IP tunnels with Generic Routing Encapsulation
GRE stands for Generic Routing Encapsulation. Like IPIP tunneling (see [Hack #50]), GRE is an unencrypted encapsulation protocol. The main advantage of using GRE instead of IPIP are that it supports multicast packets and that it will also inter operate with Cisco routers.
Just as with the IPIP tunneling hack, we'll assume that you have two private networks (10.42.1.0/24 and 10.42.2.0/24) and that these networks both have direct Internet connectivity via a Linux router at each network. The "real" IP address of the first network router is 240.101.83.2, and the "real" IP of the second router is 251.4.92.217.
Again, as with IPIP tunneling ([Hack #50]), you will need a copy of the advanced routing tools package (there is no shortcut for GRE tunnels in Linux 2.2 that I've been able to find). Once you have the iproute2 package installed, we'll begin by loading the GRE kernel module on both routers:
# modprobe ip_gre
On the first network's router, set up a new tunnel device:
# ip tunnel add gre0 mode gre remote 251.4.92.217 local 240.101.83.2 ttl 255 # ip addr add 10.42.1.254 dev gre0 # ip link set gre0 up
Note that you can call the device anything you like;
gre0 is just an example. Also, that 10.42.1.254
address can be any available address on the first network, but
shouldn't be 10.42.1.1 (the IP already bound to its
internal interface). Now, add your network routes via the new tunnel
# ip route add 10.42.2.0/24 dev gre0
The first network is finished. Now for the second:
# ip tunnel add gre0 mode gre remote 240.101.83.2 local 251.4.92.217 ttl 255 # ip addr add 10.42.2.254 dev gre0 # ip link set gre0 up # ip route add 10.42.1.0/24 dev gre0
Again, the 10.42.2.254 address can be any available address on the
second network. Feel free to add as many
ip route add . . .
dev gre0 commands as you need.
That's it! You should now be able to pass packets
between the two networks as if the Internet didn't
exist. A traceroute from the first network should show just a couple
of hops to any host in the second network (although
you'll probably notice a fair bit of latency when
crossing the 10.42.2.254 hop, unless you're really
well connected). If you're having trouble, check the
notes in the IPIP example and don't panic. Your best
friend when debugging new network configurations is probably a packet
sniffer like tcpdump
ethereal. Running a
\icmp' on both routers while pinging will give you a very
detailed overview of what's going on.
To bring the tunnel down, run this on both routers:
# ip link set gre0 down # ip tunnel del gre0