Is there a way to create something similar to an IPIP or GRE tunnel only over UDP or TCP?

I have a GRE tunnel between two servers and I noticed that sometimes it starts to drop packets. At the same time if I ping between servers over the internet I have no problems.

I believe this is a traffic shaping problem form my provider (It does not take into account the GRE protocol). I have also tried an IPIP tunnel with the same result.

  • Title is broken: 'UDP' May 13, 2009 at 12:51

5 Answers 5


Give openvpn a shot. You can create tunnels over UDP or TCP.


I'm not sure what's causing your particular problem, but you should note that in general it's better for tunnels to use an unreliable transport stream (i.e. UDP) than a reliable one.

The reason for this is that if you do happen to get packet loss the tunnelled TCP layer should be the one managing the retransmission, and not the real transport layer.

If both layers have got retransmission built into them they can start to get in a retransmission war which ultimately kills throughput.

Also, don't forget that any tunneling protocol will reduce the effective MTU (and consequently the TCP MSS). If the MTU and MSS aren't adjusted appropriately you'll see excessive fragmentation and/or dropped packets.


Do you know if you're dropping GRE packets or packets tunneled withing the GRE tunnel? With any sort of tunnel, it's not uncommon to run into MTU problems with just about any kind of tunneling. MTU problems can be hard to diagnose because smaller packets (like default pings) pass through the tunnel just fine. You'll only see problems with larger packets and generally only if the application or system is setting the DF (Don't Fragment) bit. Which unfortunately is pretty common.

You can test end-to-end for what's the smallest MTU across the network path by using pings with a large packet size and the DF bit set.

On Windows you can set the DF bit with the -f option and set the packet size with the -l option like this:

ping -f -l 1450

On Linux, you set the DF bit with the "-M do" option and set the packet size with the -s option, like this:

ping -M do -s 1450

You didn't say what you're using for the GRE endpoints.. If they are Cisco routers, this link is pretty good. If not, search google for GRE MTU issues and you'll find a ton of information.


PPP over SSH perhaps?

  • 1
    PPP over SSH, while a cool hack, suffers from the TCP-in-TCP flow problem. There's much nicer proper solutions available (OpenVPN).
    – MikeyB
    May 13, 2009 at 20:03

This little guide on tunneling may help you for choosing the right one.

  • As Alnitak said anything TCP-backed is quite bad for latency (IP does not need the reliability that TCP offers, and it comes at a price.). Typically PPP over SSH or PPP over HTTP are mostly useful to be able to eventually pass firewalls.
  • Pings are done ususally via the ICMP protocol, and therefore are usually dropped the last by overloaded routers that implement early drops. It would be interesting to see if you experience drops with UDP or TCP "pings" also. Packets dropping are quite common on the internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.