A GRE tunnel stitches an IP prefix onto a server that is not on the same LAN. It wraps packets so two machines can behave as if they sit next to each other. You use it to connect routes, not to make traffic faster. GRE, IP-in-IP, and similar tools share that job with different wrappers. Expect an MTU tax; GRE over IPv4 often tops out near 1476 before nesting lowers it further.
When a GRE tunnel makes sense
You need a tunnel when a leased prefix must land on a box outside our network, or when two servers should look adjacent. If you can place the prefix natively, do that instead of tunneling. Document tunnel keys the same way you document passwords, because they are credentials. A leftover tunnel to a decommissioned host becomes a quiet path that can cost you a full day of debugging. Bring unused tunnels down on purpose when you retire gear.
Mail that crosses a tunnel with a broken DF path fails in a painful pattern. Small messages get through while larger campaigns hang. A correct inner MTU or MSS clamping fixes that. Another encapsulation layer does not.
Path MTU blackholes
A path MTU blackhole starts when a middlebox drops ICMP fragmentation-needed messages. The sender never learns to shrink packets, so TCP stalls on large segments. Plain ping without DF still works, which makes the path look healthy when it is not. Test with DF set so you can find the real ceiling.
ping -M do -s 1472 203.0.113.1If 1472 with DF fails and 1400 works, you found the limit. Set the tunnel MTU a little under the largest size that succeeds. Try 1400, then 1280, if needed. Do not leave the inner interface at 1500 and hope. A looking glass only shows the outer path; it does not set your inner MTU. This DF ping is the inner test that matters.
Bring the tunnel up in order
Write the inner and outer addresses and keys down before you start. Set the tunnel MTU first, then bring the interface up. Confirm with a DF ping, add routes next, and only then send real traffic. The other order creates a blackhole you may blame on DNS. If only large pages hang, that is path MTU discovery failing. Note the working MTU beside the tunnel name so a second tunnel does not inherit 1500 by default.
Tagged
Was this article helpful?
Be the first to rate this article.
