Generic Routing Encapsulation (GRE) is a tunneling protocol that wraps one network packet inside another so it can travel across an IP network as if the two endpoints were directly connected. The result, a GRE tunnel, is a virtual point-to-point link between two routers or other devices. GRE is defined in IETF RFC 2784, was originally developed by Cisco and is widely supported across vendors. It is simple and flexible, but it does not encrypt anything: on untrusted networks it is normally paired with IPsec.
At a glance
- GRE creates a virtual point-to-point link by wrapping packets in an extra header and a new IP header.
- It can carry traffic that plain IP routing or basic IPsec tunnels handle poorly, such as multicast and routing protocol updates.
- It provides no encryption or authentication; GRE over IPsec is the usual way to add both.
- The extra headers reduce the room for data in each packet, so MTU settings matter.
- It is a common building block in site-to-site VPNs, overlays and some cloud security and DDoS services.
What problem it solves
Sometimes two sites need to behave as though they share a direct link even though the traffic crosses the internet or a provider network. Routing protocols such as OSPF need to exchange updates, applications may rely on multicast, and the network in between may not carry that traffic natively. GRE solves this by putting the traffic inside ordinary IP packets that any IP network can deliver, then unwrapping it at the far end.
That makes GRE a flexible way to build overlays: virtual networks on top of whatever physical connectivity is available. Because it is lightweight and almost every enterprise router supports it, it is also a common way to hand traffic to a third-party service, such as a cloud security platform or a DDoS scrubbing provider, without changing how the rest of the network works.
How it works
Encapsulation. The sending device takes the original packet, adds a GRE header, then adds a new outer IP header addressed to the far end of the tunnel. GRE has its own IP protocol number (47), so firewalls along the path must allow it.
Transport. The wrapped packet crosses the network like any other IP packet. Devices in between see only the outer header.
Decapsulation. The receiving device removes the outer headers and forwards the original packet as if it had arrived on a directly connected interface.
Routing over the tunnel. Each end has a tunnel interface with its own address. Routing protocols such as OSPF or BGP can run across it, so routes are learned and failover can happen automatically.
Adding security. Because GRE leaves traffic readable, sensitive traffic over public networks is usually sent as GRE inside IPsec, which encrypts and authenticates the tunnel. Some SD-WAN and VPN products build tunnels with IPsec alone; others use GRE in some designs.
Overhead and MTU. Basic GRE over IPv4 adds 24 bytes per packet, and IPsec adds more. If the tunnel’s maximum transmission unit (MTU) isn’t reduced to match, large packets may be fragmented or dropped, which often shows up as applications that connect but then hang.
When it matters for buyers
- When connecting to a cloud security or DDoS service. Some providers expect traffic over GRE tunnels from your routers. Confirm what encryption, if any, protects that traffic.
- When building site-to-site links over the internet. GRE over IPsec is a long-standing approach; SD-WAN products often automate similar tunnels.
- When multicast or dynamic routing must cross the WAN. GRE is one of the standard ways to carry it.
- When troubleshooting intermittent application problems over tunnels. MTU mismatches are a frequent cause.
Our Private Networking guide covers tunnel designs alongside private circuits.
Questions to ask vendors
- Does your service expect GRE, IPsec, or GRE inside IPsec, and is traffic encrypted end to end?
- What tunnel MTU and TCP MSS settings do you recommend, and do you support larger packets?
- How many tunnels are supported per site, and how is failover between tunnels handled?
- Can we run BGP or another routing protocol over the tunnel?
- How do you monitor tunnel health, and will you alert us if a tunnel goes down?
- Who manages the tunnel configuration on our routers, and who handles changes?
How it differs from IPsec
GRE creates tunnels but leaves the contents readable. IPsec encrypts and authenticates IP traffic and is the usual choice for secure site-to-site links. Basic IPsec tunnels have traditionally been less suited to multicast and routing protocols, which is why the two are often combined: GRE provides a flexible tunnel interface and IPsec protects what travels through it. A plain GRE tunnel should not be treated as a VPN in the security sense.
Problems this helps with
- Running routing protocols or multicast between sites over the internet
- A cloud security or DDoS service asking us to send traffic over a GRE tunnel
- Applications breaking over a tunnel because packets are too large
- Not knowing whether a tunnel between sites is actually encrypted
