ZeroTier Question
-
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.
Why. You keep saying this and I keep telling you that it is a bad idea.
I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.
What are you using to do that? Your windows AD DNS?
Nothing. ZeroTier passes NetBIOS. This is really basic.
Yes it does. In my experience, over VPN type techs (like Pertino, ZT, OpenVPN, etc), Netbios has not been reliable.
NetBIOS is reliable when addresses don't change like with Pertino and ZeroTier.
Therein lies our problem.. He wants to use ZeroTier.
He meant that Pertino and ZeroTier are places where the IP does not change. Their addresses are stable. Unlike many traditional VPN services.
-
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
Connect him up via ZeroTier, and set your DNS Server's ZT IP on the zt Nic, and you should be good to go.
Why. You keep saying this and I keep telling you that it is a bad idea.
I have ZeroTier running and it resolves ZeroTier IP addresses with no DNS modifications.
What are you using to do that? Your windows AD DNS?
Nothing. ZeroTier passes NetBIOS. This is really basic.
Yes it does. In my experience, over VPN type techs (like Pertino, ZT, OpenVPN, etc), Netbios has not been reliable.
NetBIOS is reliable when addresses don't change like with Pertino and ZeroTier.
Therein lies our problem.. He wants to use ZeroTier.
WTF? What problem? I just said it was reliable on ZeroTier.
I knew what you meant but after reading what he responded and reading your post again I figured out that the word order could be emphasized differently to make it sound like you were saying that they were an example of stable OR an example of unstable.
-
@scottalanmiller said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.
In what way? If the wrong DNS is being grabbed, how does the extra complexity of the gateway make it easier?
In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.
Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out... This is where the complexity pays for itself, to me. We don't have to do any fancy DNS hijacking like Pertino does.
-
All of the above said, it is best to setup DNS.
But you have to be aware of what you are doing and the side effects it will have, as well as the extra work it will entail.
-
@JaredBusch said in ZeroTier Question:
All of the above said, it is best to setup DNS.
But you have to be aware of what you are doing and the side effects it will have, as well as the extra work it will entail.
^ This, for sure.
-
@dafyre said in ZeroTier Question:
In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.
Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out... This is where the complexity pays for itself, to me. We don't have to do any fancy DNS hijacking like Pertino does.
I see, because you are not layering IPs for the servers, only for some of the clients.
-
@dafyre said in ZeroTier Question:
@scottalanmiller said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.
In what way? If the wrong DNS is being grabbed, how does the extra complexity of the gateway make it easier?
In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.
Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out.
That is not being talked about anywhere in this thread. Why would you suddenly curve this into something like that.
While it certainly is something that can be setup, let's not detract from the point at hand.
-
@scottalanmiller said in ZeroTier Question:
@dafyre said in ZeroTier Question:
In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.
Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out... This is where the complexity pays for itself, to me. We don't have to do any fancy DNS hijacking like Pertino does.
I see, because you are not layering IPs for the servers, only for some of the clients.
Exactly.
-
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@scottalanmiller said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.
In what way? If the wrong DNS is being grabbed, how does the extra complexity of the gateway make it easier?
In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.
Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out.
That is not being talked about anywhere in this thread. Why would you suddenly curve this into something like that.
While it certainly is something that can be setup, let's not detract from the point at hand.
Scott asked the question, and I answered.
-
HOLY HELL! That was a Shit ton of responses.
Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?
Reading through the last few posts my eyes were going wacko!
-
@WLS-ITGuy said in ZeroTier Question:
HOLY HELL! That was a Shit ton of responses.
It's a very active place
-
@WLS-ITGuy said in ZeroTier Question:
Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?
Setting them as DNS? That seems like a good solid fix. So you are getting reliably good DNS results now? I think that you are good to go
-
@scottalanmiller said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?
Setting them as DNS? That seems like a good solid fix. So you are getting reliably good DNS results now? I think that you are good to go
Right, but you need to be aware that your internal DNS server will now be queried for everything and return results appropriately.
-
@JaredBusch Won't it look at ZT first, realize it isn't on the ZT network, and then dump off to the end users ISP?
-
@WLS-ITGuy said in ZeroTier Question:
@JaredBusch Won't it look at ZT first, realize it isn't on the ZT network, and then dump off to the end users ISP?
Not for DNS. DNS queries happen only once. And it WILL be on the DNS server if it is set up correctly for the office to work.
-
@scottalanmiller I was thinking Gateway
-
@scottalanmiller said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?
Setting them as DNS? That seems like a good solid fix. So you are getting reliably good DNS results now? I think that you are good to go
I see a problem - How does the mobile PC find the ZT controller when it out and about? When will the mobile PC decide to use the DNS servers provided by the real network card vs using the DNS provided by the ZT adapters?
You really do need/want both to be able to work. So you go to a new location, you connect to their network, your computer needs to use DNS to find the ZT controller on the internet (unless they are considered static and the ZT software just has an IP for the controller - then nevermind), but assuming it's not FQDN based for controllers, you'll need to use the physical NICs DNS to find the controller, then after you ZT network is up, you can switch full time over to use the domain's DNS for anything/everything.
-
@WLS-ITGuy said in ZeroTier Question:
@JaredBusch Won't it look at ZT first, realize it isn't on the ZT network, and then dump off to the end users ISP?
The general traffic will not be on ZeroTier, no. But that is not what I said.
I said the DNS traffic will all be on ZeroTier. Every single lookup will go to your internal DNS server and return whatever address it knows for the query in question.
Example:
oc.domain.com returns 1.2.3.4 on public DNS.
But on my internal DNS server oc.domain.com is a CNAME for oc.domain.local which is has an internal IP of 10.202.1.12
But by ZeroTier scope is 10.202.3.0/24 and that server does not have ZeroTier on it. -
@WLS-ITGuy said in ZeroTier Question:
@scottalanmiller I was thinking Gateway
Yes, if the DNS returns a non-ZT address as the answer and it is a public IP address, it will be sent to the default gateway, not over the ZT LAN.
-
@WLS-ITGuy said in ZeroTier Question:
@JaredBusch Won't it look at ZT first, realize it isn't on the ZT network, and then dump off to the end users ISP?
For traffic, yes it will, but not for DNS queries.
