diff --git a/modules/clan/gw-router/default.nix b/modules/clan/gw-router/default.nix
index 906d516..b4de60d 100644
--- a/modules/clan/gw-router/default.nix
+++ b/modules/clan/gw-router/default.nix
@@ -302,10 +302,10 @@
   };
 
   imports = [
-    ./ipv6.nix
-    ./firewall.nix
-    ./dns-dhcp.nix
-    ./pppoe.nix
     ./crowdsec.nix
+    ./dns-dhcp.nix
+    ./firewall.nix
+    ./ipv6.nix
+    ./pppoe.nix
   ];
 }
diff --git a/modules/clan/gw-router/iperf.nix b/modules/clan/gw-router/iperf.nix
new file mode 100644
index 0000000..98234d8
--- /dev/null
+++ b/modules/clan/gw-router/iperf.nix
@@ -0,0 +1,33 @@
+{
+  roles.default.perInstance = { ... }: {
+    nixosModule =
+      {
+        config,
+        lib,
+        ...
+      }:
+      let
+        vlanIf = name: "vlan-${name}";
+        dir = config.clan.core.settings.directory;
+        instance = "zerotier";
+
+        networkId = builtins.readFile "${dir}/vars/shared/zerotier-network-${instance}/network-id/value";
+        full = "fd" + networkId + "9993";
+        hextet = i: builtins.substring (i * 4) 4 full;
+        subnetZtier = "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
+      in
+      {
+        services.iperf3.enable = true;
+
+        networking.firewall.interfaces = lib.genAttrs vlanIf (_: {
+          allowedTCPPorts = [ 5201 ];
+          allowedUDPPorts = [ 5201 ];
+        });
+
+        networking.firewall.extraInputRules = ''
+          ip6 saddr ${subnetZtier} tcp dport 5201 accept comment "iperf3 over the mesh"
+          ip6 saddr ${subnetZtier} udp dport 5201 accept comment "iperf3 over the mesh"
+        '';
+      };
+  };
+}