ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    ZeroTier Question

    IT Discussion
    zerotier
    9
    279
    174.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      JaredBusch
      last edited by

      All of the above said, it is best to setup DNS.

      But you have to be aware of what you are doing and the side effects it will have, as well as the extra work it will entail.

      D 1 Reply Last reply Reply Quote 2
      • D
        dafyre @JaredBusch
        last edited by

        @JaredBusch said in ZeroTier Question:

        All of the above said, it is best to setup DNS.

        But you have to be aware of what you are doing and the side effects it will have, as well as the extra work it will entail.

        ^ This, for sure.

        1 Reply Last reply Reply Quote 0
        • S
          scottalanmiller @dafyre
          last edited by

          @dafyre said in ZeroTier Question:

          In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.

          Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out... This is where the complexity pays for itself, to me. We don't have to do any fancy DNS hijacking like Pertino does.

          I see, because you are not layering IPs for the servers, only for some of the clients.

          D 1 Reply Last reply Reply Quote 1
          • J
            JaredBusch @dafyre
            last edited by

            @dafyre said in ZeroTier Question:

            @scottalanmiller said in ZeroTier Question:

            @dafyre said in ZeroTier Question:

            @Dashrender said in ZeroTier Question:

            @WLS-ITGuy said in ZeroTier Question:

            @dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works 🙂

            It's not about handling routing because there would be no route.

            Example
            Server internal wire network IP - 192.16.8.10
            ________________________ZT IP - 10.0.50.10

            If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.

            And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.

            In what way? If the wrong DNS is being grabbed, how does the extra complexity of the gateway make it easier?

            In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.

            Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out.

            That is not being talked about anywhere in this thread. Why would you suddenly curve this into something like that.

            While it certainly is something that can be setup, let's not detract from the point at hand.

            D 1 Reply Last reply Reply Quote 0
            • D
              dafyre @scottalanmiller
              last edited by

              @scottalanmiller said in ZeroTier Question:

              @dafyre said in ZeroTier Question:

              In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.

              Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out... This is where the complexity pays for itself, to me. We don't have to do any fancy DNS hijacking like Pertino does.

              I see, because you are not layering IPs for the servers, only for some of the clients.

              Exactly.

              1 Reply Last reply Reply Quote 0
              • D
                dafyre @JaredBusch
                last edited by

                @JaredBusch said in ZeroTier Question:

                @dafyre said in ZeroTier Question:

                @scottalanmiller said in ZeroTier Question:

                @dafyre said in ZeroTier Question:

                @Dashrender said in ZeroTier Question:

                @WLS-ITGuy said in ZeroTier Question:

                @dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works 🙂

                It's not about handling routing because there would be no route.

                Example
                Server internal wire network IP - 192.16.8.10
                ________________________ZT IP - 10.0.50.10

                If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.

                And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.

                In what way? If the wrong DNS is being grabbed, how does the extra complexity of the gateway make it easier?

                In essence the device becomes part of the physical lan...this means that you no longer have to install ZT on every device ... Only those that leave the office.

                Rather than having ZT IP space and LAN IP space... they become one single IP space. This means that the DNS server's won't have to randomly decide whether or not to give out a ZT IP, or a LAN IP... They only have one IP to give out.

                That is not being talked about anywhere in this thread. Why would you suddenly curve this into something like that.

                While it certainly is something that can be setup, let's not detract from the point at hand.

                Scott asked the question, and I answered.

                1 Reply Last reply Reply Quote 0
                • W
                  WLS-ITGuy
                  last edited by

                  HOLY HELL! That was a Shit ton of responses.

                  Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?

                  Reading through the last few posts my eyes were going wacko!

                  S 2 Replies Last reply Reply Quote 1
                  • S
                    scottalanmiller @WLS-ITGuy
                    last edited by

                    @WLS-ITGuy said in ZeroTier Question:

                    HOLY HELL! That was a Shit ton of responses.

                    It's a very active place 🙂

                    1 Reply Last reply Reply Quote 0
                    • S
                      scottalanmiller @WLS-ITGuy
                      last edited by

                      @WLS-ITGuy said in ZeroTier Question:

                      Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?

                      Setting them as DNS? That seems like a good solid fix. So you are getting reliably good DNS results now? I think that you are good to go 🙂

                      J DashrenderD 2 Replies Last reply Reply Quote 0
                      • J
                        JaredBusch @scottalanmiller
                        last edited by

                        @scottalanmiller said in ZeroTier Question:

                        @WLS-ITGuy said in ZeroTier Question:

                        Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?

                        Setting them as DNS? That seems like a good solid fix. So you are getting reliably good DNS results now? I think that you are good to go 🙂

                        Right, but you need to be aware that your internal DNS server will now be queried for everything and return results appropriately.

                        W 1 Reply Last reply Reply Quote 1
                        • W
                          WLS-ITGuy @JaredBusch
                          last edited by

                          @JaredBusch Won't it look at ZT first, realize it isn't on the ZT network, and then dump off to the end users ISP?

                          S J DashrenderD 3 Replies Last reply Reply Quote 0
                          • S
                            scottalanmiller @WLS-ITGuy
                            last edited by

                            @WLS-ITGuy said in ZeroTier Question:

                            @JaredBusch Won't it look at ZT first, realize it isn't on the ZT network, and then dump off to the end users ISP?

                            Not for DNS. DNS queries happen only once. And it WILL be on the DNS server if it is set up correctly for the office to work.

