ZeroTier Question
-
@adam-ierymenko
I have to assume this DNS problem exists for everyone, not just windows domains.You're on a linux laptop at star bucks. You want to access resources that are only known by internal DNS within your organization. So the DNS requests must be sent to the companies internal DNS first. If that server fails, then failover to the DNS provided by Star Bucks.
-
@Dashrender said in ZeroTier Question:
@adam-ierymenko
I have to assume this DNS problem exists for everyone, not just windows domains.You're on a linux laptop at star bucks. You want to access resources that are only known by internal DNS within your organization. So the DNS requests must be sent to the companies internal DNS first. If that server fails, then failover to the DNS provided by Star Bucks.
In Linux, you'd make sure the ZT DNS is the first one in the list in /etc/resolv.conf [and wherever else you have to specify it to make it actually stay at reboots].
-
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
@Dashrender ZT does precisely nothing to DNS... at least right now.
How do set the resolver to make it use the domain's(inside ZT) DNS first, and the NIC's DHCP assigned DNS second?
In Windows, you assign the ZT IP address of the DNS server in the interface properties (see my images from earlier) and then just make sure that the ZT Nic is at the top of the order.
Right, I was really asking a rhetorical question (or more accurately - one that we already answered). This as mentioned in my previous post, this isn't a Windows only problem - but a problem for anyone where the internet DNS servers can't answer DNS queries correctly, because the answers aren't on the public internet.
Considering how fundamental this issue is after you actually get traffic flowing over the solution, I'm a bit surprised there isn't specific documentation as part of the project to solve this problem.
If the ZT personal aren't running into this issue - why aren't they?
Is it because they have no internal/private network? All DNS is public DNS, so any DNS talking to the world will get the requested information? How are you registering the ZT IPs in that DNS setup?
I realize this post my be construed as mean - please understand that I simply see it as a hard question - one of the things that makes SDNs hard.
Clearly with Pertino they had to do some black magic vudu to make it work.
-
@Dashrender Pertino as far as I know implemented some kind of local split brain DNS proxy. That's not quite black magic but it's a pain.
What we do is to actually put private ZT IPs in our public DNS, e.g.
<host>.int.zerotier.comwhereint.zerotier.comis the internal LAN. But I'm not sure that'll work for Active Directory. -
DNS is fundamentally not designed for concurrent use on more than one network.
-
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
-
@JaredBusch said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
While I do not disagree with you... The problem is (at least in my opinion) an easy to fix problem... Give the DNS the ability to separate stuff out... a DHCP server can do it... why not DNS? Programatically, it's not that different (not the same, by any stretch of the imagination)... but definitely doable.
-
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
While I do not disagree with you... The problem is (at least in my opinion) an easy to fix problem... Give the DNS the ability to separate stuff out... a DHCP server can do it... why not DNS? Programatically, it's not that different (not the same, by any stretch of the imagination)... but definitely doable.
I agree with this idea, but it would require RFCs to get done.
-
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
While I do not disagree with you... The problem is (at least in my opinion) an easy to fix problem... Give the DNS the ability to separate stuff out... a DHCP server can do it... why not DNS? Programatically, it's not that different (not the same, by any stretch of the imagination)... but definitely doable.
That is most certainly not an easy fix. You are saying that the entire DNS design be rewrote, discussed, tested, ratified, and then rolled out to every device on the planet that uses DNS.
Hello, reality much?
-
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
While I do not disagree with you... The problem is (at least in my opinion) an easy to fix problem... Give the DNS the ability to separate stuff out... a DHCP server can do it... why not DNS? Programatically, it's not that different (not the same, by any stretch of the imagination)... but definitely doable.
There is a huge difference here, DHCP is handing out requests in their respective scopes to allow network communications beyond layer 2.
DNS allows things to be found and Unifies Networks, It's assumed there there is routing setup between any and all the network in DNS, DNS is not "smart" in anyway it just response back with what it knows. It doesn't care who's asking.. What you are saying is filtering DNS based on subnet and that gets very complex and likely will be cases where it causes issues.
-
@dafyre said in ZeroTier Question:
... that can cause issues with DNS giving out internal IP addresses rather than ZT IP addresses ...
I think it is better to think of them as the "underlying" IP addresses.
-
@Dashrender said in ZeroTier Question:
@adam-ierymenko
I have to assume this DNS problem exists for everyone, not just windows domains.You're on a linux laptop at star bucks. You want to access resources that are only known by internal DNS within your organization. So the DNS requests must be sent to the companies internal DNS first. If that server fails, then failover to the DNS provided by Star Bucks.
But why? DNS works just fine as it is. Why would you want to "failover" to another DNS server? If the internal DNS fails to find what you are looking for, it should not exist. Under what situation would you look up an address that your own DNS server cannot find? And if your own DNS server can't find it, why would you want Starbuck's insecure DNS server returning things transparently to your end users as if it had returned something? that's a security issue that DNS doesn't have today.
-
The above idea would be a client side work around to domain overriding and the authoritative domains system. It would bypass security systems and be dangerous. It would mean that things like OpenDNS could not work.
-
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
While I do not disagree with you... The problem is (at least in my opinion) an easy to fix problem... Give the DNS the ability to separate stuff out... a DHCP server can do it... why not DNS? Programatically, it's not that different (not the same, by any stretch of the imagination)... but definitely doable.
Separate out in what way? How would you define it? DNS has a very rigid and reliable structure today that was designed carefully. DNS servers can, if you want to get one that can be modified, hand out different responses based on different request criteria today, but no one does this as it's so uncommonly needed. There are better fixes to nearly any host resolution issue.
