wiki/gre-plus-ipsec.md

GRE+IPsec

Why GRE?

• GRE provides universal encapsulation on top of IP.
• It has a smaller header than UDP.
• GRE tunnels are processed in-kernel on *nix systems.
• It's supported by hardware routers.

Why IPsec?

• GRE provides no encryption and authentication of it's own.
• IPsec in implemented in-kernel on FreeBSD and Linux with multithreaded encryption resulting in a lower latency than userspace VPN daemons using tun/tap interfaces.

Problems with GRE

• GRE is defined directly on top of IP.
• Broken NAPT implementations will stop GRE tunnels.

Problems with IPsec

• ESP is defined directly on top of IP.
• NAT support was added as an aftertought to IPsec.
• IKEv1 is too complex.
• Racoon has useless error messages.

Requirements for sane operation

• Identify your peers by X.509 certificates
• At least one peer should operate his own (Sub-)CA.

How to configure a GRE tunnel on FreeBSD

See GRE on FreeBSD.

How to configure IPsec on FreeBSD

See IPsec on FreeBSD.

How to configure GRE + IPsec on Debian

See GRE + IPsec on Debian.