User Manual

In Keenetic routers, it is possible to create IPIP (IP over IP), GRE (Generic Routing Encapsulation), EoIP (Ethernet over IP) tunnels both in pure form and in combination with IPSec tunnel, allowing to use IPSec VPN security standards to protect these tunnels.

The support of IPIP, GRE, EoIP tunnels in Keenetic routers allows you to establish a VPN connection with hardware gateways, Linux routers, computers and servers with UNIX/Linux OS, as well as with other network and telecommunications equipment that support these tunnels.

It is necessary to install additional corresponding components of the KeeneticOS system to work with tunnels:

You can do this on the 'General system settings' page in the 'Updates and component options' section by clicking on 'Component options'.

Brief description

IPIP and GRE tunnels are network layer tunnels (L3 of the OSI model), where IP addresses of both sides are available. They are presented in the system as GreX and IPIPX interfaces, and routing (including the default route) can be configured through them just like through any other interface. Also, these interfaces can be configured with a security level of access - private, protected, or public (information on access levels can be found in the article Configuring firewall rules with the command-line interface).

IPIP (IP over IP) is one of the easiest tunnels to set up (it encapsulates only unicast IPv4 traffic). You can configure it on a UNIX/Linux system and on different routers (e.g. Cisco).

GRE (Generic Routing Encapsulation) tunnel is one of the popular VPN types. GRE tunnels are compatible with hardware security gateways, Mikrotik routers, Linux routers and other similar equipment (e.g. Cisco, Juniper, etc.).

EoIP tunnel (Ethernet over IP) is a Datalink layer tunnel (L2 of the OSI model) over the network layer (L3). Data is transmitted through this tunnel at the Ethernet frame level. EoIP provides a transparent network environment that emulates a direct Ethernet connection between networks. All MAC addresses are visible, and it is possible to connect two L2 LANs over the Internet using this type of tunnel. EoIP uses GRE as its transport. The EoIP tunnel can work over IPIP, PPTP and any other connection capable of transmitting IP packets. Any traffic other than IP can be sent through it, including ARP, DHCP, PPPoE, IPv6, etc. Subnet scanning via ARP will work in the tunnel by default when the security level changes to private/protected. In the system, it is presented as an EoIPX interface.

EoIP is developed by MikroTik, so there is compatibility with them and Linux routers that know how to work with EoIP.

You can use the Ping Check function on IPIP, GRE and EoIP tunnel interfaces to check its availability.

The IPIP, GRE and EoIP tunnels work directly over the IPv4 protocol. IPIP uses IP protocol number 4, GRE and EoIP use IP protocol number 47.

Examples

The following examples show private IP addresses, which can only be used within the local network. There must be public IP addresses at both ends of the tunnels to create tunnels over the Internet.

Setting up a GRE/IPIP tunnel between two Keenetic routers.

Setting up an EoIP tunnel between two Keenetic routers.

In the case of the EoIP tunnel, the settings will be absolutely the same, except for two things:

One end of the tunnel setup:

(config)> interface EoIP0
(config-if)> tunnel destination router1.example.com
(config-if)> tunnel eoip id 1500
(config-if)> ip address 192.168.100.1 255.255.255.0
(config-if)> security-level private
(config-if)> up
(config-if)> exit
(config)> system configuration save

The 'mirror' setting is at the other end of the tunnel:

(config)> interface EoIP0
(config-if)> tunnel destination 8.6.5.4
(config-if)> tunnel eoip id 1500
(config-if)> ip address 192.168.100.2 255.255.255.0
(config-if)> security-level private
(config-if)> up
(config-if)> exit
(config)> system configuration save

You can then try to ping the address of the remote side of the tunnel from any side to check if the tunnel is working correctly.

The EoIPx interface can be included in the Bridge to join local networks. To do this, configure the EoIP interface without an IP address on both sides and then add it to the Bridge Home:

(config)> interface Home
(config-if)> include EoIP0
(config-if)> exit
(config)> system configuration save

Using IPIP, GRE and EoIP tunnels with IPSec

If a special system component IPSec VPN is installed, it is possible to protect these tunnels using IPSec safety standards, both in automatic and fully manual mode. We will not describe the manual mode because experienced users can set up an IPSec tunnel with the correct mode and then raise the tunnel over IPSec. In the case of automatic configuration, several manual mode problems are solved at once:

The IPSec VPN component appends the following settings to tunnels:

Since IPSec separates a client from a server, to configure the client (the initiator, the side that will try to establish the connection), you must use the command interface tunnel destination, and to enable the server mode (the party that will respond to connection attempts), you must use the command interface tunnel source.

Example of EoIP tunnel configuration with IPsec (in our example, the side with the WAN address 8.6.5.4 is the server):

Server:

(config)> interface EoIP0
(config-if)> tunnel source ISP
(config-if)> tunnel eoip id 1500
(config-if)> ipsec preshared-key mytestingkey
(config-if)> ip address 192.168.100.1 255.255.255.0
(config-if)> ipsec ikev2
(config-if)> security-level private
(config-if)> up
(config-if)> exit
(config)> system configuration save

Client:

(config)> interface EoIP0
(config-if)> tunnel destination 8.6.5.4
(config-if)> tunnel eoip id 1500
(config-if)> ipsec preshared-key mytestingkey
(config-if)> ip address 192.168.100.2 255.255.255.0
(config-if)> ipsec ikev2
(config-if)> security-level private
(config-if)> up
(config-if)> exit
(config)> system configuration save

In the interface tunnel source command, you can specify both the source interface and the IP address where the server will be waiting for the connection. However, preference is given to the interface, because in this case, all the reconfiguration when changing the address and other events will take place automatically.