Tunneling

Tunneling is networking's most generative trick: carrying a packet inside another packet, so that what an intermediate network sees (the envelope) differs from what the endpoints exchange (the contents). A tunnel lets IPv6 islands cross an IPv4 ocean, a private LAN stretch across the public internet, or an arbitrary stream hide inside HTTPS. Every VPN, every overlay network, every SSH port-forward is the same idea with a different envelope — and every one pays the same tax: each layer of wrapping adds header bytes, and the payload space shrinks.

The idea

Encapsulation is the whole mechanism. A tunnel endpoint takes an inner packet — say, an IPv6 datagram — wraps it in an outer header — say, IPv4 — and sends it. The intermediate network routes only on the outer header; at the far end, the wrapper is stripped and the original packet continues as if the ocean between were a wire. To the inner traffic, the tunnel is a link; to the outer network, it's unremarkable traffic between two endpoints.

Tunnels exist at every layer: Layer 2 tunnels carry Ethernet frames (pseudowires, VXLAN, L2TP, TAP devices); Layer 3 tunnels carry IP packets (GRE, IP-in-IP, WireGuard, TUN devices). The Linux kernel exposes both as virtual interfaces — tun reads and writes raw IP packets, tap raw Ethernet frames — which is why every tunnel implementation on Linux starts by creating one.

The classic tunnels

The IPv6 transition — tunnels' greatest era

Tunnels carried IPv6 through its two-decade childhood. 6to4 (1999) encoded the IPv4 endpoint inside the IPv6 address — any host with a public IPv4 could emit a routed IPv6 /48 through automatic encapsulation. Teredo tunneled IPv6 inside UDP/IPv4 specifically to cross NATs. 6rd let ISPs offer IPv6 over IPv4 backbones. When an ISP today hands you "IPv6", there's a decent chance a tunnel is doing the work — the modern internet's bones are partly encapsulated.

SSH tunnels — the everyday tunnel

The tunnel every practitioner actually uses:

ssh -L 8080:internal-db:5432 user@bastion     # local forward — my :8080 reaches their DB
ssh -R 9090:localhost:3000 user@public-vps  # remote forward — expose my :3000 to them
ssh -D 1080 user@host                        # dynamic — a SOCKS proxy through SSH

Three flags cover most tunneling work. No VPN daemon, no certificates, no config files — the SSH session itself is the envelope.

The MTU tax

Every wrapper costs bytes. A tunnel inside Ethernet starts below the 1500-byte MTU — GRE takes ~24, IPsec ~50+, WireGuard ~60, VXLAN ~50. Inner packets that fit the physical MTU no longer fit once wrapped, forcing fragmentation or Path MTU Discovery — and when PMTUD's ICMP replies get filtered (they often do), connections hang mysteriously on large transfers while pings succeed. "The tunnel is up but stalls on big packets" is the MTU tax coming due — the fix is clamping MSS (iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu) or lowering the tunnel interface MTU.

Tunnels as overlay networks

In datacenters, tunneling is the network: VXLAN wraps Ethernet frames in UDP to stretch L2 segments across L3 fabrics — one physical network carrying thousands of isolated virtual ones (16 million VNIs vs VLAN's 4094). Kubernetes overlays (Flannel, Calico's VXLAN mode), cloud VPCs, and multi-tenant fabrics all run on encapsulated traffic. Geneve generalized the idea — a tunnel whose headers carry extensible metadata. The modern cloud is tunnels all the way down.

Security and abuse

An encrypted tunnel hides the contents but not the fact of a tunnel — endpoints, timing, and volume remain visible. And the same technique that secures a VPN can exfiltrate data: DNS tunneling (iodine) smuggles traffic in TXT queries, ICMP tunneling rides pings, and every restrictive egress filter is a tunnel waiting to be built. Tunnels are neutral plumbing — the envelope doesn't know what it's carrying.

Split tunneling

A VPN needn't carry all traffic: split tunneling routes only chosen subnets through the tunnel (corporate prefixes inside, YouTube outside) — a routing-table question, not a tunnel question. WireGuard's AllowedIPs makes it explicit: the allowed range is both the route and the ACL.

In the handbook

Tunneling is where Linux networking meets practice — ip tunnel, tun/tap devices, ssh -L, WireGuard's wg0, and the MTU subtleties that bite every first VPN. The deep follow-on: WireGuard — a modern tunnel reduced to its cryptographic essence.

Timeline

See also

• WireGuard — the modern tunnel
• Linux — tun/tap, ip, and the kernel interfaces tunnels live on