Home / server / Questions / 7735
Accepted
nicudotro
Asked: 2009-05-14 04:37:00 +0800 CST

Tunnel over UDP or TCP

  • 772

Is there a way to create something similar to an IPIP or GRE tunnel only over UDP or TCP?

I have a GRE tunnel between two servers and I noticed that sometimes it starts to drop packets. At the same time if I ping between servers over the internet I have no problems.

I believe this is a traffic shaping problem form my provider (It does not take into account the GRE protocol). I have also tried an IPIP tunnel with the same result.

linux networking tcpip tunneling

5 Answers

  1. Best Answer

    Give openvpn a shot. You can create tunnels over UDP or TCP.

    • 13

  2. I'm not sure what's causing your particular problem, but you should note that in general it's better for tunnels to use an unreliable transport stream (i.e. UDP) than a reliable one.

    The reason for this is that if you do happen to get packet loss the tunnelled TCP layer should be the one managing the retransmission, and not the real transport layer.

    If both layers have got retransmission built into them they can start to get in a retransmission war which ultimately kills throughput.

    Also, don't forget that any tunneling protocol will reduce the effective MTU (and consequently the TCP MSS). If the MTU and MSS aren't adjusted appropriately you'll see excessive fragmentation and/or dropped packets.

    • 9

  3. Do you know if you're dropping GRE packets or packets tunneled withing the GRE tunnel? With any sort of tunnel, it's not uncommon to run into MTU problems with just about any kind of tunneling. MTU problems can be hard to diagnose because smaller packets (like default pings) pass through the tunnel just fine. You'll only see problems with larger packets and generally only if the application or system is setting the DF (Don't Fragment) bit. Which unfortunately is pretty common.

    You can test end-to-end for what's the smallest MTU across the network path by using pings with a large packet size and the DF bit set.

    On Windows you can set the DF bit with the -f option and set the packet size with the -l option like this: 

    ping -f -l 1450

    On Linux, you set the DF bit with the "-M do" option and set the packet size with the -s option, like this:

    ping -M do -s 1450

    You didn't say what you're using for the GRE endpoints.. If they are Cisco routers, this link is pretty good. If not, search google for GRE MTU issues and you'll find a ton of information.

    • 3

  4. PPP over SSH perhaps?

    • 1

  5. This little guide on tunneling may help you for choosing the right one.

    • As Alnitak said anything TCP-backed is quite bad for latency (IP does not need the reliability that TCP offers, and it comes at a price.). Typically PPP over SSH or PPP over HTTP are mostly useful to be able to eventually pass firewalls.
    • Pings are done ususally via the ICMP protocol, and therefore are usually dropped the last by overloaded routers that implement early drops. It would be interesting to see if you experience drops with UDP or TCP "pings" also. Packets dropping are quite common on the internet.
    • 1