GRE tunnels: a private link across a network that will not carry it

The idea

A tunnel wraps a private packet inside a public one, so two private sites can talk across a network that will not route them; GRE tunnels are the simplest kind. Here routerA and routerB build one across the internet Router, so alice at site A reaches fileServer at site B.

Steps

1. Building the tunnel, one end at a time

   The internet will not carry the sites' private addresses, so each router must wrap them in its own public one. A GRE tunnel is a virtual card naming two public addresses: its own end (local) and the far one (remote). Build routerA's end, then routerB's mirror.

   alice:~# ping -c 2 -W 2 10.0.2.10
   routerA:~# ip tunnel add toSiteB mode gre local 10.0.11.2 remote 10.0.12.2 ttl 64
   routerA:~# ip addr add 172.16.0.1/30 dev toSiteB
   routerA:~# ip link set toSiteB up
   routerB:~# ip tunnel add toSiteA mode gre local 10.0.12.2 remote 10.0.11.2 ttl 64
   routerA:~# ping -c 2 -W 2 172.16.0.2

2. Routing the sites into the tunnel

   A tunnel carries only what a route sends into it, so the sites' traffic still goes around it. Send site B's network out of toSiteB on routerA, and site A's out of toSiteA on routerB. Then trace alice's path.

   routerA:~# ip route add 10.0.2.0/24 dev toSiteB
   routerB:~# ip route add 10.0.1.0/24 dev toSiteA
   alice:~# traceroute -n -w 1 -m 5 10.0.2.10