ZeroTier and DNS issues
-
Take a typical SMB.
5 servers (2 AD boxes, 3 whatever)
50 desktops (non mobile)
50 laptops (work in and out of the local network)The desire is to give access to the 50 laptops. So you install ZT or Pertino. In this situation, you'll have 55 devices with the vpn client on them. and 50 without.
In this setup, does Pertino put the 55 IP's for Pertino's network into AD's DNS system? You said yes before, but I want to ask again to be sure.
So, assuming Pertino does, how do you prevent DNS from giving AD1's Pertino address to one of your desktops who only know about the local LAN network?
-
@Dashrender said:
@scottalanmiller said:
@dafyre said:
Right... but most LAN clients won't have Pertino installed, will they?
Pertino is all or nothing. It's 100% deployment. You can't have a non-Pertino device or that device is not on your network.
Sure you can.. it's just not part of the Pertino network.. but it can be part of the local to the server LAN network.
that's what I'm talking about.The Pertino network IS your LAN. If you have another LAN elsewhere... that's just another LAN somewhere else. Remember Pertino is SDN, if you are doing what you describe you've completely missed the point of it.
-
@adam.ierymenko said:
If Pertino were all or nothing it wouldn't need the DNS rewriting. You can use ZeroTier like that too, as some distributed workforce clients do -- use it as the primary company network and use the physical network(s) for transport only. In that case you put your AD servers on ZT only and they only advertise ZT IPs via intranet DNS.
It is, the REASON it needs it is BECAUSE it is all or nothing. It's what keeps the traffic from heading to the cloud when services are physically local.
-
In that case then yes, you can do precisely the same with ZeroTier. Install it on everything and use it as the primary network. But as @Dashrender says not everyone wants to do that for multiple reasons.
BTW, does Pertino support Ethernet bridging? ZT can do that but I have yet to check others to see.
-
@Dashrender said:
Take a typical SMB.
5 servers (2 AD boxes, 3 whatever)
50 desktops (non mobile)
50 laptops (work in and out of the local network)The desire is to give access to the 50 laptops. So you install ZT or Pertino. In this situation, you'll have 55 devices with the vpn client on them. and 50 without.
Right, so you'd have TWO LANs. Two completely separate LANs with some dual homed servers.
-
@adam.ierymenko said:
BTW, does Pertino support Ethernet bridging? ZT can do that but I have yet to check others to see.
Not officially.
-
@adam.ierymenko said:
In that case then yes, you can do precisely the same with ZeroTier. Install it on everything and use it as the primary network. But as @Dashrender says not everyone wants to do that for multiple reasons.
The problem is, to have SDN you have to. It's not there to be a VPN product.
-
So yeah, like I said above you can support a mixed use case with bridging. Install a bridge on the main LAN and connect your mobile clients to it. When they're also in-house they'll end up with two IP addresses: one via their bridged-across ZT extension of the main LAN and one direct. But the direct one will have a lower metric so it will be used preferentially (though any connections to/from the other IP will keep working, just slightly more slowly than direct LAN due to encapsulation overhead).
@scottalanmiller Agreed for greenfield SDN deployments, but greenfield is hard to achieve in enterprise. Part of what's hard about enterprise as I'm sure you're well aware is that it's hard to undo or un-provision anything, ever. I've seen enterprise houses running 1980s Ultrix software in a modified KVM Alpha emulator on a VM in the cloud because the software is binary-only, the maker of the software is gone, and it's mission critical.
-
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
-
@adam.ierymenko said:
@scottalanmiller Agreed for greenfield SDN deployments, but greenfield is hard to achieve in enterprise. Part of what's hard about enterprise as I'm sure you're well aware is that it's hard to undo or un-provision anything, ever. I've seen enterprise houses running 1980s Ultrix software in a modified KVM Alpha emulator on a VM in the cloud because the software is binary-only, the maker of the software is gone, and it's mission critical.
