digit Network ID, authorize the node in Central (or via API/automation), and traffic flows. Advanced users push managed routes, flow rules, and SSO-connected admin workflows on paid tiers. Competitors such as Tailscale, NetBird, and self-hosted Headscale remain the usual comparison set, especially after Tailscale's 2026 seat-pricing changes pushed some homelabs to re-evaluate device-priced meshes. ZeroTier One is actively developed, not discontinued. Choose it when you want Ethernet-like multiprotocol flexibility (including non-IP oddities in some setups), broad IoT/embedded reach, and a client that is thin enough to script. Choose something else when identity-first WireGuard meshes with MagicDNS ergonomics matter more than virtual L2. If you manage Macs, verify the app's Gatekeeper signature and grant Full Disk Access only when a workflow truly needs it. After major macOS upgrades, recheck Login Items and network extension approvals, and keep a known-good installer handy. Judge any networking or productivity tool on your own numbers: cold start, RAM use after an hour, extension or driver stability, and what the price looks like after a year of adding devices. Rely on the vendor docs and GitHub release notes first, pricing pages and download pages are the authority, not roundup posts. Treat chatter on X as a slow signal, pay attention when many people report breakage after an update, ignore single angry threads. For open source dependencies, confirm the project still tags releases, answers issues and ships security fixes, stars are not proof of maintenance. Apple Silicon runs native builds well, but Rosetta-only helpers can still hurt battery during long sessions. Keep your config in dotfiles or MDM, leave auto-updates on, use least privilege and phishing resistant auth where you can, and do not trust random mirrors. For CI, use short-lived joins so headless runners do not quietly inflate your device count toward Essential overage. If you advertise a LAN route from a Mac, mark which machine is the router, two routers fighting creates asymmetric routing. Export your Central network config when your plan allows, rebuilding flow rules from memory is painful. Remember iOS uses VPN profiles while macOS uses system extensions, so train users on both. Finally, price out 25, 50 and 100 devices against Tailscale seats before you standardize.