Diff — Tunneling

{{infobox

| title = Tunneling

| type = Networking concept — encapsulation of one protocol inside another

| classic examples | GRE, IP-in-IP, SSH tunnels, VPNs, 6to4, VXLAN, TLS CONNECT

| cost | Header overhead — every envelope eats MTU

}}

**Tunneling** is networking's most generative trick: carrying a packet *inside* another packet, so that what an intermediate network sees (the envelope) differs from what the endpoints exchange (the contents). A tunnel lets IPv6 islands cross an IPv4 ocean, a private LAN stretch across the public internet, or an arbitrary stream hide inside HTTPS. Every VPN, every overlay network, every SSH port-forward is the same idea with a different envelope — and every one pays the same tax: each layer of wrapping adds header bytes, and the payload space shrinks.

## The idea

Encapsulation is the whole mechanism. A tunnel endpoint takes an inner packet — say, an IPv6 datagram — wraps it in an outer header — say, IPv4 — and sends it. The intermediate network routes only on the outer header; at the far end, the wrapper is stripped and the original packet continues as if the ocean between were a wire. To the inner traffic, the tunnel is a link; to the outer network, it's unremarkable traffic between two endpoints.

Tunnels exist at every layer: **Layer 2 tunnels** carry Ethernet frames (pseudowires, VXLAN, L2TP, TAP devices); **Layer 3 tunnels** carry IP packets (GRE, IP-in-IP, WireGuard, TUN devices). The Linux kernel exposes both as virtual interfaces — `tun` reads and writes raw IP packets, `tap` raw Ethernet frames — which is why every tunnel implementation on Linux starts by creating one.

## The classic tunnels

| Tunnel | Layer | What it wraps | Where it lives |

| --- | --- | --- | --- |

| GRE (RFC 2784, Cisco 1994) | L3 | Anything in IP | Routers everywhere |

| IP-in-IP (RFC 2003) | L3 | IPv4 in IPv4 | Simplest possible tunnel |

| SSH `-L`/`-R`/`-D` | stream | TCP inside SSH | Every admin's pocket |

| IPsec ESP tunnel mode | L3 | IP inside encrypted IP | Site VPNs |

| OpenVPN | L2/L3 | Frames/packets in TLS or UDP | User-space VPNs |

| WireGuard | L3 | IP in authenticated UDP | The modern VPN |

| VXLAN (RFC 7348) | L2 | Ethernet in UDP | Cloud/datacenter overlays |

| 6to4 / Teredo / 6rd | L3 | IPv6 in IPv4 | The transition era |

| HTTP CONNECT / TLS | stream | Anything in HTTPS | Proxies, stunnel |

## The IPv6 transition — tunnels' greatest era

Tunnels carried IPv6 through its two-decade childhood. **6to4** (1999) encoded the IPv4 endpoint *inside* the IPv6 address — any host with a public IPv4 could emit a routed IPv6 /48 through automatic encapsulation. **Teredo** tunneled IPv6 inside UDP/IPv4 specifically to cross NATs. **6rd** let ISPs offer IPv6 over IPv4 backbones. When an ISP today hands you "IPv6", there's a decent chance a tunnel is doing the work — the modern internet's bones are partly encapsulated.

## SSH tunnels — the everyday tunnel

The tunnel every practitioner actually uses:

```sh

ssh -L 8080:internal-db:5432 user@bastion     # local forward — my :8080 reaches their DB

ssh -R 9090:localhost:3000 user@public-vps  # remote forward — expose my :3000 to them

ssh -D 1080 user@host                        # dynamic — a SOCKS proxy through SSH

```

Three flags cover most tunneling work. No VPN daemon, no certificates, no config files — the SSH session itself is the envelope.

## The MTU tax

Every wrapper costs bytes. A tunnel inside Ethernet starts below the 1500-byte MTU — GRE takes ~24, IPsec ~50+, WireGuard ~60, VXLAN ~50. Inner packets that fit the physical MTU no longer fit once wrapped, forcing **fragmentation** or **Path MTU Discovery** — and when PMTUD's ICMP replies get filtered (they often do), connections hang mysteriously on large transfers while pings succeed. "The tunnel is up but stalls on big packets" is the MTU tax coming due — the fix is clamping MSS (`iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu`) or lowering the tunnel interface MTU.

## Tunnels as overlay networks

In datacenters, tunneling *is* the network: **VXLAN** wraps Ethernet frames in UDP to stretch L2 segments across L3 fabrics — one physical network carrying thousands of isolated virtual ones (16 million VNIs vs VLAN's 4094). Kubernetes overlays (Flannel, Calico's VXLAN mode), cloud VPCs, and multi-tenant fabrics all run on encapsulated traffic. **Geneve** generalized the idea — a tunnel whose headers carry extensible metadata. The modern cloud is tunnels all the way down.

## Security and abuse

An encrypted tunnel hides the contents but not the fact of a tunnel — endpoints, timing, and volume remain visible. And the same technique that secures a VPN can exfiltrate data: **DNS tunneling** (iodine) smuggles traffic in TXT queries, **ICMP tunneling** rides pings, and every restrictive egress filter is a tunnel waiting to be built. Tunnels are neutral plumbing — the envelope doesn't know what it's carrying.

## Split tunneling

A VPN needn't carry *all* traffic: **split tunneling** routes only chosen subnets through the tunnel (corporate prefixes inside, YouTube outside) — a routing-table question, not a tunnel question. WireGuard's `AllowedIPs` makes it explicit: the allowed range *is* both the route and the ACL.

## In the handbook

Tunneling is where [[Linux]] networking meets practice — `ip tunnel`, `tun`/`tap` devices, `ssh -L`, WireGuard's `wg0`, and the MTU subtleties that bite every first VPN. The deep follow-on: [[WireGuard]] — a modern tunnel reduced to its cryptographic essence.

## Timeline

| | |

| --- | --- |

| 2001 | OpenVPN — TLS-based user-space VPN |

| 2020 | WireGuard merged into Linux 5.6 |

## See also

- [[WireGuard]] — the modern tunnel

- [[Linux]] — tun/tap, `ip`, and the kernel interfaces tunnels live on

[[Category:Networking]]

[[Category:Concepts]]

[[Category:Linux]]