[Support]: One master-network (to reach all "sub-network-clients") ?

[PizzaProgram]

📝 Inquiry

What is the recommended way to set up my own planet on a VPS to handle one "master-network" that can reach the other 100+ networks too?

I like the simplicity, and I’d like to manage 100+ separated networks (restaurants).
1-10 PCs in each. (ca 300 PCs+Phones+Laptaps all together.)
I am the only one allowed to manage networks. (Pizzeria owners get only client access to their own network.)

10.9.10.0/24  BestPizzaShop
10.9.11.0/24  FastPizza
...
 10.9.250.0/16 MASTER (for my dev. PCs + phones)

But it would be bad if I'd need to connect to all 100+ networks from my phone + laptops simultaneously.
(Or disconnect / reconnect to an other network each time someone is calling for quick help.)

So my developer PCs and phones should connect to only this one "master-network", from where I could connect to any member of any separated network.

❓ So the question is:

• Is it possible somehow to create one Network that would “see everyone” (all members in all networks) ?

• If yes, can I block somehow the access to this one group, so sub-members should not be able to start connections “back to my developer PCs / phone”, only I should be able to connect to them? (VNC, RDP, SQL, ...)

Thanks for any advice :-)

🔧 Deployment Type: [X] Docker
💻 Operating System: Debian

[sinamics]

Note: This is just from the top of my head and not tested, but here's how I would configure it:
Add a routing node (like your VPS) to your master network and each pizza network. Enable IP forwarding on the routing node with:

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p

Then in your master network settings, add managed routes for each pizza network like this:

Destination: 10.9.10.0/24   (BestPizzaShop network)
Via: (The Managed IP of the routing node that exist in all networks)

Destination: 10.9.11.0/24   (FastPizza network)
Via: (The Managed IP of the routing node that exist in all networks)

This way, your devices only need to connect to the master network to reach any pizza network through the routing node.

[PizzaProgram]

Thanks for the quick answer! 😺

I have something similar in my head too, just not clear yet, how it would work in reality, because what I've tried so far, did not work. (Maybe I did a mistake?)

Only this command seems troublesome for me at first site:
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
I've red everywhere is starts forwarding internet traffic of VPN too. But I do not want my clients to surf through my VPS!

Also I'm afraid, I'll have to install a firewall and set many strict rules to prevent one network to see the other. Don't I ?
Or should I start thinking about Flow Rules inside the networks? (By Mixing them.)

Someone suggested I should run 1 of "ZeroTier ONE", where it connects to all networks, and do all the forwarding in there. But I do not know how to prevent port conflict, if it is running on the same VPS / docker stack?

Actually I also do not know, if these routings only apply "inside docker", or also outside of it, on the whole VPS...
(For example: SoftEther is using it's own MAC-routing system, so there is no need to create firewall rules to separate networks from each other. How is that working inside ZT's kernel?)

[PizzaProgram]

I've tested this method.

Conclusion:

Too slow! (30-600ms, instead of 2-5ms. Even TightVNC is lagging.)

The reason is:

• To avoid port conflict, I am forced to port forward docker container from default 9993.
• No mater what I've tried, changing that port from 9993 is impossible.
• ZeroTier One somehow recognising the "outside port" is different, so it changes back to "TCP relay" mode.

Any other ideas?

[mac-nofxmac]

Hello. :)
I use this amazing project to do something similar but not even close to that scale… :p
What are the differences:
I use the default zerotier coordination servers instead of self hosted planet, I find it more convenient and reliable.
And one less thing to manage and worry about.

What is my server set-up:
A basic vps with docker installed on Ubuntu server operating system.
I have installed a zerotier client locally (not a docker container) on that server to help me connect directly to the host operating system and the dashboard I use to control it. This way I avoid the headaches of making docker containers to communicate directly with the host's networks.
To avoid port conflicts I have changed the default port to 9994.*

*To do this,
stop zerotier-one service
change or add this lines if is not already there, to your
/var/lib/zerotier-one/local.conf (create that file if doesn't exist)

`

{
"settings":{
"primaryPort":"9994"
}
}

`
restart zerotier-one service.

Next I installed ztnet server using docker, plus some other containers like portainer and some backup software but these are irrelevant…
So.. I have a working and usable instance of ztnet on a vps.

