GRE, IPIP, SIT and VXLAN interfaces#

You will end up with a tunnel interface between this router and another endpoint. The Interfaces page creates four kinds; the difference between them is what they can carry and what the far end has to be.

Before you start#

The operator role and a licence.
The far end's address, reachable from this router.
The local address the tunnel should source from.
Configuration on the far end that matches. A tunnel is symmetric; half of one does nothing.

Which one#

Type	Carries	Far end
`gre`	Almost anything, including multicast and routing protocols	Another GRE endpoint. The general-purpose choice.
`ipip`	IPv4 in IPv4	Another IPIP endpoint. Lighter than GRE, and carries less.
`sit`	IPv6 in IPv4	Another SIT endpoint or a tunnel broker.
VXLAN	Layer 2, over UDP, with a VNI	Another VXLAN endpoint, unicast or a multicast group.

Step 1 — Create it#

Network → Interfaces → + Add interface, type Tunnel or VXLAN.

a GRE tunnel

set interfaces tunnel tun0 encapsulation gre
set interfaces tunnel tun0 source-address 203.0.113.2
set interfaces tunnel tun0 remote 198.51.100.2
set interfaces tunnel tun0 address 192.0.2.1/30
set interfaces tunnel tun0 description 'to the branch'

a VXLAN, unicast

set interfaces vxlan vxlan0 vni 100
set interfaces vxlan vxlan0 remote 198.51.100.2
set interfaces vxlan vxlan0 source-address 203.0.113.2
set interfaces vxlan vxlan0 address 192.0.2.1/24

The VXLAN panel chooses between remote and group by looking at the address you give it: a multicast address in 224.0.0.0 to 239.255.255.255 becomes group, anything else becomes remote.

A dummy interface is the fifth type the panel offers, and it is not a tunnel — it is an always-up interface with an address, useful as a stable router-id or a loopback for a routing protocol.

Step 2 — Route or bridge across it#

A tunnel with an address is a point-to-point link with nothing using it.

For a routed tunnel, add a route through the far end's tunnel address:

set protocols static route 198.51.100.0/24 next-hop 192.0.2.2

Add a static route, or run a routing protocol over the tunnel — an OSPF area works over GRE.

For a VXLAN carrying layer 2, add it to a bridge with the local segment:

set interfaces bridge br0 member interface vxlan0

Bridge two ports.

Step 3 — Let it through the firewall#

The tunnel's own packets arrive on the WAN and are addressed to the router, so the input chain has to accept them.

GRE

set firewall ipv4 input filter rule 80 action accept
set firewall ipv4 input filter rule 80 description 'gre from the branch'
set firewall ipv4 input filter rule 80 protocol gre
set firewall ipv4 input filter rule 80 source address 198.51.100.2

VXLAN is UDP, conventionally on 4789. Traffic inside the tunnel is filtered separately, in the forward chain, by the tunnel interface's name.

Check it worked#

bash

show interfaces tunnel tun0
ping -c 3 192.0.2.2
show ip route 198.51.100.0/24

The Interfaces page shows the tunnel with its link state and counters. Counters rising in one direction only is a firewall rule missing at the far end.

Undoing it#

delete interfaces tunnel tun0

Remove the routes and firewall rules that referenced it in the same commit.