,TUNNELING IS NETWORKING'S MOST GENERATIVE TRICK3 CARRYING A PACKET INSIDE ANOTHER PACKET1 SO THAT WHAT AN INTERMEDIATE NETWORK SEES " DIFFERS FROM WHAT THE ENDPOINTS EXCHANGE "4 ,A TUNNEL LETS ,I,PV#F ISLANDS CROSS AN ,I,PV#D OCEAN1 A PRIVATE ,,LAN STRETCH ACROSS THE PUBLIC INTERNET1 OR AN ARBITRARY STREAM HIDE INSIDE ,,HTTPS4 ,EVERY ,,VPN1 EVERY OVERLAY NETWORK1 EVERY ,,SSH PORT-FORWARD IS THE SAME IDEA WITH A DIFFERENT ENVELOPE AND EVERY ONE PAYS THE SAME TAX3 EACH LAYER OF WRAPPING ADDS HEADER BYTES1 AND THE PAYLOAD SPACE SHRINKS4 ,THE IDEA ,ENCAPSULATION IS THE WHOLE MECHANISM4 ,A TUNNEL ENDPOINT TAKES AN INNER PACKET SAY1 AN ,I,PV#F DATAGRAM WRAPS IT IN AN OUTER HEADER SAY1 ,I,PV#D AND SENDS IT4 ,THE INTERMEDIATE NETWORK ROUTES ONLY ON THE OUTER HEADER2 AT THE FAR END1 THE WRAPPER IS STRIPPED AND THE ORIGINAL PACKET CONTINUES AS IF THE OCEAN BETWEEN WERE A WIRE4 ,TO THE INNER TRAFFIC1 THE TUNNEL IS A LINK2 TO THE OUTER NETWORK1 IT'S UNREMARKABLE TRAFFIC BETWEEN TWO ENDPOINTS4 ,TUNNELS EXIST AT EVERY LAYER3 ,LAYER #B TUNNELS CARRY ,ETHERNET FRAMES "2 ,LAYER #C TUNNELS CARRY ,,IP PACKETS "<,,GRE1 ,,IP-IN-,,IP1 ,WIRE,GUARD1 ,,TUN DEVICES">4 ,THE ,LINUX KERNEL EXPOSES BOTH AS VIRTUAL INTERFACES TUN READS AND WRITES RAW ,,IP PACKETS1 TAP RAW ,ETHERNET FRAMES WHICH IS WHY EVERY TUNNEL IMPLEMENTATION ON ,LINUX STARTS BY CREATING ONE4 ,THE CLASSIC TUNNELS ,TUNNEL ,LAYER ,WHAT IT WRAPS ,WHERE IT LIVES ,,GRE "<,,RFC #BGHD1 ,CISCO #AIID"> ,L#C ,ANYTHING IN ,,IP ,ROUTERS EVERYWHERE ,,IP-IN-,,IP "<,,RFC #BJJC"> ,L#C ,I,PV#D IN ,I,PV#D ,SIMPLEST POSSIBLE TUNNEL ,,SSH -,L_/-,R_/-;,D STREAM ,,TCP INSIDE ,,SSH ,EVERY ADMIN'S POCKET ,I,PSEC ,,ESP TUNNEL MODE ,L#C ,,IP INSIDE ENCRYPTED ,,IP ,SITE ,V,P,NS ,OPEN,V,P,N ,L#B_/,L#C ,FRAMES_/PACKETS IN ,,TLS OR ,,UDP ,USER-SPACE ,V,P,NS ,WIRE,GUARD ,L#C ,,IP IN AUTHENTICATED ,,UDP ,THE MODERN ,,VPN ,,VXLAN "<,,RFC #GCDH"> ,L#B ,ETHERNET IN ,,UDP ,CLOUD_/DATACENTER OVERLAYS #FTO#D _/ ,TEREDO _/ #FRD ,L#C ,I,PV#F IN ,I,PV#D ,THE TRANSITION ERA ,,HTTP ,,CONNECT _/ ,,TLS STREAM ,ANYTHING IN ,,HTTPS ,PROXIES1 STUNNEL ,THE ,I,PV#F TRANSITION TUNNELS' GREATEST ERA ,TUNNELS CARRIED ,I,PV#F THROUGH ITS TWO-DECADE CHILDHOOD4 #FTO#D "<#AIII"> ENCODED THE ,I,PV#D ENDPOINT INSIDE THE ,I,PV#F ADDRESS ANY HOST WITH A PUBLIC ,I,PV#D COULD EMIT A ROUTED ,I,PV#F _/#DH THROUGH AUTOMATIC ENCAPSULATION4 ,TEREDO TUNNELED ,I,PV#F INSIDE ,,UDP_/,I,PV#D SPECIFICALLY TO CROSS ,N,A,TS4 #FRD LET ,I,S,PS OFFER ,I,PV#F OVER ,I,PV#D BACKBONES4 ,WHEN AN ,,ISP TODAY HANDS YOU 8,I,PV#F01 THERE'S A DECENT CHANCE A TUNNEL IS DOING THE WORK THE MODERN INTERNET'S BONES ARE PARTLY ENCAPSULATED4 ,,SSH TUNNELS THE EVERYDAY TUNNEL ,THE TUNNEL EVERY PRACTITIONER ACTUALLY USES3 SSH -;,L #HJHJ3INTERNAL-DB3#EDCB USER@ABASTION _? LOCAL FORWARD MY 3#HJHJ REACHES THEIR ,,DB SSH -;,R #IJIJ3LOCALHOST3#CJJJ USER@APUBLIC-VPS _? REMOTE FORWARD EXPOSE MY 3#CJJJ TO THEM SSH -;,D #AJHJ USER@AHOST _? DYNAMIC A ,,SOCKS PROXY THROUGH ,,SSH ,THREE FLAGS COVER MOST TUNNELING WORK4 ,NO ,,VPN DAEMON1 NO CERTIFICATES1 NO CONFIG FILES THE ,,SSH SESSION ITSELF IS THE ENVELOPE4 ,THE ,,MTU TAX ,EVERY WRAPPER COSTS BYTES4 ,A TUNNEL INSIDE ,ETHERNET STARTS BELOW THE #AEJJ-BYTE ,,MTU ,,GRE TAKES @9#BD1 ,I,PSEC @9#EJ"61 ,WIRE,GUARD @9#FJ1 ,,VXLAN @9#EJ4 ,INNER PACKETS THAT FIT THE PHYSICAL ,,MTU NO LONGER FIT ONCE WRAPPED1 FORCING FRAGMENTATION OR ,PATH ,,MTU ,DISCOVERY AND WHEN ,,PMTUD'S ,,ICMP REPLIES GET FILTERED "1 CONNECTIONS HANG MYSTERIOUSLY ON LARGE TRANSFERS WHILE PINGS SUCCEED4 8,THE TUNNEL IS UP BUT STALLS ON BIG PACKETS0 IS THE ,,MTU TAX COMING DUE THE FIX IS CLAMPING ,,MSS " OR LOWERING THE TUNNEL INTERFACE ,,MTU4 ,TUNNELS AS OVERLAY NETWORKS ,IN DATACENTERS1 TUNNELING IS THE NETWORK3 ,,VXLAN WRAPS ,ETHERNET FRAMES IN ,,UDP TO STRETCH ,L#B SEGMENTS ACROSS ,L#C FABRICS ONE PHYSICAL NETWORK CARRYING THOUSANDS OF ISOLATED VIRTUAL ONES "<#AF MILLION ,V,N,IS VS ,,VLAN'S #DJID">4 ,KUBERNETES OVERLAYS "<,FLANNEL1 ,CALICO'S ,,VXLAN MODE">1 CLOUD ,V,P,CS1 AND MULTI-TENANT FABRICS ALL RUN ON ENCAPSULATED TRAFFIC4 ,GENEVE GENERALIZED THE IDEA A TUNNEL WHOSE HEADERS CARRY EXTENSIBLE METADATA4 ,THE MODERN CLOUD IS TUNNELS ALL THE WAY DOWN4 ,SECURITY AND ABUSE ,AN ENCRYPTED TUNNEL HIDES THE CONTENTS BUT NOT THE FACT OF A TUNNEL ENDPOINTS1 TIMING1 AND VOLUME REMAIN VISIBLE4 ,AND THE SAME TECHNIQUE THAT SECURES A ,,VPN CAN EXFILTRATE DATA3 ,,DNS TUNNELING " SMUGGLES TRAFFIC IN ,,TXT QUERIES1 ,,ICMP TUNNELING RIDES PINGS1 AND EVERY RESTRICTIVE EGRESS FILTER IS A TUNNEL WAITING TO BE BUILT4 ,TUNNELS ARE NEUTRAL PLUMBING THE ENVELOPE DOESN'T KNOW WHAT IT'S CARRYING4 ,SPLIT TUNNELING ,A ,,VPN NEEDN'T CARRY ALL TRAFFIC3 SPLIT TUNNELING ROUTES ONLY CHOSEN SUBNETS THROUGH THE TUNNEL " A ROUTING-TABLE QUESTION1 NOT A TUNNEL QUESTION4 ,WIRE,GUARD'S ,ALLOWED,I,PS MAKES IT EXPLICIT3 THE ALLOWED RANGE IS BOTH THE ROUTE AND THE ,,ACL4 ,IN THE HANDBOOK ,TUNNELING IS WHERE ,LINUX NETWORKING MEETS PRACTICE IP TUNNEL1 TUN_/TAP DEVICES1 SSH -;,L1 ,WIRE,GUARD'S WG#J1 AND THE ,,MTU SUBTLETIES THAT BITE EVERY FIRST ,,VPN4 ,THE DEEP FOLLOW-ON3 ,WIRE,GUARD A MODERN TUNNEL REDUCED TO ITS CRYPTOGRAPHIC ESSENCE4 ,TIMELINE #AIID ,,GRE STANDARDIZED "<,,RFC #AGJA2 UPDATED ,,RFC #BGHD1 #BJJJ"> #AIIE#IH ,I,PSEC ,,ESP TUNNEL MODE "<,,RFC #AHBG ,,RFC #BDJF"> #BJJA #FTO#D AUTOMATIC ,I,PV#F TUNNELS "<,,RFC #CJEF"> #BJJA ,OPEN,V,P,N ,,TLS-BASED USER-SPACE ,,VPN #BJJF ,TEREDO ,,NAT-TRAVERSAL TUNNELS "<,,RFC #DCHJ"> #BJAD ,,VXLAN DATACENTER OVERLAY STANDARD "<,,RFC #GCDH"> #BJBJ ,WIRE,GUARD MERGED INTO ,LINUX #E4F ,SEE ALSO - ,WIRE,GUARD THE MODERN TUNNEL - ,LINUX TUN_/TAP1 IP1 AND THE KERNEL INTERFACES TUNNELS LIVE ON