GRE (Generic Routing Encapsulation) is a lightweight tunneling protocol, identified as IP protocol number 47, that encapsulates a wide range of network-layer packets inside IP packets. It creates a virtual point-to-point link between two routers.
Why it matters
GRE can carry things plain IPsec cannot, such as multicast and routing protocol traffic like OSPF, because the tunnel looks like an ordinary interface. That makes it a common building block for site-to-site links and cloud connectivity. It adds only a small header, typically 24 bytes with the outer IPv4 header, but offers no confidentiality or authentication, so it is often combined with IPsec (GRE over IPsec) when crossing the internet.
Example
On Linux:
ip tunnel add gre1 mode gre remote 198.51.100.2 local 203.0.113.5 ttl 64
ip addr add 10.255.0.1/30 dev gre1
ip link set gre1 upThe peer is configured symmetrically. Traffic routed to gre1 is wrapped and sent to 198.51.100.2. Reduce the interface MTU to about 1476 to avoid fragmentation.
Common mistakes
- Sending sensitive data through GRE alone.
- Blocking IP protocol 47 on a firewall; it is not TCP or UDP, so port rules do not apply.
- Overlooking the extra header size when setting MTU.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.