It's not an enterprise product. It was designed solely as SDN for the SMB market. It's only designed to be meaningful in a 100% full mesh deployment. Using it in any other role would be weird and completely not what it is designed for. Certainly not for the majority of deployments.
-
ZeroTier officially support bridging but our documentation on it stinks or is nonexistent. We're going to be fixing that fairly soon.
We have a user in Germany using it to provide a backplane to stitch together hundreds of local mesh access points for a community meshnet project. He says bridging with ZT works fine with dozens of bridges with hundreds of clients behind each bridge, albeit with a bit of traffic overhead... but it's Germany so they get real fiber Internet connections.
-
OOOOOOO K!
Well I can say I've never considered it for that type of use. I've also never read any of their literature either.
That changes a lot.
-
@Dashrender said:
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
Um, yeah, if by enterprises you mean companies. Basically every Pertino client you have ever heard of. That is its one and only purpose. You are thinking of it as a VPN replacement and that is confusing you into looking at it from an old model. It's a full mesh SDN, not a VPN. It uses VPN technology to make the SDN happen. I've never heard of someone wanting to run anything without Pertino on it, that would break everything about it.
Of course things like your SAN are not part of the LAN itself and would not be part of it. Only the normal LAN would be on Pertino.
And yes, this is how NTG operates.
-
Pertino's target market is the California startup market specifically where this works beautifully. You'd be surprised how much their 100% mesh completely fits the model used by the west coast IT market. It's the non-west coast's approaches that make it seems strange and impossible. I've dealt with a lot of companies out there where they are like "of course, that just works". It doesn't seem foreign to them at all.
-
If you're running Pertino as a full SDN, then why would they need to do anything special for DNS? I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
Question - how do they get to the internet? Does the local machine send DNS queries to AD's DNS via Pertino, then the local clients use the local hardware network to find a route to the internet?
-
@scottalanmiller said:
@Dashrender said:
Hhuh? So there are enterprises that do this? They install Pertino everywhere? literally every last machine?
Um, yeah, if by enterprises you mean companies. Basically every Pertino client you have ever heard of. That is its one and only purpose. You are thinking of it as a VPN replacement and that is confusing you into looking at it from an old model. It's a full mesh SDN, not a VPN. It uses VPN technology to make the SDN happen. I've never heard of someone wanting to run anything without Pertino on it, that would break everything about it.
Of course things like your SAN are not part of the LAN itself and would not be part of it. Only the normal LAN would be on Pertino.
And yes, this is how NTG operates.
I knew this was how NTG operated, but I knew that only because NTG is a physically diverse network.
-
@hubtechagain has Pertino at a few of his clients.. I wonder if he runs an all or nothing approach.
-
@Dashrender said:
If you're running Pertino as a full SDN, then why would they need to do anything special for DNS? I would think that it would be a large flat (say \23 or \22 network) and the DNS servers would only respond on the Pertino network.
Because you don't want your NFS traffic for two servers sitting next to each other traversing your WAN link. It still needs to understand how to hit the cloud or not for traffic. No matter how much you abstract your traffic the realities of congestion still exist.
-
We've had the same experience with ZeroTier which does the same thing in this use case minus some of the bundled hacks for things like AD. Greenfield is easy. "Brownfield" as they call it -- namely anywhere other than California -- is a lot harder because you have to still connect to the 1990s Windows NT server that is mission critical or the printers that can't run SDN software or the ancient Solaris box that talks via 1200 baud modem bank to the store PoS systems or the IP over carrier pigeon (RFC1149) deployment.
Right now we've elected to focus more on other uses of SDN, but yes we do eventually want to go there.
So... if Pertino is often used all-or-nothing then why is the DNS mangling needed? I understood it with mixed installs but I don't understand it if you're doing greenfield all-in SDN.
-
@Dashrender said:
Heck in that situation, I'd setup DHCP on the local business network from the firewall only so they have a way to have the underlying network (hardware layer) working.
How does DHCP do that?
