howto/GRE plus IPsec

  • Search
  • Home
  • All
  • Files
  • History
  • Latest Changes
Site Links
  • Home
    • Getting started
    • FAQ
  • How-to

    • Openvpn
    • Tinc
    • Wireguard
    • Bird
    • Quagga
    • IPsec With Public Keys
    • Email
    • GRE on FreeBSD
    • Mikrotik RouterOS
    • EdgeRouter
  • Services

    • IRC
    • Whois registry
    • Hierarchical-DNS
    • DNS
    • Looking Glasses
    • Exchanges
    • Shell
    • Virtual Machines
    • Repository Mirrors
    • Distributed Wiki
    • Certificate Authority
    • Tahoe-LAFS
  • Internal

    • Internal services
  • External Tools

    • Paste Board
    • Git Repositories

Table of Contents
  • GRE+IPsec
    • Why GRE?
    • Why IPsec?
    • Problems with GRE
    • Problems with IPsec
    • Requirements for sane operation
    • How to configure a GRE tunnel on FreeBSD
    • How to configure IPsec on FreeBSD
    • How to configure GRE + IPsec on Debian

dn42

GRE+IPsec

Why GRE?

  • GRE provides universal encapsulation on top of IP.
  • It has a smaller header than UDP.
  • GRE tunnels are processed in-kernel on *nix systems.
  • It's supported by hardware routers.

Why IPsec?

  • GRE provides no encryption and authentication of it's own.
  • IPsec in implemented in-kernel on FreeBSD and Linux with multithreaded encryption resulting in a lower latency than userspace VPN daemons using tun/tap interfaces.

Problems with GRE

  • GRE is defined directly on top of IP.
  • Broken NAPT implementations will stop GRE tunnels.

Problems with IPsec

  • ESP is defined directly on top of IP.
  • NAT support was added as an aftertought to IPsec.
  • IKEv1 is too complex.
  • Racoon has useless error messages.

Requirements for sane operation

  • Identify your peers by X.509 certificates
  • At least one peer should operate his own (Sub-)CA.

How to configure a GRE tunnel on FreeBSD

See GRE on FreeBSD.

How to configure IPsec on FreeBSD

See IPsec on FreeBSD.

How to configure GRE + IPsec on Debian

See GRE + IPsec on Debian.

Hosted by: xuu, nurtic-vibe, siska, toBee, Mic92 | Accessible via: dn42, tor, i2p

Last edited by dn42 wiki, 2015-01-01 20:46:11