ZeroTier: is this a good time to use...
-
@dafyre said:
Wow... 3 pages of replies already, lol.
There's a few things to note... If you install ZeroTier on a device that is part of active directory, by default, it will add the ZeroTier IP address into AD's DNS servers.
To fix that, you go into the Windows Adapters list, and edit the ZT Adapter, and set the IP address, and DNS to "use dhcp" -- they'll just be blank to start with. Then you go in and uncheck the "Register this connection's address in dns" checkbox, and check your DNS server to make sure your ZT IP address is gone.
If you do not do that, any client device has a potential to get the ZT IP address of your server, and that will cause problems.
Did they fix that - the last time I tried it I couldn't get the adapter to stop registering with DNS - FYI, the server in question was a DC running DNS locally.
-
@scottalanmiller said:
@dafyre said:
If you do not do that, any client device has a potential to get the ZT IP address of your server, and that will cause problems.
What issue have you seen there?
The issue this caused me was that my computer that don't have ZT installed would attempt to connect to the ZT IP instead of the LAN IP.
I'm assuming DNS was answering requests in a round robin effect and causing the problem.
I realize that the desire with ZT is that all machines should be running ZT - but I wasn't ready to pull that trigger.
-
@Dashrender said:
@scottalanmiller said:
@dafyre said:
If you do not do that, any client device has a potential to get the ZT IP address of your server, and that will cause problems.
What issue have you seen there?
The issue this caused me was that my computer that don't have ZT installed would attempt to connect to the ZT IP instead of the LAN IP.
I'm assuming DNS was answering requests in a round robin effect and causing the problem.
This is exactly the problem. I work around it by setting up a DNS server on the ZT IP range using DNSMasq and telling it to not register.
-
@dafyre said:
@Dashrender said:
@scottalanmiller said:
@dafyre said:
If you do not do that, any client device has a potential to get the ZT IP address of your server, and that will cause problems.
What issue have you seen there?
The issue this caused me was that my computer that don't have ZT installed would attempt to connect to the ZT IP instead of the LAN IP.
I'm assuming DNS was answering requests in a round robin effect and causing the problem.
This is exactly the problem. I work around it by setting up a DNS server on the ZT IP range using DNSMasq and telling it to not register.
In this case, you have to manually manage all DNS entries, right? so no chance of using IPv6?
-
@Dashrender said:
In this case, you have to manually manage all DNS entries, right? so no chance of using IPv6?
Does that rule out IPv6?
-
@Dashrender said:
@dafyre said:
@Dashrender said:
@scottalanmiller said:
@dafyre said:
If you do not do that, any client device has a potential to get the ZT IP address of your server, and that will cause problems.
What issue have you seen there?
The issue this caused me was that my computer that don't have ZT installed would attempt to connect to the ZT IP instead of the LAN IP.
I'm assuming DNS was answering requests in a round robin effect and causing the problem.
This is exactly the problem. I work around it by setting up a DNS server on the ZT IP range using DNSMasq and telling it to not register.
In this case, you have to manually manage all DNS entries, right? so no chance of using IPv6?
You do have to manage DNS entries, but that doesn't necessarily rule out IPv6. I'm not sure if DNSMasq is compatible with it or not.
ZT, AFAIK does support IPv6.
-
ZT's site says that it does IPv6, I saw that this week.
-
@scottalanmiller said:
ZT's site says that it does IPv6, I saw that this week.
If that is the case, then all you need is a DNS Server that supports IPv6.
I think DNSMasq should work, as it just looks in the /etc/hosts file.
-
I'm not questioning wither or not ZT supports IPv6, I'd be surprised if it didn't. But the use of IPv6 is largely predicated on the use of DNS.
I suppose if you only worry about putting servers IPv6 addresses in DNS, then you're probably OK manually handling that - but if you have to do that for endpoints coming and going all the time, then you'll need to give up DHCP so that endpoint IPv6's aren't changing all the time.
I'm thinking about the use of something like WSUS inside ZT where WSUS relies on DNS for endpoint connections.
-
@Dashrender said:
I'm thinking about the use of something like WSUS inside ZT where WSUS relies on DNS for endpoint connections.
WSUS = Windows Server Update Services?
-
@Dashrender said:
then you'll need to give up DHCP so that endpoint IPv6's aren't changing all the time.
<snip>ZT assigns addresses for you. From what I have seen once it has assigned an IP address to a device, that IP does not change.
-
@dafyre said:
@Dashrender said:
then you'll need to give up DHCP so that endpoint IPv6's aren't changing all the time.
<snip>ZT assigns addresses for you. From what I have seen once it has assigned an IP address to a device, that IP does not change.
Once my DHCP server assigns an IP address it also never changes - well, until it does. lol
-
@FATeknollogee said:
@Dashrender said:
I'm thinking about the use of something like WSUS inside ZT where WSUS relies on DNS for endpoint connections.
WSUS = Windows Server Update Services?
Yes.
-
@Dashrender said:
@dafyre said:
@Dashrender said:
then you'll need to give up DHCP so that endpoint IPv6's aren't changing all the time.
<snip>ZT assigns addresses for you. From what I have seen once it has assigned an IP address to a device, that IP does not change.
Once my DHCP server assigns an IP address it also never changes - well, until it does. lol
Do you have your own DHCP server that handles giving out IP addresses for your ZT network?
-
@Dashrender said:
I suppose if you only worry about putting servers IPv6 addresses in DNS, then you're probably OK manually handling that - but if you have to do that for endpoints coming and going all the time, then you'll need to give up DHCP ...
If you let ZT assign IP addresses to the devices on the ZT network, those won't change. So when a device "comes and goes" it will always keep the same ZT IP address no matter where it is connected from.
-
I suppose that ZT could be having their DHCP assign static like addresses. So this may not be an issue on ZT.
I was talking a bit more generically for my DHCP server on my LAN - if a laptop stays off beyond my 8 lease, that IP will be assigned to something else.
Have you disconnected something from ZT for say 20 days and ensured when it came back online that it got the same IP?
-
@Dashrender said:
I was talking a bit more generically for my DHCP server on my LAN - if a laptop stays off beyond my 8 lease, that IP will be assigned to something else.
What's the use case for doing that, though?
-
@Dashrender said:
I suppose that ZT could be having their DHCP assign static like addresses. So this may not be an issue on ZT.
I was talking a bit more generically for my DHCP server on my LAN - if a laptop stays off beyond my 8 lease, that IP will be assigned to something else.
Have you disconnected something from ZT for say 20 days and ensured when it came back online that it got the same IP?
Not quite that long, lol. But I have gone a week or two. It does "DHCP" not really true DHCP. Once I connect my laptop up, it associates that laptop with 192.168.100.5, and until I delete the laptop from my list of ZT devices, it will always get 100.5 -- that's the way it appears to work.
-
@scottalanmiller said:
@Dashrender said:
I was talking a bit more generically for my DHCP server on my LAN - if a laptop stays off beyond my 8 lease, that IP will be assigned to something else.
What's the use case for doing that, though?
What do you mean? This is the default way windows DHCP works. After the IP lease expires, it simply goes back into the pool.
-
@scottalanmiller said:
@Dashrender said:
I was talking a bit more generically for my DHCP server on my LAN - if a laptop stays off beyond my 8 lease, that IP will be assigned to something else.
What's the use case for doing that, though?
He's talking about generic DHCP on a LAN.
