SCID: IP over IP tunnel
Yu Cai

1) IP tunnel Introduction

IP tunneling (IP encapsulation) is a technique to encapsulate IP datagram within IP datagrams, which allows datagrams destined for one IP address to be wrapped and redirected to another IP address. IP encapsulation is now commonly used in Extranet, Mobile-IP, IP-Multicast, tunneled host or network.

There are 3 kinds of tunnels: IP over IP tunneling, GRE tunneling and tunnels that live outside the kernel. In this project, we are using IP over IP tunneling, also noted as IPIP tunnel, or IP in IP tunnel. Examples of tunnels include PPTP, IPSec, L2TP etc.

Tunneling increases overhead, because it needs an extra set of IP headers. Typically this is 20 bytes per packet, so if the normal packet size (MTU) on a network is 1500 bytes, a packet that is sent through a tunnel can only be 1480 bytes big.

Here is an IP tunneling diagram:


 

2) Steps to setup IP over IP tunnel (IPIP tunnel) on Redhat Linux

2.1) Install IP tunnel package.
Most of the time, your redhat linux should already have ip tunnel package installed by default. You can check it by running "ip tunnel add tunl1 mode ipip remote 192.168.1.1". If you can successfully add a new ip tunnel, then you are ok. But If not, then you need to recompile linux kernel to enable IPIP tunnel. see this howto for kernel recompile from redhat linux.

	Networking options  --->
	    [*] TCP/IP networking
	    [*] IP: forwarding/gateway
	    ....
	    <*> IP: tunneling

2.2) Setup the IP tunnel testbed and config route tables/firewall rules on each machine

Below is the test bed view graph (all machines are running redhat 9)

In most IP tunnel scenarios, people use public IP address and private IP address to config the tunnel. It makes sense because connecting two private lan through IP tunnel is one of the major use of IP tunneling. But in our project, we don't want any private IP address, so we config the IPIP tunnel with only public IP.

Below are scripts on each machine.
a) Script on client to setup tunnel 1

Script on client to setup tunnel 3

b) Script on proxy (script on proxy2 is similiar)

c) Script on gateway (script on gateway2 is similiar)

d) Script on target

2.3) Verify your config and make sure the IPIP tunnel set up successfully.

After the configuration, you should be able to see the ip tunnel device.

Also, you should be able to ping gateway from client, and vice verse, by passing through IPIP tunnel.
How to you know you are going through IPIP tunnel, not a regular internet route?
Run "netstat -i" on each machine several times during the ping session, you will see IP packages passing through tunnel interfaces.

For some reason, when you use tethereal to monitor the traffic, you won't see any thing!?

To disable the tunnel interface, run "ifconfig tunl1 down".

2.4) For those who want to setup IP tunnel with private IP and public IP
In most IP tunnel scenarios, people use public IP address and private IP address to config the tunnel. It makes sense because connecting two private lan through IP tunnel is one of the major use of IP tunneling.

Below is the testbed view graph for IP tunnel with private IP and public IP.

Below is the config script.

2.5) For those who want to setup IP tunnel on Windows.
If you  want to setup IP tunnel on windows, make sure you have windows 2000 server or advance server.

Since IP tunnel requires advanced features of routing and remote access, windows Me, window XP, window 2000 professional don't support IPIP tunnel. (This is kind of weird, because windows XP support IPsec tunnel, but not IPIP tunnel.)

Also, IP tunnel on Windows didn't support public IP only configuration, you have to config the machines with private IP as well as public IP.

You can set up IP tunnel between two windows machines, or a windows/ a linux.

Below is the test bed view graph: (Client is windows 2000 advance server, proxy/gateway/target are redhat 9)

Here is a step by step guide on how to configure IP tunnel between a windows 2000 advance server and a redhat 9 machine
[client (win 2000, IP 128.198.60.45 and 192.168.10.1) and proxy (redhat 9, IP 128.198.61.51 and 192.168.4.1) in above graph].

