ZeroTier Question
-
@Dashrender said in ZeroTier Question:
Sounds like you have a DNS issue. You might not be able to use short NetBIOS type names.. you might have to move to FQDN instead.
For example, if you're at StarBucks and the DHCP server gives a suffix of starbucks.com out with the IP, and you ping server1, your system might be pinging server1.starbucks.com instead of server1.yourdomain.com
I missed this or it didn't click. So you're saying that I might have to go to wls-dc01.wls.wels.net instead of WLS-DC01, correct?
-
Also, if I ping another server from off site I get this:
-
You need to go into the NIC settings for your ZT adapter and specify the ZT IP address of you internal DNS server...
What is happening is your ping / nslookup from off-site is using whatever DNS servers your ISP gives you.
Both of the IP addresses that I pointed to are the ZT IP addresses of my internal DNS servers.
-
@dafyre said in ZeroTier Question:
You need to go into the NIC settings for your ZT adapter and specify the ZT IP address of you internal DNS server...
What is happening is your ping / nslookup from off-site is using whatever DNS servers your ISP gives you.
Both of the IP addresses that I pointed to are the ZT IP addresses of my internal DNS servers.
DUDE! YOU ARE A GENIUS! <---Absoluetely no sarcasm
-
@WLS-ITGuy said in ZeroTier Question:
@dafyre said in ZeroTier Question:
You need to go into the NIC settings for your ZT adapter and specify the ZT IP address of you internal DNS server...
What is happening is your ping / nslookup from off-site is using whatever DNS servers your ISP gives you.
Both of the IP addresses that I pointed to are the ZT IP addresses of my internal DNS servers.
DUDE! YOU ARE A GENIUS! <---Absoluetely no sarcasm
This goes back to what I was saying earlier though... Your AD servers may have two IP addresses for everything... so if you ping ad01.mydomain.net, you might get the internal IP address... and that is fine if you are on site.
If you are off-site and your DNS server returns the internal IP, stuff still ain't gonna work.
Edit: Thanks for the Kudos.
-
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
-
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
ZT will only run traffic across its NIC that falls on the ZT IP Range. So if you DNS Server returns 172.16.10.100 and your ZT Network is 192.168.100.x ... Your ZT Network won't know how to get you to the 172 network.
-
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
-
@WLS-ITGuy said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
Sounds like you have a DNS issue. You might not be able to use short NetBIOS type names.. you might have to move to FQDN instead.
For example, if you're at StarBucks and the DHCP server gives a suffix of starbucks.com out with the IP, and you ping server1, your system might be pinging server1.starbucks.com instead of server1.yourdomain.com
I missed this or it didn't click. So you're saying that I might have to go to wls-dc01.wls.wels.net instead of WLS-DC01, correct?
Yes this is exactly what I meant.
-
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
-
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.
-
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
-
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
This is from a single user at his home.
-
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.
If I put the ZT IP Addresses in the ZT NIC I won't need to do this, yes?
-
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
But where did the 198.105.x.x IP come from? that is not anywhere on the OP's network (that we know of). When I ping that FQDN here I get could not fined host.
-
@WLS-ITGuy said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.
If I put the ZT IP Addresses in the ZT NIC I won't need to do this, yes?
What happens when your user is at home... and gets a 172.16 IP address... and your ZT IP range is 192.168.130.xx?
It's just like me and Dash were telling you a minute ago... It's not going to know how to find the 172 network.
-
@Dashrender said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
But where did the 198.105.x.x IP come from? that is not anywhere on the OP's network (that we know of). When I ping that FQDN here I get could not fined host.
Good point... Could it be from an old web host, or an old internal DNS entry for something?
Edit: Let us further muddy the waters... I get a totally different 198 address...
-
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
But where did the 198.105.x.x IP come from? that is not anywhere on the OP's network (that we know of). When I ping that FQDN here I get could not fined host.
Good point... Could it be from an old web host, or an old internal DNS entry for something?
Sure it could be, but if pinging that server while in the office gets the correct IP, you'd assume the DNS servers in the office would be giving the same response in all places, internal and external.
-
@Dashrender said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
But where did the 198.105.x.x IP come from? that is not anywhere on the OP's network (that we know of). When I ping that FQDN here I get could not fined host.
Good point... Could it be from an old web host, or an old internal DNS entry for something?
Sure it could be, but if pinging that server while in the office gets the correct IP, you'd assume the DNS servers in the office would be giving the same response in all places, internal and external.
Except in the case of the end-user's machine not actually hitting the internal DNS, maybe?
-
I don't know where that 198.105.x.x ip is coming from which is why I asked about the DNS/Office 365 thing.
It is not an IP here on campus that is for sure.
