Tunnel Interfaces (GRE, IPIP) in VyOS

Tunnel interfaces in VyOS let you encapsulate one protocol inside another to build virtual connections over existing infrastructure. VyOS supports several tunnel types - GRE, IPIP, SIT, GRETAP, and IP6GRE - for a variety of network interconnection scenarios.

Overview

Tunnel interfaces are used for:

Connecting remote networks: Over the internet without VPN overhead
IPv6 over IPv4: SIT tunnels for IPv6 transport
Multicast routing: GRE supports multicast traffic
NAT traversal: Tunnels work across NAT
Legacy connectivity: Connecting to legacy equipment
Ease of configuration: Simpler than IPsec for non-critical scenarios

Tunnel Types

Type	Encapsulation	Use Case	Multicast	Encryption
GRE	IP-in-IP (protocol 47)	General-purpose tunnels, routing protocols	Yes	No
IPIP	IP-in-IP (protocol 4)	IPv4-only tunnels	No	No
SIT	IPv6-in-IPv4	IPv6 over IPv4 networks	No	No
GRETAP	Ethernet-in-GRE	Layer 2 tunnels (bridging)	Yes	No
IP6GRE	IP-in-IPv6	GRE over IPv6	Yes	No

Key Considerations

Advantages:

Simple configuration (no certificates or PSK)
Low overhead (less than IPsec)
Support for routing protocols (OSPF, BGP over GRE)
Multicast support (GRE, GRETAP)

Disadvantages:

No built-in encryption (use IPsec for protection)
May be blocked by firewalls (protocols 47, 4)
Does not traverse some NAT devices (GRE passthrough required)

GRE (Generic Routing Encapsulation)

GRE is the most versatile tunnel type, supporting any protocol (IPv4, IPv6, multicast) and working with routing protocols.

Basic GRE Configuration

# Create a GRE tunnel
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.10.1/30

commit
save

Parameters:

source-address: Local external IP address
remote: Remote external IP address
address: IP address of the tunnel interface

GRE with Multicast (for OSPF/RIP)

# GRE tunnel for OSPF
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.10.1/30
set interfaces tunnel tun0 multicast enable

# OSPF over GRE
set protocols ospf area 0 network 10.10.10.0/30
set protocols ospf area 0 network 192.168.1.0/24

commit
save

GRE with IPsec for Encryption

# GRE tunnel
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.10.1/30

# IPsec to protect GRE (transport mode)
set vpn ipsec esp-group ESP-GRE mode transport
set vpn ipsec esp-group ESP-GRE proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GRE proposal 1 hash sha256

set vpn ipsec ike-group IKE-GRE key-exchange ikev2
set vpn ipsec ike-group IKE-GRE proposal 1 encryption aes256
set vpn ipsec ike-group IKE-GRE proposal 1 hash sha256

set vpn ipsec site-to-site peer 198.51.100.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 198.51.100.1 authentication pre-shared-secret 'SecretKey123!'
set vpn ipsec site-to-site peer 198.51.100.1 ike-group IKE-GRE
set vpn ipsec site-to-site peer 198.51.100.1 local-address 203.0.113.1
set vpn ipsec site-to-site peer 198.51.100.1 tunnel 0 protocol gre

commit
save

GRE Key (for Tunnel Identification)

# GRE with a key (for multiple tunnels to the same endpoint)
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.10.1/30
set interfaces tunnel tun0 parameters ip key 100

# Second tunnel with a different key
set interfaces tunnel tun1 encapsulation gre
set interfaces tunnel tun1 source-address 203.0.113.1
set interfaces tunnel tun1 remote 198.51.100.1
set interfaces tunnel tun1 address 10.10.11.1/30
set interfaces tunnel tun1 parameters ip key 200

commit
save

IPIP Tunnel

IPIP is the simplest tunnel type, encapsulating IPv4 inside IPv4. It does not support multicast but has minimal overhead.

