Berik Ashimov
Senior IT Engineer

Dynamic Routing Over Tunnels: BGP and OSPF Through Encrypted Links

· 7 min read
#vyos #bgp #ospf #routing

Static routes over VPN tunnels work until you have multiple tunnels, need failover, or manage complex topologies. Then you want routing protocols to handle the complexity.

Running OSPF or BGP over tunnels adds resilience. If a tunnel goes down, the routing protocol detects it and converges to alternate paths. But tunnels add latency, may not support multicast, and need careful interface selection.

Routing over tunnels requires careful planning — but it’s worth it for resilient networks.

Tunnel Types and Routing Support

Tunnel TypeOSPFBGPNotes
GREYes (multicast)YesFull support
IPsec VTIYes (unicast)YesNo multicast
WireGuardYes (unicast)YesNo multicast
OpenVPNYes (unicast)YesNo multicast

Multicast vs Unicast OSPF

Terminal window
# GRE supports multicast (normal OSPF)
set protocols ospf interface tun0 area 0


# IPsec VTI/WireGuard need unicast neighbors
set protocols ospf interface wg0 area 0
set protocols ospf neighbor 10.255.0.2  # Explicit neighbor

OSPF Over GRE

GRE Tunnel Setup

Terminal window
configure


# GRE tunnel
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.255.0.1/30
set interfaces tunnel tun0 mtu 1476


commit

OSPF Configuration

Terminal window
configure


# OSPF over GRE (multicast works)
set protocols ospf interface tun0 area 0
set protocols ospf interface tun0 network point-to-point
set protocols ospf interface tun0 hello-interval 10
set protocols ospf interface tun0 dead-interval 40


# Advertise tunnel network
set protocols ospf area 0 network 10.255.0.0/30


# Advertise local networks
set protocols ospf area 0 network 192.168.1.0/24


commit

Verify OSPF

Terminal window
# Check neighbors
show ip ospf neighbor


# Should show neighbor via tun0
# Neighbor ID     Pri   State    Dead Time   Address      Interface
# 10.255.0.2      1     Full/-   00:00:32    10.255.0.2   tun0


# Check routes
show ip route ospf

OSPF Over IPsec (VTI)

IPsec VTI Setup

Terminal window
configure


# IPsec VTI (route-based VPN)
set vpn ipsec interface eth0
set vpn ipsec esp-group ESP proposal 1 encryption aes256gcm128
set vpn ipsec esp-group ESP proposal 1 hash sha256
set vpn ipsec ike-group IKE proposal 1 encryption aes256
set vpn ipsec ike-group IKE proposal 1 hash sha256
set vpn ipsec ike-group IKE proposal 1 dh-group 14


set vpn ipsec site-to-site peer 198.51.100.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 198.51.100.1 authentication pre-shared-secret "secret"
set vpn ipsec site-to-site peer 198.51.100.1 connection-type initiate
set vpn ipsec site-to-site peer 198.51.100.1 ike-group IKE
set vpn ipsec site-to-site peer 198.51.100.1 local-address 203.0.113.1
set vpn ipsec site-to-site peer 198.51.100.1 vti bind vti0
set vpn ipsec site-to-site peer 198.51.100.1 vti esp-group ESP


# VTI interface
set interfaces vti vti0 address 10.255.0.1/30
set interfaces vti vti0 mtu 1400


commit

OSPF Over VTI (No Multicast)

Terminal window
configure


# OSPF needs explicit neighbor (no multicast over IPsec)
set protocols ospf interface vti0 area 0
set protocols ospf interface vti0 network point-to-point
set protocols ospf neighbor 10.255.0.2


commit

OSPF Over WireGuard

WireGuard Setup

Terminal window
configure


# WireGuard interface
set interfaces wireguard wg0 address 10.255.0.1/30
set interfaces wireguard wg0 port 51820
set interfaces wireguard wg0 private-key <your-private-key>


# Peer configuration
set interfaces wireguard wg0 peer PEER1 public-key <peer-public-key>
set interfaces wireguard wg0 peer PEER1 allowed-ips 0.0.0.0/0
set interfaces wireguard wg0 peer PEER1 endpoint 198.51.100.1:51820
set interfaces wireguard wg0 peer PEER1 persistent-keepalive 25


commit

OSPF Over WireGuard

Terminal window
configure


# OSPF with explicit neighbor
set protocols ospf interface wg0 area 0
set protocols ospf interface wg0 network point-to-point
set protocols ospf neighbor 10.255.0.2


# BFD for faster failover
set protocols ospf interface wg0 bfd


commit

BGP Over Tunnels

BGP is easier — it uses TCP unicast, works over any tunnel.

