alecov's questions

I'm having a really hard time trying to estabilish a VPN connection using a GRE over IPsec tunnel. The problem is that it involves some sort of "loopback" connection which I don't understand -- let alone be able to configure --, and the only help I could find is related to configuring Cisco routers.

My network is composed of a router and a single host running Debian Linux. My task is to create a GRE tunnel over an IPsec infrastructure, which is particularly intended to route multicast traffic between my network, which I am allowed to configure, and a remote network, for which I only bear a form containing some setup information (IP addresses and phase information for IPsec). For now it suffices to estabilish a communication between this single host and the remote network, but in the future it will be desirable for the traffic to be routed to other machines on my network.

As I said this GRE tunnel involves a "loopback" connection which I have no idea of how to configure. From my previous understanding, a loopback connection is simply a local pseudo-device used mostly for testing purposes, but in this context it might be something more specific that I do not have the knowledge of.

I have managed to properly estabilish the IPsec communication using racoon and ipsec-tools, and I believe I'm familiar with the creation of tunnels and addition of addresses to interfaces using ip, so the focus is on the GRE step. The worst part is that the remote peers do not respond to ping requests and the debugging of the general setup is very difficult due to the encrypted nature of the traffic.

There are two pairs of IP addresses involved: one pair for the GRE tunnel peer-to-peer connection and one pair for the "loopback" part. There is also an IP range involved, which is supposed to be the final IP addresses for the hosts inside the VPN.

My question is: how (or if) can this setup be done? Do I need some special software or another daemon, or does the Linux kernel handle every aspect of the GRE/IPsec tunneling?

Please inform me if any extra information could be useful.

Any help is greatly appreciated.

I am configuring a GRE tunnel in Linux 2.6.26 and I've been facing a very strange problem for which I could not find any solution.

I have created a GRE tunnel called gre0, but no matter what I do, I am simply unable to delete this tunnel. The command ip tunnel del gre0 fails with the response ioctl: Operation not permitted. Any attempt to change the addresses of the tunnel also fails.

The following commands illustrate the problem:

# ip tunnel del gre0
ioctl: Operation not permitted
# ip tunnel change gre0
# ip tunnel change gre0 remote <some address> local <some address>
ioctl: No such file or directory

I can create, change and delete other tunnels without any problem, but gre0 just sticks there and does not go away, even if I reboot or take the interfaces down.

If I remove the ip_gre module, the tunnel disappears. As soon as I insert the module again, gre0 reappears and the problem continues.

I have two questions:

1. What can I do to get rid of this pesky tunnel? I suspect this might be a kernel or a module bug.
2. Where such persistent data (in this case, the information for gre0, but this applies to any other setup I may be even unaware of) is stored?

If any other information is needed, please let me know.

Thanks a lot for any help.