Hot answers tagged

7 votes

GRE tunnel TTL number

TTL stands for Time to Live. It is a field present in the IP packet header. The value is initially set by the sender, often to 64, and decremented by one by every router. When it reaches 0 without ...
Anton's user avatar
  • 171
7 votes
Accepted

Cannot Delete GRE Tunnel

The gre0 tunnel interface is named as the fallback interface and has special meaning. It's created by ip_gre kernel module at initialization of module. You cannot disable this feature. When the host ...
Anton Danilov's user avatar
5 votes
Accepted

PPTP Passthrough Centos 7/Firewalld router to Windows Server

On my rhel7 servers which allow access to a PPTP VPN I set the following in addition to opening the port: sudo firewall-cmd --permanent --zone=public --direct --add-rule ipv4 filter INPUT 0 -p gre -j ...
hvindin's user avatar
  • 206
4 votes
Accepted

Reading back Linux gre[tap] local/remote address

To get all information from an interface, you can use ip's -details option: -d, -details     Output more detailed information. # ip link add name gretaptest type gretap remote 192.0.2.1 local 192.0....
A.B's user avatar
  • 12.5k
4 votes

Allow GRE (IP protocol 47) over Linux router NAT for a subnet

I found the solution. I did this: sysctl -w net.netfilter.nf_conntrack_helper=1 Then add modprobe ip_nat_pptp I was using Ubuntu 18.04.2 LTS, kernel version 4.15.0-45-generic. There was no need to ...
Shyamkkhadka's user avatar
2 votes
Accepted

MikroTik GRE over IPSec

Don't use tunnel mode in your IPSec Policy. That's what causes Torch to show the GRE packets. Since you are encrypting the whole GRE connection, it will be just as secure by not using tunnel mode. ...
Cha0s's user avatar
  • 2,460
2 votes

Cannot Delete GRE Tunnel

You need to verify that the gre module is completely removed. Run sudo lsmod | grep gre to check if the module is in the list. If it is, run sudo rmmod ip_gre sudo rmmod gre to remove them from ...
Tony's user avatar
  • 21
2 votes

Packet loss in IpSec/GRE tunnel

The default table is filter, so when you provide a rule like iptables -A FORWARD ... you just put the rule in filter table. There are also several another tables and table mangle is one of them. As of ...
Yura Poltoratskiy's user avatar
2 votes

How can I set up a point-to-point IPv6 GRE tunnel encrypted with ipsec between my Mikrotik CCR2004 router and a Linux host running Strongswan?

Similar to what was posted above by Falcom Momot, you can find an entire wiki page I've done up on various VPN programs and linking them here https://wiki.pttlink.org/wiki/VPN I have a section under ...
KG7QIN's user avatar
  • 21
1 vote
Accepted

iptables - route traffic back to origin GRE interface

Why are you doing DNAT and mangle with a gre tunnel? The point of a gre tunnel, is to get through the firewall so you can then use standard routing. What Subnet are you using for 10.0.0.6 and 10.0.0.2?...
Luke Attard's user avatar
1 vote
Accepted

Is it safe to use a Linux GRE tunnel with remote IP 0.0.0.0?

Yes. In various cases this is desired, for example, this is how Cisco DMVPN works. This is often called mGRE (multipoint GRE). You also need to add peers manually with ip neigh add or automatically ...
Nikita Kipriyanov's user avatar
1 vote

How does GRE interface route packet to remote endpoint

But l2gre0 has only the idea about remote 192.168.0.10 and local 192.168.0.103 endpoints, so how did it decide that this packet (dest IP: 10.10.10.1) need to be encapsulated ? It didn't. The ...
Peter Zhabin's user avatar
  • 2,871
1 vote

How can I route traffic back through the interface it came through for Docker

You need to mark incoming packets (entering the the virtual nic), and then, setup routing rules based on the mark, and eventually a secondary routing table. Sometimes, source-based routing can also ...
Dylan's user avatar
  • 500
1 vote

Want to set GRE as the default network

Let's establish the following concrete addressing scheme (since you didn't provided any): Server A: eno1: address 198.51.100.2/24, gateway 198.51.100.1 gre1: remote 192.0.2.2, local 198.51.100.2, ...
Nikita Kipriyanov's user avatar
1 vote

GRETAP over IPSEC ESP using ip-xfrm

The problem with the above is that the policy matches only traffic using the local IP addresses. It doesn't match relayed packets that are forwarded to the remote local IP, and it doesn't match the ...
Jeff Learman's user avatar
1 vote
Accepted

GRE tunneling using Open vSwitch

I got it working. This answer helped me. I had two problems with my config. First, I should have added an IP address for the nested guests. With tap0 up and connected to the nested guest, I configured ...
a5hk's user avatar
  • 107
1 vote
Accepted

How can I set up a point-to-point IPv6 GRE tunnel encrypted with ipsec between my Mikrotik CCR2004 router and a Linux host running Strongswan?

