Wireless Hacks. 1917 IndustrialStrength Tips and Tools [Electronic resources] نسخه متنی

Hack 54 Tunneling: IPIP Encapsulation

IP tunneling with the Linux IPIP
driver.

If you have
never worked with IP tunneling before,
you might want to take a look at the
Advanced Router HOWTO
(http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/)
before continuing. Essentially, an IP tunnel is much like a VPN,
except that not every IP tunnel involves encryption. A machine that
is "tunneled" into another network
has a virtual interface configured with an IP address that
isn't local, but exists on a remote network.
Usually, all (or most) network traffic is routed down this tunnel, so
remote clients appear to exist on the network as if they were local.
This can be used to allow clients from the Internet to access private
network services, or more generally, to connect to any two private
networks together using the Internet to carry the tunnel traffic.

If you want to perform simple
IP-within-IP tunneling between two machines, you might try
IPIP.
It is probably the simplest tunnel protocol available, and also works
with *BSD, Solaris, and even Windows. Note that IPIP is simply a
tunneling protocol, and does not involve any sort of encryption. It
is also only capable of tunneling unicast packets; if
you need to tunnel multicast traffic, take a look at GRE
tunneling [Hack #55].

Before we
rush right into our first tunnel, you need a copy of the advanced
routing tools (specifically the ip utility.) You
can get the latest authoritative copy from
ftp://ftp.inr.ac.ru/ip-routing/. Be warned, the
advanced routing tools aren't especially friendly,
but they allow you to manipulate nearly any facet of the Linux
networking engine.

In this example, I assume that you have two private networks
(10.42.1.0/24 and 10.42.2.0/24) and that these networks both have
direct Internet connectivity via a Linux router at each network. The
"real" IP address of the first
network router is 240.101.83.2, and the
"real" IP of the second router is
251.4.92.217. This isn't very
difficult, so let's jump right in.

First, load the kernel module on both routers by typing as the root
user:

  # modprobe ipip

Next, on the first network's router (on the
10.42.1.0/24 network), do the following:

  # ip tunnel add mytun mode ipip remote 
251.4.92.217 local 240.101.83.2[RETURN]
ttl 255
# ifconfig mytun 10.42.1.1
# route add -net 10.42.2.0/24 dev mytun

And on the second network's router (on the
10.42.2.0/24), reciprocate:

  # ip tunnel add mytun mode ipip remote 240.101.83.2 local 
251.4.92.217[RETURN] 
ttl 255
# ifconfig mytun 10.42.2.1
# route add -net 10.42.1.0/24 dev mytun

Naturally, you can give the interface a more meaningful name than
mytun if you like. From the first
network's router, you should now be able to
ping 10.42.2.1, and from the second
network's router, you should be able to
ping 10.42.1.1. Likewise, every machine on the
10.42.1.0/24 network should be able to route to every machine on the
10.42.2.0/24 network, just as if the Internet
weren't even there.

If you're running a Linux 2.2.x kernel,
you're in luck: here's a shortcut
that you can use to avoid having to use the Advanced Router tools
package at all. After loading the module, try these commands instead:

  # ifconfig tunl0 10.42.1.1 pointopoint 251.4.92.217
# route add -net 10.42.2.0/24 dev tunl0

And on the second network's router (on the
10.42.2.0/24 network):

  # ifconfig tunl0 10.42.2.1 pointopoint 240.101.83.2
# route add -net 10.42.1.0/24 dev tunl0

That's all there is to it.

If you can ping the opposite router, but other machines on the
network don't seem to be able to pass traffic beyond
the router, make sure that both routers are configured to forward
packets between interfaces:

  # echo "1" > /proc/sys/net/ipv4/ip_forward

If you need to reach networks beyond 10.42.1.0 and 10.42.2.0, simply
add additional route add -net lines. There is no
configuration needed on any of your network hosts, as long as they
have a default route to their respective router (which they
definitely should, since it is their router,
after all).

To bring the tunnel down, bring down the interface on both routers
and delete it, if you like:

  # ifconfig mytun down
# ip tunnel del mytun

(or, in Linux 2.2):

  # ifconfig tunl0 down

The kernel will very politely clean up your routing table for you
when the interface goes away.

See Also

Advanced Routing HOWTO,
http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/

Advanced Routing Tools (iproute2),
ftp://ftp.inr.ac.ru/ip-routing/