7
votes
GRE tunnel TTL number
TTL stands for Time to Live. It is a field present in the IP packet header. The value is initially set by the sender, often to 64, and decremented by one by every router. When it reaches 0 without ...
7
votes
Accepted
Cannot Delete GRE Tunnel
The gre0 tunnel interface is named as the fallback interface and has special meaning. It's created by ip_gre kernel module at initialization of module. You cannot disable this feature.
When the host ...
5
votes
Accepted
PPTP Passthrough Centos 7/Firewalld router to Windows Server
On my rhel7 servers which allow access to a PPTP VPN I set the following in addition to opening the port:
sudo firewall-cmd --permanent --zone=public --direct --add-rule ipv4 filter INPUT 0 -p gre -j ...
4
votes
Accepted
Reading back Linux gre[tap] local/remote address
To get all information from an interface, you can use ip's -details option:
-d, -details
Output more detailed information.
# ip link add name gretaptest type gretap remote 192.0.2.1 local 192.0....
4
votes
Allow GRE (IP protocol 47) over Linux router NAT for a subnet
I found the solution.
I did this:
sysctl -w net.netfilter.nf_conntrack_helper=1
Then add
modprobe ip_nat_pptp
I was using Ubuntu 18.04.2 LTS, kernel version 4.15.0-45-generic. There was no need to ...
2
votes
Accepted
MikroTik GRE over IPSec
Don't use tunnel mode in your IPSec Policy.
That's what causes Torch to show the GRE packets.
Since you are encrypting the whole GRE connection, it will be just as secure by not using tunnel mode. ...
2
votes
Cannot Delete GRE Tunnel
You need to verify that the gre module is completely removed. Run
sudo lsmod | grep gre
to check if the module is in the list. If it is, run
sudo rmmod ip_gre
sudo rmmod gre
to remove them from ...
2
votes
Packet loss in IpSec/GRE tunnel
The default table is filter, so when you provide a rule like iptables -A FORWARD ... you just put the rule in filter table. There are also several another tables and table mangle is one of them. As of ...
2
votes
How can I set up a point-to-point IPv6 GRE tunnel encrypted with ipsec between my Mikrotik CCR2004 router and a Linux host running Strongswan?
Similar to what was posted above by Falcom Momot, you can find an entire wiki page I've done up on various VPN programs and linking them here https://wiki.pttlink.org/wiki/VPN
I have a section under ...
1
vote
Accepted
iptables - route traffic back to origin GRE interface
Why are you doing DNAT and mangle with a gre tunnel?
The point of a gre tunnel, is to get through the firewall so you can then use standard routing.
What Subnet are you using for 10.0.0.6 and 10.0.0.2?...
1
vote
Accepted
Is it safe to use a Linux GRE tunnel with remote IP 0.0.0.0?
Yes. In various cases this is desired, for example, this is how Cisco DMVPN works.
This is often called mGRE (multipoint GRE).
You also need to add peers manually with ip neigh add or automatically ...
1
vote
How does GRE interface route packet to remote endpoint
But l2gre0 has only the idea about remote 192.168.0.10 and local 192.168.0.103 endpoints, so how did it decide that this packet (dest IP: 10.10.10.1) need to be encapsulated ?
It didn't. The ...
1
vote
How can I route traffic back through the interface it came through for Docker
You need to mark incoming packets (entering the the virtual nic), and then, setup routing rules based on the mark, and eventually a secondary routing table. Sometimes, source-based routing can also ...
1
vote
Want to set GRE as the default network
Let's establish the following concrete addressing scheme (since you didn't provided any):
Server A:
eno1: address 198.51.100.2/24, gateway 198.51.100.1
gre1: remote 192.0.2.2, local 198.51.100.2, ...
1
vote
GRETAP over IPSEC ESP using ip-xfrm
The problem with the above is that the policy matches only traffic using the local IP addresses. It doesn't match relayed packets that are forwarded to the remote local IP, and it doesn't match the ...
1
vote
Accepted
GRE tunneling using Open vSwitch
I got it working. This answer helped me. I had two problems with my config.
First, I should have added an IP address for the nested guests. With tap0 up and connected to the nested guest, I configured ...
