• Home

  • Getting Started
  • Registry Authentication
  • Address Space
  • BGP communities
  • FAQ

• How-To

  • Wireguard
  • Openvpn
  • IPsec With Public Keys
  • Tinc
  • GRE on FreeBSD
  • GRE on OpenBSD
  • IPv6 Multicast (PIM-SM)
  • SSM Multicast
  • MPLS
  • Bird / Bird2
  • Quagga
  • FRRouting
  • OpenBGPD
  • Mikrotik RouterOS
  • EdgeRouter
  • Static routes on Windows
  • Universal Network Requirements
  • VyOS
  • NixOS

• Services

  • IRC
  • Whois registry
  • DNS
  • IX
  • Public DNS
  • Looking Glasses
  • Automatic Peering
  • Repository Mirrors
  • Distributed Wiki
  • Certificate Authority
  • Route Collector

• Internal

  • Internal services
  • Interconnections
  • APIs
  • Show and Tell
    
  • Historical services

• External Tools

  • Paste Board
  • Git Repositories

---

GRE+IPsec

Why GRE?

• GRE provides universal encapsulation on top of IP.
• It has a smaller header than UDP.
• GRE tunnels are processed in-kernel on *nix systems.
• It's supported by hardware routers.

Why IPsec?

• GRE provides no encryption and authentication of it's own.
• IPsec in implemented in-kernel on FreeBSD and Linux with multithreaded encryption resulting in a lower latency than userspace VPN daemons using tun/tap interfaces.

Problems with GRE

• GRE is defined directly on top of IP.
• Broken NAPT implementations will stop GRE tunnels.

Problems with IPsec

• ESP is defined directly on top of IP.
• NAT support was added as an aftertought to IPsec.
• IKEv1 is too complex.
• Racoon has useless error messages.

Requirements for sane operation

• Identify your peers by X.509 certificates
• At least one peer should operate his own (Sub-)CA.

How to configure a GRE tunnel on FreeBSD

See GRE on FreeBSD.

How to configure IPsec on FreeBSD

See IPsec on FreeBSD.

How to configure GRE + IPsec on Debian

See GRE + IPsec on Debian.

Hosted by: xuu, nurtic-vibe, toBee, burble | Accessible via: dn42, dn42.eu, dn42.dev