ZeroTier Review

dafyre

@johnhooks Thanks for the heads up. I'll keep that in mind.

quicky2g

Thanks for the code snippets to create a network and authorize a client. I modified the PHP script to change a client IP. I disconnected my client and reconnected to be safe and client started using the new IP.

<?PHP

$secret=file_get_contents('authtoken.secret');

echo "Connecting with secret of $secret\n\r";

$networkID="aaaaaaaaaaaaaaaa";
$memberID="bbbbbbbbbb";
$NewIP=array("192.168.50.10/24");

$url="http://localhost:9993/controller/network/$networkID/member/$memberID?auth=$secret";
$networkOption=array(
 'ipAssignments'=>$NewIP
);

//echo json_encode($networkOption);

$curl=curl_init();

$curlOptions=array(
 CURLOPT_URL=>$url,
 CURLOPT_POSTFIELDS=>json_encode($networkOption),
 CURLOPT_RETURNTRANSFER=>true
);

curl_setopt_array($curl,$curlOptions);

$result=curl_exec($curl);

print_r($result);

/*
echo "Sent Data: \n\r";
print_r($curlOptions);
*/

scottalanmiller

@quicky2g Welcome to the community!

quicky2g

@scottalanmiller Thanks! Co-worker put me onto this article and seems like a pretty cool site. Might have to stick around

scottalanmiller

Awesome! Great to see people starting to steer others over here!

dafyre

@quicky2g said:

@scottalanmiller Thanks! Co-worker put me onto this article and seems like a pretty cool site. Might have to stick around

Welcome aboard & Thanks for the code update!

travisdh1

I'm really liking how easy it is to setup. Just want to see some security review by a trusted security person before I go ahead and roll it out. Anyone seen a review on it from someone like Steve Gibson, Brian Krebs, or the like?

dafyre

@travisdh1 said:

I'm really liking how easy it is to setup. Just want to see some security review by a trusted security person before I go ahead and roll it out. Anyone seen a review on it from someone like Steve Gibson, Brian Krebs, or the like?

If you haven't read up in the FAQ yet, check it out here: https://www.zerotier.com/tech_faq.shtml -- especially the security section.

What kind of use case are you seeing for it?

quicky2g

@dafyre said:

@travisdh1 said:

I'm really liking how easy it is to setup. Just want to see some security review by a trusted security person before I go ahead and roll it out. Anyone seen a review on it from someone like Steve Gibson, Brian Krebs, or the like?

If you haven't read up in the FAQ yet, check it out here: https://www.zerotier.com/tech_faq.shtml -- especially the security section.

What kind of use case are you seeing for it?

I did Wireshark on the traffic yesterday. All I saw was encrypted data inside a UDP packet. Not sure if there are any vulnerabilities or security holes in the dependent applications.

travisdh1

@dafyre said:

@travisdh1 said:

I'm really liking how easy it is to setup. Just want to see some security review by a trusted security person before I go ahead and roll it out. Anyone seen a review on it from someone like Steve Gibson, Brian Krebs, or the like?

If you haven't read up in the FAQ yet, check it out here: https://www.zerotier.com/tech_faq.shtml -- especially the security section.

What kind of use case are you seeing for it?

I've got two locations, one with the worst "high-speed" internet you're likely to find outside of satellite (good riddance to satellite!) 1 vm host and 1 backup target at each location. Ether XenServer or ProxMox running on the servers. I'm thinking I'll be able to manage most things at both sites with a jumpbox vm. Maybe even make xrdp available as well, tho that would be painful with the DSL connection (756kb/250kb actual measured 600kb/300kb.)

Dashrender

@dafyre said:

What kind of use case are you seeing for it?

The use case I see is a primarily mobile workforce. But also something like more modern offices mostly seen on the west coast - just let anyone on the network because the network is just a connection medium. ZT over the physical is what would actually allow you access to services for the company.

quicky2g

@travisdh1 said:

@dafyre said:

@travisdh1 said:

I'm really liking how easy it is to setup. Just want to see some security review by a trusted security person before I go ahead and roll it out. Anyone seen a review on it from someone like Steve Gibson, Brian Krebs, or the like?

If you haven't read up in the FAQ yet, check it out here: https://www.zerotier.com/tech_faq.shtml -- especially the security section.

What kind of use case are you seeing for it?

I've got two locations, one with the worst "high-speed" internet you're likely to find outside of satellite (good riddance to satellite!) 1 vm host and 1 backup target at each location. Ether XenServer or ProxMox running on the servers. I'm thinking I'll be able to manage most things at both sites with a jumpbox vm. Maybe even make xrdp available as well, tho that would be painful with the DSL connection (756kb/250kb actual measured 600kb/300kb.)

ZeroTier must use some kind of compression so might help with your speed issues. I have 5mbps upload at home. Did an upload test with iPerf between my house and my work office and saw 5mbps with Hamachi:

Did the same test with ZeroTier between the same endpoints:

dafyre

@quicky2g said:

@travisdh1 said:

@dafyre said:

@travisdh1 said:

I'm really liking how easy it is to setup. Just want to see some security review by a trusted security person before I go ahead and roll it out. Anyone seen a review on it from someone like Steve Gibson, Brian Krebs, or the like?