What I manage;
A local radio station networks
Some work networks for sharing files.
Some family and friends networks.
There are about 40 machines in Total.
Most of them windows and some Linux machines.
Laptops and desktops.

How I manage the different networks:
I use organizations!
Every “company” is an organization.
There is a “Radio” organization
A “Home” , a “Work” organization etc…
Every organization have its own networks
meaningful naming of the networks and peers is very helpful
Every organization have its own users and admins.

to have access to ztnet software i have made a “control network” in the ztnet and i have joined the server’s
local client and my control machines
( 2 laptops and a smartphone) this way i have full access to the vps server itself and the ztnet through zerotier! no need to open any ports or make any complicated firewall rules.
for the organization users and admins acces to the ztnet i have setup a reverse proxy but that is irrelevant too….

So far i have access to the ztnet and i have full control of all the organizations, networks and users.

if i need to offer IT support to every single peer/machine on every organization my control devices need to be part of the respective networks to be able to communicate with that machine through zerotier and some kind of control/rdp software like vnc.

i hope that this will give you some ideas on how to use this amazing project!

[PizzaProgram]

... my control devices need to be part of the respective networks ...

So basically you have to connect to all networks the same time. Right?

• so in my case I would need to do it with all the 100+ networks
  (what I'm trying to avoid, that's why I've opened this topic)
• and it is not possible to do with mobile phones

Or did I misunderstood something, and you have only one giant network (like: 10.100.0.0/16) and you are using micro-segmentation via organization only?

[mac-nofxmac]

Hello again :)

Let's make it clear that I am trying to help and be educated myself. I am not a network expert by any means even if I have some experience with big networks.

I find what you are trying to do very interesting. The scale of it makes it more challenging.

Yes. You understood correct, the way I do it, my control device needs to be connected/attached to every network if i want to have access to all nodes.
No giant networks here.. :p

And yes you are right, smartphone client cannot do it, they don't allow to be connected to more than one network at the time.
For me, this is not a problem at all.
When I need to have access to a specific client/node I connect to the specific network that the node is part of.

My laptop “control device ”
Is indeed connected to many networks and can “see” all the the nodes on those networks.

I know you suggested a big “control network” that all the clients will be connected to with
Your control devices.
So you don't have to be connected to a 100 networks…

So…
Before we get lost in the zerotier’s documentation let's talk about the basics..

zerotier makes p2p networks.

Zetnet is an excellent way to self host, create and manage those networks!

“Peers are equally privileged, equipotent participants in the network, forming a peer-to-peer network of nodes.” (Wikipedia)

To be able to communicate with a peer/node we should be able to ping it and get a response.

In my implementation I can do that, since I “see” all the peers and peers “see” my control device. (But no one outside their network).

In your suggested implementation, using a big zerotier p2p network, all peers will be able to see everyone on all networks 🫣..
Yes you can use some sort of flow rules at network level but I can't see a world where it will be possible to restrict each client to communicate only with your control device without strict complicated firewall rules on each client itself..

I understand your concerns about being connected to hundreds of networks but maybe it is not that terrible.
Your control device should see a thousand peers on one or multiple networks.. anyway.

Be mindful that big networks in one big or multiple segments are live organisms .. They constantly change everyday. Hundreds of people try all kinds of things on those networks while trying to do their job or just messing around, machines need to be added, removed or replaced that makes it even more challenging to manage and maintain.
Keeping it as simple as possible is the way to go.

Sorry for the long post.

[PizzaProgram]

Hi,

Thanks for the long letter! I appreciate it!

In your suggested implementation, using a big zerotier p2p network, all peers will be able to see everyone on all networks 🫣..

No, I definitely want to avoid that.

Keeping it as simple as possible is the way to go.

I agree. That's why I'm afraid of rule-based micro-segmentation. (One mistake, and PCs from other networks may see each other.)

[mac-nofxmac]

Hi, " I agree. That's why I'm afraid of rule-based micro-segmentation. (One mistake, and PCs from other networks may see each other " There is no need for micro-segmentation as described in zerotier documentation in the organization implementation.. Each organization have its own networks that are completely separated from any other network. Just make some organizations On your server and play with them, you can delete them anytime. I will try to make a small example project in the discussions section sometime next week. Since I will be very busy this weekend. I will let you know when it is done. Message ID: ***@***.***>

…