BGP Over WireGuard

Terminal window
configure


# WireGuard tunnel (as above)
# ...


# BGP over WireGuard
set protocols bgp system-as 65001
set protocols bgp neighbor 10.255.0.2 remote-as 65002
set protocols bgp neighbor 10.255.0.2 update-source wg0
set protocols bgp neighbor 10.255.0.2 address-family ipv4-unicast


commit

BGP Over IPsec VTI

Terminal window
configure


# IPsec VTI (as above)
# ...


# BGP over VTI
set protocols bgp system-as 65001
set protocols bgp neighbor 10.255.0.2 remote-as 65002
set protocols bgp neighbor 10.255.0.2 update-source vti0
set protocols bgp neighbor 10.255.0.2 address-family ipv4-unicast


# BFD for fast failover
set protocols bgp neighbor 10.255.0.2 bfd


commit

Multi-Tunnel Design

Hub and Spoke with OSPF

          [Spoke1]
              │ wg1
        ┌─────┴─────┐
        │           │
       [Hub]        │
        │           │
        └─────┬─────┘
              │ wg2
          [Spoke2]
Terminal window
# Hub configuration
configure


# WireGuard to Spoke1
set interfaces wireguard wg1 address 10.255.1.1/30
set interfaces wireguard wg1 peer SPOKE1 ...


# WireGuard to Spoke2
set interfaces wireguard wg2 address 10.255.2.1/30
set interfaces wireguard wg2 peer SPOKE2 ...


# OSPF on both tunnels
set protocols ospf interface wg1 area 0
set protocols ospf interface wg1 network point-to-point
set protocols ospf neighbor 10.255.1.2


set protocols ospf interface wg2 area 0
set protocols ospf interface wg2 network point-to-point
set protocols ospf neighbor 10.255.2.2


commit

Full Mesh with BGP

Terminal window
# Each site peers with all others via BGP
# More configuration but better path selection


set protocols bgp neighbor 10.255.0.2 remote-as 65002
set protocols bgp neighbor 10.255.0.3 remote-as 65003
set protocols bgp neighbor 10.255.0.4 remote-as 65004

Fast Failover

BFD Over Tunnels

Terminal window
configure


# BFD for fast tunnel failure detection
set protocols bfd peer 10.255.0.2 source address 10.255.0.1
set protocols bfd peer 10.255.0.2 interval transmit 300
set protocols bfd peer 10.255.0.2 interval receive 300
set protocols bfd peer 10.255.0.2 interval multiplier 3


# Link BFD to OSPF
set protocols ospf interface wg0 bfd


# Or link to BGP
set protocols bgp neighbor 10.255.0.2 bfd


commit

Tunnel Keepalives

Terminal window
# WireGuard persistent keepalive
set interfaces wireguard wg0 peer PEER1 persistent-keepalive 25


# GRE keepalives
set interfaces tunnel tun0 parameters ip keepalive interval 10
set interfaces tunnel tun0 parameters ip keepalive failure-count 3

Troubleshooting

Routing Protocol Not Forming

Terminal window
# Check tunnel is up
show interfaces wireguard
ping 10.255.0.2


# Check routing protocol
show ip ospf neighbor
show bgp summary


# Check firewall allows protocol traffic
# OSPF: Protocol 89
# BGP: TCP 179
# BFD: UDP 3784/3785

Routes Not Propagating

Terminal window
# Check route advertisement
show ip ospf database
show bgp ipv4 unicast


# Verify network statements
show configuration commands | grep "protocols ospf area"
show configuration commands | grep "protocols bgp"

Asymmetric Routing

Terminal window
# Traffic goes out tunnel, returns via different path


# Ensure consistent costs
set protocols ospf interface wg0 cost 100
set protocols ospf interface wg1 cost 100


# Or use BGP with consistent metrics

Best Practices

1. Use Point-to-Point Network Type

Terminal window
# For tunnel interfaces
set protocols ospf interface wg0 network point-to-point


# Saves DR election overhead

2. Enable BFD

Terminal window
# Fast failure detection
set protocols ospf interface wg0 bfd
# Or
set protocols bgp neighbor 10.255.0.2 bfd

3. Set Appropriate Costs

Terminal window
# Higher cost for slower/less reliable tunnels
set protocols ospf interface wg0 cost 100  # Fast tunnel
set protocols ospf interface wg1 cost 200  # Backup tunnel

4. Consider MTU

Terminal window
# Ensure routing protocol packets fit
set interfaces wireguard wg0 mtu 1420


# Or enable fragmentation on underlay

The Lesson

Routing over tunnels requires careful planning — but it’s worth it for resilient networks.

Benefits:

  • Automatic failover on tunnel failure
  • Dynamic path selection
  • Consistent with non-tunnel routing

Challenges:

  • Tunnel type affects protocol support
  • MTU requires attention
  • Convergence time adds to tunnel detection time

Key decisions:

  1. Protocol: OSPF (simple) or BGP (more control)
  2. Failover: BFD required for fast detection
  3. Topology: Hub-spoke vs full mesh
  4. Tunnel type: Affects multicast support

Done right, routing over tunnels gives you a resilient VPN mesh that handles failures automatically. Done wrong, you get mysterious routing issues and slow failover.

Plan it. Test it. Monitor it.