3

I remember in uni that we implemented VPN tunnels always on the border routers and then use GRE tunnels to connect between two remote subnets.

I was always told that VPN tunnels need to know the external interface (Public IP) of the routers to implement.

I was wondering though if there is a way to implement a VPN tunnel between two subnets from site-to-site. For example if we have a remote network with 3 subnets and I want to access the server on subnet 2.

Usually I would do what I learnt, a VPN tunnell between the two networks and a GRE tunnel for the subnet. But is this right? Or is it better way to do it?

Improve this question

2 Answers 2

Reset to default
1

A tunnel is really just encapsulation of packets within other packets. The outer packets still need to be able to be routed normally to the address of the tunnel source (different than the tunnel address itself. The packets carried inside the outer packets see the tunnel as a single link, but the outer packets may need to be routed over many hops, especially if routed over the public Internet (which requires public addresses for the outer packets). The tunnel source must be able to send traffic that gets routed to the other tunnel source normally.

If you have a tunnel source inside a private network, then you cannot use that over the public Internet because you cannot route packets with private addresses over the public Internet. That is why the tunnel source addresses are usually the public WAN addresses of sites. If both your tunnel endpoints are within the same private network, then you could put the tunnel endpoints on any of the devices, as long as the tunnel source can normally reach each other.

Over a tunnel, you can use routing protocols to let the router on the other end of the tunnel know about any networks at the site, so it doesn't really matter how many networks are on each side of the tunnel. A tunnel is really just like connecting the two sites with a cable because it sets up a single link.

There are different tunnel types, and some cannot carry broadcast/multicast traffic, so some routing protocols or multicast routing may not work over that tunnel type. You could use a GRE tunnel inside that type of tunnel to overcome this, or use a different tunnel type that supports the features you need to support. Another possibility is to use static routes between the sites, but that doesn't scale, and it is not dynamic the way routing protocols are.

You could also have a problem if the private addressing at each of the two sites is using the same private addressing ranges. You may need to use NAT to overcome that.

Improve this answer
1
  • That makes sense. This is what I had in mind, but using always a GRE tunnel in our exercises got me a bit confused of why we used always the two together. This clears it up. I have been asked that question by friends and always suggested VPN + GRE tunnels, but now I can have a better understanding of what and why, cheers
    – Jimmy_A
    May 26, 2017 at 16:25
0

why do you need a GRE tunnel ? You're already forming a tunnel via VPN (IPSec), so you dont need to form a GRE tunnel on top of it. There is no reason to use GRE in your case. IF you just need access to a remote server, form a VPN tunnel and then allow access to the server in the remote subnet 2. GRE is a way to repackage the data in a new header. Reasons to do this vary, for instance you may want to send multicast over IPSec, or sometimes you may want to have GRE tunnels for Dynamic routing over IPSec VPN or service provicer MPLS... But normally, people do not need GRE and IPSec VPN together, VPN by itslef is enough.

Improve this answer
2
  • IPsec doesn't support broadcast/multicast, so if you need that, you must use a GRE tunnel inside the VPN.
    – Ron Maupin ♦
    May 26, 2017 at 16:21
  • Well actually, the GRE tunnel was created to connect two intranets on the two remote sites, so it was needed. Each site had an intranet and extranet, and the two intranets had to communicate with each other
    – Jimmy_A
    May 26, 2017 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.