ZeroTier Question

Dashrender

@JaredBusch said in ZeroTier Question:

@Dashrender said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Except in the case of the end-user's machine not actually hitting the internal DNS, maybe?

Sure, but if the user isn't hitting an internal DNS, where would that address come from at all? I would expect it to simply fail, or get a *.wls.wels.net reply back, which isn't happening when I ping, so no reason to believe that would be happening to the home user.

F[moderated], I said it. It is coming from his primary DNS like it should.

Most likely it is his ISP hijacking the bad DNS results and will show a search page if he were to use a web browser.

I concur.

Dashrender

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

I've got $1 that says I can name the ISP of the home user...

(Pro tip: It's mine too).

Not a secret. it is listed right in the screenshot.

lol, nice scrolling

dafyre

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

JaredBusch

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

dafyre

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

JaredBusch

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

Nothing. ZeroTier passes NetBIOS. This is really basic.

Dashrender

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

Nothing. ZeroTier passes NetBIOS. This is really basic.

Ug.. did you just say NetBIOS?

JaredBusch

@Dashrender said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

Nothing. ZeroTier passes NetBIOS. This is really basic.

Ug.. did you just say NetBIOS?

Yes. That magic way that everything works on a LAN without DNS.

dafyre

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

Nothing. ZeroTier passes NetBIOS. This is really basic.

Yes it does. In my experience, over VPN type techs (like Pertino, ZT, OpenVPN, etc), Netbios has not been reliable.

Dashrender

@dafyre I too have found reliability to be a problem.

dafyre

Let's wait and hear back from @WLS-ITGuy before we go too far down the rabbit hole.

JaredBusch

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

Nothing. ZeroTier passes NetBIOS. This is really basic.

Yes it does. In my experience, over VPN type techs (like Pertino, ZT, OpenVPN, etc), Netbios has not been reliable.

NetBIOS is reliable when addresses don't change like with Pertino and ZeroTier.

dafyre

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

Nothing. ZeroTier passes NetBIOS. This is really basic.

Yes it does. In my experience, over VPN type techs (like Pertino, ZT, OpenVPN, etc), Netbios has not been reliable.

NetBIOS is reliable when addresses don't change like with Pertino and ZeroTier.

Therein lies our problem.. He wants to use ZeroTier.

JaredBusch

Anyway, as I linked at some point above and it was apparently not understood, i have zero problems access network resources over ZeroTier from this laptop. There is not any DNS setup. So that does mean that if the laptop never comes in the office, it will eventually lose trust with the server because domain.local does not resolve, only the machine names.

No I could easily fix that by adding a line to the hosts file with the ZeroTier IP of one of the domain controllers and the domain suffix like this:

10.202.3.21    domain.local

Then even domain queries will work. But for machines that are on and off the network all the time, it is usually not needed as they get their tokens refreshed often enough.

Windows IP Configuration

   Host Name . . . . . . . . . . . . : dt-backup-laptop
   Primary Dns Suffix  . . . . . . . : domain.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain.local

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : ZeroTier One Virtual Port #2
   Physical Address. . . . . . . . . : A2-E2-9D-9B-48-F1
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : fd56:5799:d8f6:3ed4:a199:9336:a36d:9068(P
referred)
   Link-local IPv6 Address . . . . . : fe80::e023:2905:284a:b878%24(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.202.3.188(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 25.255.255.254
   DHCPv6 IAID . . . . . . . . . . . : 587267855
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-2C-13-92-F0-1F-AF-13-7A-8E

   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) Centrino(R) Advanced-N 6205
   Physical Address. . . . . . . . . : 6C-88-14-5A-B5-A0
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::d90e:714e:228:aafb%12(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.8(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Monday, May 09, 2016 7:43:00 PM
   Lease Expires . . . . . . . . . . : Wednesday, May 11, 2016 3:06:04 PM
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 225216532
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-2C-13-92-F0-1F-AF-13-7A-8E

   DNS Servers . . . . . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

JaredBusch

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

Nothing. ZeroTier passes NetBIOS. This is really basic.

Yes it does. In my experience, over VPN type techs (like Pertino, ZT, OpenVPN, etc), Netbios has not been reliable.

NetBIOS is reliable when addresses don't change like with Pertino and ZeroTier.

Therein lies our problem.. He wants to use ZeroTier.

WTF? What problem? I just said it was reliable on ZeroTier.

scottalanmiller

@dafyre said in ZeroTier Question:

@Dashrender said in ZeroTier Question:

@WLS-ITGuy said in ZeroTier Question:

@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works

It's not about handling routing because there would be no route.

Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10

If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.

And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.

In what way? If the wrong DNS is being grabbed, how does the extra complexity of the gateway make it easier?

scottalanmiller

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

Nothing. ZeroTier passes NetBIOS. This is really basic.

Yes it does. In my experience, over VPN type techs (like Pertino, ZT, OpenVPN, etc), Netbios has not been reliable.

NetBIOS is reliable when addresses don't change like with Pertino and ZeroTier.

Therein lies our problem.. He wants to use ZeroTier.

He meant that Pertino and ZeroTier are places where the IP does not change. Their addresses are stable. Unlike many traditional VPN services.

scottalanmiller

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@JaredBusch said in ZeroTier Question:

@dafyre said in ZeroTier Question:

Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.

Why. You keep saying this and I keep telling you that it is a bad idea.

I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.

What are you using to do that? Your windows AD DNS?

Nothing. ZeroTier passes NetBIOS. This is really basic.

Yes it does. In my experience, over VPN type techs (like Pertino, ZT, OpenVPN, etc), Netbios has not been reliable.

NetBIOS is reliable when addresses don't change like with Pertino and ZeroTier.

Therein lies our problem.. He wants to use ZeroTier.

WTF? What problem? I just said it was reliable on ZeroTier.

I knew what you meant but after reading what he responded and reading your post again I figured out that the word order could be emphasized differently to make it sound like you were saying that they were an example of stable OR an example of unstable.

dafyre

@scottalanmiller said in ZeroTier Question:

@dafyre said in ZeroTier Question:

@Dashrender said in ZeroTier Question:

@WLS-ITGuy said in ZeroTier Question:

@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works

It's not about handling routing because there would be no route.

Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10

If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.

And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.

In what way? If the wrong DNS is being grabbed, how does the extra complexity of the gateway make it easier?

In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.

Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out... This is where the complexity pays for itself, to me. We don't have to do any fancy DNS hijacking like Pertino does.

JaredBusch

All of the above said, it is best to setup DNS.

But you have to be aware of what you are doing and the side effects it will have, as well as the extra work it will entail.