Linux Server Hacks by Rob Flickenger

Author:Rob Flickenger
Language: eng
Format: mobi, epub, pdf
Tags: Reference:Computers
ISBN: 9780596004613
Publisher: O'Reilly Media
Published: 2009-06-30T10:00:00+00:00

See also:

[Hack #47]

Hack #50. Tunneling: IPIP Encapsulation

IP tunneling with the Linux IPIP driver

If you have never worked with IP tunneling before, you might want to take a look at the Advanced Router HOWTO before continuing. Essentially, an IP tunnel is much like a VPN, except that not every IP tunnel involves encryption. A machine that is "tunneled" into another network has a virtual interface configured with an IP address that isn't local, but exists on a remote network. Usually, all (or most) network traffic is routed down this tunnel, so remote clients appear to exist on the network services, or more generally, to connect to any two private networks together using the Internet to carry the tunnel traffic.

If you want to perform simple IP-within-IP tunneling between two machines, you might want to try IPIP. It is probably the simplest tunnel protocol available and will also work with *BSD, Solaris, and even Windows. Note that IPIP is simply a tunneling protocol and does not involve any sort of encryption. It is also only capable of tunneling unicast packets; if you need to tunnel multicast traffic, take a look at GRE tunneling in [Hack #51].

Before we rush right into our first tunnel, you'll need a copy of the advanced routing tools (specifically the ip utility). You can get the latest authoritative copy at ftp://ftp.inr.ac.ru/ip-routing/. Be warned, the advanced routing tools aren't especially friendly, but they allow you to manipulate nearly any facet of the Linux networking engine.

Assume that you have two private networks (10.42.1.0/24 and 10.42.2.0/24) and that these networks both have direct Internet connectively via a Linux router at each network. The "real" IP address of the first network router is 240.101.83.2, and the "real" IP of the second router is 251.4.92.217. This isn't very difficult, so let's jump right in.

First, load the kernel module on both routers:

# modprobe ipip

Next, on the first network's router (on the 10.42.1.0/24 network), do the following:

# ip tunnel add mytun mode ipip remote 251.4.92.217 \

local 240.101.83.2 ttl 255

# ifconfig mytun 10.42.1.1

# route add -net 10.42.2.0/24 dev mytun

And on the second network's router (on the 10.42.2.0/24), reciprocate:

# ip tunnel add mytun mode ipip remote 240.101.83.2 \

local 251.4.92.217 ttl 255

# ifconfig tun10 10.42.2.1

# route add -net 10.42.1.0/24 dev mytun

Naturally, you can give the interface a more meaningful name than mytun if you like. From the first network's router, you should be able to ping 10.42.2.1, and from the second network router, you should be able to ping 10.42.1.1. Likewise, every machine on the 10.42.1.0/24 network should be able to route to every machine on the 10.42.2.0/24 network, just as if the Interent weren't even there.

If you're running a Linux 2.2x kernel, you're in luck: here's a shortcut that you can use to avoid having to use the Advanced Router tools package at all. After loading the module, try these commands instead:

# ifconfig tun10 10.42.1.1 pointopoint 251.4.92.217

# route add -net 10.42.2.0/24 dev tun10

And on the second network's router (on the 10.42.2.0/24):

# ifconfig tun10 10.42.2.1 pointopoint 240.101.83.2

# route add -net 10.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.