I need to build a simple point-to-point tunnel to connect an office through an area of the network we trust but directly don't control. Does the tunnel need to be GRE-encapsulated or can I use direct IP-in-IP? (We won't be using IPsec for this particular implementation.)
asked May 10, 2013 at 19:09
Add a comment
|
4 Answers
Either method will work. I personally prefer GRE, but there should be no practical difference between the two for your use case. (GRE can transport other layer3 protocols than just IP, though.)
The only thing to really keep in mind is that GRE incurs a tiny bit of extra overhead as opposed to IPinIP.
answered May 10, 2013 at 19:26
It is also worth considering how tunneling impacts the path MTU. It would be ideal for the infrastructure between tunnel endpoints to support a larger MTU. This will avoid issues with fragmentation and broken pmtud.
answered May 10, 2013 at 19:57
Running a tunnel over GRE has the added benefit of being pretty much protocol-agnostic, so you can of course use it for IPv6 later on.
With that said however, there's equally nothing stopping you running 6in4 or ip6ip6 alongside ipip, so the question really comes down to whether there's any tangible gain for you by choosing GRE and using it for multiprotocol.
If you're planning to load the link to its full capacity - go with IPinIP. Otherwise - GRE.
