Berik Ashimov
Senior IT Engineer

GRE, IPIP, and SIT Tunnels: Simple Point-to-Point Encapsulation

· 7 min read
#vyos #networking #vpn

VPNs like IPsec and WireGuard provide encryption. But sometimes you don’t need encryption — just encapsulation. Connect two private networks over public internet without the complexity of key management.

GRE, IPIP, and SIT are simple tunneling protocols. They wrap packets inside other packets. No encryption, minimal overhead, easy to set up. Use them when encapsulation is enough and encryption is handled elsewhere (or not needed).

Simple tunnels solve simple problems.

Tunnel Types

TypeFull NameEncapsulatesOverhead
GREGeneric Routing EncapsulationAny protocol24 bytes
IPIPIP-in-IPIPv4 only20 bytes
SITSimple Internet TransitionIPv6 in IPv420 bytes

When to Use Each

GRE:   Most flexible, multicast support, routing protocols
IPIP:  Minimal overhead, IPv4 only
SIT:   IPv6 tunneling over IPv4

GRE Tunnel Configuration

Basic GRE Tunnel

Terminal window
configure


# Create GRE tunnel
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.255.0.1/30


commit

Both Ends Must Match

Terminal window
# Site A (203.0.113.1)
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.255.0.1/30


# Site B (198.51.100.1)
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 198.51.100.1
set interfaces tunnel tun0 remote 203.0.113.1
set interfaces tunnel tun0 address 10.255.0.2/30

GRE with Key

GRE key identifies tunnel (useful when multiple tunnels to same endpoint):

Terminal window
configure


# Add GRE key
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 parameters ip key 12345
set interfaces tunnel tun0 address 10.255.0.1/30


commit


# Both ends must use same key

GRE Keepalives

Detect tunnel failure:

Terminal window
configure


# Enable keepalives
set interfaces tunnel tun0 parameters ip keepalive interval 10
set interfaces tunnel tun0 parameters ip keepalive failure-count 3


# Tunnel goes down after 30 seconds of no response


commit

IPIP Tunnel Configuration

Minimal overhead for IPv4-only:

Terminal window
configure


# Create IPIP tunnel
set interfaces tunnel tun0 encapsulation ipip
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.255.0.1/30


commit

IPIP vs GRE

IPIP: 20 bytes overhead, IPv4 only, no multicast
GRE:  24 bytes overhead, any protocol, multicast support


Use IPIP when:
- Only IPv4 needed
- Minimal overhead matters
- No routing protocols over tunnel


Use GRE when:
- Need multicast (OSPF, etc.)
- Need IPv6 over tunnel
- Need GRE key for identification

SIT Tunnel Configuration

IPv6 over IPv4 tunneling:

Terminal window
configure


# Create SIT tunnel (6in4)
set interfaces tunnel tun0 encapsulation sit
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 2001:db8::1/64


commit

6in4 Tunnel Example

/48
# Site B: IPv4 198.51.100.1, wants IPv6 2001:db8:b::/48
# Tunnel addresses: 2001:db8:ffff::1/126 and ::2


# Site A
set interfaces tunnel tun0 encapsulation sit
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 2001:db8:ffff::1/126


set protocols static route6 2001:db8:b::/48 interface tun0


# Site B
set interfaces tunnel tun0 encapsulation sit
set interfaces tunnel tun0 source-address 198.51.100.1
set interfaces tunnel tun0 remote 203.0.113.1
set interfaces tunnel tun0 address 2001:db8:ffff::2/126


set protocols static route6 2001:db8:a::/48 interface tun0

MTU Considerations

Calculate Tunnel MTU

Outer IP header:  20 bytes
GRE header:       4 bytes (8 with key/seq)
Inner packet:     MTU - overhead


Standard Ethernet (1500):
- GRE: 1500 - 24 = 1476 MTU
- IPIP: 1500 - 20 = 1480 MTU
- SIT: 1500 - 20 = 1480 MTU

Set Tunnel MTU

Terminal window
configure


# Set MTU on tunnel interface
set interfaces tunnel tun0 mtu 1476


# Important: Prevents fragmentation issues


commit

MSS Clamping

Terminal window
# Clamp TCP MSS for traffic over tunnel
set firewall options interface tun0 adjust-mss 1436


