[Day 12] 3. GRE Tunnel

GRE is a tunneling protocol developed to encapsulate one protocol inside another. It is often used to create virtual point-to-point connections between remote networks over an IP-based network (such as the internet).

How GRE Works

• Packet inside a packet:
  • GRE encapsulates one data packet inside another. This means that the original packet, including its header and payload, is wrapped inside a new packet with a new IP header.
• Two Network Headers:
  • The inner packet contains the original source and destination IP addresses.
  • The outer packet (GRE header) adds additional information, such as the source and destination IP addresses of the GRE endpoints, enabling the packet to be routed across different networks. This encapsulation allows routing information (private IPs or otherwise) to be sent through intermediate public networks.

Issues with NAT and Private IP Communication

1. Private IP to Private IP Communication:

   • When trying to ping or communicate between two private IP addresses across different networks, NAT (Network Address Translation) or even double NAT typically won't help.
   • NAT translates private IP addresses to public IP addresses for communication over the internet, but it doesn't inherently support routing between different private networks.

2. NAT Limitation with GRE:

   • Even if you configure Dynamic NAT with Overload (also known as PAT – Port Address Translation, where many private IPs are mapped to one public IP), external users cannot access internal private networks directly because NAT hides the internal network structure.

3. GRE Tunneling Bypasses NAT:

   • GRE encapsulates the private IP packet inside an outer IP packet with public IP addresses (usually routable across the internet). This allows the private IP traffic to traverse public networks.
   • Once the packet reaches the other end of the GRE tunnel, it is decapsulated, and the original private IP packet is delivered to the destination.
   • NATing alone cannot achieve this, as it is not designed to facilitate private-to-private network communication across public networks without such encapsulation.

Key Points

• GRE tunneling allows private IP addresses to communicate over public networks by encapsulating private network traffic within a public network tunnel.
• NAT alone (or even double NAT) is not sufficient for direct private IP communication across different private networks. However, GRE tunnels can provide a solution.
• Even with dynamic NAT with overload, the external (public) network cannot directly access internal private IP addresses without proper tunneling mechanisms like GRE.