1
vote
Accepted
How can I set up a point-to-point IPv6 GRE tunnel encrypted with ipsec between my Mikrotik CCR2004 router and a Linux host running Strongswan?
We're going to use PSK identities for this, because it's a point to point link and there's no reason to complicate it with certificates. This works on Ubuntu 20.04 and RouterOS 6.48.1.
On the ...
1
vote
Accepted
Packets not getting forwarded on Centos7 between GRE tunnels
The Docker daemon seems to be running on the forwarding machine. By default to isolate containers on different bridges and the host machine, Docker will install a default DROP policy on the forwarding ...
1
vote
GRE traffic not forwarded to local subnet
Problem solved. rp_filter was enabled for the tunnel interfaces
$ cat /proc/sys/net/ipv4/conf/all/rp_filter
1
$ cat /proc/sys/net/ipv4/conf/tun0/rp_filter
1
Changing both of those to 0 fixed the ...
1
vote
Allow GRE (IP protocol 47) over Linux router NAT for a subnet
Did you load nf_nat_proto_gre kernel module? If you do so the first two lines will likely not be needed anymore.
1
vote
Accepted
GRE perfomance issue on Linux
Sorry, It was my mistake.
Stale traffic control 400Mbps restriction was applied to the output of host2.
[root@host2 ~]# tc class show dev eth2.17
class htb 1:1 root prio 0 rate 400000Kbit ceil ...
1
vote
How to setup a GRE 3 host mesh without loops and forwards with OpenVSwitch?
I suggest you to try it with some SDN controller. Maybe you can use ONOS or Open Day Light. Or if you want to some flexible exploration you can use Ryu controller, here is some Ryu controller with web ...
1
vote
Accepted
Packet loss in IpSec/GRE tunnel
You forgot about MSS
1 ) You must set mtu on gre tunnel 1400
2 ) For SYN packets set mss at same size mtu 1400
in linux:
iptables -I FORWARD -i tun+ -p tcp -m tcp --tcp-flags SYN,RST SYN -j ...
1
vote
Get IP over DHCP for GRE-tunnel
As you can see from the ip tunnel show output, your tunnel type is gre/ip, so it is a layer 3 tunnel.
It means that you can only send IP packets, but BOOTP (the protocol under DHCP) uses layer 2 ...
1
vote
Bonding over OpenVPN, for fault tolerance
I would begin to answer this by stating that your strategy won't work. You're not going to get bonding over these interfaces. When you get into routing, you've abandoned the notions of bonding and are ...
1
vote
iptables SNAT not working for GRE packets
First of all your iptables command missing -t nat part. But this should generate an error as no POSTROUTING table exists in filter table by default. Make sure you are adding this to a correct table. ...
1
vote
IPSEC over GRE tunnel on PFSENSE
I think you do not have a rules in ipsec interfaces for allow traffic.
Under firewall rules select ipsec interface and try to add an easy role for allow traffic any to any fie each pfsense
1
vote
Accepted
Virtualize using IPs under GRE Tunnel (or NAT?)
If DDoS protection is implemented on devices in front of your server then you probably can use either GRE or IPIP tunnel if you have 2 linux boxes.
IPIP tunnel will only work for Linux OS (while GRE ...
1
vote
Reverse proxy for DoS / DDoS protection
It sure is possible, and you have more than one choices as usual.
You can proxy the TCP connection (Layer 4), this is expecially useful when you are terminating SSL connections at your webserver so ...
1
vote
Linux GRE keep alive
This is related only partially to keepalives. Basically you need to establish a second GRE tunnel and implement some mechanism to detect tunnel failures (though it can be done with keepalives, usually ...
Only top scored, non community-wiki answers of a minimum length are eligible
Related Tags
gre × 133linux × 36
networking × 32
tunneling × 28
iptables × 21
linux-networking × 20
routing × 19
ipsec × 17
tunnel × 15
vpn × 14
nat × 14
cisco × 10
centos × 6
ip × 6
route × 6
debian × 5
router × 5
pptp × 5
iproute2 × 5
openvswitch × 4
ubuntu × 3
port-forwarding × 3
ddos × 3
mikrotik × 3
ip-routing × 3