Documentation
A ZeroTier alternative: the post-quantum QUIC mesh
ZeroTier holds a singular place among mesh VPNs: it is one of the few to build a true L2 Ethernet bridge, and if that is precisely what you need, it remains better placed than VIGIL-MESH. This page lays its cards on the table: what ZeroTier does very well, where the VIGIL-MESH approach differs structurally — a standard QUIC/TLS 1.3 transport, post-quantum encryption by default, a node in the browser, self-hostable blind relays — and how to evaluate the alternative without breaking anything, since both overlays can coexist.
What ZeroTier does very well
Let’s start with complete honesty: on the Ethernet layer, ZeroTier goes further than VIGIL-MESH, and that is no small detail. If one of the points below sits at the heart of your need, ZeroTier is probably the right choice.
- A true L2 Ethernet bridge. ZeroTier builds a virtual network that behaves like a single physical switch, down to the frame level. VIGIL-MESH remains an L3 overlay with “L2-like” broadcast: it does not claim to do L2 Ethernet.
- Non-IP protocols. Because it carries Ethernet frames, ZeroTier can transport non-IP protocols — certain industrial or legacy protocols — that the IP core of VIGIL-MESH does not support.
- Broadcast and multicast over L2. Broadcast traffic crosses a ZeroTier network as it would a physical segment, carried by its Ethernet bridge.
- A self-hostable controller. ZeroTier offers a controller you can host yourself to manage the allocation of your networks.
- The mesh fundamentals. Peer-to-peer connections, centralized device management, routes to a remote LAN, zero inbound ports: on these criteria, ZeroTier and VIGIL-MESH do the same job.
Where the approach differs structurally
The question is not “who does more” but “on which foundations”. ZeroTier built its own protocol and its Ethernet emulation; VIGIL-MESH makes the opposite bet: an L3 overlay resting on standard building blocks, with encrypted broadcast rebuilt on top.
- QUIC/TLS 1.3 rather than a homegrown protocol. Every VIGIL-MESH session is an end-to-end QUIC/TLS 1.3 connection over Ed25519 identities — the standardized transport that powers HTTP/3. ZeroTier relies on its own protocol, designed for its L2 emulation: a coherent choice, but one that lives outside the TLS standards.
- Post-quantum by default. The key exchange of every session is an X25519 + ML-KEM768 hybrid, present by design, not as an option. According to its public documentation, ZeroTier does not offer native post-quantum encryption today.
- Encrypted IP broadcast and multicast, without an L2 bridge. VIGIL-MESH treats every network as a broadcast domain and replicates IP broadcast, multicast and link-local across its L3 overlay, encrypted end to end with rotating sender keys. mDNS, SSDP, WS-Discovery, LAN games: most of what motivates an L2 bridge is covered — without stretching an Ethernet domain across the Internet.
- A node in the browser. VIGIL-MESH compiles its core to WASM: a browser tab becomes a member of the mesh, with an SSH terminal and an RDP desktop to your machines through the console — no client to install on the machine you happen to be using.
- Blind, self-hostable relays — and 443 UDP. When the direct path is not yet established, traffic goes through a structurally blind vigie that you can host yourself; the session then migrates seamlessly to the direct path. And all traffic is QUIC on port 443 over UDP, the same profile as HTTP/3 — an asset on locked-down networks.
The profiles for whom the question arises
The right criterion is simple: do you actually need Ethernet frames, or only IP discovery and broadcast? If you recognize yourself below, the alternative deserves a trial; otherwise, ZeroTier’s L2 remains a valid argument.
IP discovery without an L2 bridge
You use L2 mostly for mDNS, SSDP/UPnP or WS-Discovery? VIGIL-MESH replicates that IP broadcast encrypted over an L3 overlay: discovery works, without stretching an Ethernet domain between sites.
Locked-down networks and mobility
A single outbound flow, 443 over UDP, zero inbound ports, zero router configuration — and a session that migrates seamlessly from relay to direct path when the network changes.
Access from any machine
The WASM browser node opens an SSH terminal or an RDP desktop to your machines from a simple tab, through the console — handy when installing a client is not an option.
Long-term cryptographic requirements
End-to-end QUIC/TLS 1.3 sessions, Ed25519 identities, post-quantum X25519 + ML-KEM hybrid on every session: an answer by design to the “harvest now, decrypt later” risk.
Control over the relayed path
The private vigie is a relay dedicated to your workspace, self-configured and structurally blind: relayed traffic goes through your infrastructure, never through shared infrastructure you do not control.
Coexistence: evaluate without breaking anything
VIGIL-MESH and ZeroTier are two independent overlays, each with its own interface and its own addresses (VIGIL-MESH assigns stable addresses in 100.64.0.0/10). Nothing stops you from running them side by side while you check, use case by use case, what the L3 overlay covers for you.
- 1Connect two machinesCreate a workspace, install the client (Windows, Linux, Android, Jetson — or a browser tab) and enroll two machines. Your ZeroTier network keeps working as before.
- 2Test what depends on L2 firstList what relies on the Ethernet bridge today: mDNS or SSDP discovery, application multicast, any non-IP protocols. Check which ones run over VIGIL-MESH’s encrypted IP broadcast — non-IP frames, for their part, will remain ZeroTier territory.
- 3Switch service by serviceMove one use case at a time, keeping the other network as a safety net. Deploy a private vigie if you want to host the relay.
- 4Decide with full knowledgeDecommission the old network once everything has moved — or keep both: if a use case requires a true L2 bridge, it can perfectly well stay on ZeroTier.