Basic IPIP Configuration

# Create an IPIP tunnel
set interfaces tunnel tun0 encapsulation ipip
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.10.1/30

commit
save

IPIP for Simple Point-to-Point Connectivity

# Site A
set interfaces tunnel tun0 encapsulation ipip
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.10.1/30

# Static route to the remote network
set protocols static route 192.168.2.0/24 next-hop 10.10.10.2

commit
save

# Site B
set interfaces tunnel tun0 encapsulation ipip
set interfaces tunnel tun0 source-address 198.51.100.1
set interfaces tunnel tun0 remote 203.0.113.1
set interfaces tunnel tun0 address 10.10.10.2/30

# Static route to the remote network
set protocols static route 192.168.1.0/24 next-hop 10.10.10.1

commit
save

SIT Tunnel (IPv6-in-IPv4)

SIT (Simple Internet Transition) tunnels are used to transport IPv6 across IPv4 networks.

Basic SIT Configuration

# Create a SIT tunnel
set interfaces tunnel tun0 encapsulation sit
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 2001:db8:1::1/64

commit
save

SIT for Connecting to an IPv6 Provider (Hurricane Electric)

# Example: Hurricane Electric Tunnel Broker
set interfaces tunnel tun0 encapsulation sit
set interfaces tunnel tun0 source-address 203.0.113.1  # Your IPv4
set interfaces tunnel tun0 remote 216.66.84.46        # HE tunnel server
set interfaces tunnel tun0 address 2001:470:1f0a:xxxx::2/64  # Your IPv6 (client)

# Default route through the tunnel
set protocols static route6 ::/0 next-hop 2001:470:1f0a:xxxx::1

# IPv6 on the LAN interface
set interfaces ethernet eth1 address 2001:470:1f0b:xxxx::1/64

# Router Advertisement for clients
set service router-advert interface eth1 prefix 2001:470:1f0b:xxxx::/64

commit
save

SIT with Multiple IPv6 Subnets

# SIT tunnel
set interfaces tunnel tun0 encapsulation sit
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 2001:db8:1::1/64

# Additional IPv6 addresses
set interfaces tunnel tun0 address 2001:db8:2::1/64
set interfaces tunnel tun0 address 2001:db8:3::1/64

commit
save

GRETAP (Ethernet over GRE)

GRETAP encapsulates Ethernet frames inside GRE, allowing you to build Layer 2 tunnels (for bridging).

Basic GRETAP Configuration

# Create a GRETAP tunnel
set interfaces tunnel tun0 encapsulation gretap
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1

# MAC address of the tunnel interface (optional)
set interfaces tunnel tun0 address 00:11:22:33:44:55

commit
save

GRETAP with a Bridge for L2 Extension

# GRETAP tunnel
set interfaces tunnel tun0 encapsulation gretap
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1

# Bridge to extend the L2 network
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface tun0
set interfaces bridge br0 address 192.168.1.1/24

commit
save

Now eth1 and the remote network reachable through tun0 are in the same L2 broadcast domain.

IP6GRE (GRE over IPv6)

IP6GRE tunnels are GRE tunnels that operate over an IPv6 transport.

Basic IP6GRE Configuration

# Create an IP6GRE tunnel
set interfaces tunnel tun0 encapsulation ip6gre
set interfaces tunnel tun0 source-address 2001:db8:1::1
set interfaces tunnel tun0 remote 2001:db8:2::1
set interfaces tunnel tun0 address 10.10.10.1/30

commit
save

Configuration Examples

Example 1: GRE Tunnel for Connecting Offices with OSPF

Office A (203.0.113.1):

# WAN interface
set interfaces ethernet eth0 address 203.0.113.1/24

# LAN interface
set interfaces ethernet eth1 address 192.168.1.1/24

# GRE tunnel to Office B
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.10.1/30
set interfaces tunnel tun0 multicast enable

# OSPF for dynamic routing
set protocols ospf area 0 network 10.10.10.0/30
set protocols ospf area 0 network 192.168.1.0/24
set protocols ospf parameters router-id 10.255.255.1

