Wireless Hacks

Hack 55 Tunneling: GRE Encapsulation

IP tunnels with GRE for supporting multicast and Cisco devices.

GRE stands for Generic Routing Encapsulation. Like IPIP tunneling [Hack #54], GRE is an unencrypted encapsulation protocol. The main advantages of using GRE instead of IPIP are that it supports multicast packets, and that it also interoperates with Cisco routers.

Just as with the IPIP tunneling hack, I assume that you have two private networks (10.42.1.0/24 and 10.42.2.0/24), and that these networks both have direct Internet connectivity via a Linux router at each network. The "real" IP address of the first network router is 240.101.83.2, and the "real" IP of the second router is 251.4.92.217.

Again, as with IPIP tunneling, you also need a copy of the advanced routing tools package (there is no shortcut for GRE tunnels in Linux 2.2 that I've been able to find). Once you have the iproute2 package installed, begin by loading the GRE kernel module on both routers:

  # modprobe ip_gre

On the first network's router, set up a new tunnel device:

  # ip tunnel add gre0 mode gre remote 251.4.92.217 local 240.101.83.2 [RETURN]
    ttl 255
  # ip addr add 10.42.1.254 dev gre0
  # ip link set gre0 up

Note that you can call the device anything you like; gre0 is just an example. Also, that 10.42.1.254 address can be any available address on the first network, but shouldn't be 10.42.1.1 (the IP already bound to its internal interface.) Now, add your network routes via the new tunnel interface:

  # ip route add 10.42.2.0/24 dev gre0

The first network is finished. Now for the second:

  # ip tunnel add gre0 mode gre remote 240.101.83.2 local 251.4.92.217 [RETURN]
    ttl 255
  # ip addr add 10.42.2.254 dev gre0
  # ip link set gre0 up
  # ip route add 10.42.1.0/24 dev gre0

Again, the 10.42.2.254 address can be any available address on the second network. Feel free to add as many ip route add ... dev gre0 commands as you need.

That's it! You should now be able to pass packets between the two networks as if the Internet didn't exist. A traceroute from the first network should show just a couple of hops to any host in the second network (although you'll probably notice a fair bit of latency when crossing the 10.42.2.254 hop, unless you're really well connected). If you're having trouble, check the notes in the IPIP example and don't panic. Your best friend when debugging new network configurations is probably a packet sniffer like tcpdump [Hack #37] or Ethereal [Hack #38].

To bring the tunnel down, run this on both routers:

  # ip link set gre0 down
  # ip tunnel del gre0

See Also

• Advanced Routing HOWTO, http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/

• Advanced Routing Tools (iproute2), ftp://ftp.inr.ac.ru/ip-routing/