Clients take "ages" in "REQUESTING_CONFIGURATION" and to come up online / ZTNET as "official moon" setup

[jcnissen79]

Hello,

i used official ZeroTier some years, now i found this promising project on github and startetd over installing ZTNET on a VPS with Docker.

I run it as "official moon" because i assumed it is more reliable if i rely on the official ZeroTier planets.
I created 3 networks and joined the clients (Windows / ZT v1.14.2) to them.

Now i am experiencing, that the clients take really long in status "REQUESTING_CONFIGURATION". It takes 5 to 90 minutes! I had clients where it took 10h.
Same problem if a client was offline for a few days and than boots up, the ZeroTier Service is running, the status is "OK" but i cant see the client online on the ZTNET Controller. The clients also cant connect to other peers like RDP Servers.

Checking on the client with zerotier-cli peers command shows, that the client is directly connected to the officail servers starting with "cafe..."

But the self-hosted controller is often not connected, or starts in relay state.

The firewall rules on the VPS are "generated" like this:

# Generated by iptables-save v1.8.10 (nf_tables) on Mon Aug  4 07:24:09 2025
*raw
:PREROUTING ACCEPT [52656077:9717477459]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -d 172.18.0.2/32 ! -i br-7e0535f5xxxx -p tcp -m tcp --dport 9443 -j DROP
-A PREROUTING -d 172.31.255.3/32 ! -i br-9921ae2xxxx -p udp -m udp --dport 9993 -j DROP
-A PREROUTING -d 172.31.255.4/32 ! -i br-9921ae2xxxx -p tcp -m tcp --dport 3000 -j DROP
-A PREROUTING -d 172.31.255.5/32 ! -i br-9921ae2xxxx -p tcp -m tcp --dport 80 -j DROP
-A PREROUTING -d 172.31.255.5/32 ! -i br-9921ae2xxxx -p tcp -m tcp --dport 443 -j DROP
COMMIT
# Completed on Mon Aug  4 07:24:09 2025
# Generated by iptables-save v1.8.10 (nf_tables) on Mon Aug  4 07:24:09 2025
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [4:840]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-BRIDGE - [0:0]
:DOCKER-CT - [0:0]
:DOCKER-FORWARD - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-FORWARD
-A DOCKER -d 172.31.255.5/32 ! -i br-9921ae22xxxx -o br-9921ae22xxxx -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER -d 172.31.255.5/32 ! -i br-9921ae22xxxx -o br-9921ae22xxxx -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER -d 172.31.255.4/32 ! -i br-9921ae22xxxx -o br-9921ae22xxxx -p tcp -m tcp --dport 3000 -j ACCEPT
-A DOCKER -d 172.31.255.3/32 ! -i br-9921ae22xxxx -o br-9921ae22xxxx -p udp -m udp --dport 9993 -j ACCEPT
-A DOCKER -d 172.18.0.2/32 ! -i br-7e0535f5xxxx -o br-7e0535f5xxxx -p tcp -m tcp --dport 9443 -j ACCEPT
-A DOCKER ! -i br-7e0535f5xxxx -o br-7e0535f5xxxx  -j DROP
-A DOCKER ! -i docker0 -o docker0 -j DROP
-A DOCKER ! -i br-9921ae22xxxx  -o br-9921ae22xxxx  -j DROP
-A DOCKER-BRIDGE -o br-7e0535f5xxxx  -j DOCKER
-A DOCKER-BRIDGE -o docker0 -j DOCKER
-A DOCKER-BRIDGE -o br-9921ae22xxxx  -j DOCKER
-A DOCKER-CT -o br-7e0535f5xxxx  -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-CT -o br-9921ae22e1a1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A DOCKER-FORWARD -j DOCKER-CT
-A DOCKER-FORWARD -j DOCKER-ISOLATION-STAGE-1
-A DOCKER-FORWARD -j DOCKER-BRIDGE
-A DOCKER-FORWARD -i br-7e0535f5xxxx  -j ACCEPT
-A DOCKER-FORWARD -i docker0 -j ACCEPT
-A DOCKER-FORWARD -i br-9921ae22xxxx  -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i br-7e0535f5xxxx  ! -o br-7e0535f5xxxx  -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-9921ae22xxxx  ! -o br-9921ae22xxxx  -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-2 -o br-9921ae22xxxx  -j DROP

This is my compose file:

services:
  postgres:
    image: postgres:15.2-alpine
    container_name: postgres
    restart: unless-stopped
    environment:
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: xxxxx
      POSTGRES_DB: ztnet
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - app-network

  zerotier:
    image: zyclonite/zerotier:1.14.2
    hostname: zerotier
    container_name: zerotier
    restart: unless-stopped
    volumes:
      - zerotier:/var/lib/zerotier-one
    cap_add:
      - NET_ADMIN
      - SYS_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    networks:
      - app-network
    ports:
      - "9993:9993/udp"
    environment:
      - ZT_OVERRIDE_LOCAL_CONF=true
      - ZT_ALLOW_MANAGEMENT_FROM=172.31.255.0/29

  ztnet:
    image: sinamics/ztnet:latest
    container_name: ztnet
    working_dir: /app
    volumes:
      - zerotier:/var/lib/zerotier-one
    restart: unless-stopped
    ports:
      - 3000:3000
    # - 127.0.0.1:3000:3000  <--- Use / Uncomment this line to restrict access to localhost only
    environment:
      POSTGRES_HOST: postgres
      POSTGRES_PORT: 5432
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: xxxxx
      POSTGRES_DB: ztnet
      NEXTAUTH_URL: "http://myfqdomainname:3000/" # !! Important !! Set the NEXTAUTH_URL environment variable to the canonical URL or IP of your site with port 3000
      NEXTAUTH_SECRET: "mysecret"
      NEXTAUTH_URL_INTERNAL: "http://ztnet:3000/" # Internal NextAuth URL for 'ztnet' container on port 3000. Do not change unless modifying container name.
    networks:
      - app-network
    links:
      - postgres
    depends_on:
      - postgres
      - zerotier

  ############################################################################
  #                                                                          #
  # Uncomment the section below to enable HTTPS reverse proxy with Caddy.    #
  #                                                                          #
  # Steps:                                                                   #
  # 1. Replace <YOUR-PUBLIC-HOST-NAME> with your actual public domain name.  #
  # 2. Uncomment the caddy_data volume definition in the volumes section.    #
  #                                                                          #
  ############################################################################

  https-proxy:
     image: caddy:latest
     container_name: ztnet-https-proxy
     restart: unless-stopped
     depends_on:
       - ztnet
     command: caddy reverse-proxy --from myfqdomainname --to ztnet:3000
     volumes:
       - caddy_data:/data
     networks:
       - app-network
     links:
       - ztnet
     ports:
       - "80:80"
       - "443:443"

volumes:
  zerotier:
  postgres-data:
  caddy_data:

networks:
  app-network:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.31.255.0/29

It would be great if someone can help me troubleshoot my setup.