# Firewall for GRE (protocol 47)
set firewall ipv4 name WAN_LOCAL rule 100 action accept
set firewall ipv4 name WAN_LOCAL rule 100 protocol gre
set firewall ipv4 name WAN_LOCAL rule 100 source address 198.51.100.1

set interfaces ethernet eth0 firewall local name WAN_LOCAL

commit
save

Office B (198.51.100.1):

# WAN interface
set interfaces ethernet eth0 address 198.51.100.1/24

# LAN interface
set interfaces ethernet eth1 address 192.168.2.1/24

# GRE tunnel to Office A
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 198.51.100.1
set interfaces tunnel tun0 remote 203.0.113.1
set interfaces tunnel tun0 address 10.10.10.2/30
set interfaces tunnel tun0 multicast enable

# OSPF
set protocols ospf area 0 network 10.10.10.0/30
set protocols ospf area 0 network 192.168.2.0/24
set protocols ospf parameters router-id 10.255.255.2

# Firewall for GRE
set firewall ipv4 name WAN_LOCAL rule 100 action accept
set firewall ipv4 name WAN_LOCAL rule 100 protocol gre
set firewall ipv4 name WAN_LOCAL rule 100 source address 203.0.113.1

set interfaces ethernet eth0 firewall local name WAN_LOCAL

commit
save

Example 2: GRE + IPsec for a Secure Tunnel

Site A:

# GRE tunnel
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.10.1/30

# IPsec in transport mode to protect GRE
set vpn ipsec esp-group ESP-GRE mode transport
set vpn ipsec esp-group ESP-GRE proposal 1 encryption aes256
set vpn ipsec esp-group ESP-GRE proposal 1 hash sha256

set vpn ipsec ike-group IKE-GRE key-exchange ikev2
set vpn ipsec ike-group IKE-GRE proposal 1 encryption aes256
set vpn ipsec ike-group IKE-GRE proposal 1 hash sha256

set vpn ipsec site-to-site peer 198.51.100.1 authentication mode pre-shared-secret
set vpn ipsec site-to-site peer 198.51.100.1 authentication pre-shared-secret 'StrongPassword123!'
set vpn ipsec site-to-site peer 198.51.100.1 ike-group IKE-GRE
set vpn ipsec site-to-site peer 198.51.100.1 local-address 203.0.113.1
set vpn ipsec site-to-site peer 198.51.100.1 tunnel 0 protocol gre

# Static route
set protocols static route 192.168.2.0/24 next-hop 10.10.10.2

commit
save

Example 3: IPIP Tunnel for Simple Connectivity

# Site A
set interfaces tunnel tun0 encapsulation ipip
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.10.1/30

# MTU adjustment (IPIP overhead = 20 bytes)
set interfaces tunnel tun0 mtu 1480

# Static route
set protocols static route 192.168.2.0/24 next-hop 10.10.10.2

commit
save

Example 4: SIT Tunnel for IPv6 (Hurricane Electric)

# Obtain the parameters from tunnelbroker.net

# SIT tunnel
set interfaces tunnel tun0 encapsulation sit
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 216.66.84.46
set interfaces tunnel tun0 address 2001:470:1f0a:1234::2/64
set interfaces tunnel tun0 description 'HE IPv6 Tunnel'

# Default IPv6 route
set protocols static route6 ::/0 next-hop 2001:470:1f0a:1234::1

# Routed /48 on the LAN
set interfaces ethernet eth1 address 2001:470:1f0b:1234::1/64

# Router Advertisement
set service router-advert interface eth1 prefix 2001:470:1f0b:1234::/64

commit
save

Example 5: Hub-and-Spoke with GRE

Hub (headquarters):

# Tunnel to Spoke 1
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1
set interfaces tunnel tun0 address 10.10.1.1/30
set interfaces tunnel tun0 parameters ip key 100

# Tunnel to Spoke 2
set interfaces tunnel tun1 encapsulation gre
set interfaces tunnel tun1 source-address 203.0.113.1
set interfaces tunnel tun1 remote 198.51.100.2
set interfaces tunnel tun1 address 10.10.2.1/30
set interfaces tunnel tun1 parameters ip key 200

