ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    ZeroTier and DNS issues

    IT Discussion
    zerotier dns vpn
    10
    176
    102.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      Dashrender
      last edited by

      So this is for someone who has a network with both Pertino enabled endpoints, and NOT enabled endpoints.

      Do you ever have an issue where a local client is trying to reach a DC that is multi-homed (local LAN and Pertino)? if so, what was the issue? was it that DNS was giving you the Pertino IP?

      1 Reply Last reply Reply Quote 0
      • D
        Dashrender @dafyre
        last edited by

        @dafyre said:

        In this instance, couldn't we just let the company DHCP assign IP addresses across the bridge?

        Assuming the bridge will pass the DHCP request to the network, that should be possible.

        I'd be more worried about the long term problem - laptop user at the office during the day, home at night - they will end up with two IP's in DNS, and two IPs taken in DHCP.

        1 Reply Last reply Reply Quote 0
        • A
          adam.ierymenko
          last edited by

          This discussion is helpful toward a product idea we've had for a long time: a very simple device that can be plugged into a physical network and will "extend" it. Basically you plug in this device and it creates a virtual ZeroTier network that you join on endpoint devices. The missing piece for us has been "what then?" How should IPs be assigned on this virtual network and what should endpoint devices do with those IPs? I think this is giving me some ideas, and they're very very interesting. Short answer: "no IPs should be assigned" and "the virtual network should shadow the physical and only be used if the physical is not available."

          1 Reply Last reply Reply Quote 0
          • A
            adam.ierymenko
            last edited by

            Basically it's virtual redundant multipath ethernet. If you've ever used network bonding, you can set two interfaces to connect to two different switches such that if one switch fails the second link takes over and traffic is not interrupted. This would be the same thing but with a virtual network as failover path.

            1 Reply Last reply Reply Quote 0
            • D
              Dashrender
              last edited by

              I don't know if this is possible, but if the ZT interface could present itself as the MAC address of the normal LAN adapter to get the same IP it would get on it's normal adapter when it's in the office, that would be cool.

              1 Reply Last reply Reply Quote 0
              • A
                adam.ierymenko
                last edited by

                That is entirely possible. Ideas in progress. 🙂

                In the short term I'm not sure what to do, but priority seems like part of the answer.

                1 Reply Last reply Reply Quote 0
                • D
                  dafyre
                  last edited by

                  What I have done on my own network at home is build my own ZeroTier router... it has 1 Interface on my LAN, and 1 x ZeroTier interface...and that ZeroTier client has the Gateway option activated.

                  And it routes to my Home Network. NB: I had to add a route to my ZeroTier IP space on my home router as well, so traffic could flow both ways...

                  IE: On my home router, I had a route for 192.168.100.0/24 (zero tier ip space) to 192.168.1.179 (LAN interface of my zero tier router).

                  On remote Client devices, I add a route to 192.168.1.0/24 via 192.168.100.179 (ZT IP addresss of my ZTRouter).

                  This seems to work. Arguably it would work better if I had more RAM to add to my VM, lol.

                  D 1 Reply Last reply Reply Quote 0
                  • D
                    Dashrender @dafyre
                    last edited by Dashrender

                    @dafyre said:

                    What I have done on my own network at home is build my own ZeroTier router... it has 1 Interface on my LAN, and 1 x ZeroTier interface...and that ZeroTier client has the Gateway option activated.

                    And it routes to my Home Network. NB: I had to add a route to my ZeroTier IP space on my home router as well, so traffic could flow both ways...

                    IE: On my home router, I had a route for 192.168.100.0/24 (zero tier ip space) to 192.168.1.179 (LAN interface of my zero tier router).

                    On remote Client devices, I add a route to 192.168.1.0/24 via 192.168.100.179 (ZT IP addresss of my ZTRouter).

                    This seems to work. Arguably it would work better if I had more RAM to add to my VM, lol.

                    This solves the routing issues.. how do you solve the DNS issue? Unless you're running a server at home, I'm guessing either you're using a Host file or IP addresses.

                    One thought - you could install DNS on the Linux router you stood up.. and create the entries you need DNS for... this would allow everything to remain separate, but would require manual maintenance.

                    1 Reply Last reply Reply Quote 0
                    • D
                      Dashrender
                      last edited by

                      What does ZeroTier use for it's DNS normally?

