ZeroTier Review
-
That's awesome. Thanks so much! I'll give this a shot when I get some time today. I'm glad it wasn't just me that couldn't get it through the cli, I think their ReadMe's need some more direction.
-
@johnhooks Very much so, lol. I think they have an admin bit in the works, but I'm not sure if it will be part of the client package or a separate download or what they are going to do with it yet.
-
How did you allow bridging? Just using their hosted account, I checked the box but I can't see any other devices on the network.
-
I treated it as a routed network. So I built a Fedora 22 VM, enabled IP Forwarding and set up the routes on my remote client to my home network via the ztRouter's zt ip addeess.
And then on my home router, I added a route to my Zerotier ip range via the LAN address of my Zerotier router.
Clear as mud?
-
@dafyre said:
I treated it as a routed network. So I built a Fedora 22 VM, enabled IP Forwarding and set up the routes on my remote client to my home network via the ztRouter's zt ip addeess.
And then on my home router, I added a route to my Zerotier ip range via the LAN address of my Zerotier router.
Clear as mud?
Ha :-P. I just figured they had the function built in since there was an option for it. I'll give it a shot.
I was thinking of setting this up at a doctors office because they need a new VPN between the hospital billing and their office. The hospital said a site to site VPN isn't an option, so I figured this might be easier.
-
@dafyre said:
I treated it as a routed network. So I built a Fedora 22 VM, enabled IP Forwarding and set up the routes on my remote client to my home network via the ztRouter's zt ip addeess.
And then on my home router, I added a route to my Zerotier ip range via the LAN address of my Zerotier router.
Clear as mud?
Did you create a bridge before you set up the routes or did you just use the actual interface?
-
@johnhooks said:
@dafyre said:
I treated it as a routed network. So I built a Fedora 22 VM, enabled IP Forwarding and set up the routes on my remote client to my home network via the ztRouter's zt ip addeess.
And then on my home router, I added a route to my Zerotier ip range via the LAN address of my Zerotier router.
Clear as mud?
Ha :-P. I just figured they had the function built in since there was an option for it. I'll give it a shot.
I was thinking of setting this up at a doctors office because they need a new VPN between the hospital billing and their office. The hospital said a site to site VPN isn't an option, so I figured this might be easier.
Why is a Site to Site VPN not an option? If you use this site to site VPN, you would have a site to site VPN. Do you see my confusion? If the hospital thinks that this is not an option, why would this be an option?
-
@scottalanmiller said:
@johnhooks said:
@dafyre said:
I treated it as a routed network. So I built a Fedora 22 VM, enabled IP Forwarding and set up the routes on my remote client to my home network via the ztRouter's zt ip addeess.
And then on my home router, I added a route to my Zerotier ip range via the LAN address of my Zerotier router.
Clear as mud?
Ha :-P. I just figured they had the function built in since there was an option for it. I'll give it a shot.
I was thinking of setting this up at a doctors office because they need a new VPN between the hospital billing and their office. The hospital said a site to site VPN isn't an option, so I figured this might be easier.
Why is a Site to Site VPN not an option? If you use this site to site VPN, you would have a site to site VPN. Do you see my confusion? If the hospital thinks that this is not an option, why would this be an option?
You can do this without site to site. Just have peers connect. All the controller does is allow connections. If you set this up and delete the controller, everything still works.
I don't understand why a site to site is not an option. It would make all of this easier, but that's what I was told. So I was thinking either this or set up an edgerouter with L2TP. He should probably have a new router anyway.
-
@johnhooks said:
@scottalanmiller said:
@johnhooks said:
@dafyre said:
I treated it as a routed network. So I built a Fedora 22 VM, enabled IP Forwarding and set up the routes on my remote client to my home network via the ztRouter's zt ip addeess.
And then on my home router, I added a route to my Zerotier ip range via the LAN address of my Zerotier router.
Clear as mud?
Ha :-P. I just figured they had the function built in since there was an option for it. I'll give it a shot.
I was thinking of setting this up at a doctors office because they need a new VPN between the hospital billing and their office. The hospital said a site to site VPN isn't an option, so I figured this might be easier.
Why is a Site to Site VPN not an option? If you use this site to site VPN, you would have a site to site VPN. Do you see my confusion? If the hospital thinks that this is not an option, why would this be an option?
You can do this without site to site. Just have peers connect. All the controller does is allow connections. If you set this up and delete the controller, everything still works.
I don't understand why a site to site is not an option. It would make all of this easier, but that's what I was told. So I was thinking either this or set up an edgerouter with L2TP. He should probably have a new router anyway.
So site to peers?
-
@scottalanmiller said:
@johnhooks said:
@scottalanmiller said:
@johnhooks said:
@dafyre said:
I treated it as a routed network. So I built a Fedora 22 VM, enabled IP Forwarding and set up the routes on my remote client to my home network via the ztRouter's zt ip addeess.
And then on my home router, I added a route to my Zerotier ip range via the LAN address of my Zerotier router.
