Help · Operators

GRE+IPsec Tunnel

An alternative to WireGuard for the tunnel between an edge and an origin, for networks that block WireGuard. Both nodes of a link have to support the tunnel type it uses.

Open in the app All help topics
example
WireGuard blocked between your nodes?
  → choose GRE+IPsec on the edge AND the origin
  → switch the link's tunnel under Edge ↔ Origin Links

The tunnel between an edge and an origin is WireGuard by default. Some networks block WireGuard or recognise its handshake. For them there are two alternatives:

  • GRE+IPsec: GRE inside an IPsec (ESP) tunnel negotiated by strongSwan. It looks like ordinary site-to-site IPsec.
  • GRE (plain): GRE without encryption between the nodes. The users' traffic inside is still encrypted end to end by Reality, but the tunnel itself is not.

How to use it

  1. Choose the tunnel under Inter-node tunnel when you register the node, or later in its Settings. Do it on both the edge and the origin: a link can use only a tunnel type both nodes support.
  2. Bare-metal (systemd) nodes install strongSwan only when they are installed with --tunnel=gre_ipsec; a node installed for WireGuard needs a reinstall first. Docker nodes always include it.
  3. Switch an existing link with the tunnel selector on its row under Edge ↔ Origin Links. Switching closes the link's active sessions.

The node needs UDP 500 and 4500 plus the ESP and GRE protocols open between the two servers, in its own firewall and in the hosting provider's.

Costs

  • More encryption work on the CPU than WireGuard, and usually somewhat lower throughput.
  • Some networks block or throttle IPsec too.
Stay on WireGuard unless it is actually blocked between your two servers.