ZeroTier + Active Directory Authentication
-
@wirestyle22 said:
@scottalanmiller said:
@wirestyle22 said:
Oh, you can't do that. The devices would freak out. It's as simple as... you can't.
But... when would this happen? Why would you choose a ZT network that overlaps with the LAN?Couldn't you create two separate reservations--one for the LAN and one for ZT?
DHCP would not work, you'd have a mess.
I was thinking statically assigned IP's
Bottom line, you cannot overlap the same network. It conceptually doesn't even make sense. The machine would have no idea how to differentiate between the two because they are literally the same network.
Static, dynamic, reservations.. doesn't matter. You can't layer the same network on itself.
-
@Dashrender said:
@dafyre said:
@scottalanmiller said:
@Dashrender said:
I'm curious though.. what happens when two NICs have IPs in the same range? This would be the case when a laptop is in the office.
Why would that happen with laptops?
He means if they use the same IP range for both the LAN and the ZT network... what would happen if a laptop got 192.168.16.16 on the LAN, as well as 192.168.16.16 on the ZT network.
uh.. no - that shouldn't happen.
So looking at the ZT docs on creating a bridge: The LAN will use 192.168.0.x and ZT will use 192.168.1.x. DHCP on the LAN will only provide 192.168.0.x addresses so you'll never have a conflict of IPs (wasn't part of my concern)
But since this is all in the same /22 you now have two adapters on the same network.I don't have the docs in from of me, but why is it making two addresses on the same LAN?
-
@scottalanmiller said:
@Dashrender said:
@dafyre said:
@scottalanmiller said:
@Dashrender said:
I'm curious though.. what happens when two NICs have IPs in the same range? This would be the case when a laptop is in the office.
Why would that happen with laptops?
He means if they use the same IP range for both the LAN and the ZT network... what would happen if a laptop got 192.168.16.16 on the LAN, as well as 192.168.16.16 on the ZT network.
uh.. no - that shouldn't happen.
So looking at the ZT docs on creating a bridge: The LAN will use 192.168.0.x and ZT will use 192.168.1.x. DHCP on the LAN will only provide 192.168.0.x addresses so you'll never have a conflict of IPs (wasn't part of my concern)
But since this is all in the same /22 you now have two adapters on the same network.I don't have the docs in from of me, but why is it making two addresses on the same LAN?
because that's how bridging works. Bridging assumes NO routes.. everything is on the same subnet.
-
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linux
Configure the DHCP Server in the Office LAN to give leases in the range 10.0.0.100-10.0.0.200.
Configure the ZeroTier portal to manage IP addresses in the range range 10.0.1.100-10.0.1.200. Note how the address ranges are in the same 10.0.0.0/16 subnet, but have a unique pool of IP addresses.The instructions have you create a giant subnet /16 the LAN will be on x.x.0.x and the ZT will be on x.x.1.x No routers involved for communication here.
-
So if I'm reading this correctly, using bridging means that no ZT devices can ever be on the local network, except the one server providing the bridging, which it's doing through a disconnected NIC port that's acting like a switch port.
The typical ZT clients would need to never be on that same physical network.
-
@Dashrender said:
So if I'm reading this correctly, using bridging means that no ZT devices can ever be on the local network, except the one server providing the bridging, which it's doing through a disconnected NIC port that's acting like a switch port.
The typical ZT clients would need to never be on that same physical network.
There is no reason they cannot be on the same network.
I can have my laptop plugged in to the LAN and WiFi at the same time. they get two different addresses. This is no different with ZT. it is a separate adapter.Basic IP functions here, nothing complicated.
-
@Dashrender said:
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linux
Configure the DHCP Server in the Office LAN to give leases in the range 10.0.0.100-10.0.0.200.
Configure the ZeroTier portal to manage IP addresses in the range range 10.0.1.100-10.0.1.200. Note how the address ranges are in the same 10.0.0.0/16 subnet, but have a unique pool of IP addresses.The instructions have you create a giant subnet /16 the LAN will be on x.x.0.x and the ZT will be on x.x.1.x No routers involved for communication here.
