ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Windows AD DNS Server Per NIC Responses with ZeroTier

    Scheduled Pinned Locked Moved IT Discussion
    windowsactive directorydnswindows dnszerotier
    31 Posts 5 Posters 5.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • scottalanmillerS
      scottalanmiller
      last edited by

      Adding @adam-ierymenko

      1 Reply Last reply Reply Quote 0
      • DashrenderD
        Dashrender
        last edited by

        To add to this request, let's assume there are two local networks
        192.168.1.x
        192.168.2.x

        DNS = 192.168.1.10
        ZT network = 10.10.10.x

        You want all 192.168.x.x to get 192.168.x.x addresses, and the 10.x.x.x to get 10.x.x.x responses.

        1 Reply Last reply Reply Quote 0
        • dafyreD
          dafyre
          last edited by dafyre

          Yes, exactly... and 196.168.2.x... to get 192.168.2.x....

          DashrenderD 1 Reply Last reply Reply Quote 0
          • DashrenderD
            Dashrender @dafyre
            last edited by

            @dafyre said:

            Yes, exactly... and 196.168.2.x... to get 192.168.2.x....

            well, my example was specifically in the expectation that DNS only existed in the 192.168.1.x network, not the .2.x network... but sure, in a larger network, with multiple DNS servers across multiple connected networks, you would want a way to say, if the DNS request is coming from what we declare is an internal network, always give an internal IP if one is available in DNS.

            dafyreD 1 Reply Last reply Reply Quote 0
            • dafyreD
              dafyre @Dashrender
              last edited by

              @Dashrender Okay. Good point .8-)

              1 Reply Last reply Reply Quote 0
              • scottalanmillerS
                scottalanmiller
                last edited by

                Paging @adam-ierymenko from ZeroTier.

                1 Reply Last reply Reply Quote 0
                • J
                  Jason Banned
                  last edited by Jason

                  Windows DNS can't do that. Nor would you really want to clutter DNS like that.

                  I think something to do NAT on the addresses is really what you need

                  1 Reply Last reply Reply Quote 1
                  • scottalanmillerS
                    scottalanmiller
                    last edited by

                    I suppose that you could do it by having different DNS servers, like add a BIND server to handle one of the subnets.

                    1 Reply Last reply Reply Quote 0
                    • DashrenderD
                      Dashrender
                      last edited by

                      From the other thread, ZT doesn't provide a DNS server address (at least in default mode). Perhaps if you're providing the IP info to the clients you can provide a DNS server that would be used.

                      1 Reply Last reply Reply Quote 0
                      • scottalanmillerS
                        scottalanmiller
                        last edited by

                        What are the DNS issues that have arisen? In theory ZeroTier does link detection to find the best path to a node. Is DNS detection necessary?

                        1 Reply Last reply Reply Quote 0
                        • DashrenderD
                          Dashrender
                          last edited by

                          For me it wasn't an issue on the ZT side, it was that clients on my local network that don't have ZT installed are getting the ZT ip address when querying DNS.

                          scottalanmillerS 1 Reply Last reply Reply Quote 2
                          • scottalanmillerS
                            scottalanmiller @Dashrender
                            last edited by

                            @Dashrender said:

                            For me it wasn't an issue on the ZT side, it was that clients on my local network that don't have ZT installed are getting the ZT ip address when querying DNS.

                            Oh, that would do it. ZeroTier seems, much like Pertino, like it will work far better if you "install everywhere", at least in regards to end user devices, rather than selectively. Since you don't pay "per device" for the software it does not have the financial concerns that Pertino does for doing that. And as it has that low level detection of best path it should not carry any significant network penalties.

                            I would run it on the SAN, of course, but you know what I mean.

                            1 Reply Last reply Reply Quote 0
                            • dafyreD
                              dafyre
                              last edited by

                              I actually was thinking about things like two separate NICs in a DNS server that sits on 2 networks that don't have access to one another.

