2 ms·

Actually, I have a hook on the openvpn server (on docker), that talks to the DNS server when a new device connects to it. The DNS and reverse DNS is automatical

by Faaak 9y ago

Actually, I have a hook on the openvpn server (on docker), that talks to the DNS server when a new device connects to it. The DNS and reverse DNS is automatically added. I use the 11.0.0.0/16 zone. It's not a good practice at all, but in this case it's very useful (doesn't conflict with any network map, only routed inside my devices, which only talk to each other). But I would love to take a look at it if you share it ;-)

aequitas 9y ago
Currently my implementation only has 1 VPN endpoint per 'location' so the other devices still need to get their IP some way else (DHCP/router advertisement). Since my network is not that large layer2 is doable and i'm trying to see where I hit practical limits.
Piskvorrr 9y ago
Why clobber an allocated segment, is 10.0.0.0/8 not large enough for you? (e.g. never have I ever seen 10.11.0.0/16 in a network)
- Faaak 9y ago
  Of course it's large enough, but it's also widely used. If you use 10.11.0.0/16, then you can be sure that you'll run into a company that also uses it. And when there's a conflit between your VPN device space and your custommer's IP space, … well, it's really annoying. Sure, you could use 192.168/24, or 172.16/12 but you'll run into the same problem. Once it'll be a hotel that uses this space, and another time it'll be an industry. So that's why I use 11.0.0.0/16. Yes it's allocated, but my devices will (never) need to talk to it (they only talk with me, and I'll never install devices in the DoD, so there won't be a conflict).
  - Piskvorrr 9y ago
    Possible, but improbable (the private address space is fairly large, and most companies are very imaginatively using 10.[0-9], I have yet to see a 10.11. anywhere. 192.168 is indeed everywhere, but 172.16 is by far the rarest). You're setting yourself up for the exact same issue that Hamachi had, when it started using the 5/8 space for VPN - suddenly the block owner started using those addresses for outside purposes.
    - Faaak 9y ago
      Well, sorry, but on the top of my mind, I have a client that uses 10.96.0.0/16 and another that uses the whole 172.16 subnet... I don't really see how I'm setting up for these kinds of problems as these devices only talk to my infra, but I'm on the other way avoiding a lot of problems.

by Faaak 9y ago

aequitas 9y ago

Currently my implementation only has 1 VPN endpoint per 'location' so the other devices still need to get their IP some way else (DHCP/router advertisement). Since my network is not that large layer2 is doable and i'm trying to see where I hit practical limits.

Piskvorrr 9y ago

Why clobber an allocated segment, is 10.0.0.0/8 not large enough for you? (e.g. never have I ever seen 10.11.0.0/16 in a network)

Faaak 9y ago
Of course it's large enough, but it's also widely used. If you use 10.11.0.0/16, then you can be sure that you'll run into a company that also uses it. And when there's a conflit between your VPN device space and your custommer's IP space, … well, it's really annoying. Sure, you could use 192.168/24, or 172.16/12 but you'll run into the same problem. Once it'll be a hotel that uses this space, and another time it'll be an industry. So that's why I use 11.0.0.0/16. Yes it's allocated, but my devices will (never) need to talk to it (they only talk with me, and I'll never install devices in the DoD, so there won't be a conflict).
- Piskvorrr 9y ago
  Possible, but improbable (the private address space is fairly large, and most companies are very imaginatively using 10.[0-9], I have yet to see a 10.11. anywhere. 192.168 is indeed everywhere, but 172.16 is by far the rarest). You're setting yourself up for the exact same issue that Hamachi had, when it started using the 5/8 space for VPN - suddenly the block owner started using those addresses for outside purposes.
  - Faaak 9y ago
    Well, sorry, but on the top of my mind, I have a client that uses 10.96.0.0/16 and another that uses the whole 172.16 subnet... I don't really see how I'm setting up for these kinds of problems as these devices only talk to my infra, but I'm on the other way avoiding a lot of problems.