How to Establish a GRE Tunnel Between Two CentOS 7 Servers

• Introduction
• Prerequisites and Configuring Both Endpoints
• Conclusion

Introduction

What is GRE? What are some advantages?

GRE stands for Generic Routing Encapsulation, which allows two servers to communicate privately. GRE tunnels are useful as they allow all types of traffic to go through. It is relatively easy to set up and is secure (imagine having a direct pipe between server A and server B).

Simply put: creating a GRE tunnel allows for packets to be forwarded with minimal resource usage.

NOTE: GRE tunnels must be set up on two endpoints.

How does it work?

When you create a GRE tunnel on your server, your server will act as a virtual router. Keep in mind that both ends will need a public IP address as packets are sent over multiple networks.

Prerequisites and Configuring Both Endpoints

What you'll need to set a GRE tunnel up

Fortunately, all you'll need is:

• 2 servers running CentOS 7
• The ip_gre module loaded
• nano or any text editor

If you don't already have the GRE module loaded into either server, perform the following command:

modprobe ip_gre

In order to make things easier to understand, the first and second endpoint will be labelled as A and B respectively.

The IP addresses that we'll be using are below:

Endpoint A:

• local/internal IP: 192.0.2.1
• public IP: 203.0.113.1

Endpoint B:

• local/internal IP: 192.0.2.2
• public IP: 203.0.113.2

Keep in mind that you'll need to modify the example IP addresses (change 203.0.113.1 and 203.0.113.2 with the IP addresses of the two servers that you will be using).

Configuring Endpoint A

To begin, we need to head over to the network-scripts folder:

cd /etc/sysconfig/network-scripts

Now, use nano or your favourite text editor to create a file called ifcfg-tun0:

nano ifcfg-tun0

In the newly created file, paste the following:

DEVICE=tun0
BOOTPROTO=none
ONBOOT=yes
    DEVICETYPE=tunnel
TYPE=GRE
PEER_INNER_IPADDR=192.0.2.2
PEER_OUTER_IPADDR=203.0.113.2
MY_INNER_IPADDR=192.0.2.1

Save and exit (with nano, do CTRL + X, followed by ENTER).

Bring the interface up:

ifup tun0

Once you perform the command above, you can begin configuring the second endpoint.

Configuring Endpoint B

The process of configuring this endpoint is similar to that of the first one. To begin, head over to your network-scripts folder:

cd /etc/sysconfig/network-scripts

Now, create a new file called ifcfg-tun0:

nano ifcfg-tun0 

Paste the following:

DEVICE=tun0
BOOTPROTO=none
ONBOOT=yes
TYPE=GRE
PEER_INNER_IPADDR=192.0.2.1
PEER_OUTER_IPADDR=203.0.113.1
MY_INNER_IPADDR=192.0.2.2

Exit and save.

You can now bring the interface up:

ifup tun0

Testing the tunnels

On Endpoint A, enter the following:

ping 192.0.2.2

You will see a similar output:

On Endpoint B:

ping 192.0.2.1

You will see a similar output:

If both ends can ping each other successfully, you can skip to the final section of this article. If it times out, you may need to disable your firewall or whitelist the appropate addresses.

Refer to this article if you don't understand how to create these rules.

If you only wish to test if the tunnels work, you can (at your own risk) disable the firewall on both servers:

service firewalld stop

Some CentOS 7 systems have IPTables, so perform the following if the command above does not work:

service iptables stop

Conclusion

You've successfully established a GRE tunnel between two servers. Should you wish to remove the tunnels in the future, perform the following on both servers:

ifdown tun0
rm -rf /etc/sysconfig/network-scripts/ifcfg-tun0
service network restart