Looking for a ZeroTier alternative? QS-WAN drops the emulated LAN and has you build segments instead: VLANs and LANs on the gateway that serves them, each reserving its address range, with directional edges between them. Move for that shape plus policy and endpoint control. Stay if you need layer 2.
ZeroTier calls itself “a smart programmable Ethernet switch for planet Earth”. It pairs a peer to peer layer, VL1, with VL2, which its docs describe as “a VXLAN-like network virtualization protocol with SDN management features”. Shorter, from their own site: it “connects your devices like they’re on the same local network”.
Machines in four buildings, three clouds and somebody’s garage, all behaving as if they shared a switch, is the problem it was built for, and it solves that well.
Topology is free-form, and a device joins by network ID. There is nothing to lay out before it works.
One global rule set, enforced “by both the senders and the receivers of packets”, which their docs call micro-segmentation.
ZeroTier starts with one emulated Ethernet network and narrows it. QS-WAN starts with nothing connected.
Everyone admitted is on the same segment, and what they reach is trimmed by a global rule set capped at 1024 entries. Direction is a match condition inside that list.
The diagram compares two ways of expressing what may reach what. In the first, a finance server, a build agent, a laptop and an office local network all sit inside one emulated network and reach each other directly, and beside them one base rule set applies to all traffic, holds up to 1024 entries, is checked by sender and receiver, and treats direction as a match condition. Nothing has to be drawn before it works. In the second, the same machines sit in separate segments, each reserving its address range as it is created, on a gateway that serves them. A path exists only where an edge has been drawn: one edge points one way from a segment to a local network, one edge runs both ways between two segments, and one pair has no edge at all, so there is no path between them. Drawing every path that exists is the work this architecture asks of you. The diagram compares how reachability is expressed and says nothing about how traffic moves between machines.
Segments are objects: create VLANs and LANs in the console, on the gateway that serves them, and each reserves its address range as it’s created, so two can’t claim the same one. Then you draw the edges: a VLAN to LAN edge is one way by construction, with SNAT as a per-edge option, and a VLAN to VLAN edge is symmetric, so both directions open at once.
One way by construction, not by configuration. It isn’t a direction field somebody can invert at five on a Friday. Every segment and edge sits on the network map, clicking an edge changes it, and firewall rules hang off each segment. Microsegmentation has the mechanism.
The documented ZeroTier path is to pick a member, tick Allow Bridging and Do Not Auto Assign, delete the default managed route and add one for the real subnet. Their page even warns that “sometimes, iptables rules apply”. In QS-WAN, adjacent LANs are discovered gateway-side and connected with an edge that already has a direction. That’s the infrastructure integration path, and nothing gets re-addressed.
One model reads the answer out of an ordered list. The other draws it.
ZeroTier is a networking product. Read this as scope, not scoreboard.
Key exchange is the hybrid pair X25519 and ML-KEM-768, authentication is ML-DSA-87, the cipher is AES-256-GCM.
Eight key exchange options, eight certificate authority options and three ciphers are selectable fleet-wide or per gateway, with certificates reissued and redistributed on their own, which is crypto agility.
QNova Client carries the tunnel, endpoint protection with EDR, remote support accepted per session, a password vault and encrypted file transfer.
On-premise, private cloud or air-gapped, carrying a signed policy of 16 rules scoped per gateway, user or device, and nine compliance frameworks scored.
Self-hosting isn't the difference, since their docs describe running your own controller too. What differs is what it carries.
Nobody of ours watches your traffic: it's a product, not a managed service.
A gateway goes in at the site that has the machines, adjacent LANs are discovered gateway-side, and switches, servers and cabling stay where they are.
You create the VLANs, each reserves its range, and you draw the edges. Then the agent goes out: install, sign in, one button.
Your rule set doesn’t convert. An ordered list over one flat space isn’t a set of segments and edges, so somebody decides the topology those rules stood in for. Addressing gets replanned, layer 2 adjacency needs another answer, and rotating the certificate authority is a scheduled job needing every gateway connected.
VL2 emulates Ethernet, and QS-WAN gives you routed segments and directional edges. If an application needs broadcast or multicast discovery on one segment, ZeroTier is the product for that.
VL1 is peer to peer. QS-WAN is built around gateways you run, and every edge runs between segments on them. If no box of yours belongs in the path, we’re the wrong shape.
Free-form topology with no compliance obligation attached is what ZeroTier was built for. A console for policy and audit is overhead for nothing.
Much of the argument here is one agent instead of several. If you like the tools you have, it isn’t for you.
The agent is complete on Windows, covered on macOS and on Android, and a genuine port with declared gaps on Linux. iOS comes next, and until it ships there’s no decision to make.
No. ZeroTier emulates one Ethernet network and narrows it with rules. QS-WAN has you build segments on a gateway and draw directional edges between them. Different topology, not a new console on the old one.
No. You get routed segments with reserved ranges and edges between them. If two machines must share one Ethernet segment and see each other's broadcasts, stay put.
Yes, and your data doesn't cross a cloud of ours. That's no point against ZeroTier, whose docs describe running your own controller too.
Not on that edge. A VLAN to LAN edge is one way by construction. The symmetric case is VLAN to VLAN, which opens both ways at once.
Tell us how it’s laid out and which two groups shouldn’t be talking to each other, and we’ll draw the segments and the edges on your layout, free, with nothing to sign, and if you should stay put you’ll hear that on the call.