                      S 1 Reply Last reply Reply Quote 0
                      • A
                        adam.ierymenko
                        last edited by

                        @Dashrender Right now ZeroTier does nothing for DNS. It virtualizes at L2 and that's it. It does handle IP address management if you enable that feature, but otherwise it just moves packets around.

                        D 1 Reply Last reply Reply Quote 0
                        • S
                          scottalanmiller @Dashrender
                          last edited by

                          @Dashrender said:

                          What does ZeroTier use for it's DNS normally?

                          That Pertino actually "does" DNS is a completely unique feature and it is only available in their enterprise packages, their free and entry level packages do not offer it. I know of no one else hijacking DNS and manipulating it in that way.

                          1 Reply Last reply Reply Quote 0
                          • S
                            scottalanmiller
                            last edited by

                            It is a huge part of the power, and the expense, of Pertino.

                            1 Reply Last reply Reply Quote 0
                            • A
                              adam.ierymenko
                              last edited by

                              So let me check my understanding: Pertino hijacks and manipulates DNS in order to implement multi-path routing, modifying DNS in transit to fill in the best reachable IP address for a given device?

                              D S 2 Replies Last reply Reply Quote 0
                              • D
                                Dashrender @adam.ierymenko
                                last edited by

                                @adam.ierymenko said:

                                So let me check my understanding: Pertino hijacks and manipulates DNS in order to implement multi-path routing, modifying DNS in transit to fill in the best reachable IP address for a given device?

                                That can't be all it's doing, otherwise clients on the LAN that don't have Pertino installed would still possibly wind up with issues if the DNS server provides the Pertino IP to a LAN client.

                                S 1 Reply Last reply Reply Quote 0
                                • S
                                  scottalanmiller @adam.ierymenko
                                  last edited by

                                  @adam.ierymenko said:

                                  So let me check my understanding: Pertino hijacks and manipulates DNS in order to implement multi-path routing, modifying DNS in transit to fill in the best reachable IP address for a given device?

                                  Yes.

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    dafyre
                                    last edited by

                                    Right... but most LAN clients won't have Pertino installed, will they?

                                    S 1 Reply Last reply Reply Quote 0
                                    • S
                                      scottalanmiller @Dashrender
                                      last edited by

                                      @Dashrender said:

                                      @adam.ierymenko said:

                                      So let me check my understanding: Pertino hijacks and manipulates DNS in order to implement multi-path routing, modifying DNS in transit to fill in the best reachable IP address for a given device?

                                      That can't be all it's doing, otherwise clients on the LAN that don't have Pertino installed would still possibly wind up with issues if the DNS server provides the Pertino IP to a LAN client.

                                      If you don't have Pertino on a client, it isn't on the network at all and is useless. EVERY device on the network without Pertino would be "off the LAN."

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        scottalanmiller @dafyre
                                        last edited by

                                        @dafyre said:

                                        Right... but most LAN clients won't have Pertino installed, will they?

                                        Pertino is all or nothing. It's 100% deployment. You can't have a non-Pertino device or that device is not on your network.

                                        D 1 Reply Last reply Reply Quote 0
                                        • D
                                          Dashrender @adam.ierymenko
                                          last edited by

                                          @adam.ierymenko said:

                                          @Dashrender Right now ZeroTier does nothing for DNS. It virtualizes at L2 and that's it. It does handle IP address management if you enable that feature, but otherwise it just moves packets around.

                                          I don't understand what you mean by IP address management?

                                          I just installed it on three PCs - those three PCs where all able to ping each other, no other configuration was done. and I could ping by NetBIOS name (not sure if it DNS was involved or not). My NetBIOS names are the same as my DNS names, just missing the domain portion.

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            adam.ierymenko
                                            last edited by

                                            @Dashrender It's probably doing it outbound as well as inbound, and you probably have to run something on your AD server(s).

                                            @scottalanmiller Understood. That would indeed work -- basically it's an intra-LAN version of what Amazon Route 53 and other cloud DNS providers can do on the global Internet -- but I can think of more elegant solutions 1-2 layers down. Might explore in the near-mid term, but right now we're focused on more devops and IoT use cases.

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 3
                                            • 4
                                            • 5
                                            • 6
                                            • 7
                                            • 8
                                            • 9
                                            • 6 / 9
                                            • First post
                                              Last post