-
@scottalanmiller said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
While I do not disagree with you... The problem is (at least in my opinion) an easy to fix problem... Give the DNS the ability to separate stuff out... a DHCP server can do it... why not DNS? Programatically, it's not that different (not the same, by any stretch of the imagination)... but definitely doable.
Separate out in what way? How would you define it? DNS has a very rigid and reliable structure today that was designed carefully. DNS servers can, if you want to get one that can be modified, hand out different responses based on different request criteria today, but no one does this as it's so uncommonly needed. There are better fixes to nearly any host resolution issue.
I could have better worded that... a DHCP Server adjusts its responses based on incoming criteria... If it comes in on ETH1, then give out 192.168.10.x ... If it comes in on ETH2, give out 192.168.99.x (or VLANs or what-not).
You just said what I said... DNS servers could be modified to do this. While it may be uncommonly needed...I can see uses in just about every IT job I've had.
-
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
While I do not disagree with you... The problem is (at least in my opinion) an easy to fix problem... Give the DNS the ability to separate stuff out... a DHCP server can do it... why not DNS? Programatically, it's not that different (not the same, by any stretch of the imagination)... but definitely doable.
That is most certainly not an easy fix. You are saying that the entire DNS design be rewrote, discussed, tested, ratified, and then rolled out to every device on the planet that uses DNS.
Hello, reality much?
If I were a programmer, I'd fix it for you. That is also why I specified it is PROGRAMAATICALLY not that different or difficult. And I'm not talking about rewriting the entire DNS RFC or anything like that. I am speaking to specific software based features. Software can be modified without having to rewrite the entire protocol stack from scratch.
You start talking about ratification and all that mess, that's for the paper pushers and think tanks. I've no interest in that, I am simply talking about adding a feature into a piece of software... If every other device on the planet wants to keep doing DNS the old way, it doesn't break anything.
-
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
While I do not disagree with you... The problem is (at least in my opinion) an easy to fix problem... Give the DNS the ability to separate stuff out... a DHCP server can do it... why not DNS? Programatically, it's not that different (not the same, by any stretch of the imagination)... but definitely doable.
That is most certainly not an easy fix. You are saying that the entire DNS design be rewrote, discussed, tested, ratified, and then rolled out to every device on the planet that uses DNS.
Hello, reality much?
If I were a programmer, I'd fix it for you. That is also why I specified it is PROGRAMAATICALLY not that different or difficult. And I'm not talking about rewriting the entire DNS RFC or anything like that. I am speaking to specific software based features. Software can be modified without having to rewrite the entire protocol stack from scratch.
You start talking about ratification and all that mess, that's for the paper pushers and think tanks. I've no interest in that, I am simply talking about adding a feature into a piece of software... If every other device on the planet wants to keep doing DNS the old way, it doesn't break anything.
Well in that case, you're talking about ZT installing it's own DNS solution that your machine is forced to use, and removing the responsibility from typical DNS servers - but I don't know how that would work either... so now I think I hear you saying that ZT would need to make a stand alone ZT DNS server that knows how to response correctly - one of these solutions is kinda what Pertino did.
-
@scottalanmiller said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
I suppose my other option is to do mapped drives via ZT IP address and remove the static DNS.
And hosts files work great, too.
So I am getting a few users (2 to be exact) who are still experiencing issues. I made the A record for the exchange server, and verified that it indeed has ZT on it.
As I have never messed with Host file records, how does one put a pointer in there?
<A Record name> <ZT IP ADDRESS>
?
-
@Dashrender said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@JaredBusch said in ZeroTier Question:
@adam.ierymenko said in ZeroTier Question:
DNS is fundamentally not designed for concurrent use on more than one network.
This exactly. And the problem is that people keep trying to make it do it.
While I do not disagree with you... The problem is (at least in my opinion) an easy to fix problem... Give the DNS the ability to separate stuff out... a DHCP server can do it... why not DNS? Programatically, it's not that different (not the same, by any stretch of the imagination)... but definitely doable.
That is most certainly not an easy fix. You are saying that the entire DNS design be rewrote, discussed, tested, ratified, and then rolled out to every device on the planet that uses DNS.
Hello, reality much?
If I were a programmer, I'd fix it for you. That is also why I specified it is PROGRAMAATICALLY not that different or difficult. And I'm not talking about rewriting the entire DNS RFC or anything like that. I am speaking to specific software based features. Software can be modified without having to rewrite the entire protocol stack from scratch.
You start talking about ratification and all that mess, that's for the paper pushers and think tanks. I've no interest in that, I am simply talking about adding a feature into a piece of software... If every other device on the planet wants to keep doing DNS the old way, it doesn't break anything.
Well in that case, you're talking about ZT installing it's own DNS solution that your machine is forced to use, and removing the responsibility from typical DNS servers - but I don't know how that would work either... so now I think I hear you saying that ZT would need to make a stand alone ZT DNS server that knows how to response correctly - one of these solutions is kinda what Pertino did.
It seems like I remember a few Pertino folks on here having some issues with Pertino and DNS...
I'm not talking about having ZT write their own dns solution. I'm talking about modifying existing software to fix problems like this... Microsoft calls it DNS Policies and it's coming in Server 2016 (https://blogs.technet.microsoft.com/networking/2015/05/12/split-brain-dns-deployment-using-windows-dns-server-policies/)
-
@WLS-ITGuy said in ZeroTier Question:
@scottalanmiller said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
I suppose my other option is to do mapped drives via ZT IP address and remove the static DNS.
And hosts files work great, too.
So I am getting a few users (2 to be exact) who are still experiencing issues. I made the A record for the exchange server, and verified that it indeed has ZT on it.
As I have never messed with Host file records, how does one put a pointer in there?
<A Record name> <ZT IP ADDRESS>
?
In Windows, it goes the other way...
zt_ip_address hostname.mydomain.org