# Tunnel to Spoke 3
set interfaces tunnel tun2 encapsulation gre
set interfaces tunnel tun2 source-address 203.0.113.1
set interfaces tunnel tun2 remote 198.51.100.3
set interfaces tunnel tun2 address 10.10.3.1/30
set interfaces tunnel tun2 parameters ip key 300

# BGP for dynamic routing
set protocols bgp local-as 65000
set protocols bgp neighbor 10.10.1.2 remote-as 65001
set protocols bgp neighbor 10.10.2.2 remote-as 65002
set protocols bgp neighbor 10.10.3.2 remote-as 65003

commit
save

Spoke 1:

# Tunnel to the Hub
set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 198.51.100.1
set interfaces tunnel tun0 remote 203.0.113.1
set interfaces tunnel tun0 address 10.10.1.2/30
set interfaces tunnel tun0 parameters ip key 100

# BGP to the Hub
set protocols bgp local-as 65001
set protocols bgp neighbor 10.10.1.1 remote-as 65000
set protocols bgp address-family ipv4-unicast network 192.168.1.0/24

commit
save

Example 6: GRETAP for L2 Extension

Site A:

# GRETAP tunnel
set interfaces tunnel tun0 encapsulation gretap
set interfaces tunnel tun0 source-address 203.0.113.1
set interfaces tunnel tun0 remote 198.51.100.1

# Bridge for L2 extension
set interfaces bridge br0 member interface eth1
set interfaces bridge br0 member interface tun0

# DHCP relay through the tunnel (optional)
set service dhcp-relay interface br0
set service dhcp-relay interface eth0
set service dhcp-relay server 192.168.1.10

commit
save

Monitoring and Diagnostics

Viewing Tunnel Status

# Show all tunnel interfaces
show interfaces tunnel

# Detailed information
show interfaces tunnel tun0

# Statistics
show interfaces tunnel tun0 statistics

Checking Connectivity

# Ping through the tunnel
ping 10.10.10.2 interface tun0

# Traceroute
traceroute 192.168.2.1

# MTU check (with Don't Fragment)
ping 10.10.10.2 size 1472 do-not-fragment

Traffic Monitoring

# Capture packets on the tunnel interface
sudo tcpdump -i tun0 -nn

# Capture GRE packets on the physical interface
sudo tcpdump -i eth0 proto gre

# Capture IPIP
sudo tcpdump -i eth0 proto 4

# Verbose output
sudo tcpdump -i tun0 -vvv

Checking Routing

# Routing table
show ip route

# Specific route
show ip route 192.168.2.0/24

# OSPF routes (if used)
show ip ospf route

# BGP routes (if used)
show ip bgp

MTU Diagnostics

# Path MTU Discovery
ping 10.10.10.2 size 1400 do-not-fragment

# Gradually increasing the packet size
ping 10.10.10.2 size 1200 do-not-fragment
ping 10.10.10.2 size 1300 do-not-fragment
ping 10.10.10.2 size 1400 do-not-fragment
ping 10.10.10.2 size 1500 do-not-fragment  # Should fail

Checking the Configuration

# Show the tunnel configuration
show configuration interfaces tunnel tun0

# All tunnels
show configuration interfaces tunnel

Troubleshooting

Problem: Tunnel Does Not Come Up

Diagnostics:

# 1. Check the interface
show interfaces tunnel tun0

# 2. Check connectivity to the external IPs
ping 198.51.100.1

# 3. Check the firewall
show firewall

# 4. Logs
show log | match tun0

Solution:

# Verify the source/remote addresses
show configuration interfaces tunnel tun0

# Allow GRE in the firewall (protocol 47)
set firewall ipv4 name WAN_LOCAL rule 100 action accept
set firewall ipv4 name WAN_LOCAL rule 100 protocol gre

# For IPIP (protocol 4)
set firewall ipv4 name WAN_LOCAL rule 100 protocol 4

commit
save

Problem: Tunnel Is Up but There Is No Connectivity

Diagnostics:

# Ping the tunnel IP
ping 10.10.10.2

# Check the routes
show ip route

# Traceroute
traceroute 192.168.2.1

Solution:

# Add routes (if static)
set protocols static route 192.168.2.0/24 next-hop 10.10.10.2

# Check the routing protocol (if OSPF/BGP)
show ip ospf neighbor
show ip bgp summary

commit
save

Problem: Poor Performance / Packet Loss

Cause: MTU issues - the tunnel adds overhead.