If you haven't read up in the FAQ yet, check it out here: https://www.zerotier.com/tech_faq.shtml -- especially the security section.

What kind of use case are you seeing for it?

I've got two locations, one with the worst "high-speed" internet you're likely to find outside of satellite (good riddance to satellite!) 1 vm host and 1 backup target at each location. Ether XenServer or ProxMox running on the servers. I'm thinking I'll be able to manage most things at both sites with a jumpbox vm. Maybe even make xrdp available as well, tho that would be painful with the DSL connection (756kb/250kb actual measured 600kb/300kb.)

ZeroTier must use some kind of compression so might help with your speed issues. I have 5mbps upload at home. Did an upload test with iPerf between my house and my work office and saw 5mbps with Hamachi:

Did the same test with ZeroTier between the same endpoints:

O.o. That'd be some crazy compression!

travisdh1

@quicky2g said:

@travisdh1 said:

@dafyre said:

@travisdh1 said:

I'm really liking how easy it is to setup. Just want to see some security review by a trusted security person before I go ahead and roll it out. Anyone seen a review on it from someone like Steve Gibson, Brian Krebs, or the like?

If you haven't read up in the FAQ yet, check it out here: https://www.zerotier.com/tech_faq.shtml -- especially the security section.

What kind of use case are you seeing for it?

I've got two locations, one with the worst "high-speed" internet you're likely to find outside of satellite (good riddance to satellite!) 1 vm host and 1 backup target at each location. Ether XenServer or ProxMox running on the servers. I'm thinking I'll be able to manage most things at both sites with a jumpbox vm. Maybe even make xrdp available as well, tho that would be painful with the DSL connection (756kb/250kb actual measured 600kb/300kb.)

ZeroTier must use some kind of compression so might help with your speed issues. I have 5mbps upload at home. Did an upload test with iPerf between my house and my work office and saw 5mbps with Hamachi:

Did the same test with ZeroTier between the same endpoints:

That makes me go "What is going on here, something is not right."

Dashrender

Something seems flawed with the test - shouldn't doing speed test with compressible data.

dafyre

@Dashrender said:

Something seems flawed with the test - shouldn't doing speed test with compressible data.

True. I haven't seen similar results, although a thought just hit me.

@quicky2g -- Were you running this test on ZeroTier to another device that is connected to the same physical lan?

(IE: Two ZeroTier devices in the same building?)

quicky2g

@dafyre said:

@Dashrender said:

Something seems flawed with the test - shouldn't doing speed test with compressible data.

True. I haven't seen similar results, although a thought just hit me.

@quicky2g -- Were you running this test on ZeroTier to another device that is connected to the same physical lan?

(IE: Two ZeroTier devices in the same building?)

Was going across a WAN.

When I did a LAN test between 2 devices on the same Gigabit switch I also got better results than Hamachi and almost as good as LAN IP's.

Gig LAN iPerf (Regular LAN IP’s):

0_1452092207498_Gig LAN Test.png

Hamachi LAN iPerf:

0_1452092241605_Hamachi LAN Test.png

ZeroTier LAN iPerf:

0_1452092275939_ZeroTier LAN Test.png

dafyre

@quicky2g -- Those are some good numbers to see. It is important to note that if two ZT devices are on the same network subnet, then ZT will communicate directly over the LAN (the traffic will never leave your network). That's likely the reason for the good speeds.

Also are you doing your WAN test with UDP or TCP? (I think with UDP, you could see the higher rates, as UDP doesn't have to confirm delivery of the data).

travisdh1

"What encryption algorithms are used?
ZeroTier currently uses 256-bit Curve25519 elliptic curve Diffie-Hellman for shared key agreement and Ed25519 for elliptic curve signatures. 256-bit Salsa20 with Poly1305 authentication is used to encrypt traffic in transit. The construction and use of these algorithms is identical to the well-regarded NaCl cryptographic library."

I could wish for 512 bit where it's available, but 256-bit ECCDH and Salsa20 + Poly1305 should be all right. I know Steve Gibson is using NaCl and ECCDH in his SQRL protocol, so should be ok. So long as implementation isn't funky, it should be good.

quicky2g

@dafyre said:

@quicky2g -- Those are some good numbers to see. It is important to note that if two ZT devices are on the same network subnet, then ZT will communicate directly over the LAN (the traffic will never leave your network). That's likely the reason for the good speeds.

Also are you doing your WAN test with UDP or TCP? (I think with UDP, you could see the higher rates, as UDP doesn't have to confirm delivery of the data).

Wasn't sure if iPerf used TCP or UDP as default so had to check in Wireshark. Looks like TCP is default. Makes sense that UDP would get better results but have never been able to find a different combo of options for iPerf that got me better results. Anyone else use iPerf?