Clear as mud?
Ha :-P. I just figured they had the function built in since there was an option for it. I'll give it a shot.
I was thinking of setting this up at a doctors office because they need a new VPN between the hospital billing and their office. The hospital said a site to site VPN isn't an option, so I figured this might be easier.
Why is a Site to Site VPN not an option? If you use this site to site VPN, you would have a site to site VPN. Do you see my confusion? If the hospital thinks that this is not an option, why would this be an option?
You can do this without site to site. Just have peers connect. All the controller does is allow connections. If you set this up and delete the controller, everything still works.
I don't understand why a site to site is not an option. It would make all of this easier, but that's what I was told. So I was thinking either this or set up an edgerouter with L2TP. He should probably have a new router anyway.
So site to peers?
Yes. I was planning on having a peer at the office in bridge mode which forwards requests to the office and out of the office. Then just have clients at the billing office join and disconnect from the network as needed.
I managed to get everything working in a test environment, but I'm leaning more towards an edgerouter now.
-
@johnhooks said:
Yes. I was planning on having a peer at the office in bridge mode which forwards requests to the office and out of the office.
That works. So the problem is that the one side can't be connected to the other. A A can see all of B, but B can't see all of A?
-
@scottalanmiller said:
@johnhooks said:
Yes. I was planning on having a peer at the office in bridge mode which forwards requests to the office and out of the office.
That works. So the problem is that the one side can't be connected to the other. A A can see all of B, but B can't see all of A?
Well I'm not even sure if that's a stipulation. In my experience with this hospital before, I believe it's just because they don't want to do anything on their end. I had set up a client to connect to his existing Cisco router. It works everywhere outside of the hospital's network but they essentially wouldn't attempt to figure out why. That's when I asked if we could do a site to site tunnel and they said "that's not going to happen." So I needed a client/server set up. This will work and is east to connect to but I think the edgerouter will be nicer.
-
@johnhooks said:
Well I'm not even sure if that's a stipulation. In my experience with this hospital before, I believe it's just because they don't want to do anything on their end.
Isn't site to site the "least to do on their end" solution?
-
@scottalanmiller said:
@johnhooks said:
Well I'm not even sure if that's a stipulation. In my experience with this hospital before, I believe it's just because they don't want to do anything on their end.
Isn't site to site the "least to do on their end" solution?
You would think. So we will have to install the client on each billing computer and then they will have to manually connect and disconnect.
This is a hospital that is still using the records system they wrote in DOS and I'm willing to bet dollars to donuts that it's sent via HTTP over the internet from the offices to the hospital. The doctors just run this small application that sends all of the info to the hospital address. I never inspected, but Ive set it up and never had to create or install any certificates.
-
@johnhooks said:
You would think. So we will have to install the client on each billing computer and then they will have to manually connect and disconnect.
Seems their required solution is the opposite of their stated goals.
I need a car but you must only buy a boat.
-
@johnhooks said:
This is a hospital that is still using the records system they wrote in DOS and I'm willing to bet dollars to donuts that it's sent via HTTP over the internet from the offices to the hospital.
Seems unlikely. The gap between DOS was a viable OS and when HTTP was a viable transfer protocol was pretty huge. I suspect they are using something far, far older.
-
@scottalanmiller said:
@johnhooks said:
This is a hospital that is still using the records system they wrote in DOS and I'm willing to bet dollars to donuts that it's sent via HTTP over the internet from the offices to the hospital.
Seems unlikely. The gap between DOS was a viable OS and when HTTP was a viable transfer protocol was pretty huge. I suspect they are using something far, far older.
Well that's even worse then. They are supposed to switch over to the system that this doctors office uses. So I'm sure I'll be in for some fun when the switch happens.
-
That will be a big shock coming from DOS! What OS are they running the app on now? XP, I assume?
-
@scottalanmiller said:
That will be a big shock coming from DOS! What OS are they running the app on now? XP, I assume?
Well I'm not sure about in the hospital itself. They send out discs with updates to the doctors offices so it does run on 7 in the doctors office.
-
@johnhooks I activated the bridging functionality within ZeroTier when I created the network, and then authorized the client (at my destination network) to be a bridge, and then I set up the route on my remote ztClient.... I should probably draw it out, lol.
I did have to set up a Linux VM to get the routing to work right. Windows doesn't do routing without having to install RRAS, and I didn't feel like settingall that up (and I had a fresh Fedora VM with nothing on it anyway, lol)...
... |---(Llinksys, NAT)---- (public internet)--------------(remote client, 192.168.251.49/24, zt0)
(SITE A)--|
... |--(SITE A LAN, 192.168.10.0/24)--(192.168.10.10/24, eth0)--ztRouter(192.168.251.179/24, zt0)On my Linksys, I added a route to 192.168.251.0/24 via 192.168.10.10.
On the remote client, I added a route to 192.168.10.0/24 via 192.68.251.179