                            W 1 Reply Last reply Reply Quote 0
                            • W
                              WLS-ITGuy @scottalanmiller
                              last edited by

                              @scottalanmiller I was thinking Gateway 🙂

                              S 1 Reply Last reply Reply Quote 0
                              • DashrenderD
                                Dashrender @scottalanmiller
                                last edited by

                                @scottalanmiller said in ZeroTier Question:

                                @WLS-ITGuy said in ZeroTier Question:

                                Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?

                                Setting them as DNS? That seems like a good solid fix. So you are getting reliably good DNS results now? I think that you are good to go 🙂

                                I see a problem - How does the mobile PC find the ZT controller when it out and about? When will the mobile PC decide to use the DNS servers provided by the real network card vs using the DNS provided by the ZT adapters?

                                You really do need/want both to be able to work. So you go to a new location, you connect to their network, your computer needs to use DNS to find the ZT controller on the internet (unless they are considered static and the ZT software just has an IP for the controller - then nevermind), but assuming it's not FQDN based for controllers, you'll need to use the physical NICs DNS to find the controller, then after you ZT network is up, you can switch full time over to use the domain's DNS for anything/everything.

                                J S D 3 Replies Last reply Reply Quote 1
                                • J
                                  JaredBusch @WLS-ITGuy
                                  last edited by

                                  @WLS-ITGuy said in ZeroTier Question:

                                  @JaredBusch Won't it look at ZT first, realize it isn't on the ZT network, and then dump off to the end users ISP?

                                  The general traffic will not be on ZeroTier, no. But that is not what I said.

                                  I said the DNS traffic will all be on ZeroTier. Every single lookup will go to your internal DNS server and return whatever address it knows for the query in question.

                                  Example:
                                  oc.domain.com returns 1.2.3.4 on public DNS.
                                  But on my internal DNS server oc.domain.com is a CNAME for oc.domain.local which is has an internal IP of 10.202.1.12
                                  But by ZeroTier scope is 10.202.3.0/24 and that server does not have ZeroTier on it.

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    scottalanmiller @WLS-ITGuy
                                    last edited by

                                    @WLS-ITGuy said in ZeroTier Question:

                                    @scottalanmiller I was thinking Gateway 🙂

                                    Yes, if the DNS returns a non-ZT address as the answer and it is a public IP address, it will be sent to the default gateway, not over the ZT LAN.

                                    1 Reply Last reply Reply Quote 0
                                    • DashrenderD
                                      Dashrender @WLS-ITGuy
                                      last edited by

                                      @WLS-ITGuy said in ZeroTier Question:

                                      @JaredBusch Won't it look at ZT first, realize it isn't on the ZT network, and then dump off to the end users ISP?

                                      For traffic, yes it will, but not for DNS queries.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        JaredBusch @Dashrender
                                        last edited by

                                        @Dashrender said in ZeroTier Question:

                                        @scottalanmiller said in ZeroTier Question:

                                        @WLS-ITGuy said in ZeroTier Question:

                                        Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?

                                        Setting them as DNS? That seems like a good solid fix. So you are getting reliably good DNS results now? I think that you are good to go 🙂

                                        I see a problem - How does the mobile PC find the ZT controller when it out and about? When will the mobile PC decide to use the DNS servers provided by the real network card vs using the DNS provided by the ZT adapters?

                                        You really do need/want both to be able to work. So you go to a new location, you connect to their network, your computer needs to use DNS to find the ZT controller on the internet (unless they are considered static and the ZT software just has an IP for the controller - then nevermind), but assuming it's not FQDN based for controllers, you'll need to use the physical NICs DNS to find the controller, then after you ZT network is up, you can switch full time over to use the domain's DNS for anything/everything.

                                        If the ZeroTier controller is not available, the ZeroTier adapter will not be online, so the local DNS will apply.

                                        DashrenderD 1 Reply Last reply Reply Quote 1
                                        • S
                                          scottalanmiller @Dashrender
                                          last edited by

                                          @Dashrender said in ZeroTier Question:

                                          I see a problem - How does the mobile PC find the ZT controller when it out and about? When will the mobile PC decide to use the DNS servers provided by the real network card vs using the DNS provided by the ZT adapters?

                                          When connected versus when not connected. It doesn't look to the ZT controller's DNS settings when that controller is down.

                                          1 Reply Last reply Reply Quote 2
                                          • DashrenderD
                                            Dashrender @JaredBusch
                                            last edited by

                                            @JaredBusch said in ZeroTier Question:

                                            @Dashrender said in ZeroTier Question:

                                            @scottalanmiller said in ZeroTier Question:

                                            @WLS-ITGuy said in ZeroTier Question:

                                            Setting the ZT IP addresses of my two on-site DCs in the V-NIC on the client works. Should this be a short term fix only?

                                            Setting them as DNS? That seems like a good solid fix. So you are getting reliably good DNS results now? I think that you are good to go 🙂

                                            I see a problem - How does the mobile PC find the ZT controller when it out and about? When will the mobile PC decide to use the DNS servers provided by the real network card vs using the DNS provided by the ZT adapters?

                                            You really do need/want both to be able to work. So you go to a new location, you connect to their network, your computer needs to use DNS to find the ZT controller on the internet (unless they are considered static and the ZT software just has an IP for the controller - then nevermind), but assuming it's not FQDN based for controllers, you'll need to use the physical NICs DNS to find the controller, then after you ZT network is up, you can switch full time over to use the domain's DNS for anything/everything.

                                            If the ZeroTier controller is not available, the ZeroTier adapter will not be online, so the local DNS will apply.

                                            Good to know - OK that problem's solved. +1

                                            1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 9
                                            • 10
                                            • 11
                                            • 12
                                            • 13
                                            • 14
                                            • 11 / 14
                                            • First post
                                              Last post