Hack 54 Tunneling: IPIP Encapsulation

IP tunneling with the Linux IPIP driver.

If you have never worked with IP tunneling before, you might want to take a look at the Advanced Router HOWTO (http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/) before continuing. Essentially, an IP tunnel is much like a VPN, except that not every IP tunnel involves encryption. A machine that is "tunneled" into another network has a virtual interface configured with an IP address that isn't local, but exists on a remote network. Usually, all (or most) network traffic is routed down this tunnel, so remote clients appear to exist on the network as if they were local. This can be used to allow clients from the Internet to access private network services, or more generally, to connect to any two private networks together using the Internet to carry the tunnel traffic.

If you want to perform simple IP-within-IP tunneling between two machines, you might try IPIP. It is probably the simplest tunnel protocol available, and also works with *BSD, Solaris, and even Windows. Note that IPIP is simply a tunneling protocol, and does not involve any sort of encryption. It is also only capable of tunneling unicast packets; if you need to tunnel multicast traffic, take a look at GRE tunneling [Hack #55].

Before we rush right into our first tunnel, you need a copy of the advanced routing tools (specifically the ip utility.) You can get the latest authoritative copy from ftp://ftp.inr.ac.ru/ip-routing/. Be warned, the advanced routing tools aren't especially friendly, but they allow you to manipulate nearly any facet of the Linux networking engine.

In this example, I assume that you have two private networks (10.42.1.0/24 and 10.42.2.0/24) and that these networks both have direct Internet connectivity via a Linux router at each network. The "real" IP address of the first network router is 240.101.83.2, and the "real" IP of the second router is 251.4.92.217. This isn't very difficult, so let's jump right in.

First, load the kernel module on both routers by typing as the root user:

  # modprobe ipip

Next, on the first network's router (on the 10.42.1.0/24 network), do the following:

  # ip tunnel add mytun mode ipip remote 251.4.92.217 local 240.101.83.2[RETURN]   ttl 255   # ifconfig mytun 10.42.1.1   # route add -net 10.42.2.0/24 dev mytun

And on the second network's router (on the 10.42.2.0/24), reciprocate:

  # ip tunnel add mytun mode ipip remote 240.101.83.2 local 251.4.92.217[RETURN]    ttl 255   # ifconfig mytun 10.42.2.1   # route add -net 10.42.1.0/24 dev mytun

Naturally, you can give the interface a more meaningful name than mytun if you like. From the first network's router, you should now be able to ping 10.42.2.1, and from the second network's router, you should be able to ping 10.42.1.1. Likewise, every machine on the 10.42.1.0/24 network should be able to route to every machine on the 10.42.2.0/24 network, just as if the Internet weren't even there.

If you're running a Linux 2.2.x kernel, you're in luck: here's a shortcut that you can use to avoid having to use the Advanced Router tools package at all. After loading the module, try these commands instead:

  # ifconfig tunl0 10.42.1.1 pointopoint 251.4.92.217   # route add -net 10.42.2.0/24 dev tunl0

And on the second network's router (on the 10.42.2.0/24 network):

  # ifconfig tunl0 10.42.2.1 pointopoint 240.101.83.2   # route add -net 10.42.1.0/24 dev tunl0

That's all there is to it.

If you can ping the opposite router, but other machines on the network don't seem to be able to pass traffic beyond the router, make sure that both routers are configured to forward packets between interfaces:

  # echo "1" > /proc/sys/net/ipv4/ip_forward

If you need to reach networks beyond 10.42.1.0 and 10.42.2.0, simply add additional route add -net lines. There is no configuration needed on any of your network hosts, as long as they have a default route to their respective router (which they definitely should, since it is their router, after all).

To bring the tunnel down, bring down the interface on both routers and delete it, if you like:

  # ifconfig mytun down   # ip tunnel del mytun

(or, in Linux 2.2):

  # ifconfig tunl0 down

The kernel will very politely clean up your routing table for you when the interface goes away.

See Also