I really like ZeroTier, but the nail in the coffin for me has been that there is no ability to self host a controller, while also using the management web GUI.
Their sales team, when I asked about self-hosing a controller, said it's not necessary because they've never had all the hosted controllers go down, but when I asked about a tweet they sent in May 2020 about their controllers being down, I never got a reply. [1]
My plan was to put ZeroTier on all of our machines and use it as an overlay network that all traffic goes over. But I don't want to open the availability of our network to depending on an external service.
I've all but decided on Nebula, just need to get the deployment worked out. I'm playing with Tailscale right now, and am very impressed. It does have the ability to require MFA on logins that we would like for user VPNs, while still being able to have servers self-authenticate (we respin half of our dev/stg environment every night).
Can't speak for the parent commentator, but I gave zerotier a try and ended up dumping it mostly because it was unusably slow on single core Linux VMs, making it not a viable option for connecting lower tier cloud VM options. I believe this is on the list of things they're fixing with their next major version, but that version has been very slow in coming out.
i can't say about that specific thing but i've been using this daily 24x7 for the last 2 years now. it connects my 20+ pcs and laptops which are geographically apart but because of zerotier, they are in a local lan.
it does not have SSO, relying on the admin accepting/rejecting connected devices by a single checkbox.
this is in comparison to tailscale which uses Oath, meaning you have to create and maintain those accounts as well.