1) On windows 2000 machine (client), see if Routing and Remote Access Service is running	Windows Control Pane or Administrative Tools ==>Service ==> Routing and Remote Access Running. If it is not running, Windows Control Pane or Administrative Tools ==>Routing and Remote Access ==>In the console tree, click the server you use ==> right click "Config Routing and Remote Access" ==> select "Manually Configure server" ==> follow the instruction.
2) Create Tunnel Interface	Windows Control Pane or Administrative Tools ==>Routing and Remote Access ==> In the console tree, click the server you use & select Routing Interface ==> R-click Routing Interface & choose 'New IP tunnel' ==> In interface name, type a name for the tunnel, and click OK Now we have a new IP tunnel interface, below is how we use it. ==> In the console tree, click IP Routing, r-click General, and then click New Interface ==> In Interfaces, click the IP-in-IP tunnel you just created ==> On the Tunnel tab - Local address : IP address of the tunnel start point (your public IP) - Remote address: IP address of the tunnel endpoint (remote public IP)
3) Add new Static Route	In Administrative Tools ==> Routing & Remote Access ==> Choose the server you want ==>IP Routing ==> R-click 'Static Route' ==> Select 'New Static Route' ==> Enter the parameter below:      - Interface : the IP tunnel which you just created.      -  Destination :  IP address of the tunnel endpoint (remote private IP)      -  Net Mask : 255.255.255.255      -  Gateway: IP address of the tunnel start point (your public IP)
4) Above is the manual configuration on windows 2000. We can use netsh script to setup the ip tunnel on windows.	#------------------------------------------------------------------------- # IPIP tunnel config batch script on windows 2000 advance server  #  # By Yu Cai (ycai@uccs.edu) at UCCS, June 2003 #------------------------------------------------------------------------- netsh interface add interface tunl1 tunnel netsh routing ip set ipiptunnel tunl1 128.198.60.45 128.198.61.50 5 netsh routing ip add rtmroute dest=192.168.4.1 mask=255.255.255.255 nameorindex=tunl1
5) Now the config on windows 2000 is finished. Let's config on the redhat 9 machine (Proxy). Here is the script.	#!/bin/sh #------------------------------------------------ # IPIP tunnel config scipt on proxy side # connecting a redhat linux 9 and a windows 2000 advance server # # By Yu Cai (ycai@uccs.edu) at UCCS, June 2003 #------------------------------------------------ #config tunl1 between win2000 and redhat9 ip tunnel add tunl1 mode ipip remote 128.198.60.45 dev eth0 ifconfig tunl1 192.168.4.1 ip link set tunl1 up ip route add 192.168.10.1 via 128.198.61.1 dev tunl1 onlink
6) See if the IP tunnel is really setup.	Ping 192.168.10.1 from 192.168.4.1 and vice verse. Run ethereal on one side, you should catch some TCP packages like below. Notice that the packages have two IP header with different IP address.

3) Performance Benchmark

Test below is based on configuration of Section 2.2: linux machines with public IP only.

3.1) Testbed machine configuration.

3.2) Response Time benchmark using Ping
I ping gateway from client. Below is the testing result (result is the average of 10 tests).

3.3) Throughput benchmark using FTP
I installed VSFTP server on gateway machine. On client machine, retrieve a 100MB file from gateway.
Below is the testing result (result is the average of 10 tests).

When the main gateway got attacked, the performance on the direct route will go from 12 seconds to days or infinity. The overhead occurs in the indirect route include more hop, more protocol processing (it goes through proxy server; and IP over IP overhead related to fragmentation; can be reduced if the client can set MSB to max - 20 (additional IP header)).
 

4) Related Questions

1) How many IP tunnels are allowed in redhat linux and windows 2000 server?
It seems unlimited or only limited by system resources. I wrote a script to add more than 100 tunnels, and it seems to work fine (on linux and on windows). 
Not sure about the effect of frequent and large amount of connect and disconnect of tunnel.
Not sure about the effect of heavy traffic passing through tunnel.

5) Related Resources

1) Compile linux kernel.
2) IP tunnel howto from redhat
3)  IProute2
4) IPIP howto from redhat
5) IPtables command reference