IP tunnelling is a method to connect two disjoint Internet Protocol (IP) networks, that don't have a native routing path, to each other via a communications channel (the IP tunnel) that uses encapsulation technologies across an intermediate network.

IP tunnels are often used in conjunction with the IPSec protocol to create a virtual private network (VPN) between two or more private networks across a public network such as the Internet. Another popular use is to connect islands of IPv6 implementations across the still dominant IPv4 Internet.

In IP tunnelling, every IP packet, with addressing information of its source and destination IP networks, is encapsulated within another packet format native to the transit network.

At the borders between the source network and the transit network, as well as the transit network and the destination network, gateways are used that establish the end-points of the IP tunnel across the transit network. Thus, the IP tunnel endpoints become native IP routers that establish a standard IP route between the source and destination networks. Packets traversing these end-points from the transit network are stripped from their transit frame format headers and trailers used in the tunnelling protocol and thus converted into native IP format and injected into the IP stack of the tunnel endpoints. In addition, any other protocol encapsulations used during transit, such as IPsec, TLS/SSL, are removed.

Diagram describing IP tunnelling

IP tunnelling often bypasses firewall rules transparently since the specific nature and addressing of the original datagrams are hidden.

See also

• Tunnelling Protocol
• Tunnel broker

References

• http://www.rfc-editor.org/rfc/rfc1853.txt
• http://www.rfc-editor.org/rfc/rfc2003.txt

de:IP-to-IP-Kapselung