General VPN Linux setup issues

VPN-technologies are now firmly in everyday life and not only among IT-specialists, but we decided to update a number of old articles, significantly supplementing and expanding the information available in them. If ten years ago, VPN was mainly the destiny of large enough organizations, today it is widely used everywhere even the mobile VPN.

EoIP is a link layer tunneling (L2) protocol developed by Mikrotik and operates on the basis of the GRE protocol, encapsulating Ethernet frames in GRE packets. It allows you to connect remote networks at the data link layer (which is equivalent to connecting a patch cord between them directly) and provide communication without using routing. It should be understood that such a connection involves the passage of broadcast traffic, which can significantly reduce the performance of the tunnel, especially on narrow channels or channels with large delays.

Initially, EoIP was supported only by Mikrotik equipment, today its support is implemented in Zyxel equipment and packages exist for its implementation in the VPN Linux environment.

IPsec is a set of protocols for securing data transmitted over IP networks. It can also be used not only to protect existing communication channels, but also to organize independent tunnels. But IPsec tunnels were not widely used for several reasons: the complexity of the configuration, the criticality of configuration errors and the inability to use routing to control traffic in such tunnels.

GRE is a tunneling protocol developed by Cisco and is designed to encapsulate any OSI network layer protocols (i.e. not just IP), GRE works directly over IP and does not use ports, does not go through NAT, protocol number 47.

GRE requires white IP addresses for both sides of the tunnel and is a stateless protocol, i.e. does not control the availability of the opposite node in any way, although most modern implementations contain additional mechanisms to determine the state of the channel. There are also no security mechanisms, but this is not a drawback, because, unlike client-server solutions, GRE tunnels are used in a corporate and telecommunication environment where other technologies can be used to ensure security.