We're going to use PSK identities for this, because it's a point to point link and there's no reason to complicate it with certificates. This works on Ubuntu 20.04 and RouterOS 6.48.1. On the ...
Falcon Momot's user avatar
  • 25.3k
1 vote
Accepted

Packets not getting forwarded on Centos7 between GRE tunnels

The Docker daemon seems to be running on the forwarding machine. By default to isolate containers on different bridges and the host machine, Docker will install a default DROP policy on the forwarding ...
Gerrit's user avatar
  • 1,572
1 vote

GRE traffic not forwarded to local subnet

Problem solved. rp_filter was enabled for the tunnel interfaces $ cat /proc/sys/net/ipv4/conf/all/rp_filter 1 $ cat /proc/sys/net/ipv4/conf/tun0/rp_filter 1 Changing both of those to 0 fixed the ...
Dero's user avatar
  • 185
1 vote

Allow GRE (IP protocol 47) over Linux router NAT for a subnet

Did you load nf_nat_proto_gre kernel module? If you do so the first two lines will likely not be needed anymore.
Tomek's user avatar
  • 3,553
1 vote
Accepted

GRE perfomance issue on Linux

Sorry, It was my mistake. Stale traffic control 400Mbps restriction was applied to the output of host2. [root@host2 ~]# tc class show dev eth2.17 class htb 1:1 root prio 0 rate 400000Kbit ceil ...
Veniamin's user avatar
  • 863
1 vote

How to setup a GRE 3 host mesh without loops and forwards with OpenVSwitch?

I suggest you to try it with some SDN controller. Maybe you can use ONOS or Open Day Light. Or if you want to some flexible exploration you can use Ryu controller, here is some Ryu controller with web ...
dek.tiram's user avatar
  • 111
1 vote
Accepted

Packet loss in IpSec/GRE tunnel

You forgot about MSS 1 ) You must set mtu on gre tunnel 1400 2 ) For SYN packets set mss at same size mtu 1400 in linux: iptables -I FORWARD -i tun+ -p tcp -m tcp --tcp-flags SYN,RST SYN -j ...
user3809680's user avatar
1 vote

Get IP over DHCP for GRE-tunnel

As you can see from the ip tunnel show output, your tunnel type is gre/ip, so it is a layer 3 tunnel. It means that you can only send IP packets, but BOOTP (the protocol under DHCP) uses layer 2 ...
Enrico Polesel's user avatar
1 vote

Bonding over OpenVPN, for fault tolerance

I would begin to answer this by stating that your strategy won't work. You're not going to get bonding over these interfaces. When you get into routing, you've abandoned the notions of bonding and are ...
Spooler's user avatar
  • 7,126
1 vote

iptables SNAT not working for GRE packets

First of all your iptables command missing -t nat part. But this should generate an error as no POSTROUTING table exists in filter table by default. Make sure you are adding this to a correct table. ...
NStorm's user avatar
  • 1,342
1 vote

IPSEC over GRE tunnel on PFSENSE

I think you do not have a rules in ipsec interfaces for allow traffic. Under firewall rules select ipsec interface and try to add an easy role for allow traffic any to any fie each pfsense
Alessandro Secchi's user avatar
1 vote
Accepted

Virtualize using IPs under GRE Tunnel (or NAT?)

If DDoS protection is implemented on devices in front of your server then you probably can use either GRE or IPIP tunnel if you have 2 linux boxes. IPIP tunnel will only work for Linux OS (while GRE ...
alxgomz's user avatar
  • 1,650
1 vote

Reverse proxy for DoS / DDoS protection

It sure is possible, and you have more than one choices as usual. You can proxy the TCP connection (Layer 4), this is expecially useful when you are terminating SSL connections at your webserver so ...
Fredi's user avatar
  • 2,277
1 vote

Linux GRE keep alive

This is related only partially to keepalives. Basically you need to establish a second GRE tunnel and implement some mechanism to detect tunnel failures (though it can be done with keepalives, usually ...
drookie's user avatar
  • 8,759

Only top scored, non community-wiki answers of a minimum length are eligible