I had looked at this. It doesn't seem like they've implemented anything to handle firewall rules. They may not even be able to, seeing as how that part of ZT is closed source. Also, this doesn't solve the problem with mobile apps, so the whole thing was a moot point for me.

The mobile app does work with the self hosted option, we use it at work.

The official ZT docs* say, "The mobile apps don't support custom roots." And I don't see any setting in the Android app to point it to any server.

* https://docs.zerotier.com/self-hosting/introduction

Ah, that's because we run a controller node not a root. So you just add an ID as normal.

The software linked in the parent works with the mobile apps.