Site-to-Site VPN tunnel configuration

Question

I remember in uni that we implemented VPN tunnels always on the border routers and then use GRE tunnels to connect between two remote subnets.

I was always told that VPN tunnels need to know the external interface (Public IP) of the routers to implement.

I was wondering though if there is a way to implement a VPN tunnel between two subnets from site-to-site. For example if we have a remote network with 3 subnets and I want to access the server on subnet 2.

Usually I would do what I learnt, a VPN tunnell between the two networks and a GRE tunnel for the subnet. But is this right? Or is it better way to do it?

Answer 1

A tunnel is really just encapsulation of packets within other packets. The outer packets still need to be able to be routed normally to the address of the tunnel source (different than the tunnel address itself. The packets carried inside the outer packets see the tunnel as a single link, but the outer packets may need to be routed over many hops, especially if routed over the public Internet (which requires public addresses for the outer packets). The tunnel source must be able to send traffic that gets routed to the other tunnel source normally.

If you have a tunnel source inside a private network, then you cannot use that over the public Internet because you cannot route packets with private addresses over the public Internet. That is why the tunnel source addresses are usually the public WAN addresses of sites. If both your tunnel endpoints are within the same private network, then you could put the tunnel endpoints on any of the devices, as long as the tunnel source can normally reach each other.

Over a tunnel, you can use routing protocols to let the router on the other end of the tunnel know about any networks at the site, so it doesn't really matter how many networks are on each side of the tunnel. A tunnel is really just like connecting the two sites with a cable because it sets up a single link.

There are different tunnel types, and some cannot carry broadcast/multicast traffic, so some routing protocols or multicast routing may not work over that tunnel type. You could use a GRE tunnel inside that type of tunnel to overcome this, or use a different tunnel type that supports the features you need to support. Another possibility is to use static routes between the sites, but that doesn't scale, and it is not dynamic the way routing protocols are.

You could also have a problem if the private addressing at each of the two sites is using the same private addressing ranges. You may need to use NAT to overcome that.

Answer 2

why do you need a GRE tunnel ? You're already forming a tunnel via VPN (IPSec), so you dont need to form a GRE tunnel on top of it. There is no reason to use GRE in your case. IF you just need access to a remote server, form a VPN tunnel and then allow access to the server in the remote subnet 2. GRE is a way to repackage the data in a new header. Reasons to do this vary, for instance you may want to send multicast over IPSec, or sometimes you may want to have GRE tunnels for Dynamic routing over IPSec VPN or service provicer MPLS... But normally, people do not need GRE and IPSec VPN together, VPN by itslef is enough.