I totally missed that bit before... I think I am going to try it out again.
-
@JaredBusch said:
@Dashrender said:
So if I'm reading this correctly, using bridging means that no ZT devices can ever be on the local network, except the one server providing the bridging, which it's doing through a disconnected NIC port that's acting like a switch port.
The typical ZT clients would need to never be on that same physical network.
There is no reason they cannot be on the same network.
I can have my laptop plugged in to the LAN and WiFi at the same time. they get two different addresses. This is no different with ZT. it is a separate adapter.Basic IP functions here, nothing complicated.
Good point - I've done that before too. Though It's my understanding that the default in Windows - when the LAN is connected, the WLAN is ignored.
-
@dafyre said:
@Dashrender said:
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linux
Configure the DHCP Server in the Office LAN to give leases in the range 10.0.0.100-10.0.0.200.
Configure the ZeroTier portal to manage IP addresses in the range range 10.0.1.100-10.0.1.200. Note how the address ranges are in the same 10.0.0.0/16 subnet, but have a unique pool of IP addresses.The instructions have you create a giant subnet /16 the LAN will be on x.x.0.x and the ZT will be on x.x.1.x No routers involved for communication here.
I totally missed that bit before... I think I am going to try it out again.
Well that might be why your Bridge didn't work
I don't really want a bridge - I want a ZT to LAN router. Then you could have all of your printers on your production network, all of your users on open/free network, and the ZT would still provide IP access to the printers and their real IPs.
The problem with this is putting a route into the local machine that ensures that traffic bound for that routed network goes through ZT, not the default gateway of the end point.
-
@Dashrender said:
@JaredBusch said:
@Dashrender said:
So if I'm reading this correctly, using bridging means that no ZT devices can ever be on the local network, except the one server providing the bridging, which it's doing through a disconnected NIC port that's acting like a switch port.
The typical ZT clients would need to never be on that same physical network.
There is no reason they cannot be on the same network.
I can have my laptop plugged in to the LAN and WiFi at the same time. they get two different addresses. This is no different with ZT. it is a separate adapter.Basic IP functions here, nothing complicated.
Good point - I've done that before too. Though It's my understanding that the default in Windows - when the LAN is connected, the WLAN is ignored.
Not even close to true. Windows does not care about it. You need to set that up in BIOS or have HP/Dell software running to do it automagically.
In Windows, you can set adapter order. But some things like Pertino reinstall the adapter when they update and that puts it back on the top of the list.
This is where you specify it in Windows.
-
@Dashrender said:
@dafyre said:
@Dashrender said:
https://www.zerotier.com/community/topic/5/bridging-ethernet-to-zerotier-virtual-networks-on-linux
Configure the DHCP Server in the Office LAN to give leases in the range 10.0.0.100-10.0.0.200.
Configure the ZeroTier portal to manage IP addresses in the range range 10.0.1.100-10.0.1.200. Note how the address ranges are in the same 10.0.0.0/16 subnet, but have a unique pool of IP addresses.The instructions have you create a giant subnet /16 the LAN will be on x.x.0.x and the ZT will be on x.x.1.x No routers involved for communication here.
I totally missed that bit before... I think I am going to try it out again.
Well that might be why your Bridge didn't work
I don't really want a bridge - I want a ZT to LAN router. Then you could have all of your printers on your production network, all of your users on open/free network, and the ZT would still provide IP access to the printers and their real IPs.
The problem with this is putting a route into the local machine that ensures that traffic bound for that routed network goes through ZT, not the default gateway of the end point.
I've built one of those... I'll do it again and document it this weekend.
-
@Dashrender That's not true. If a ZT device is on the same local network, then it will just have two ports that go to the same network. It would be like putting two NICs in the device and running two cables to the same switch. Confusing, but nothing "wrong" with that.
