Simple definition
GRE (Generic Routing Encapsulation) wraps a network protocol or packet inside a new IP packet to create a logical tunnel between two endpoints.
Technical definition
GRE adds an encapsulation header between the original packet and the outer IP header. It can carry multiple Layer 3 protocols and is often used with dynamic routing. GRE by itself does not provide encryption or strong authentication.
How it works / role
At the tunnel entrance, the router encapsulates the original packet and sends it to the remote tunnel endpoint. The remote router removes the GRE header and processes the inner packet. The additional overhead reduces the usable MTU.
What is it used for?
Carry private subnets or routing protocols across an IP network, optionally combined with IPsec when confidentiality is required.
Practical example
Two routers build a GRE tunnel across the Internet to exchange private routes; IPsec can then protect that tunnel if the traffic must be encrypted.
Common issues
- No route to the remote tunnel endpoint
- MTU or MSS is not adjusted for the encapsulation overhead
- GRE is filtered by an intermediate device
- A GRE tunnel is incorrectly assumed to be encrypted
Key takeaway: GRE provides encapsulation and tunneling, not encryption; add an appropriate security mechanism when the transport requires confidentiality.