Network Tunnels

Link remote networks to this one with GRE, EOIP, IPIP or VXLAN tunnels.

Last updated Aug 14, 2026View as Markdown

Overview

The screen is titled Network Tunnels, described as “Configure network tunnels for connecting remote networks”. A tunnel here is a point-to-point link between this router and another one somewhere else, carrying traffic as if the two sites shared a wire.

The sub-step starts disabled. Until you turn it on you see “Network tunneling is currently disabled. Enable it using the toggle above to configure tunnel settings.”, and the wizard notes the step as skipped. Turn it on and you are walked through Select Protocol, then a configuration screen for the protocol you picked, then a Summary.

It appears only in Advanced Mode, and only when you have a domestic link.

Before you start

  • You need the remote end’s public address, and you need matching configuration at the far end, because a tunnel only works if both routers agree.
  • Each tunnel consumes a /30 subnet from the Tunnel section of Network Subnets, giving two usable hosts, one at each end.

Steps

  1. Enable network tunnelling with the toggle.
  2. On Select Protocol, choose GRE, EOIP, IPIP or VXLAN.
  3. Click Add Tunnel and fill in the fields for that protocol.
  4. Repeat for as many tunnels as you need. The Configured Tunnels list shows what you have so far.
  5. Review the Summary and save.

Reference

Protocols:

Protocol Description in the app
IPIP IP-in-IP tunneling encapsulates IP packets inside IP packets
EOIP Ethernet over IP tunnels for bridging remote Ethernet segments
GRE Generic Routing Encapsulation for protocol-agnostic tunneling
VXLAN Virtual Extensible LAN for large-scale network virtualization

Fields:

Field What it does Notes
Name Identifies the tunnel interface Required
Local Address The address on this router the tunnel originates from Required
Remote Address The address of the far end Required
Tunnel ID Distinguishes multiple EOIP tunnels between the same pair EOIP
VNI (VXLAN Network Identifier) The VXLAN segment identifier VXLAN
Port UDP port for the VXLAN tunnel VXLAN, default 4789
MTU Maximum transmission unit for the tunnel Optional
Keepalive How often to probe the far end Optional
IPsec Secret Pre-shared key to encrypt the tunnel Optional
MAC Address Explicit MAC for the tunnel interface Optional
Clamp TCP MSS Adjusts TCP MSS to fit the tunnel MTU None
DSCP DSCP handling; Inherit or an explicit value None
ARP ARP mode: Default, Proxy ARP or Reply Only None