ZT emulates a smart Ethernet switch. Think of it the way you would think of a switch. An "active bridge" is a port set to permit bridging to another switch (some smart switches let you control that) while a regular ZeroTier endpoint is a port that only goes to a single device.
If you're thinking of it any differently you're over-thinking it. Pertino adds a whole ton of complexity by operating at L3 and none of that applies here. VPNs also add a lot of complexity by fragmenting the network with tunnels and such, and that's also irrelevant. Just imagine a switch with invisible wires going to it.
-
@adam.ierymenko said:
@Dashrender That's not true. If a ZT device is on the same local network, then it will just have two ports that go to the same network. It would be like putting two NICs in the device and running two cables to the same switch. Confusing, but nothing "wrong" with that.
ZT emulates a smart Ethernet switch. Think of it the way you would think of a switch. An "active bridge" is a port set to permit bridging to another switch (some smart switches let you control that) while a regular ZeroTier endpoint is a port that only goes to a single device.
If you're thinking of it any differently you're over-thinking it. Pertino adds a whole ton of complexity by operating at L3 and none of that applies here. VPNs also add a lot of complexity by fragmenting the network with tunnels and such, and that's also irrelevant. Just imagine a switch with invisible wires going to it.
If that were the case, then bridging would be much easier.
(see my latest post on your site.) -
@dafyre I'll take a look, but in my experience bridging is always confusing to set up when you have any boundary between how things like IPs are allocated. One of the things on our to-do list is to ship a preconfigured Raspberry Pi config or image that does bridging easily.
-
@adam.ierymenko said:
@dafyre I'll take a look, but in my experience bridging is always confusing to set up when you have any boundary between how things like IPs are allocated. One of the things on our to-do list is to ship a preconfigured Raspberry Pi config or image that does bridging easily.
If you guys decide to do a straight up Linux image, I'll be happy to help test it. I don't have a Pi to test with at the moment.
-
@dafyre In the shorter term a more detailed HOWTO would probably be best. We can gear it to Debian since the Pi is Debian and makes a great bridge device, but you could also use a Debian VM or regular machine.
-
@adam.ierymenko said:
@dafyre In the shorter term a more detailed HOWTO would probably be best. We can gear it to Debian since the Pi is Debian and makes a great bridge device, but you could also use a Debian VM or regular machine.
I'd be happy to help test them as you write them.
-
@adam.ierymenko said:
@Dashrender That's not true. If a ZT device is on the same local network, then it will just have two ports that go to the same network. It would be like putting two NICs in the device and running two cables to the same switch. Confusing, but nothing "wrong" with that.
ZT emulates a smart Ethernet switch. Think of it the way you would think of a switch. An "active bridge" is a port set to permit bridging to another switch (some smart switches let you control that) while a regular ZeroTier endpoint is a port that only goes to a single device.
If you're thinking of it any differently you're over-thinking it. Pertino adds a whole ton of complexity by operating at L3 and none of that applies here. VPNs also add a lot of complexity by fragmenting the network with tunnels and such, and that's also irrelevant. Just imagine a switch with invisible wires going to it.
Yeah - I was over thinking that. JB set me straight already.
-
Okay, so I took a pot shot at @adam-ierymenko and told him Bridging should be easier... It turns out it is, lol. I blame Microsoft!
Hyper-V has some security features that prevent the system from communicating on the network using a Mac Address that wasn't assigned to it via Hyper-V... There's a fix for that!
In PowerShell, on the Hyper-V host, run the following (it should be typed all on one line... I broke it up for readability)...
*note: This enables the Mac spoofing on ALL NICS attached to the VM.get-vmnetworkadapter -VMName MYVMNAME|where {$_.SwitchName -eq "MY_HYPERV_SWITCH"}| set-vmnetworkadapter -MacAddressSpoofing onEdit: In VMware, you will need to enable Forged Transmits and Promiscuous Mode on the VM that you run things like this on. I don't have access to a VMware system to chek this.
-
@adam.ierymenko I have a Pi (the newest one) to test on if you need more testers
