ZeroTier ONLINE but ACCESS_DENIED: Where Do You Fix It?

ZeroTier reports ONLINE at the service level and ACCESS_DENIED at the network level, and the pair is not a contradiction. The first is a statement about the path between your client and the coordination infrastructure. The second is a statement about one network's member list. Read them separately and the combination tells you exactly where to look.

What ONLINE Measures

The status command reports whether the local service has a working path to the root servers that coordinate peer discovery. It says nothing about any individual network, and nothing about whether a controller has approved this device. A fresh installation on a working connection therefore reports ONLINE immediately, before anyone has authorized it anywhere.

Treat ONLINE as a statement about the plumbing and the per-network status as a statement about membership. Using one to explain the other is where most of this confusion starts.

What ACCESS_DENIED Asks You to Do

On a private network the controller keeps a member list. A node missing from that list, or listed but not authorized, receives ACCESS_DENIED along with no configuration beyond the basic handshake. The fix is on the controller side and it needs the node address rather than the machine name, so match the address in your client output against the member entry and authorize that entry.

Reinstalling the client is the wrong first move, because a new installation brings a new identity and the old authorization no longer applies to it. If the network is public, the same status points at a different condition, so ask the controller owner whether the network is private before requesting approval. That one question decides the rest of the conversation.

Status Text Is a Branch, Not a Verdict

Each status narrows the next check, and reading them as one failure message is what turns a two-minute fix into an afternoon of reinstalling. NOT_FOUND means the identifier you typed does not exist at that controller, so the membership question has not been reached yet. REQUESTING_CONFIGURATION means the node reached the controller and is waiting on configuration that is not arriving, which points at the path rather than at authorization. OK means membership and configuration are in place, so the next question is the assigned address and then the service itself.

Two commands separate all of this, and both read the same client. The ZeroTier CLI reference lists the per-network status strings they return. The first command is the service view and the second is per network:

zerotier-cli status
zerotier-cli listnetworks

Keep the status text when you ask the administrator for help. A local join command that printed a confirmation proves only that the request was accepted locally, which is a different fact from being admitted.

Membership Belongs to an Identity

The client's identity files are what the controller recognizes, so copying a configuration to another machine or clearing the identity during a reinstall produces a member the controller has never seen. That is also why deleting a member record differs from deauthorizing it. An authorized node that is still running keeps trying, and a record that was deleted rather than revoked can come back as a new request from the same address.

When you retire a device, revoke it first and confirm the entry reflects that state before you remove anything. The order is the difference between a clean removal and a mystery rejoin.

Verify After the Change

Re-read the network entry instead of the command that made the change. Four questions cover the outcome, and any one of them can be wrong while the others look right:

zerotier-cli listnetworks
ip -br addr show
ping -c 2 10.147.20.5
ip route get 10.147.20.5

The first prints membership and the assigned address for each network, and the second shows whether an interface actually received that address. The last two prove that a peer on the network answers and which interface carries the traffic. Note which command answered which question, so the next person starts from evidence rather than from memory.

If membership is OK and the address is present but peers do not answer, the problem has moved to routing or to the peer's own policy. Take the status text out of that conversation, because it has already done its job. The membership record and the path are separate subjects, and the sooner they are separated the shorter the investigation gets.