ZeroTier and DNS

adam.ierymenko

@Dashrender No, we're not doing this if that's what you mean:

https://en.wikipedia.org/wiki/Split-horizon_DNS

We're just putting our intranet IPs under our main domain. Doesn't matter since nobody without intranet access can actually access these systems and they're not advertised anywhere.

I'm thinking that there's a need here for some kind of DNS solution to work with ZeroTier, but in the interest of sanity and avoiding feature explosion I'm reticent to actually build it into ZeroTier itself. Instead I think it should maybe be another app, something that serves DNS locally and makes decisions about where to get the actual DNS information from.

I wonder if anyone's already written anything like this? I know on *nix we have dnsmasq and other similar services.

Dashrender

These kinds of problems are why Pertino had to create their own DNS hack (for lack of a better word) to solve these types of problems.

scottalanmiller

@adam.ierymenko said:

I'm thinking that there's a need here for some kind of DNS solution to work with ZeroTier, but in the interest of sanity and avoiding feature explosion I'm reticent to actually build it into ZeroTier itself. Instead I think it should maybe be another app, something that serves DNS locally and makes decisions about where to get the actual DNS information from.

I wonder if anyone's already written anything like this? I know on *nix we have dnsmasq and other similar services.

Much as Pertino did. They leverage your existing Windows DNS servers and have a special app that runs inside the Pertino network and handles your DNS.

Dashrender

With ZT installed on one of my servers, and that interface getting DHCP from ZT, the interface is registering itself in my AD's DNS system. Non ZT machines are now resolving to the ZT IP address instead of the local network IP. Though it seems non deterministic, that just might be my limited exposure so far.

scottalanmiller

@Dashrender said:

With ZT installed on one of my servers, and that interface getting DHCP from ZT, the interface is registering itself in my AD's DNS system. Non ZT machines are now resolving to the ZT IP address instead of the local network IP. Though it seems non deterministic, though that just might be my limited exposure so far.

That's what we found with the Pertino system too.

adam.ierymenko

Does anyone know if this comes up in other situations? Seems like the one-layer-down issue is getting AD to work in a multi-network environment.

adam.ierymenko

Obviously if you go 'all in' with SDN then your private IPs will just work always, but not everyone can do that.

scottalanmiller

@adam.ierymenko said:

Does anyone know if this comes up in other situations? Seems like the one-layer-down issue is getting AD to work in a multi-network environment.

That is correct. But generally you don't run into these issues except when building a full mesh.

Dashrender

@adam.ierymenko said:

Does anyone know if this comes up in other situations? Seems like the one-layer-down issue is getting AD to work in a multi-network environment.

I'm trying to recall how this is solved in a traditional VPN setup. VPN server on the edge of my network, I connect while I'm at home. The IP I get from the VPN server includes my office's DNS server as well as an IP. But even then, I've had issues where things don't resolve correctly, so I'm sure this isn't a new problem.

scottalanmiller

@Dashrender said:

I'm trying to recall how this is solved in a traditional VPN setup. VPN server on the edge of my network, I connect while I'm at home. The IP I get from the VPN server includes my office's DNS server as well as an IP. But even then, I've had issues where things don't resolve correctly, so I'm sure this isn't a new problem.

DHCP because you only connect to the VPN when remote. You are handling the whole process manually and just don't realize that that is what is happening. You are manually choosing to tell the system when you are or are not in the office.

Dashrender

@scottalanmiller said:

@Dashrender said:

I'm trying to recall how this is solved in a traditional VPN setup. VPN server on the edge of my network, I connect while I'm at home. The IP I get from the VPN server includes my office's DNS server as well as an IP. But even then, I've had issues where things don't resolve correctly, so I'm sure this isn't a new problem.

DHCP because you only connect to the VPN when remote. You are handling the whole process manually and just don't realize that that is what is happening. You are manually choosing to tell the system when you are or are not in the office.

I don't follow. While my post started out asking how we solved this with before, I ended by saying it really never was solved.

The DNS servers provided to the VPN client weren't reliably more authoritative with responses than the local connection DNS servers. I basically had to setup a host file for anyone who was mobile to ensure IP connectivity for them.

scottalanmiller

@Dashrender said:

The DNS servers provided to the VPN client weren't reliably more authoritative with responses than the local connection DNS servers. I basically had to setup a host file for anyone who was mobile to ensure IP connectivity for them.

That should not happen. I've done VPNs for decades and never ran into that issue. What was causing DNS to not work well when on the VPN?

Dashrender

@scottalanmiller said:

@Dashrender said:

The DNS servers provided to the VPN client weren't reliably more authoritative with responses than the local connection DNS servers. I basically had to setup a host file for anyone who was mobile to ensure IP connectivity for them.

That should not happen. I've done VPNs for decades and never ran into that issue. What was causing DNS to not work well when on the VPN?

Maybe the fact that I have a split brain DNS?