# Network Tunnels

> Link remote networks to this one with GRE, EOIP, IPIP or VXLAN tunnels.

Source: https://joinnasnet.com/en/guides/nasnet-connect/lan/tunnel/
Last updated: 2026-08-14

---

## Overview

The screen is titled **Network Tunnels**, described as *"Configure network tunnels for
connecting remote networks"*. A tunnel here is a point-to-point link between
this router and another one somewhere else, carrying traffic as if the two sites
shared a wire.

The sub-step starts disabled. Until you turn it on you see *"Network tunneling
is currently disabled. Enable it using the toggle above to configure tunnel
settings."*, and the wizard notes the step as skipped. Turn it on and you are
walked through **Select Protocol**, then a configuration screen for the protocol
you picked, then a **Summary**.

It appears only in **Advanced Mode**, and only when you have a domestic link.

## Before you start

- You need the remote end's public address, and you need matching configuration
  at the far end, because a tunnel only works if both routers agree.
- Each tunnel consumes a `/30` subnet from the **Tunnel** section of
  [Network Subnets](/en/guides/nasnet-connect/lan/subnets/), giving two usable hosts,
  one at each end.

## Steps

1. Enable network tunnelling with the toggle.
2. On **Select Protocol**, choose GRE, EOIP, IPIP or VXLAN.
3. Click **Add Tunnel** and fill in the fields for that protocol.
4. Repeat for as many tunnels as you need. The **Configured Tunnels** list
   shows what you have so far.
5. Review the **Summary** and save.

## Reference

Protocols:

| Protocol | Description in the app |
| -------- | ---------------------- |
| **IPIP** | IP-in-IP tunneling encapsulates IP packets inside IP packets |
| **EOIP** | Ethernet over IP tunnels for bridging remote Ethernet segments |
| **GRE** | Generic Routing Encapsulation for protocol-agnostic tunneling |
| **VXLAN** | Virtual Extensible LAN for large-scale network virtualization |

Fields:

| Field | What it does | Notes |
| ----- | ------------ | ----- |
| **Name** | Identifies the tunnel interface | Required |
| **Local Address** | The address on this router the tunnel originates from | Required |
| **Remote Address** | The address of the far end | Required |
| **Tunnel ID** | Distinguishes multiple EOIP tunnels between the same pair | EOIP |
| **VNI (VXLAN Network Identifier)** | The VXLAN segment identifier | VXLAN |
| **Port** | UDP port for the VXLAN tunnel | VXLAN, default 4789 |
| **MTU** | Maximum transmission unit for the tunnel | Optional |
| **Keepalive** | How often to probe the far end | Optional |
| **IPsec Secret** | Pre-shared key to encrypt the tunnel | Optional |
| **MAC Address** | Explicit MAC for the tunnel interface | Optional |
| **Clamp TCP MSS** | Adjusts TCP MSS to fit the tunnel MTU | None |
| **DSCP** | DSCP handling; **Inherit** or an explicit value | None |
| **ARP** | ARP mode: **Default**, **Proxy ARP** or **Reply Only** | None |

## Related

- [Network Subnets](/en/guides/nasnet-connect/lan/subnets/)
- [VPN Server](/en/guides/nasnet-connect/lan/vpn-server/)