GRE (Generic Routing Encapsulation)

GRE is about the simplest tunnel there is, and I have a soft spot for it. You take a packet, stick a small GRE header on it, wrap the whole thing in a new IP packet, and send it to the other end of the tunnel. That end unwraps it and forwards the original packet like it just showed up on a directly connected link. Two networks that are miles apart end up acting like neighbors.

How it works

There are three layers to keep straight:

The passenger: your original packet.
The GRE header: small, and mostly just says what kind of packet is inside.
The outer IP header: addressed from one tunnel endpoint to the other.

Cisco came up with it, but it's a standard now and pretty much everything supports it, including Linux. It doesn't care what's inside. It can carry IPv4, IPv6, multicast, and back in the day even IPX and AppleTalk.

Why I'd use it

The big one: running routing protocols across a network you don't control. OSPF relies on multicast, and you can't send that across the Internet. Put OSPF (or BGP) on a GRE tunnel, though, and to the routers it's just another link. That's very handy for connecting branch sites to a hub with real dynamic routing and failover.

It's also great in a homelab. Want to bring a public IP from a cheap VPS back to a server at home, or connect two labs together with routing? GRE is an easy way to do it.

The catch: no security

GRE doesn't encrypt anything and doesn't check who's sending. Anyone along the path can read or tamper with the traffic. So if the tunnel crosses the Internet and you care what's in it, wrap it in IPsec: GRE handles the flexible encapsulation, IPsec handles the encryption and authentication. GRE-over-IPsec is a very common combination for exactly that reason.

The header

The basic GRE header is just 4 bytes: some flags and a protocol type field. Optional fields add a checksum, a key (handy for telling multiple tunnels between the same endpoints apart), or a sequence number, and each one makes the header a little bigger.

Setting one up

On Cisco, you make a tunnel interface, give it an address, and tell it where the tunnel starts and ends:

interface Tunnel0
  ip address 192.168.1.1 255.255.255.252
  tunnel source 203.0.113.1
  tunnel destination 198.51.100.1

tunnel source and tunnel destination are the real, reachable addresses of the two routers. The ip address is for inside the tunnel. I use a /30 (or /31) since it's a point-to-point link. The other side is the mirror image. Then you route traffic (or run OSPF/BGP) over Tunnel0 like any other interface.

On Linux it's just as easy:

ip tunnel add gre1 mode gre local 203.0.113.1 remote 198.51.100.1 ttl 255
ip addr add 192.168.1.1/30 dev gre1
ip link set gre1 up

MTU: the thing that bites everyone

GRE adds 24 bytes (20 for the new IP header, 4 for GRE). That means a full 1500-byte packet won't fit through the tunnel anymore. The classic symptom: ping works, SSH works, but big downloads stall and some websites never finish loading.

Set the tunnel MTU to 1476 (or lower if there's IPsec on top too).
Clamp TCP MSS on the tunnel, for example ip tcp adjust-mss 1436 on Cisco.
Don't block ICMP "fragmentation needed" messages anywhere along the path.

Other things to know

GRE is stateless. It doesn't retransmit lost packets or tell you if the other end disappeared, and a tunnel interface can show "up" while the far side is dead. GRE keepalives (on platforms that support them) or a routing protocol running over the tunnel will notice when it's actually down. A tunnel is also only as good as the path underneath it, so loss and latency on the underlay show up in the tunnel too.

Where you'll see it

Branch offices tunneling back to a hub, with OSPF or BGP running over the tunnels for redundancy.
Extending an on-prem network into a cloud provider while keeping the same addressing and routing.
Providers carrying customer traffic across their backbone without exposing internal routes.
DDoS scrubbing services handing clean traffic back to you over GRE.
Homelabs. Lots of homelabs.

It's not fancy, and that's sort of the point. GRE is simple enough that once you understand it, the fancier tunnels (VXLAN, for example) make a lot more sense.

Last Modified: October 12, 2026, 11:41 am