Diagnostics:

# Check the MTU
show interfaces tunnel tun0

# Path MTU Discovery
ping 10.10.10.2 size 1472 do-not-fragment

Solution:

# Reduce the MTU on the tunnel
# GRE overhead = 24 bytes (20 IP + 4 GRE)
# IPIP overhead = 20 bytes
# Standard MTU 1500 - 24 = 1476

set interfaces tunnel tun0 mtu 1476

# MSS clamping for TCP (optional)
set firewall ipv4 name FORWARD rule 100 action accept
set firewall ipv4 name FORWARD rule 100 protocol tcp
set firewall ipv4 name FORWARD rule 100 tcp flags syn
set firewall ipv4 name FORWARD rule 100 tcp mss 1436

commit
save

Problem: GRE Does Not Work Through NAT

Cause: NAT does not always handle GRE (protocol 47) correctly.

Solution:

Use GRE over IPsec (NAT-T is handled automatically by IPsec).

# GRE + IPsec configuration (see Example 2 above)
set vpn ipsec site-to-site peer <remote> tunnel 0 protocol gre

Alternatively, use a VTI (Virtual Tunnel Interface) with IPsec.

Problem: OSPF/BGP Does Not Work Over the Tunnel

Diagnostics:

# Check multicast on GRE
show configuration interfaces tunnel tun0 multicast

# OSPF neighbors
show ip ospf neighbor

# BGP neighbors
show ip bgp summary

Solution:

# Enable multicast on GRE (for OSPF)
set interfaces tunnel tun0 multicast enable

# Check the OSPF network statements
set protocols ospf area 0 network 10.10.10.0/30

commit
save

Problem: SIT Tunnel Does Not Receive IPv6

Diagnostics:

# Check the tunnel
show interfaces tunnel tun0

# Ping the IPv6 gateway
ping 2001:470:1f0a:1234::1

# IPv6 routing
show ipv6 route

Solution:

# Verify the source/remote addresses
show configuration interfaces tunnel tun0

# Add a default route
set protocols static route6 ::/0 next-hop 2001:470:1f0a:1234::1

# Check the firewall for IPv6
show firewall ipv6

commit
save

Best Practices

1. Choosing the Right Tunnel Type

# GRE - for general-purpose needs with routing protocols
set interfaces tunnel tun0 encapsulation gre

# IPIP - for simple IPv4 tunnels without multicast
set interfaces tunnel tun0 encapsulation ipip

# SIT - only for IPv6 over IPv4
set interfaces tunnel tun0 encapsulation sit

2. MTU Configuration

Always configure the correct MTU:

# GRE: 1500 - 24 = 1476
set interfaces tunnel tun0 mtu 1476

# IPIP: 1500 - 20 = 1480
set interfaces tunnel tun0 mtu 1480

# SIT: 1500 - 20 = 1480
set interfaces tunnel tun0 mtu 1480

3. Tunnel Security

Tunnels are unencrypted - use IPsec:

# GRE + IPsec for encryption
set vpn ipsec site-to-site peer <remote> tunnel 0 protocol gre

4. Firewall Rules

Allow the tunnel protocols:

# GRE (protocol 47)
set firewall ipv4 name WAN_LOCAL rule 100 action accept
set firewall ipv4 name WAN_LOCAL rule 100 protocol gre
set firewall ipv4 name WAN_LOCAL rule 100 source address <remote-ip>

# IPIP (protocol 4)
set firewall ipv4 name WAN_LOCAL rule 101 action accept
set firewall ipv4 name WAN_LOCAL rule 101 protocol 4
set firewall ipv4 name WAN_LOCAL rule 101 source address <remote-ip>

5. Monitoring

Monitor the state of your tunnels:

# Task Scheduler for checks
set system task-scheduler task check-tunnel interval '*/5 * * * *'
set system task-scheduler task check-tunnel executable path '/config/scripts/check-tunnel.sh'

The /config/scripts/check-tunnel.sh script:

#!/bin/bash
if ! ping -c 3 -W 2 10.10.10.2 > /dev/null 2>&1; then
    logger -t tunnel-monitor "Tunnel tun0 is DOWN"
    echo "Tunnel tun0 is DOWN" | mail -s "Tunnel Alert" admin@example.com
fi

6. Interface Descriptions

Document your tunnels:

set interfaces tunnel tun0 description 'GRE to Branch-Office-B (198.51.100.1)'

7. GRE Keys for Multiple Tunnels

Use GRE keys for identification:

set interfaces tunnel tun0 parameters ip key 100
set interfaces tunnel tun1 parameters ip key 200

8. Redundancy

Set up backup tunnels for critical links:

# Primary tunnel via ISP1
set interfaces tunnel tun0 source-address 203.0.113.1

# Backup tunnel via ISP2
set interfaces tunnel tun1 source-address 198.51.100.1

# BGP for automatic failover
set protocols bgp neighbor 10.10.10.2 remote-as 65001
set protocols bgp neighbor 10.10.11.2 remote-as 65001

9. QoS Over Tunnels

Apply QoS to prioritize traffic:

set traffic-policy shaper TUNNEL-QOS bandwidth 50mbit
set traffic-policy shaper TUNNEL-QOS class 10 bandwidth 10mbit
set traffic-policy shaper TUNNEL-QOS class 10 priority 7
set traffic-policy shaper TUNNEL-QOS class 10 match voip ip dscp ef

set interfaces tunnel tun0 traffic-policy out TUNNEL-QOS

10. Documentation

Document every tunnel in the system:

# File /config/tunnels.txt
# tun0: GRE to Branch-B (198.51.100.1), OSPF enabled
# tun1: GRE to Branch-C (198.51.100.2), OSPF enabled
# tun2: SIT for IPv6 (HE Tunnel Broker)

Useful Commands

# Show all tunnels
show interfaces tunnel

# Details of a specific tunnel
show interfaces tunnel tun0

# Statistics
show interfaces tunnel tun0 statistics

# Configuration
show configuration interfaces tunnel tun0

# Ping through the tunnel
ping 10.10.10.2 interface tun0

# MTU test
ping 10.10.10.2 size 1472 do-not-fragment

# Traceroute
traceroute 192.168.2.1

# tcpdump on the tunnel
sudo tcpdump -i tun0 -nn

# tcpdump GRE on the physical interface
sudo tcpdump -i eth0 proto gre

# Routes
show ip route

# OSPF (if used)
show ip ospf neighbor
show ip ospf route

# BGP (if used)
show ip bgp summary

# Logs
show log | match tun

Conclusion

Tunnel interfaces in VyOS provide flexible options for connecting remote networks over IP infrastructure. The various tunnel types (GRE, IPIP, SIT, GRETAP, IP6GRE) suit different scenarios - from simple point-to-point connections to complex hub-and-spoke topologies with dynamic routing.

Key advantages of tunnels:

Simpler configuration compared to IPsec
Support for routing protocols (OSPF, BGP over GRE)
Multicast support (GRE, GRETAP)
Low overhead
Topology flexibility

Recommendations for production:

Choose the right tunnel type for the task
Use GRE + IPsec for encryption
Configure the correct MTU (avoid fragmentation)
Monitor the state of your tunnels
Apply firewall rules for the tunnel protocols
Document every tunnel
Use routing protocols for automatic failover
Apply QoS to critical traffic

Tunnels in VyOS deliver reliable and flexible network interconnection, serving as an alternative or a complement to VPN solutions for a range of enterprise and ISP scenarios.

Reviewed by OpenNix LLC · Last updated on 29 July 2026

Bond Interfaces (Link Aggregation) in VyOS VTI Interfaces (Virtual Tunnel Interface) in VyOS