# MSS = MTU - 40 (IP + TCP headers)

Routing Over Tunnels

Static Routes

Terminal window
configure


# Route remote network via tunnel
set protocols static route 10.2.0.0/16 interface tun0


commit

Dynamic Routing

Terminal window
configure


# OSPF over GRE (GRE supports multicast)
set protocols ospf interface tun0 area 0


# For IPIP (no multicast), use unicast neighbors
set protocols ospf interface tun0 area 0
set protocols ospf neighbor 10.255.0.2  # Explicit neighbor


commit

GRE over IPsec

GRE for routing + IPsec for encryption:

Terminal window
configure


# IPsec tunnel first
set vpn ipsec interface eth0
set vpn ipsec esp-group ESP-GRE proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GRE proposal 1 hash sha256
set vpn ipsec ike-group IKE-GRE proposal 1 encryption aes256
set vpn ipsec ike-group IKE-GRE proposal 1 hash sha256


set vpn ipsec site-to-site peer 198.51.100.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 198.51.100.1 authentication pre-shared-secret "secret"
set vpn ipsec site-to-site peer 198.51.100.1 ike-group IKE-GRE
set vpn ipsec site-to-site peer 198.51.100.1 local-address 203.0.113.1
set vpn ipsec site-to-site peer 198.51.100.1 tunnel 1 esp-group ESP-GRE
set vpn ipsec site-to-site peer 198.51.100.1 tunnel 1 protocol gre


# GRE inside IPsec
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.255.0.1/30


commit

Troubleshooting Tunnels

Tunnel Not Coming Up

Terminal window
# Check interface status
show interfaces tunnel


# Verify source address is local
ip addr show | grep 203.0.113.1


# Check remote reachability (outer IP)
ping 198.51.100.1


# Check firewall allows GRE/IPIP
# GRE: Protocol 47
# IPIP: Protocol 4

Traffic Not Flowing

Terminal window
# Check routing
show ip route


# Verify routes via tunnel
show ip route 10.2.0.0/16


# Test tunnel connectivity
ping 10.255.0.2  # Tunnel endpoint


# Check MTU
ping -s 1400 -M do 10.255.0.2  # Large packet with DF

Capture Tunnel Traffic

Terminal window
# Capture on physical interface (encapsulated)
sudo tcpdump -i eth0 proto gre
sudo tcpdump -i eth0 proto 4  # IPIP


# Capture on tunnel interface (inner packets)
sudo tcpdump -i tun0

Security Considerations

GRE/IPIP Have No Encryption

Traffic visible to anyone on path:
- Inner IP addresses
- Protocol information
- Payload content


For sensitive data:
- Use GRE over IPsec
- Use WireGuard/IPsec instead
- Encrypt at application layer

Firewall GRE at Ingress

Terminal window
# Only allow GRE from known peer
set firewall ipv4 name WAN-IN rule 100 action accept
set firewall ipv4 name WAN-IN rule 100 protocol gre
set firewall ipv4 name WAN-IN rule 100 source address 198.51.100.1


set firewall ipv4 name WAN-IN rule 999 action drop

Multiple Tunnels

To Same Remote

Terminal window
# Use GRE key to distinguish
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 parameters ip key 1
set interfaces tunnel tun0 address 10.255.0.1/30


set interfaces tunnel tun1 encapsulation gre
set interfaces tunnel tun1 remote 198.51.100.1
set interfaces tunnel tun1 parameters ip key 2
set interfaces tunnel tun1 address 10.255.1.1/30

To Different Remotes

Terminal window
# Different tunnel interfaces
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun1 remote 198.51.100.2
set interfaces tunnel tun2 remote 198.51.100.3

The Lesson

Simple tunnels solve simple problems.

Use GRE/IPIP/SIT when:

  • Encapsulation is enough (no encryption needed)
  • Running routing protocols over tunnel (GRE)
  • IPv6 over IPv4 infrastructure (SIT)
  • Minimal overhead matters (IPIP)
  • Already have encryption elsewhere

Don’t use when:

  • Data is sensitive (use IPsec/WireGuard)
  • Through untrusted networks without encryption
  • Need advanced features (VPN, multi-homing)

These protocols are old but not obsolete. They’re tools in the toolkit. Know when to use them and when to reach for something more capable.

Simple problems deserve simple solutions.