I'm trying to build the following network architecture:


Where clients try to connect to a backend server (e.g. SSH) by using a Public Anycast IP adddress (, that routes the client to the closest entrypoint.

There are 2 entrypoints:

Entrypoint 1 in London, with Public IP, which receives the traffic from clients in Europe. Entrypoint 2 in Sao Paulo, with Public IP, which receives traffic from clients in America. These 2 entrypoints have an established GRE tunnel to the backend server.

So far this works fine if the backend SSH server binds to a specific GRE tunnel interface IP, but then only clients coming from the associated entrypoint GRE address interface can connect.

How can I make so that clients can connect from both entrypoint, i.e. make the backend SSH server "bind" to both GRE interfaces and route the traffic approprietaly depending from which tunnel it came?

Thank you.

  • 1
    Source based routing. Since linux deleted the route-cache eons ago, it doesn't naturally keep path affinity (symmetry). You'll have to setup connection tracking to recreate the route-cache, or use source based routing.
    – Ricky
    Mar 17, 2023 at 2:58

1 Answer 1


You need to make sure that both GRE tunnels route back client packets (just in case) and that the server-to-client metric is the same as the client-to-server metric (to enable symmetric routing).

In case of asymmetric routing (undesired but possible) you need to disable stateful inspection on any firewalls in the path (which breaks with asymmetric routing).

Since you're tunneling, the outside hop count isn't visible by looking at the tunneled packets - the tunnel is always just one hop. You'd need to find a way to assign a usable metric to the tunnel interfaces, either by outside hop distance, latency, probed throughput or whatever makes sense for your use case.

  • How can I do that with ip tunnel and iptables commands in Linux?
    – John
    Mar 16, 2023 at 22:49
  • Sorry, host configurations are off topic here, see the help center. You could try on Server Fault or on Unix & Linux.
    – Zac67
    Mar 17, 2023 at 6:15
  • Are you available for hire perhaps?
    – John
    Mar 17, 2023 at 11:09
  • I might be, but I don't think it's appropriate to discuss here and Linux isn't one of my areas of expertise. I guess you'd need some scripted daemon that monitors the connections and adjusts the metrics accordingly.
    – Zac67
    Mar 17, 2023 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.