Skip to main content
Generic Routing Encapsulation (GRE) tunneling creates a virtual point-to-point connection between two endpoints over the internet, encapsulating traffic in GRE packets so it can travel between them. Gcore DDoS Protection uses a GRE tunnel together with Border Gateway Protocol (BGP) routing to protect entire networks: after BGP announces the protected network prefixes, inbound traffic to those prefixes routes through the Gcore scrubbing center, which filters malicious traffic and forwards legitimate traffic back through the GRE tunnel. Outbound traffic from the network continues to route through its own default gateway rather than through Gcore. Before starting, collect the values Gcore provides for the account: the Gcore tunnel IP, the BGP neighbor IP, the Gcore AS number, and the prefixes to advertise. The local router also needs a public IP that Gcore can reach. The Cisco section configures both the GRE tunnel and the BGP session. The Ubuntu section configures the GRE tunnel only; use the Cisco BGP example as the policy model for whatever routing daemon runs on the host.

​
Configure a GRE tunnel on Cisco routers

These configuration steps are specific to Cisco routers. For other vendors, use that manufacturer’s GRE and BGP documentation with the same Gcore and customer roles described below.

​
Step 1. Check network availability between routers

Both routers in a tunnel must have routable interfaces connected to the internet, and their routes must be mutually visible and reachable. To verify the connectivity, run either of the following commands on a router platform:
or
These commands display the routing table of the router, showing the IP addresses of their interfaces that will be used as tunnel sources.

​
Step 2. Configure a tunnel

Follow these steps and use the configuration snippets below as a guideline. In the examples, 40.0.0.1 is the Gcore public IP and 50.0.0.1 is the customer public IP. 1. Set the tunnel ID:
2. Set the tunnel IP address and subnet mask:
3. Specify the source and destination IP addresses.
The far-end router uses the matching configuration, with tunnel source and destination swapped:
When both ends of the tunnel are configured with matching parameters, the GRE tunnel between the two routers is established.

​
Step 3. Set the MTU and MSS limits

Tunneling adds an extra header to the original IP packet, resulting in overhead, so unadjusted MTU and MSS limits can lead to packet delivery issues. Set these limits on the exit interface towards the internet/ISP — the path outbound traffic uses. Do not set them on the GRE tunnel interface.
Replace GigabitEthernet0/0 with the name of that internet-facing interface.
The standard MTU size allowed on the internet is 1500 bytes. When using GRE, typically an additional 24 bytes are added to the packet, consisting of 20 bytes for an outer IP header and 4 bytes for GRE itself, so the maximum allowed packet size over the GRE tunnel is reduced to 1476 bytes. This example does not use encryption. Encrypted tunnels add extra header bytes that vary by protocol, which is out of scope for this article.For TCP, subtract 40 bytes from the GRE MTU to account for the minimum IPv4 header (20 bytes) plus the minimum TCP header (20 bytes). In this example, the MSS value is 1436 bytes (1476 − 40 = 1436).

​
Step 4. Configure BGP

Open a BGP peering session, configure the BGP neighbor by specifying its IP address and remote AS number, set BGP policies that determine the best path for routing, and advertise network prefixes. Gcore (AS 10 in the example) provides DDoS Protection: it accepts specific customer routes, denies the default route, and does not advertise prefixes back. The customer router (AS 20) advertises only its own routes. Configure the Gcore side first. 1. Define the neighbor routes:
Prefix-list lines define which routes match. 2. Define the inbound route policy:
The GCORE_POLICY_INBOUND route policy processes incoming routes. The first line denies the default route, while the second line permits the client routes. 3. Define the outbound route policy:
The GCORE_POLICY_OUTBOUND route policy denies all routes coming out of the router. The route policy configuration on the customer router is similar:
The customer inbound policy accepts no routes from Gcore. The outbound policy advertises the customer prefixes without the default route. The BGP configuration on both ends of the GRE tunnel should be as follows. Gcore:
Customer:
Replace the example AS numbers, neighbor IPs, and prefixes with the values Gcore provided. The configuration above establishes a BGP session with Gcore over the GRE tunnel.

​
Set a GRE tunnel on Ubuntu

Establish a GRE tunnel on Linux endpoints. This section does not configure BGP; use the Cisco BGP policies above as the model for the routing daemon on the host.

​
Step 1. Install required tools

Install the iproute2 package for managing GRE tunnels:

​
Step 2. Configure the GRE tunnel

Configure the tunnel on the first endpoint with the example address 40.0.0.1: 1. Create the GRE tunnel:
Replace 40.0.0.1 with this system’s public IP and 50.0.0.1 with the remote system’s public IP. 2. Assign an IP address to the tunnel interface: sudo ip addr add 10.20.30.1/24 dev gre1. 3. Bring up the GRE interface: sudo ip link set gre1 up. Configure the tunnel on the second endpoint with the example address 50.0.0.1: 1. Create the GRE tunnel:
2. Assign an IP address to the tunnel interface: sudo ip addr add 10.20.30.2/24 dev gre1. 3. Bring up the GRE interface: sudo ip link set gre1 up.

​
Step 3. Enable IP forwarding

If the GRE tunnel is being used for routing, verify that IP forwarding is enabled on both endpoints. Run the following command:
To make this setting persistent, add the following to the configuration file /etc/sysctl.conf: net.ipv4.ip_forward=1. Apply the changes by running sudo sysctl -p.

​
Step 4. Adjust MTU and MSS settings

To handle the additional GRE header, set the MTU and MSS limits on both endpoints:

​
Step 5. Verify tunnel connectivity

On each endpoint, test the connectivity by pinging the opposite end of the GRE tunnel:

​
Step 6. Configure routing (optional)

To route specific traffic through the GRE tunnel, add routing rules. For example:

​
Step 7. Make the configuration persistent

Current Ubuntu releases use Netplan. Add a tunnel stanza and apply it with sudo netplan apply:
On older Ubuntu systems that still use ifupdown, the equivalent lives in /etc/network/interfaces:
Alternatively, create a custom systemd service to set up the tunnel at boot.