GRE Tunnel Tutorial

Generic Routing Encapsulation (GRE) is a simple tunneling technique that makes two routers behave as though they were directly connected, even when there are other networks sitting physically between them. This is extremely useful when a company has two sites far apart from each other, each with its own local network, and wants to connect them as if they were on the same link.

How a GRE Tunnel Works

When a router sends a packet into a GRE tunnel, it wraps the original packet in two additional headers: a 4-byte GRE header and a 20-byte delivery (outer IP) header. The delivery header carries the physical, routable addresses of the two tunnel endpoints, so the underlying network only ever needs to know how to reach those addresses — it has no idea what is actually being carried inside.

It’s worth being clear about what GRE does and does not do: it encapsulates traffic, but it does not encrypt it. If confidentiality is required, GRE needs to be paired with IPsec. On the other hand, GRE does support multicast traffic, which is exactly why routing protocols that rely on multicast — such as OSPF and EIGRP — can run directly over a GRE tunnel without any special workaround.

The physical addresses used as the tunnel’s source and destination don’t need to be in the same subnet, or even directly connected — they simply need to be reachable from one router to the other across the underlying network.