                              I don't want the DNS server giving out 192.168.50 addresses on the 192.168.30 subnet.

                              scottalanmillerS 1 Reply Last reply Reply Quote 0
                              • scottalanmillerS
                                scottalanmiller @dafyre
                                last edited by

                                @dafyre said:

                                I actually was thinking about things like two separate NICs in a DNS server that sits on 2 networks that don't have access to one another.

                                I don't want the DNS server giving out 192.168.50 addresses on the 192.168.30 subnet.

                                What is the underlying purpose of the dual homing?

                                1 Reply Last reply Reply Quote 0
                                • dafyreD
                                  dafyre
                                  last edited by

                                  To have one DNS server serving two separate, unrelated subnets to which it has a NIC in each.

                                  scottalanmillerS 1 Reply Last reply Reply Quote 0
                                  • scottalanmillerS
                                    scottalanmiller @dafyre
                                    last edited by

                                    @dafyre said:

                                    To have one DNS server serving two separate, unrelated subnets to which it has a NIC in each.

                                    Why are the subnets unrelated if single devices have to sit on both of them? They must be somehow related. Why isn't there a third, service network for the shared services? Once you multi-home you are tying the networks together, just in a poor way.

                                    dafyreD 1 Reply Last reply Reply Quote 0
                                    • dafyreD
                                      dafyre @scottalanmiller
                                      last edited by dafyre

                                      @scottalanmiller said:

                                      @dafyre said:

                                      To have one DNS server serving two separate, unrelated subnets to which it has a NIC in each.

                                      Why are the subnets unrelated if single devices have to sit on both of them? They must be somehow related. Why isn't there a third, service network for the shared services? Once you multi-home you are tying the networks together, just in a poor way.

                                      Only if you are using a device for routing. And that is not what I want done...

                                      What I want is Split-Brain DNS (coming Feature in Server 2016, http://blogs.technet.com/b/networking/archive/2015/05/12/split-brain-dns-deployment-using-windows-dns-server-policies.aspx)... Guess I gotta wait a few more weeks.

                                      My primary use case would be for something like with ZeroTier, but I could see it being useful under certain types of lab conditions as well.

                                      1 Reply Last reply Reply Quote 0
                                      • scottalanmillerS
                                        scottalanmiller
                                        last edited by

                                        But why don't you want that done? You are leading with your tech want, but what is the business need? What is the business factor pushing you to dual homing?

                                        1 Reply Last reply Reply Quote 0
                                        • dafyreD
                                          dafyre
                                          last edited by dafyre

                                          Just to be clear, I've answered my question -- I didn't know what it was called, but it is called Split-Brain DNS. If you are a Windows shop, you get that feature in Server 2016.

                                          ===

                                          You know as well as I do that a Lab environment needs to be isolated from the network, and it some shops, the lab network doesn't even have internet access. I'd like to have my lab network connected to a multihomed DNS server simply because I can. I want to know if the tech can do what I want it to do. No other reason is necessary.

                                          scottalanmillerS 2 Replies Last reply Reply Quote 0
                                          • scottalanmillerS
                                            scottalanmiller @dafyre
                                            last edited by

                                            @dafyre said:

                                            You know as well as I do that a Lab environment needs to be isolated from the network, and it some shops, the lab network doesn't even have internet access. I'd like to have my lab network connected to a multihomed DNS server simply because I can. I want to know if the tech can do what I want it to do. No other reason is necessary.

                                            That's fine. If it is a lab you can obviously do whatever you want to do.

                                            For isolation, though, just to be clear and for anyone who reads this and gets the wrong idea from the statement made above, dual homing has always been avoided for security reasons. So if the goal is to isolate a lab from product, or whatever, that is why you avoid dual homing and use a service network. Because the dual homing exposes the product to the lab more, rather than less, than a service network.

                                            I just don't want others reading along and not realizing that this is a lab for a lab's sake and thinking that there is a standard product network design pattern here.

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 1 / 2
                                            • First post
                                              Last post