ZeroTier Question
-
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.
-
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
-
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
This is from a single user at his home.
-
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.
If I put the ZT IP Addresses in the ZT NIC I won't need to do this, yes?
-
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
But where did the 198.105.x.x IP come from? that is not anywhere on the OP's network (that we know of). When I ping that FQDN here I get could not fined host.
-
@WLS-ITGuy said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
@dafyre I got the onsite vs offsite part. However, shouldn't ZeroTier handle the offsite routing? Or is that not how this works
It's not about handling routing because there would be no route.
Example
Server internal wire network IP - 192.16.8.10
________________________ZT IP - 10.0.50.10If, when you're offsite, DNS returns the 192.16.8.10 address, the ZT network would never look at this traffic because it's not part of the ZT network. Instead that traffic would go to the normal NIC, wireless probably, and go out that way and of course fail.
And this is why I default to building a ZT Gateway. Yes, it is more work up front. Yes, it is slightly more complicated. However, it prevents you from having to deal with these types of issues.
If I put the ZT IP Addresses in the ZT NIC I won't need to do this, yes?
What happens when your user is at home... and gets a 172.16 IP address... and your ZT IP range is 192.168.130.xx?
It's just like me and Dash were telling you a minute ago... It's not going to know how to find the 172 network.
-
@Dashrender said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
But where did the 198.105.x.x IP come from? that is not anywhere on the OP's network (that we know of). When I ping that FQDN here I get could not fined host.
Good point... Could it be from an old web host, or an old internal DNS entry for something?
Edit: Let us further muddy the waters... I get a totally different 198 address...
-
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
But where did the 198.105.x.x IP come from? that is not anywhere on the OP's network (that we know of). When I ping that FQDN here I get could not fined host.
Good point... Could it be from an old web host, or an old internal DNS entry for something?
Sure it could be, but if pinging that server while in the office gets the correct IP, you'd assume the DNS servers in the office would be giving the same response in all places, internal and external.
-
@Dashrender said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@dafyre said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
Also, if I ping another server from off site I get this:
WOW - how does that happen? What is returning that IP address? I wonder if the coffeehouse server is returning bad info?
You probably need to ipconfig /flushdns ?
But where did the 198.105.x.x IP come from? that is not anywhere on the OP's network (that we know of). When I ping that FQDN here I get could not fined host.
Good point... Could it be from an old web host, or an old internal DNS entry for something?
Sure it could be, but if pinging that server while in the office gets the correct IP, you'd assume the DNS servers in the office would be giving the same response in all places, internal and external.
Except in the case of the end-user's machine not actually hitting the internal DNS, maybe?
-
I don't know where that 198.105.x.x ip is coming from which is why I asked about the DNS/Office 365 thing.
It is not an IP here on campus that is for sure.
-
@dafyre said in ZeroTier Question:
Except in the case of the end-user's machine not actually hitting the internal DNS, maybe?
Sure, but if the user isn't hitting an internal DNS, where would that address come from at all? I would expect it to simply fail, or get a *.wls.wels.net reply back, which isn't happening when I ping, so no reason to believe that would be happening to the home user.
-
@WLS-ITGuy said in ZeroTier Question:
I don't know where that 198.105.x.x ip is coming from which is why I asked about the DNS/Office 365 thing.
It is not an IP here on campus that is for sure.
could it belong to corporate?
-
the reverse lookup for that IP is
NetRange: 198.105.240.0 - 198.105.255.255
CIDR: 198.105.240.0/20
OriginAS:
NetName: SEARCHGUIDE
NetHandle: NET-198-105-240-0-1
Parent: NET-198-0-0-0-0
NetType: Direct Assignment
RegDate: 2012-07-10
Updated: 2012-07-10
Ref: http://whois.arin.net/rest/net/NET-198-105-240-0-1OrgName: Search Guide Inc
OrgId: SG-63
Address: 1942 Broadway
Address: Suite 319
City: Boulder
StateProv: CO
PostalCode: 80302
Country: US
RegDate: 2012-06-26
Updated: 2012-06-26
Comment: Standard NOC hours are 7am to 6pm EST
Ref: http://whois.arin.net/rest/org/SG-63 -
Corporate is in Wisconsin
-
makes me wonder if the router at the coffee shop was taken over and is doing bad things...
Was that IP obtained while at the coffee shop? or did I miss it and it was really someone at their home?
-
@Dashrender said in ZeroTier Question:
makes me wonder if the router at the coffee shop was taken over and is doing bad things...
Was that IP obtained while at the coffee shop? or did I miss it and it was really someone at their home?
Someone at their home.
-
@Dashrender said in ZeroTier Question:
makes me wonder if the router at the coffee shop was taken over and is doing bad things...
Was that IP obtained while at the coffee shop? or did I miss it and it was really someone at their home?
This one is at home.
-
The user has IPv6 DNS enabled as their first DNS server at home.
Turn off IPv6 on their main network conneciton.
-
@WLS-ITGuy said in ZeroTier Question:
@Dashrender said in ZeroTier Question:
makes me wonder if the router at the coffee shop was taken over and is doing bad things...
Was that IP obtained while at the coffee shop? or did I miss it and it was really someone at their home?
This one is at home.
What do they have for DNS servers at home? Their ISP? I've seen many ISPs (Cox does this) if you put in a bad address, you get redirected to a bad website request page hosted by Cox instead of getting an invalid domain name as you might rather have. They are trying to making things more understandable for consumers, sadly it just screws us instead.
Have you home user change the DNS provided by their router (if possible) to Google's 8.8.8.8 and 8.8.4.4 and try again.
-
@dafyre said in ZeroTier Question:
@WLS-ITGuy said in ZeroTier Question:
DUDE! YOU ARE A GENIUS! <---Absoluetely no sarcasm
If you are off-site and your DNS server returns the internal IP, stuff still ain't gonna work.
This also goes back to what I said. You do NOT want to do this unless you are 100% ready to manually update your on premise DNS server manually to have every ZeroTier IP address listed.
