ZeroTier and DNS issues
-
That solution looks good for a primarily mobile user, so you'll have little concern about having two DNS entries for the client in DNS. This is a problem when you are trying to manage the client devices, you can run into the same problem as my two IP addressed DC.
But I see the potential for a lot of problems for someone who is in and out, and finding themselves most of the time having two DNS entries.
-
On further thought, I wonder if it would work if ZT were given the same IP scheme as the main network, but were set to a lower priority on all machines. Then it would be used as an alternate path and only if the main network were not available.
This might be something we'd want to officially support: "shadow network" use case?
-
@Dashrender Yes, I can see issues as well. Unfortunately I can't see a clean solution that doesn't involve either changing the layout of things or some form of client-side hackery. But I want to think about this a bit longer.
-
I'll agree that DNS doesn't handle mulit-homed computers well - well that's to say that our ability to use DNS effectively when a device has more than one registered IP is poor at best.
AD itself doesn't care about IP space other than it's ability to reference DNS to find a device, which is a mandate, but not what I would call a failing or falter on the part of AD.
-
@Dashrender Can you go up a level and out of the realm of technical details and explain what you're actually attempting to accomplish? Is this a road warrior use case or something else like inter-site collaboration?
-
@scottalanmiller or anyone who uses Pertino, Are the Pertino addresses registered to your AD's DNS servers?
-
@Dashrender said:
@scottalanmiller or anyone who uses Pertino, Are the Pertino addresses registered to your AD's DNS servers?
Yes, that is how the machines locate each other.
-
In this instance, couldn't we just let the company DHCP assign IP addresses across the bridge?
-
So this is for someone who has a network with both Pertino enabled endpoints, and NOT enabled endpoints.
Do you ever have an issue where a local client is trying to reach a DC that is multi-homed (local LAN and Pertino)? if so, what was the issue? was it that DNS was giving you the Pertino IP?
-
@dafyre said:
In this instance, couldn't we just let the company DHCP assign IP addresses across the bridge?
Assuming the bridge will pass the DHCP request to the network, that should be possible.
I'd be more worried about the long term problem - laptop user at the office during the day, home at night - they will end up with two IP's in DNS, and two IPs taken in DHCP.
-
This discussion is helpful toward a product idea we've had for a long time: a very simple device that can be plugged into a physical network and will "extend" it. Basically you plug in this device and it creates a virtual ZeroTier network that you join on endpoint devices. The missing piece for us has been "what then?" How should IPs be assigned on this virtual network and what should endpoint devices do with those IPs? I think this is giving me some ideas, and they're very very interesting. Short answer: "no IPs should be assigned" and "the virtual network should shadow the physical and only be used if the physical is not available."
-
Basically it's virtual redundant multipath ethernet. If you've ever used network bonding, you can set two interfaces to connect to two different switches such that if one switch fails the second link takes over and traffic is not interrupted. This would be the same thing but with a virtual network as failover path.
-
I don't know if this is possible, but if the ZT interface could present itself as the MAC address of the normal LAN adapter to get the same IP it would get on it's normal adapter when it's in the office, that would be cool.
-
That is entirely possible. Ideas in progress.
In the short term I'm not sure what to do, but priority seems like part of the answer.
-
What I have done on my own network at home is build my own ZeroTier router... it has 1 Interface on my LAN, and 1 x ZeroTier interface...and that ZeroTier client has the Gateway option activated.
And it routes to my Home Network. NB: I had to add a route to my ZeroTier IP space on my home router as well, so traffic could flow both ways...
IE: On my home router, I had a route for 192.168.100.0/24 (zero tier ip space) to 192.168.1.179 (LAN interface of my zero tier router).
On remote Client devices, I add a route to 192.168.1.0/24 via 192.168.100.179 (ZT IP addresss of my ZTRouter).
This seems to work. Arguably it would work better if I had more RAM to add to my VM, lol.
-
@dafyre said:
What I have done on my own network at home is build my own ZeroTier router... it has 1 Interface on my LAN, and 1 x ZeroTier interface...and that ZeroTier client has the Gateway option activated.
And it routes to my Home Network. NB: I had to add a route to my ZeroTier IP space on my home router as well, so traffic could flow both ways...
IE: On my home router, I had a route for 192.168.100.0/24 (zero tier ip space) to 192.168.1.179 (LAN interface of my zero tier router).
On remote Client devices, I add a route to 192.168.1.0/24 via 192.168.100.179 (ZT IP addresss of my ZTRouter).
This seems to work. Arguably it would work better if I had more RAM to add to my VM, lol.
This solves the routing issues.. how do you solve the DNS issue? Unless you're running a server at home, I'm guessing either you're using a Host file or IP addresses.
One thought - you could install DNS on the Linux router you stood up.. and create the entries you need DNS for... this would allow everything to remain separate, but would require manual maintenance.
-
What does ZeroTier use for it's DNS normally?
-
@Dashrender Right now ZeroTier does nothing for DNS. It virtualizes at L2 and that's it. It does handle IP address management if you enable that feature, but otherwise it just moves packets around.
-
@Dashrender said:
What does ZeroTier use for it's DNS normally?
That Pertino actually "does" DNS is a completely unique feature and it is only available in their enterprise packages, their free and entry level packages do not offer it. I know of no one else hijacking DNS and manipulating it in that way.
-
It is a huge part of the power, and the expense, of Pertino.
