ZeroTier and DNS issues
-
@adam.ierymenko said:
@scottalanmiller ZeroTier just connects directly over LAN if two devices are in the same physical network (if possible). So in-building traffic goes in-building, albeit with the overhead of an extra 28 byte header and encryption/authentication. Overhead is somewhat comparable to IPSec.
How is ZeroTier determining how to address a machine in one place or another? Say a laptop is communicating with a server that is remote and then becomes local. How does it know when to switch?
-
we use pertino only on our laptops and "out of office" computers. not installed on every workstation, that would be silly. We use pertino essentially as a vpn, a means for those geographically separate devises to still use LAN resources securely and easily (doctors, nurses, etc)
-
@adam.ierymenko said:
@scottalanmiller Sure, but why wouldn't you handle that a layer down? Are you saying Pertino uses DNS to route traffic?
Yes. DNS is used to determine where to send traffic. Because it gives different addresses out under different circumstances.
-
@scottalanmiller said:
@Dashrender said:
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
How does DHCP do that?
What I mean is that I wouldn't bother setting up DHCP on a Windows Server to handle the local network portion... I'd leave that to some unrelated device, and not have the local network be part of the Windows concern.
But in reading some of your responses I'm not sure how that would work either.
Let's say I'm on a 1 Gb network... the server is on that same network... but we're using Pertino... I have a 5 meg internet connection, how fast are files going to move between me and the server?
-
@scottalanmiller Every ZT device has a cryptographically-defined identity, so any time it gets a packet it knows who sent it. It can then try various paths for connectivity and use them if a bi-directional link is determined to be present. ZeroTier devices on the same virtual network try each other over their local IPs as well as via NAT-t and other methods and if that works they prefer local to global. But if it stops working they'll fall back to whatever works according to a preference order based on IP scope/class and type (V6 over V4, local over global, direct over indirect).
It's open source if you're curious: https://github.com/zerotier/ZeroTierOne
-
@adam.ierymenko said:
@scottalanmiller ZeroTier just connects directly over LAN if two devices are in the same physical network (if possible). So in-building traffic goes in-building, albeit with the overhead of an extra 28 byte header and encryption/authentication. Overhead is somewhat comparable to IPSec.
Good to know - can you tell us how that works? Ok you did the post before mine.
-
@Dashrender said:
Let's say I'm on a 1 Gb network... the server is on that same network... but we're using Pertino... I have a 5 meg internet connection, how fast are files going to move between me and the server?
Depends, are you using Pertino free or Pertino with the AD Connector? If using the free it all goes through the hosted switch so over your WAN bidirectionally.
If using the AD Connector it is going over the GigE network directly and not over the WAN.
-
and that was with design help from pertino. if a device/resource needs to be accessed off lan, stick a client on it. so our app/dc/sql/rds servers all have pertino installed on them. works great. local traffic still uses 10.x.x.x pertino uses 172.x.x.x
-
Interesting. I haven't looked deeply into Pertino because my business philosophy is to focus on doing what users want and what makes technical design sense and ignore competition. In fact, during ZT initial design I deliberately did not try any alternatives because I didn't want to "pollute" my headspace.
ZT may not need the DNS hack, since it doesn't use DNS to route traffic. It doesn't need any of that. It does everything a layer down using crypto for authentication and lazy route-learning with automatic switching and preference order. It's like VXLAN over a p2p mesh. It will fall back to WAN-in-WAN-out however if your LAN has rules that prohibit lateral communication... I've seen that in houses that run WiFi switches that do that.
It does seem like the DNS hack would help with the IP ambiguity issue though in mixed deployments, and mixed deployments are what most non-greenfield existing enterprises are going to want because they can't install SDN software on everything... either because they are risk/change averse or because they run a lot of things that are too old/slow/whatever to run it.
-
adam, want to talk to you about a possible switch to your product sometime?
-
Sounds like ZT is giving you free what Pertino is charging an arm for.
But yeah, I know Pertino still has a lot of other features as well.
Although - Adam, it sounds like you have the local vs remote problem already solved. You probably wouldn't need to do any of the DNS hacking that Pertino did, you've solved it through the crypto location hash.
Nice!
-
Is ZT's goal to have control of all traffic like a SDN? What is the underlying design goal, just to be the ultimate VPN? That might be a major influencer of design decisions.
-
@Dashrender said:
Sounds like ZT is giving you free what Pertino is charging an arm for.
Like he said... OpenSource. Think Linux and Windows
That's not a 100% true all the time thing, but you know, in general.
-
What's the difference between a SDN and a full mesh VPN?
-
Keep in mind that Pertino is a 100% of the time hosted service. It is never software on its own. You always get enterprise hosting that is globally load balanced. Doing the same with ZT wouldn't be nearly as expensive, but isn't free either. Pertino is paying the Amazon, Rackspace and Azure bills for you.
-
@Dashrender said:
What's the difference between a SDN and a full mesh VPN?
Focus. The VPN is about connectivity. The SDN is about creating a single, monitorable network. Pertino is designed for you to build out applications on the platform that exist inside of the SDN.
-
Pertino seems to have a lot of enterprise management features we don't have, and may or may not ever build. We've decided to focus intensely upon the "SDN everywhere" problem domain and do it right and that's our bread and butter as they say. We're targeting mobile, IoT, data center, and hybrid cloud as well as distributed teams and other VPN-ish use cases. (And tech hobbyists, hackers, gamers, etc. We've even had someone install ZT on an ARM Linux device in a drone and make the drone switch WiFi networks as it flies... said it worked decently well.)
@scottalanmiller Yes ZT is SDN, basically VXLAN over a P2P network. Here is a brief technical overview: https://www.zerotier.com/misc/2015-09-23_ZeroTier_Tech_Intro.pdf
@hubtechagain E-mail me at [email protected] and we can determine if that would work or not for your use case. (Also helps us decide what to build next even if it won't work.)
-
@hubtechagain said:
and that was with design help from pertino. if a device/resource needs to be accessed off lan, stick a client on it. so our app/dc/sql/rds servers all have pertino installed on them. works great. local traffic still uses 10.x.x.x pertino uses 172.x.x.x
Hub,
Did Pertino try to talk you into installing (buying) Pertino for every device?If not, @scottalanmiller, why would they not push him heavily that way if the point is a full SDN or nothing solution?
-
@Dashrender said:
If not, @scottalanmiller, why would they not push him heavily that way if the point is a full SDN or nothing solution?
To not lose customers
Pertino does end up being a super simple VPN compared to most other products. And free for ten and under makes it popular for small networks.
-
@adam.ierymenko said:
Pertino seems to have a lot of enterprise management features we don't have, and may or may not ever build.
Yes, Pertino is all about the management. That's the goal, connectivity is a tool for getting there.
