EasyTier

Search the Azure Marketplace for EasyTier, select the SecureAnyCloud publisher, and select Create.

Configure the network security group to allow TCP 11010 and UDP 11010 from the peers that will join this network, and TCP 22 for administration. UDP 11010 is the primary path and enables direct NAT hole punching. TCP 11010 is the fallback for restrictive networks.

RG="mesh-prod"; LOCATION="eastus"; VM_NAME="easytier1" IMAGE_URN="sac1647283583153:easytier-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:easytier-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 11010 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

On first boot the image generates a unique network name and a strong random network secret for this VM. It renders /etc/easytier/config.toml with those values and this node's virtual IP, resolves the VM's public IP for the peer join endpoint, writes the root-only credentials file, and starts easytier. This completes within seconds.

SSH in as azureuser and read the credentials:

sudo cat /root/easytier-credentials.txt

The file records four values:

• network_name and network_secret: your per-instance network name and the key that admits peers
• virtual_ipv4: this node's virtual IP
• node_endpoint (<public-ip>:11010): the endpoint that your other machines connect to

Keep the network secret private. Anyone who has it can join your mesh.

Run the commands below. easytier.service should be active, and easytier-core --version should report 2.6.4. The ss output should show the node listening on :11010 for the peer-to-peer transport (TCP and UDP), with the management RPC port bound to loopback only.

systemctl is-active easytier.service /opt/easytier/easytier-core --version sudo ss -tulnp | grep -E ':11010|:15888'

easytier-cli talks to the node over the loopback management port. Run easytier-cli node to see this node's virtual IP, public IP, peer ID and listeners.

sudo /opt/easytier/easytier-cli node

The virtual IP (10.144.144.1/24 by default) is this node's address inside the mesh. Every node you add gets a distinct virtual IP in the same range. Once a node has joined, every other node can reach it over that address.

The image includes a mesh self test. It starts a second, short-lived EasyTier node in an isolated network namespace and joins it to the same network as this node. It then pings across the two virtual IPs to prove that a real peer-to-peer tunnel carries traffic. The test is self-contained on this one VM and needs no external peers.

sudo /opt/easytier/mesh-selftest.sh

The script prints MESH_SELFTEST_OK when the tunnel forms and the ping succeeds in both directions. It also confirms that both nodes see each other as connected peers.

To inspect the mesh routing table, run the command below. It lists the virtual IP of every reachable node and the next hop this node uses to reach it.

sudo /opt/easytier/easytier-cli route

To grow the mesh, install the free EasyTier client on another machine, or launch another of these images. Join it to the same network name and secret and point it at this node's public endpoint.

Read your network_name, network_secret and node_endpoint from /root/easytier-credentials.txt (Step 3). Then run this on the other machine:

sudo easytier-core \
  --network-name <EASYTIER_NETWORK_NAME> \
  --network-secret <EASYTIER_NETWORK_SECRET> \
  --ipv4 10.144.144.2 \
  --peers tcp://<public-ip>:11010 \
  --rpc-portal 127.0.0.1:15888

Give the second node a distinct virtual IP (10.144.144.2 in this example). Once it connects, each node can reach the other over its virtual IP. For example, run ping 10.144.144.1 from the second machine.

Because both nodes share the same secret, all traffic between them is authenticated and encrypted end to end. You can add as many nodes as you like. The network is a full mesh, so every node talks directly to every other node wherever a direct path exists.

This image ships with no known credentials. The network secret, which is the key that admits peers, is generated uniquely per VM at first boot and stored root-only. The management RPC port that easytier-cli uses is bound to loopback only, so it is never reachable from the network. Mesh traffic is encrypted with your secret. Besides SSH, the only network-facing surface is the peer-to-peer transport on port 11010.

Confirm the RPC binding and the encryption setting:

sudo ss -tulnp | grep 15888
sudo grep -E 'enable_encryption|network_name' /etc/easytier/config.toml

Rotate the secret if it may have leaked. Generate a new one, update [network_identity] in /etc/easytier/config.toml on every node in the network, and restart the service. All nodes must share the same name and secret to stay in one network.

NEW_SECRET="$(openssl rand -hex 24)" echo "New network secret: $NEW_SECRET"
sudo sed -i "s/^network_secret = .*/network_secret = \"$NEW_SECRET\"/" /etc/easytier/config.toml
sudo systemctl restart easytier.service

Apply the same new secret to your other nodes so they can rejoin.