ZeroTier and DNS issues
-
So let me check my understanding: Pertino hijacks and manipulates DNS in order to implement multi-path routing, modifying DNS in transit to fill in the best reachable IP address for a given device?
-
@adam.ierymenko said:
So let me check my understanding: Pertino hijacks and manipulates DNS in order to implement multi-path routing, modifying DNS in transit to fill in the best reachable IP address for a given device?
That can't be all it's doing, otherwise clients on the LAN that don't have Pertino installed would still possibly wind up with issues if the DNS server provides the Pertino IP to a LAN client.
-
@adam.ierymenko said:
So let me check my understanding: Pertino hijacks and manipulates DNS in order to implement multi-path routing, modifying DNS in transit to fill in the best reachable IP address for a given device?
Yes.
-
Right... but most LAN clients won't have Pertino installed, will they?
-
@Dashrender said:
@adam.ierymenko said:
So let me check my understanding: Pertino hijacks and manipulates DNS in order to implement multi-path routing, modifying DNS in transit to fill in the best reachable IP address for a given device?
That can't be all it's doing, otherwise clients on the LAN that don't have Pertino installed would still possibly wind up with issues if the DNS server provides the Pertino IP to a LAN client.
If you don't have Pertino on a client, it isn't on the network at all and is useless. EVERY device on the network without Pertino would be "off the LAN."
-
@dafyre said:
Right... but most LAN clients won't have Pertino installed, will they?
Pertino is all or nothing. It's 100% deployment. You can't have a non-Pertino device or that device is not on your network.
-
@adam.ierymenko said:
@Dashrender Right now ZeroTier does nothing for DNS. It virtualizes at L2 and that's it. It does handle IP address management if you enable that feature, but otherwise it just moves packets around.
I don't understand what you mean by IP address management?
I just installed it on three PCs - those three PCs where all able to ping each other, no other configuration was done. and I could ping by NetBIOS name (not sure if it DNS was involved or not). My NetBIOS names are the same as my DNS names, just missing the domain portion.
-
@Dashrender It's probably doing it outbound as well as inbound, and you probably have to run something on your AD server(s).
@scottalanmiller Understood. That would indeed work -- basically it's an intra-LAN version of what Amazon Route 53 and other cloud DNS providers can do on the global Internet -- but I can think of more elegant solutions 1-2 layers down. Might explore in the near-mid term, but right now we're focused on more devops and IoT use cases.
-
@scottalanmiller said:
@dafyre said:
Right... but most LAN clients won't have Pertino installed, will they?
Pertino is all or nothing. It's 100% deployment. You can't have a non-Pertino device or that device is not on your network.
Sure you can.. it's just not part of the Pertino network.. but it can be part of the local to the server LAN network.
that's what I'm talking about. -
If Pertino were all or nothing it wouldn't need the DNS rewriting. You can use ZeroTier like that too, as some distributed workforce clients do -- use it as the primary company network and use the physical network(s) for transport only. In that case you put your AD servers on ZT only and they only advertise ZT IPs via intranet DNS.
-
Take a typical SMB.
5 servers (2 AD boxes, 3 whatever)
50 desktops (non mobile)
50 laptops (work in and out of the local network)The desire is to give access to the 50 laptops. So you install ZT or Pertino. In this situation, you'll have 55 devices with the vpn client on them. and 50 without.
In this setup, does Pertino put the 55 IP's for Pertino's network into AD's DNS system? You said yes before, but I want to ask again to be sure.
So, assuming Pertino does, how do you prevent DNS from giving AD1's Pertino address to one of your desktops who only know about the local LAN network?
-
@Dashrender said:
@scottalanmiller said:
@dafyre said:
Right... but most LAN clients won't have Pertino installed, will they?
Pertino is all or nothing. It's 100% deployment. You can't have a non-Pertino device or that device is not on your network.
Sure you can.. it's just not part of the Pertino network.. but it can be part of the local to the server LAN network.
that's what I'm talking about.The Pertino network IS your LAN. If you have another LAN elsewhere... that's just another LAN somewhere else. Remember Pertino is SDN, if you are doing what you describe you've completely missed the point of it.
-
@adam.ierymenko said:
If Pertino were all or nothing it wouldn't need the DNS rewriting. You can use ZeroTier like that too, as some distributed workforce clients do -- use it as the primary company network and use the physical network(s) for transport only. In that case you put your AD servers on ZT only and they only advertise ZT IPs via intranet DNS.
It is, the REASON it needs it is BECAUSE it is all or nothing. It's what keeps the traffic from heading to the cloud when services are physically local.
-
In that case then yes, you can do precisely the same with ZeroTier. Install it on everything and use it as the primary network. But as @Dashrender says not everyone wants to do that for multiple reasons.
BTW, does Pertino support Ethernet bridging? ZT can do that but I have yet to check others to see.
-
@Dashrender said:
Take a typical SMB.
5 servers (2 AD boxes, 3 whatever)
50 desktops (non mobile)
50 laptops (work in and out of the local network)The desire is to give access to the 50 laptops. So you install ZT or Pertino. In this situation, you'll have 55 devices with the vpn client on them. and 50 without.
Right, so you'd have TWO LANs. Two completely separate LANs with some dual homed servers.
-
@adam.ierymenko said:
BTW, does Pertino support Ethernet bridging? ZT can do that but I have yet to check others to see.
Not officially.
-
@adam.ierymenko said:
In that case then yes, you can do precisely the same with ZeroTier. Install it on everything and use it as the primary network. But as @Dashrender says not everyone wants to do that for multiple reasons.
The problem is, to have SDN you have to. It's not there to be a VPN product.
-
So yeah, like I said above you can support a mixed use case with bridging. Install a bridge on the main LAN and connect your mobile clients to it. When they're also in-house they'll end up with two IP addresses: one via their bridged-across ZT extension of the main LAN and one direct. But the direct one will have a lower metric so it will be used preferentially (though any connections to/from the other IP will keep working, just slightly more slowly than direct LAN due to encapsulation overhead).
@scottalanmiller Agreed for greenfield SDN deployments, but greenfield is hard to achieve in enterprise. Part of what's hard about enterprise as I'm sure you're well aware is that it's hard to undo or un-provision anything, ever. I've seen enterprise houses running 1980s Ultrix software in a modified KVM Alpha emulator on a VM in the cloud because the software is binary-only, the maker of the software is gone, and it's mission critical.
-
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
-
@adam.ierymenko said:
@scottalanmiller Agreed for greenfield SDN deployments, but greenfield is hard to achieve in enterprise. Part of what's hard about enterprise as I'm sure you're well aware is that it's hard to undo or un-provision anything, ever. I've seen enterprise houses running 1980s Ultrix software in a modified KVM Alpha emulator on a VM in the cloud because the software is binary-only, the maker of the software is gone, and it's mission critical.
It's not an enterprise product. It was designed solely as SDN for the SMB market. It's only designed to be meaningful in a 100% full mesh deployment. Using it in any other role would be weird and completely not what it is designed for. Certainly not for the majority of deployments.
