GRE

networking

Generic Routing Encapsulation: the minimal IP-in-IP envelope (24 bytes with its delivery header, protocol 47) - no encryption, no authentication, just carriage.

The plain envelope: highest tunnel ceilings, zero secrecy.

GRE is deliberately dumb, and that is its value. It wraps one protocol inside another with a minimal header, no encryption, no authentication, and no session negotiation. It carries whatever you put in it, including protocols that routing normally will not, which is why it survives as plumbing decades after fancier tunnelling arrived.

The classic use is making two networks look adjacent when they are not. Multicast and routing protocols that expect a directly connected neighbour will happily run over a GRE tunnel, which is why so many designs pair GRE with IPsec: GRE provides the transport that carries the awkward traffic, and IPsec provides the confidentiality GRE deliberately omits. Cloud security services also accept GRE from an edge router as a way to send an entire site's traffic for inspection without deploying an agent on every device.

The failure mode is always overhead. Each layer of encapsulation shrinks what is left for the payload, and the symptom is the familiar one: the tunnel comes up, small packets pass, large transfers hang. Anyone who has clamped MSS on a GRE interface has met this, usually at an unreasonable hour.

← All glossary entries